KESPA AI Public Research
Open KESPA
← Research archive
Technical note verified Sep 23, 2026

Local-First Image Generation Bridge and Encrypted Retention Architecture

KESPA established an operational local-first image-generation path that detects image requests in chat, routes them through an authenticated OpenAI-compatible image bridge to localhost-only ComfyUI on an RTX 3070, returns the generated image to the conversation, and retains it as an encrypted private artifact. The implementation also adds plan-aware generated-image retention, automated worker/application cleanup, and storage-provider routing for future S3-compatible backends; external image fallback, production object-storage configuration, higher-quality checkpoints, and formal image-quality benchmarking remain outside this verified checkpoint.

image-generation comfyui local-inference artifact-retention encrypted-storage provider-routing
MARKDOWN

README.md

7,581 bytes SHA-256 701a294d994bfdf6…

KESPA-NOTE-028 — Local-First Image Generation Bridge and Encrypted Retention Architecture

Summary

KESPA established an operational local-first image-generation path using the existing RTX 3070 image worker. A normal chat request can be identified as image generation, routed by the WWW application through the configured provider layer, sent to an authenticated OpenAI-compatible image bridge, executed by localhost-only ComfyUI, returned to KESPA, retained as an encrypted private artifact, and displayed in the originating conversation.

This note records the working integration checkpoint rather than an image-quality benchmark. The initial SDXL Base 1.0 configuration was selected as a known-good functional baseline; higher-quality checkpoint comparison remains future work.

Architecture

The verified request path is:

``text KESPA chat → image-generation intent / capability route → KESPA WWW provider layer → authenticated OpenAI-compatible image bridge → Cloudflare-protected public bridge endpoint → localhost-only ComfyUI worker → RTX 3070 generation → generated image returned to KESPA → encrypted private artifact → rendered in chat ``

The public application does not communicate directly with raw ComfyUI. ComfyUI remains bound to localhost, while the dedicated bridge provides the externally routable API boundary and bearer-token authentication.

No brain_api.py change was required for this implementation.

Operational generation checkpoint

The recorded initial generation baseline used:

  • GPU: NVIDIA GeForce RTX 3070
  • VRAM: 8 GB
  • checkpoint: sd_xl_base_1.0.safetensors
  • output resolution: 1024 × 1024
  • steps: 25
  • CFG: 7
  • sampler: dpmpp_2m
  • scheduler: karras
  • batch size: 1

The image worker shares the GPU with KESPA's other local AI workloads, so the implementation uses conservative VRAM settings and the source explicitly identifies ongoing VRAM/resource contention as a scaling concern.

Recorded validation

Three operational layers were exercised successfully:

1. direct ComfyUI API generation,

2. generation through the local KESPA Image Bridge,

3. generation through the public bridge and a real KESPA chat request.

The source records an example local Image Bridge generation latency of approximately 13.7 seconds and an example public/Cloudflare bridge latency of approximately 16.6 seconds. These are individual observed examples, not benchmark means or latency guarantees.

The real-chat validation completed the full path:

``text image request detected → image_generation capability selected → local provider selected → image generated on RTX 3070 → artifact stored → image displayed in chat ``

The recorded status for this end-to-end test is PASS.

Generated-image retention

Generated images have two storage stages with different responsibilities.

Worker copy

Raw ComfyUI output is temporary worker state. The recorded policy removes raw outputs older than approximately 60 minutes, with cleanup running every 15 minutes.

KESPA artifact copy

After KESPA receives the generated image, the application stores it through the private artifact lifecycle. The recorded metadata identifies generated-image artifacts as AI-generated/generated authority and local encrypted storage at this checkpoint. The binary payload is encrypted at rest and is not intentionally stored as a publicly browsable image under the web root.

