slimRAG is a lightweight, end-to-end encrypted, decentralized RAG (Retrieval-Augmented Generation) engine. It provides hybrid semantic search across code, documents, CAD symbols, and PDFs — with a focus on edge-originated sync, zero-knowledge transport, and pluggable embedding backends.
┌────────────────────────────────────────────────────────────┐
│ slimSync (Edge Agent) │
│ ┌──────────┐ ┌──────────┐ ┌──────────────────────────┐ │
│ │ Tracker │ │ Slicer │ │ Crypto (Encrypt + HMAC) │ │
│ │ (inotify │ │ FastCDC │ │ ChaCha20-Poly1305 │ │
│ │ /fanotify│ │ /AST │ │ + Blind-ID HMAC-SHA256 │ │
│ │ /jwalk) │ │ /Dual) │ └──────────┬───────────────┘ │
│ └──────────┘ └──────────┘ │ │
└──────────────────────────────────────────┼──────────────────┘
│ Zenoh Pub/Sub
│ (ciphertext only)
▼
┌────────────────────────────────────────────────────────────┐
│ slimHub (Encrypted Ring Buffer) — Zero-knowledge relay │
│ sled-backed, watermark backpressure, blind-ID only │
└────────────────────────────────────────────────────────────┘
│ Zenoh Pub/Sub
▼
┌────────────────────────────────────────────────────────────┐
│ slimRagSvr (Core RAG Server) │
│ ┌──────────┐ ┌──────────┐ ┌──────────────────────────┐ │
│ │Decryptor │ │ Stitcher │ │ LMDB Store │ │
│ │+ HMAC │ │ /CDC │ │ 7 DB (segments, nodes, │ │
│ │Verify │ │ /AST │ │ edges, vectors, postings,│ │
│ └──────────┘ └──────────┘ │ hnsw, doc_ids) │ │
│ └──────────────────────────┘ │
│ ┌────────────────────┐ ┌──────────────────────────────┐ │
│ │ Hybrid Search │ │ Embedding Worker │ │
│ │ Keyword + Graph + │ │ Mock / FastEmbed / LlamaCpp │ │
│ │ Vector (RRF Fuse) │ │ (pluggable via trait) │ │
│ └────────────────────┘ └──────────────────────────────┘ │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ Axum HTTP API ── /api/v1/search /api/v1/health │ │
│ └──────────────────────────────────────────────────────┘ │
└────────────────────────────────────────────────────────────┘
- End-to-End Encryption: Data is encrypted at the edge (slimSync) and decrypted only at the RAG server (slimRagSvr). slimHub handles ciphertext only — it is zero-knowledge by construction.
- Pluggable Embedding: The
EmbeddingProvidertrait decouples embedding backends from the retrieval pipeline. Switch between mock, ONNX (FastEmbed), GGUF (llama.cpp), or a custom provider via a single config line. - Hybrid Retrieval: Three independent recall channels — keyword inverted index, AST graph topology, and HNSW vector search — fused via Reciprocal Rank Fusion (RRF) for maximum coverage.
- Decentralized Transport: All inter-component communication uses Zenoh (Pub/Sub with optional peer-to-peer), with no centralized broker required.
Watches directories at the filesystem level, detects changes via inotify/fanotify (Linux) or polling (macOS/Windows), slices files into semantic chunks, encrypts them end-to-end, and publishes over Zenoh.
| Capability | Implementation |
|---|---|
| File change detection | Linux: fanotify (kernel-level, fallback to inotify), macOS/Windows: notify crate |
| Cold scan | jwalk (parallel directory walk) on all platforms |
| File chunking | FastCDC (content-defined, 2KB–64KB windows) + AST-aware paragraph/function boundary detection |
| Chunk dedup | Local SQLite cache + remote blind-ID existence check via Zenoh |
| Encryption | ChaCha20-Poly1305 AEAD + HMAC-SHA256 Blind-ID |
| File rotation detection | st_dev + st_ino comparison (append vs rechunk) |
| Debouncing | Configurable debounce_ms to coalesce rapid changes |
A stateless, zero-knowledge relay that buffers encrypted chunks between slimSync and slimRagSvr. It stores only ciphertext and blind-IDs — it cannot decrypt any payload.
