Workspace RAG Without Indexing Secrets
Semantic search across a 100-project workspace — with a hard line on what never gets embedded.
- rag
- firestore
- ollama
- security
Why RAG in a workspace this big
When you maintain 100+ project folders, “where did I write that down?” becomes the daily tax. Full-text grep works until it doesn’t — you need semantic recall across READMEs, SOPs, and planning docs. That’s what workspace-rag is for: a Firestore-backed vector index plus a local CLI that queries it with Ollama embeddings.
The catch: not everything belongs in the index.
What goes in — and what stays out
Indexed: project summaries, agent SOPs, planning docs, deploy registries — anything that helps future-you route work.
Never indexed: 03_admin_finance/VAULT/, secrets, credentials, and broad 06_archive/ dumps. If a path can hold API keys or client PII, it stays out of RAG. Same rule as git: when in doubt, exclude.
| Layer | Role |
|---|---|
gnomad-swarm-core | Shared agent library — consumed by projects, not deployed as a service |
workspace-rag | Firestore vectors + local internal/cli.py |
| Local Ollama | Embedding and ad-hoc queries on the Nobara hub |
How I use it day to day
Before a deep grep across the tree, I query RAG. Before opening Cursor on an unfamiliar client folder, I query RAG. The swarm chronicler (QUILL) and doc-gather scripts feed the index after each documentation pass — so June’s deploy-registry work is findable in July without re-reading six READMEs.
What I’d do differently
I’d automate a pre-index lint that fails the job if any VAULT path or .env pattern appears in the manifest. Human discipline scales until it doesn’t — one bad glob and you’ve embedded secrets. Next step: wire that check into project-doc-gather.py before anything hits Firestore.