[tylerhutcherson]

MOD-20121

Ticket. Backend: redislabsdev/iris#2065, stacked on #2064 and #2061. Operator walkthrough: docs #4331, stacked on #4256. UI recovery/copy: cloud-ui #3346.

The optional Playbook extraction instructions still prescribe Identity Service subject grants and lookup permissions. The new Control Plane-owned binding lifecycle uses RAM's existing static worker JWT trust for source reads and a separate tenant-confined Control Plane viewer for source discovery and ownership checks. This replaces that obsolete recipe with the exact RAM Helm values, explains operator consent and static-trust revocation, and preserves ordinary agent-key authentication, RAM's own worker identity, and separately administered service-subject integrations.

The 23 public Agent Memory paths were inspected for this change. This is the only extraction-specific mismatch found; the backend stack does not change RAM's public API, so the RAM OpenAPI snapshots stay unchanged.

Coordinated publication required

Keep this PR DRAFT. Do not merge or publish until the backend stack is merged/released and applicable RAM/Playbook charts and images are verified. Both foundation PRs have merged; child #2065 remains unmerged and the stack is unreleased. Merging docs main publishes live automatically. Coordinate #4256, #4331 and this PR; preserve the CLA gate.

The existing Memory installation walkthrough's pinned versions do not establish support for this setup. No minimum versions or release URLs are invented here. Verify release applicability before publication and add released-version guidance then. The backend change provides no existing-installation migration.

Cloud UI #3346 must remain unmerged until the candidate backend is deployed in the Cloud environments where extraction is exposed; its master merge starts QA/production workflows. After backend rollout, run a Cloud preview smoke with an eligible RAM source to verify binding creation and activation before UI release. The older app-qa baseline with no eligible sources does not satisfy this gate.

Separately for on-prem UI consumption, normal post-merge MFE publication must be followed by an explicit update of the actual Iris package.json and lockfile pin, a rebuilt/released UI gateway, and a packaged smoke without a local bundle override. No automatic cross-repository pin updater exists. The currently installed 0.0.19 bundle does not contain #3346's blocked/off recovery and copy corrections.

Current backend restack

Both foundation PRs have merged: MOD-20115 #2061 as 876853ddb2c111150c3f4040343597bb50bc7612 and MOD-20116 #2064 as f526654fd9a6e4c32ba0e5548f1b23f8af4ec5f3. The child #2065 is now e6555c27109800bb7c0cfc25657e8c0e08b56e2d, rebased onto main bc758425655d4ba952e907c7284081f4992bc1a8 after #2091 merged. The test-only repair adapts incoming daily startup checks to metadata-local binding cleanup; all ten feature commits are unchanged by the final rebase. Current backend CI is running; Bugbot skipped the unchanged reviewed patch, human approval remains and no review threads are unresolved. Keep merge/publication on hold until current CI, merge-queue and release gates are satisfied. The previous D8 snapshot passed CI (106 successful checks, 24 skipped) and Bugbot, but that is historical evidence. The canceled a542f186 run is not a complete passing result. Current backend review record.

The previously qualified backend snapshot is 7c73e2a1952904ff5dce9b5ed8d63aff78989077, on MOD-20116 d4921756c745bd6e6d7ee990e73830215dc746e5 and MOD-20115 be04ba2127fc6bc51b2bc5f005cd20e71b532bee. CI for that snapshot is complete. Child #2065 reports 97 successful checks, 20 skipped, no pending or failed checks, Bugbot SUCCESS and no unresolved review threads. All five deployed profiles passed on the child and MOD-20116. Child Branch Checks, MOD-20116 Branch Checks and MOD-20115 CI completed successfully at these exact heads. Earlier af81d8655/2ed416db1 local qualification and CI remain historical evidence. Previous snapshot review record.