Plan-aware generated-image retention was added with the following initial policy:

| Plan | Recorded generated-image retention | |---|---:| | Free | 1 hour | | Plus | 12 hours | | Pro | 24 hours | | Enterprise | 168 hours / 7 days |

The policy is configurable. The source also records special values where -1 means no automatic expiration and 0 means immediately eligible for expiration.

The WWW cleanup worker runs every 10 minutes and uses the normal artifact-deletion lifecycle so associated indexes, message bindings, analysis/enrichment state, and encrypted storage objects are cleaned consistently rather than deleting files blindly.

Generation-event history can outlive the image binary so KESPA can preserve usage/accounting/provider telemetry without retaining generated content indefinitely.

Storage-provider architecture

The update also extends artifact storage routing so generated images and uploaded artifacts can be assigned independently.

Resolution order is:

``text per-user storage override → plan storage provider → built-in local encrypted storage ``

The implementation includes S3-compatible provider support and encrypts artifact content before an external storage backend receives it.

At this checkpoint:

  • local encrypted storage is operational,
  • the S3-compatible storage framework is implemented,
  • no production external object-storage provider is configured,
  • changing provider assignments does not silently move historical artifacts,
  • future migration is expected to be explicit/queued rather than implicit.

Security boundary

The recorded security choices include:

  • raw ComfyUI is localhost-only,
  • public generation traffic terminates at the dedicated Image Bridge,
  • generation/model endpoints require bearer-token authorization,
  • generated WWW artifacts are encrypted at rest,
  • generated images are subject to automatic retention rather than indefinite hosting,
  • user uploads and generated images can be routed independently for future cost/storage policy.

Credential values, tunnel identifiers, private filesystem paths, and private configuration details are intentionally not reproduced in this public note.

Deployment validation

The supplied update records successful schema/application QA for the new retention/storage foundation:

  • QA failures: 0
  • QA warnings: 1
  • warning: no external storage providers configured, expected for the current local-storage deployment

The initial retention-worker dry run recorded:

  • expired: 0
  • deleted: 0
  • failed: 0

This establishes that the worker executed without recorded deletion failures at installation time; it does not demonstrate long-term retention behavior across expired production artifacts.

Current verified state

Verified/recorded operational at this checkpoint:

  • local image generation on RTX 3070,
  • ComfyUI startup automation,
  • dedicated authenticated Image Bridge,
  • public bridge endpoint,
  • provider routing for image_generation,
  • automatic chat image-intent path,
  • image rendering in chat,
  • encrypted artifact retention,
  • plan-specific generated-image retention controls,
  • worker-side raw-output cleanup,
  • WWW generated-image cleanup,
  • per-plan storage routing,
  • per-user storage overrides,
  • S3-compatible storage framework implementation,
  • no brain_api.py modification required.

Limitations and non-claims

This release does not claim:

  • production-final image quality,
  • a completed image-generation quality benchmark,
  • Fast/Balanced/Quality preset validation,
  • production S3/R2 integration,
  • external image-generation fallback,
  • asynchronous generation queues,
  • multi-GPU image scheduling,
  • production-scale concurrency,
  • a latency service-level objective,
  • superiority over external image models or providers.

The source explicitly identifies SDXL Base 1.0 as a functional baseline rather than the final quality model. Planned follow-on work includes controlled checkpoint comparison, richer image UX/editing, async queueing, multi-worker routing, object-storage validation, and longer-term GPU/resource coordination.

TEXT

SHA256SUMS.txt

393 bytes SHA-256 4fe03c4fd8d9142b… 
701a294d994bfdf699a76d6cb6b4244511d1377e5c152aceaf36fcc29e82a554  README.md
75245babc0b680c6385b86590ec4876882d2463615a0d0b8bd15496b843a29a2  note.json
3ba09f775f422edfcbd60bbb23399285d600e107454f712686adb92ce630718f  metrics.csv
d28580a32a8e164cb58fc1114ba057ff632c266a3685fea8d99f68a1a1f575ac  methodology.md
fd9b356683e45bab2a00fd4007a1dede9e404aea7e077f3ebed0cce8af2c5f69  provenance.json
MARKDOWN

methodology.md

3,195 bytes SHA-256 d28580a32a8e164c…

Methodology

Classification

This material is published as a technical note, not as an image-quality benchmark.

