Reference
Architecture & integration
The enterprise memory framework, supporting gateway/UI, trust boundaries, deployment modes, and integration surfaces.
Architecture & integration
Meivo is Amzu's customer-deployed enterprise memory framework for AI. It gives applications and agents durable memory, hybrid retrieval, time-aware knowledge, episodes, linked memory cards, and cited context while the customer's data remains in the environment they control.
The built-in gateway and control panel support that framework with ingestion, identity, policy, audit, and operations. They are important enterprise capabilities, but they are not the product's primary identity.
Meivo currently runs as a single-workspace product, not a public multi-tenant SaaS. The same codebase can be packaged for a cloud marketplace, a private cloud, or an appliance deployment.
System at a glance
The core engine owns the memory lifecycle and retrieval behavior. Its main document and vector store is SQLite for local/smaller installations or Postgres with pgvector for server deployments. MySQL is supported only as an optional, separate knowledge-graph backend; it is not a document or vector-store backend.
The gateway (gm-ingest-svc) and web UI add the enterprise operating layer:
authentication, directory integration, permission-aware retrieval, connectors,
guardrails, encrypted model-provider configuration, audit review, and data
lifecycle workflows.
The two integration boundaries
There are two deliberate ways to integrate:
| Boundary | Use it when | Security and policy behavior |
|---|---|---|
| Enterprise gateway | Business users, customer applications, connected data sources, and governed chat/search | Applies the packaged product's JWT/local/LDAP identity, roles, ACL resolution, guardrails, provider policy, and control-panel audit workflows |
| Direct engine REST or MCP | A trusted internal agent or platform service needs the memory framework directly | Uses the engine's optional bearer API keys and engine audit configuration; it does not automatically inherit the gateway's directory groups, per-user ACL resolution, or guardrail checks |
Direct engine access is therefore an intentional trust boundary, not a shortcut
to the governed application path. Put network-reachable engine endpoints behind
the built-in gateway or equivalent customer controls. Stdio MCP runs locally in
the process that launches it; streamable HTTP MCP is served at /mcp.
Governed request flow
This sequence describes the packaged gateway path. A client calling gm-server
directly enters at the memory-framework step and is responsible for the controls
that would otherwise have been applied by the gateway.
Deployment modes
| Mode | Package | Data boundary | Model choices |
|---|---|---|---|
| Cloud marketplace | Cloud-specific deployment package | Customer account, project, VPC, or VNet | Customer-approved hosted APIs and local/private endpoints |
| Private cloud | Helm, Terraform, or compose-based package | Customer-managed cloud or data centre | Customer-approved hosted APIs and local/private endpoints |
| Appliance | Pre-integrated server bundle | Customer site and network | Local endpoints; application-level provider restrictions are enabled for local-only deployments |
An appliance can be prepared for offline operation by preloading the embedding model and using local model endpoints. The application-level local-provider gate is defense in depth; a genuinely sealed or air-gapped environment still requires customer-controlled firewall, DNS, routing, update, and media-transfer policy.
Memory and operational controls
- Memory lifecycle: durable remember/recall/context/profile/forget operations, bi-temporal facts, episodes, linked cards, feedback, and point-in-time queries.
- Retrieval: vector similarity, BM25/full-text, facts, reciprocal-rank fusion, recency, optional lexical reranking, usefulness weighting, and optional graph expansion.
- Context: token-budgeted context blocks with citations and provenance for downstream model calls.
- Identity: local accounts and LDAP/AD are available through the enterprise gateway. The direct engine offers shared bearer API keys, not user-directory authentication.
- Audit: mutating engine actions use a durable outbox in integrated mode.
Read events use a bounded asynchronous queue and can be dropped under sustained
overload;
/v1/statsexposes backlog and drop counters. The gateway maintains a tamper-evident HMAC/hash chain with checkpoints and export workflows. - Observability: the gateway can export OpenTelemetry data; the engine exposes health, readiness, store statistics, RSS, and audit-pipeline counters.
- Provider keys: enterprise provider configurations are encrypted and
resolved by the gateway. Direct engine model settings are separate
GM_*configuration and should be supplied through the customer's secret manager.
Data isolation
Each packaged installation represents one customer workspace today. The engine
stores records under space, but a space name by itself is not an authorisation
boundary on the direct API: an engine API key can address every space. The
enterprise gateway derives permission filters from the authenticated principal.
Use one installation per hard security boundary until multi-workspace access and
delegated administration are explicitly delivered.