Historical backend local qualification

Production/API source af81d8655a5c2ff48003cc96fb7bce42daf1935f passed 99 reported checks and Bugbot before expanded local qualification. Earlier qualified child 2ed416db157ebd12c3f5081ca9eaaf26c8375f0d completed 101 reported successes, 20 skips, no pending or failed checks, Bugbot SUCCESS and no unresolved review threads. This is historical CI evidence for that earlier head. Branch Checks run 39903123145 completed successfully at that exact SHA. Backend qualification record.

• Packaged KinD ci-auth: all four cases passed in 873.105 seconds, including both projected probe-token rotations with strict unchanged worker UID, audience rejection, and three RAM promotion jobs. The report is complete with exit 0 and no missing/unsuccessful cases.
• Race qualification: 675 repeated authentication/fencing/transport executions plus 18 real-HTTP method executions passed. Real RAM/Playbook CP/DP, IdS, Redis and the shared worker cover A/B and C added after startup; external issuer, SM/AWS resolution and model responses remain fixtures.
• Engine stress: exact admission bounds, drain/recovery, 16 cloud accounts/108 bindings/2,368 exact ledger/proposal-request pairs, and 520 pairs in four bindings in one on-prem tenant passed. Deterministic HTTP peers/model, sampled runtime peaks and finite progress do not establish fleet capacity or fairness.
• Reviewed b38b4e18 and installed 0.0.19 UI bundles each passed the three on-prem lifecycle/stale-version/late-source browser cases. App-qa was read-only baseline evidence at backend 044628e4, with one account and no eligible sources; it did not qualify current-candidate cloud A/B/C or mutations.

These local results do not establish live-model quality, production licensing, deployed Neptune reachability, published-version support, fleet capacity or spending limits.

Documentation validation

• Hugo 0.143.1 (CI-pinned): full-site build passed, 20,193 pages; 25 unrelated warnings, none for the changed page. Reused existing ignored client-example data and Node dependencies.
• All four YAML examples parse; frontmatter unchanged; source links and worker-platform anchor resolve.
• Helm 3.20.2 rendered the public RAM base plus overlay against 720f1063826dc920102dcd288890725adfa2559b. Assertions verify static worker read trust, tenant-confined CP viewer, existing agent-key introspection, RAM worker write trust and matching admin tenant. This is the original render evidence, separate from the later backend runtime qualification.
• git diff --check passed. Independent backend-owner review approved the complete diff and operator clarification. No page changes are added by this evidence-only PR-body refresh.

Docs revision and remaining checks

Branch revision: 9644dffdbc190bb003e615233c8c69e5adcfd610. Remote build/staging CI passed at that revision: 101 successful checks, 1 skipped; no open code-review findings. license/cla remains pending after the documented bot recheck. No agreement was signed, asserted or changed. The same contributor condition is pending on existing docs drafts; human contributor action is still required if it persists. Draft and coordinated-publication holds remain.

@hristopopovredis

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

Staging links:
https://redis.io/docs/staging/docs/MOD-20121-extraction-worker-auth/operate/iris/agent-memory/self-managed/configuration/

[github-actions]

🧠 Redis Memory

Found 5 related items from repository history (5 new this commit):

• PR — MOD-18528: Document Playbook bindings and RAM service-subject authentication 🆕

  Summary

• PR — MOD-18825: Correct Iris self-managed docs for RAM 0.7.0 and LangCache 0.0.1 🆕

  Ticket: MOD-18825 · Control Plane OpenAPI text: [redislabsdev/iris#1648](https://github.

• PR — WIP: Redis Agent Playbooks self-managed operator docs 🆕

  MOD-19679 — Self-managed Redis Agent Playbooks operator documentation.

• PR — MOD-19813: Document Memory 0.8.0 with a standalone Identity Service 🆕

  Ticket ID

• PR — Consolidate Agent Memory documentation for GA 🆕

  Consolidate the Agent Memory documentation into one PR against iris-ga-docs. This includes the public API and namespace routing work from

Memory updated at 9644dff