The source establishes a working end-to-end local image-generation system and multiple deployment validations. It also explicitly states that quality/model optimization and the image-generation benchmark suite are future work. Accordingly, this package records the verified architecture and operational checkpoint without converting example latencies or subjective image quality into benchmark claims.

Source handling

The publication was derived only from the supplied KESPA Image Generation V1 implementation/update record and the existing public manifest used to allocate the next technical-note ID.

The source was separated into four evidence classes:

1. Operational architecture — request routing, bridge, ComfyUI worker, encrypted artifact return path.

2. Recorded validation — direct ComfyUI, local bridge, public bridge, and real-chat generation checks.

3. Retention/storage controls — cleanup cadence, plan retention, encrypted storage and storage-provider routing.

4. Future work / limitations — quality benchmarking, richer workflows, external fallback, async queues, multi-GPU scaling and production object storage.

Future items were not converted into completed results.

Status rationale

verified is used because the supplied material records successful production checks across the local worker, dedicated bridge, public bridge and real KESPA chat path, plus successful deployment QA for the retention/storage additions.

This status is scoped to the implementation checkpoint. It does not verify final image quality, production-scale throughput, external-storage operation, external-provider fallback, or multi-worker behavior.

Latency treatment

The source records approximately 13.7 seconds for one local-bridge generation example and approximately 16.6 seconds for one public-bridge example. These values are preserved as recorded_example metrics.

They are not presented as averages, percentiles, benchmark distributions, or service-level objectives because the source does not establish repeated-run statistics.

Security/publication treatment

The public artifact preserves the architectural security decisions while omitting unnecessary sensitive implementation details. In particular, this publication does not reproduce credential values, private configuration contents, tunnel identifiers, absolute private filesystem paths, internal tokens, or private user data.

The note does preserve the externally meaningful boundaries that raw ComfyUI remains localhost-only, the Image Bridge is authenticated, and KESPA stores generated-image artifacts encrypted at rest.

Deduplication boundary

KESPA-NOTE-025 already documents the broader private encrypted artifact storage and scoped retrieval foundation. This note does not duplicate that artifact as a general file-storage release. It records only the image-generation-specific lifecycle additions: operational generation, generated-image retention, cleanup, and provider/storage routing needed to make generated images sustainable in production.

CSV

metrics.csv

2,536 bytes SHA-256 4670ccb19e52fe21… 
metric,value,unit,status,notes
image_worker_gpu,NVIDIA GeForce RTX 3070,identifier,recorded,Current local image-generation GPU.
image_worker_vram,8,GB,recorded,Recorded VRAM capacity of the current image worker.
current_checkpoint,sd_xl_base_1.0.safetensors,identifier,recorded,Known-good functional baseline; not claimed as final quality model.
default_resolution,1024x1024,pixels,recorded,Recorded current generation default.
default_steps,25,steps,recorded,Recorded current generation default.
default_cfg,7,cfg,recorded,Recorded current generation default.
local_bridge_latency_example,13.7,seconds,recorded_example,"Single observed example, not a benchmark mean or service-level guarantee."
public_bridge_latency_example,16.6,seconds,recorded_example,"Single observed example through the public bridge, not a benchmark mean or service-level guarantee."
end_to_end_chat_generation_pass,1,boolean,recorded,"Normal KESPA chat request completed generation, storage, and rendering."
worker_raw_output_retention,60,minutes,recorded,Approximate age threshold for temporary raw ComfyUI output cleanup.
worker_cleanup_interval,15,minutes,recorded,Recorded worker cleanup cadence.
www_cleanup_interval,10,minutes,recorded,Recorded generated-image artifact cleanup cadence.
free_generated_image_retention,1,hours,recorded,Initial plan policy.
plus_generated_image_retention,12,hours,recorded,Initial plan policy.
pro_generated_image_retention,24,hours,recorded,Initial plan policy.
enterprise_generated_image_retention,168,hours,recorded,Initial plan policy (7 days).
storage_qa_failures,0,count,recorded,Recorded migration/storage QA result.
storage_qa_warnings,1,count,recorded,"Warning was absence of external storage providers, expected for current local-storage deployment."
retention_dry_run_expired,0,artifacts,recorded,Installation-time dry run.
retention_dry_run_deleted,0,artifacts,recorded,Installation-time dry run.
retention_dry_run_failed,0,artifacts,recorded,Installation-time dry run.
external_object_storage_configured,0,boolean,recorded_boundary,S3-compatible framework implemented but not configured against a production bucket.
external_image_fallback_configured,0,boolean,recorded_boundary,Provider architecture supports fallback; no external image-generation provider configured at this checkpoint.
formal_image_quality_benchmark_completed,0,boolean,recorded_boundary,Image-generation benchmark suite remains pending.
brain_api_modified,0,boolean,recorded,Source explicitly states no brain_api.py changes were required.
JSON