| Capability | Implementation |
|---|---|
| Storage engine | sled (embedded, zero-config) |
| Data model | Two trees: pending (timestamp+blind-ID → ciphertext), acknowledged (blind-ID → timestamp) |
| Flow control | Tiered watermark backpressure (Normal → Warning → Critical) broadcast over Zenoh |
| Pull protocol | FIFO batch pull (64 items every 100ms) |
| ACK relay | Forwards acks back to slimSync |
| TTL cleanup | 7-day retention for acknowledged items; disk watermark enforcement |
Receives encrypted chunks from slimHub, decrypts and verifies them, stitches chunks back into complete files, parses AST structure, extracts embeddings, and builds a multi-layered index. Exposes an OpenAI-compatible search API.
| Capability | Implementation |
|---|---|
| Decryption | ChaCha20-Poly1305 + HMAC-SHA256 Blind-ID verification |
| Chunk stitching | FastCDC alignment (overlap dedup) + AST boundary detection + timeout flush |
| Storage | LMDB (7 databases: segments, nodes, edges, vectors, postings, HNSW, doc_ids) + SQLite (file metadata, task queue, file paths) |
| AST parsing | Tree-sitter for Rust, Go, C++, Python (feature-gated) |
| Embedding | ProviderRegistry with mock (hash-based, default), FastEmbed (ONNX, feature=embedding), LlamaCpp (GGUF, feature=llamacpp) |
| Hybrid search | Keyword (inverted index) + Graph (AST symbol topology) + Vector (HNSW ANN) → RRF fuse |
| HTTP API | Axum at /api/v1/search (POST) and /api/v1/health (GET) |
| Offline ingestion | slim_ingest CLI tool for bulk data import directly into LMDB |
Benchmarked on real-world codebases (tokio + axum) for cross-file dependency tracing:
| Metric | slimRAG (Hybrid) | Baseline (FTS5) | Δ |
|---|---|---|---|
| Recall@10 | 17.5% | 0.0% | +17.5pp |
| MRR | 0.292 | 0.000 | +0.292 |
| Cross-file coverage | 97.5% | 100% | −2.5pp |
And for Git branch switching with delta embedding:
| Metric | Value |
|---|---|
| Avg ingest per branch | 48ms |
| Avg retrieval latency | 9ms |
| LMDB cross-branch growth | 0 bytes |
| Branch switch latency | 71ms (ingest + retrieve) |
| Hallucination rate | 0% |
- Rust 1.75+ (MSRV)
- Linux kernel 5.9+ (for fanotify) — macOS/Windows supported with reduced file watching
# Clone and build everything
git clone https://github.com/dataxcash/slimRAG.git
cd slimRAG
cargo build --release
# Enable ONNX embedding (FastEmbed, CPU)
cargo build --release --features slimragsvr/embedding
# Enable llama.cpp GGUF backend (CPU/CUDA/Metal)
cargo build --release --features slimragsvr/llamacpp
# Enable all language parsers (Rust + Go + C++ + Python)
cargo build --release --features "slimragsvr/lang-cpp,slimragsvr/lang-python"cargo testCreate /etc/slimragsvr/slimragsvr.toml:
[http]
bind = "127.0.0.1:8080"
[lmdb]
path = "/var/lib/slimragsvr/data.mdb"
map_size_gb = 10
[sqlite]
path = "/var/lib/slimragsvr/control.db"
[embedding]
provider = "mock" # mock | fastembed | llamacpp
dimension = 128
[llamacpp]
model_path = "/models/bge-small-en.gguf"
n_threads = 4
n_gpu_layers = 0
[stitcher]
byte_threshold = 4096
flush_timeout_ms = 3000
[zenoh]
mode = "client"
connect = ["tcp/127.0.0.1:7448"]
[sensitivity]
# 数据血缘密级（docs/33 §5）：服务端可信策略，fail-closed 默认 high。
# 未匹配任何 low 规则 / 未记录路径的文件一律 high（宁可拒载，绝不泄密）。
default = "high"