note.json

2,107 bytes SHA-256 75245babc0b680c6… 
{
    "id": "KESPA-NOTE-028",
    "type": "technical_note",
    "title": "Local-First Image Generation Bridge and Encrypted Retention Architecture",
    "date": "2026-09-23",
    "status": "verified",
    "summary": "KESPA established an operational local-first image-generation path that detects image requests in chat, routes them through an authenticated OpenAI-compatible image bridge to localhost-only ComfyUI on an RTX 3070, returns the generated image to the conversation, and retains it as an encrypted private artifact. The implementation also adds plan-aware generated-image retention, automated worker/application cleanup, and storage-provider routing for future S3-compatible backends; external image fallback, production object-storage configuration, higher-quality checkpoints, and formal image-quality benchmarking remain outside this verified checkpoint.",
    "image_worker": {
        "gpu": "NVIDIA GeForce RTX 3070",
        "vram_gb": 8,
        "checkpoint": "sd_xl_base_1.0.safetensors",
        "resolution": "1024x1024",
        "steps": 25,
        "cfg": 7,
        "sampler": "dpmpp_2m",
        "scheduler": "karras",
        "batch_size": 1
    },
    "provider_interface": "OpenAI-compatible image generation bridge",
    "image_provider_model_id": "local-sdxl-basic",
    "end_to_end_chat_status": "PASS",
    "observed_latency_examples_seconds": {
        "local_image_bridge": 13.7,
        "public_cloudflare_bridge": 16.6
    },
    "retention": {
        "worker_raw_output_minutes": 60,
        "worker_cleanup_interval_minutes": 15,
        "www_cleanup_interval_minutes": 10,
        "generated_image_hours_by_plan": {
            "Free": 1,
            "Plus": 12,
            "Pro": 24,
            "Enterprise": 168
        }
    },
    "storage": {
        "local_encrypted_operational": true,
        "s3_compatible_framework_implemented": true,
        "production_external_storage_configured": false,
        "external_image_fallback_configured": false
    },
    "brain_api_modified": false,
    "formal_image_quality_benchmark_completed": false,
    "tags": [
        "image-generation",
        "comfyui",
        "local-inference",
        "artifact-retention",
        "encrypted-storage",
        "provider-routing"
    ]
}
JSON