[[sensitivity.rules]]
pattern = "/data/projects/public/"
level = "low"
[crypto]
key_file = "/etc/slimragsvr/key.bin"
salt_file = "/etc/slimragsvr/salt.bin"Create /etc/slimsync/slimsync.toml:
[general]
log_level = "info"
[watch]
dirs = ["/data/projects"]
debounce_ms = 200
exclude = ["*.tmp", "*.swp", ".git/**", "node_modules/**", "target/**"]
[crypto]
key_file = "/etc/slimsync/key.bin"
salt_file = "/etc/slimsync/salt.bin"
[storage]
db_path = "/var/lib/slimsync/slimsync.db"
[zenoh]
mode = "client"
connect = ["tcp/127.0.0.1:7447"]
timeout_ms = 5000Create /etc/slimhub/slimhub.toml:
[general]
hub_id = "slimhub-1"
log_level = "info"
[storage]
db_path = "/var/lib/slimhub/slimhub.db"
disk_capacity_gb = 10
high_watermark_pct = 80
low_watermark_pct = 60
[zenoh]
listen = ["tcp/0.0.0.0:7447"]Crypto keys: Generate a 32-byte encryption key and a 32-byte HMAC salt:
openssl rand -out /etc/slimragsvr/key.bin 32 openssl rand -out /etc/slimragsvr/salt.bin 32Both slimSync and slimRagSvr must use the same key+salt pair.
cargo run --release -p slimhubcargo run --release -p slimragsvrOr with a specific config:
cargo run --release -p slimragsvr -- --config /etc/slimragsvr/slimragsvr.tomlcargo run --release -p slimsync -- dir add /path/to/watch
cargo run --release -p slimsync # daemon modecurl -X POST http://localhost:8080/api/v1/search \
-H "Content-Type: application/json" \
-d '{"query": "impl IntoResponse for", "top_k": 10}'Response:
{
"results": [
{
"segment_id": "abc123...",
"score": 0.85,
"source": "vector",
"text": "pub fn ...",
"file_blind_id": "def456...",
"file_path": "/workspace/src/lib.rs"
}
],
"total": 1
}curl http://localhost:8080/api/v1/healthpub trait EmbeddingProvider: Send + Sync {
fn dimension(&self) -> usize;
fn embed(&self, texts: &[&str]) -> Result<Vec<Vec<f32>>, Box<dyn std::error::Error + Send>>;
}| Provider | Backend | Feature Gate | Use Case |
|---|---|---|---|
MockEmbeddingProvider |
CPU (SHA256 hash → f32) | default | Development / testing |
FastEmbedProvider |
ONNX CPU (BGE-Small-EN) | --features embedding |
CPU deployment |
LlamaCppProvider |
GGUF (CPU/CUDA/Metal) | --features llamacpp |
GPU-accelerated |
ForgeOsSubSchedulerProvider |
NPU (Strix Halo) | Internal [patch] only |
IronCurtain production |
All providers are registered via ProviderRegistry and selected by name in the config file. The forgeos-npu backend is closed-source and resolved through a [patch] section in internal builds — it is not available in this repository.
slimRAG/
├── slimRagSvr/ # Core RAG server: ingest, index, hybrid search, HTTP API
├── bench/ # Benchmark framework & datasets (tokio, axum)
├── docs/ # Architecture design documents
└── Cargo.toml # Cargo workspace
slimSync / slimHub / slim-common 已拆分为独立仓库：
- slimSync — https://github.com/dataxcash/slimSync
- slimHub — https://github.com/dataxcash/slimHub
- slim-common — https://github.com/dataxcash/slim-common（git 依赖引入）
The open-source core of slimRAG is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0) — see LICENSE. The IronCurtain hardware adaptation layer (forgeos-npu) is proprietary and not included in this repository.