provenance.json

4,738 bytes SHA-256 fd9b356683e45bab… 
{
    "artifact_id": "KESPA-NOTE-028",
    "source_material": [
        {
            "type": "user_provided_project_update",
            "title": "KESPA Image Generation V1 \u2014 Local ComfyUI/RTX 3070 Integration, Image Bridge, Plan Retention & Scalable Artifact Storage",
            "status": "Implemented / Operational \u2014 Phase 2 Quality & Scaling Pending"
        },
        {
            "type": "existing_public_manifest",
            "description": "Current generated KESPA public research manifest through KESPA-NOTE-027, used for deduplication and sequential ID allocation."
        }
    ],
    "directly_recorded_facts": [
        "KESPA can detect image-generation requests in normal chat and route them through the existing provider architecture.",
        "A dedicated authenticated OpenAI-compatible Image Bridge mediates between KESPA and local ComfyUI.",
        "Raw ComfyUI is intentionally localhost-only and not directly exposed to the Internet.",
        "The current local image worker uses an NVIDIA GeForce RTX 3070 with 8 GB VRAM and shares the system with other KESPA local AI workloads.",
        "The known-good initial checkpoint uses SDXL Base 1.0 at 1024x1024, 25 steps, CFG 7, dpmpp_2m, karras, batch 1.",
        "Direct ComfyUI generation, local bridge generation, public bridge generation, and real KESPA chat generation were recorded as successful.",
        "A local bridge example was recorded at approximately 13.7 seconds and a public bridge example at approximately 16.6 seconds.",
        "The real KESPA chat test detected the image request, selected image_generation, routed to the local provider, generated on the RTX 3070, stored the artifact, and rendered the image in chat with PASS status.",
        "Temporary raw worker outputs are cleaned after approximately 60 minutes and cleanup runs every 15 minutes.",
        "Generated images retained by the WWW application are stored through the encrypted private artifact lifecycle.",
        "Initial plan retention values are Free 1 hour, Plus 12 hours, Pro 24 hours, Enterprise 168 hours.",
        "The generated-image cleanup worker runs every 10 minutes and uses the normal artifact deletion lifecycle rather than blind filesystem deletion.",
        "The artifact storage framework supports per-user override, plan provider, then local encrypted fallback resolution.",
        "S3-compatible external storage support is implemented but not configured against a production provider at this checkpoint.",
        "External image-generation fallback and higher-quality image models are not configured at this checkpoint.",
        "Deployment QA recorded failures=0 and warnings=1, where the warning was no external providers configured.",
        "The initial retention dry run recorded expired=0, deleted=0, failed=0.",
        "No brain_api.py modification was required."
    ],
    "derived_values": [],
    "validation_boundary": {
        "verified": [
            "local image generation on the recorded RTX 3070 worker",
            "dedicated authenticated image bridge",
            "public bridge path",
            "provider-routed real-chat image generation",
            "generated-image encrypted artifact retention",
            "plan-specific retention configuration",
            "worker and WWW cleanup configuration",
            "storage-provider routing framework implementation"
        ],
        "not_claimed": [
            "production-final image quality",
            "formal image-generation benchmark completion",
            "latency distribution or service-level objective",
            "production S3/R2 integration",
            "external image-generation fallback operation",
            "asynchronous job queue operation",
            "multi-GPU scheduling",
            "production-scale concurrency",
            "superiority over external image models or providers"
        ]
    },
    "metric_interpretation": {
        "latency_examples": "The approximately 13.7 s and 16.6 s values are individual observed examples preserved from the source, not benchmark averages or percentiles.",
        "qa_warning": "The single recorded warning reflects the intentional absence of configured external storage providers and is not represented as a failure.",
        "retention_dry_run": "The zero counts reflect installation-time dry-run state and do not establish long-term deletion behavior."
    },
    "publication_exclusions": [
        "credential values",
        "bearer tokens",
        "private configuration contents",
        "Cloudflare tunnel identifiers",
        "absolute private filesystem paths",
        "private user prompts or generated-image contents",
        "private user/account identifiers",
        "raw private logs",
        "private source code"
    ],
    "repository_identity": "https://github.com/ryanmurray89/KespaAI-Research",
    "repository_identity_rule": "The public-research manifest repository field is preserved exactly as the canonical KespaAI-Research repository URL."
}