feat(openviking): pilot deployment to fastpass (wave 8)

Platform Knowledge Infrastructure pilot - context database for large
file trees, shared skills, and long-term logs to reduce agent token
consumption. Pilot scope: two corpora (hermes/ skills library,
personal/homelab/), two consumer profiles (Wong, Shuri) for before/after
token comparison.

- namespace.yaml: openviking namespace, sync-wave 8 (after Harbor wave 7)
- externalsecret.yaml: credentials from 1Password via onepassword-connect
  ClusterSecretStore (Wong, t_32766900)
- values.yaml: Helm overrides - px-fa-direct-access storage (30Gi),
  embedding (nomic-embed-text-v1.5) + VLM (Llama-3.1-8B) via astro-orbiter
  router (:8002), internal-only ingress
- application.yaml: multi-source ArgoCD Application, Harbor pattern
  (Peter Parker, t_eefdcc17 + reconciled in t_3e54efa8)

Prerequisites verified complete before this commit:
- nomic-embed-text-v1.5-Q4_K_M live on astro-orbiter router (War Machine,
  t_34b96e83, commit ad70b34)
- All 3 1Password items provisioned (root/embedding/vlm api keys)
- Storage class corrected to px-fa-direct-access after live PV audit
  showed pure-block/pure-file have zero provisioned volumes (t_77b3ff79)
- Dry-run validated against live cluster prior to commit

Constraint: vault (~/friday) remains canonical source of truth; OpenViking
index is a derived cache, rebuilt from vault source files.

Honcho/lincoln explicitly out of scope for this work.

cluster/platform/openviking/values.yaml

@@ -0,0 +1,214 @@
+# ============================================================================
+# OpenViking Helm Chart Values
+# Cluster: fastpass (Talos Kubernetes)
+# Wave: 8 (after Harbor at Wave 7)
+# Pilot scope: Two corpora (hermes/ skills, personal/homelab/)
+# ============================================================================
+#
+# KEY CONSTRAINT: Vault (~/friday) is the CANONICAL source of truth.
+# OpenViking's index is a derived cache, rebuilt from vault source files.
+# If index and vault ever diverge, vault wins and re-index runs.
+# See inbox/ryan/2026-08-13-openviking-pilot-deployment-plan.md for full context.
+#
+
+replicaCount: 1
+
+image:
+  repository: ghcr.io/volcengine/openviking
+  # Pin to a stable release tag (not "latest" for production-ish pilot)
+  tag: v0.3.17
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  create: false
+  annotations: {}
+  name: ""
+
+podAnnotations: {}
+podLabels:
+  app: openviking
+  wave: "8"
+
+# Security context: run as non-root if the image supports it
+podSecurityContext: {}
+securityContext: {}
+
+# Service: ClusterIP (no direct external exposure; MCP proxy handles agent access)
+service:
+  type: ClusterIP
+  port: 1933
+
+# ============================================================================
+# Ingress: enabled, INTERNAL-ONLY
+# Constraint from Phase 0 (Ryan's decision, 2026-08-13):
+# Standard nginx-ingress fronting the service (consistent with Harbor pattern),
+# but internal DNS only — no external/public DNS entry, no public-facing cert-manager issuer.
+# Use internal CA / self-signed cert to get ingress consistency without expanding public attack surface.
+# ============================================================================
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    # Internal cert-manager cluster issuer (self-signed or internal CA)
+    cert-manager.io/cluster-issuer: "letsencrypt-internal"
+    # Block external DNS registration (internal only)
+    external-dns.alpha.kubernetes.io/enabled: "false"
+  hosts:
+    - host: openviking.local.mk-labs.cloud
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: openviking-tls
+      hosts:
+        - openviking.local.mk-labs.cloud
+
+# ============================================================================
+# Resources: start conservative, tune after pilot
+# ============================================================================
+resources:
+  limits:
+    cpu: "2"
+    memory: 4Gi
+  requests:
+    cpu: 500m
+    memory: 1Gi
+
+# ============================================================================
+# Persistence: RocksDB index + workspace
+# Storage class: px-fa-direct-access (Portworx direct access to Pure FlashArray)
+# Rationale (from Phase 0 / t_77b3ff79): 40+ days of proven production history on fastpass,
+# RocksDB-optimized (direct block access, not NFS), RAID 6 durability via FlashArray.
+# Access mode: ReadWriteOnce (single replica only — RocksDB does not support concurrent access)
+# Update strategy: Recreate (no rolling updates; single-replica RocksDB workload)
+# ============================================================================
+persistence:
+  enabled: true
+  storageClass: px-fa-direct-access
+  accessMode: ReadWriteOnce
+  size: 30Gi  # 30Gi provides headroom for ~6 months of pilot corpus growth (~2GB actual use at launch)
+  existingClaim: ""
+  mountPath: /app/.openviking
+
+# Pod disruption budget: single replica, no HA
+# Explicit Recreate strategy (handled via Deployment patch in ArgoCD Application)
+podDisruptionBudget: {}
+
+# ============================================================================
+# Bot feature: disabled (scope out vikingbot for this phase)
+# ============================================================================
+bot:
+  enabled: false
+
+# ============================================================================
+# OpenViking server configuration (ov.conf)
+# Rendered into a ConfigMap mounted at ${persistence.mountPath}/ov.conf
+# ============================================================================
+config:
+  storage:
+    workspace: ""  # Defaults to /app/.openviking/openviking_workspace
+    vectordb:
+      name: context
+      backend: local
+      project: default
+    agfs:
+      backend: local
+      timeout: 10
+  log:
+    level: INFO
+    output: stdout
+  server:
+    host: "0.0.0.0"
+    port: 1933
+    workers: 1
+    # root_api_key injected via environment variable + ExternalSecret
+    root_api_key: "${OPENVIKING_ROOT_API_KEY}"
+    cors_origins:
+      - "*"
+
+  # ============================================================================
+  # Embedding configuration (dense)
+  # Provider: openai-compatible endpoint (local llama-server router)
+  # Model: nomic-embed-text-v1.5-Q4_K_M (137M params, 768-dim, local inference)
+  # Endpoint: http://astro-orbiter:8002/v1 (folded into existing astro-orbiter router per t_eb36eb2e)
+  # No cloud key needed; internal unauthenticated endpoint
+  # ============================================================================
+  embedding:
+    dense:
+      provider: "openai"
+      api_base: "http://astro-orbiter:8002/v1"
+      api_key: "${OPENVIKING_EMBEDDING_API_KEY}"  # Placeholder: "local-nomic" or similar
+      model: "nomic-embed-text-v1.5"
+      dimension: 768
+      encoding_format: "float"  # Required: avoid base64 encoding issues with OpenAI-compatible gateways
+      input: "text"
+      max_concurrent: 5
+    max_concurrent: 5
+
+  # ============================================================================
+  # VLM / Summarization configuration (L0/L1/L2 generation)
+  # Provider: openai-compatible endpoint (local llama-server router)
+  # Model: Llama-3.1-8B (already resident on astro-orbiter per Phase 0 analysis)
+  # Endpoint: http://astro-orbiter:8002/v1 (same router as embedding)
+  # No cloud key needed; internal unauthenticated endpoint
+  # max_concurrent: 4 (recommend capping background indexing load on shared VLM)
+  # ============================================================================
+  vlm:
+    api_base: "http://astro-orbiter:8002/v1"
+    api_key: "${OPENVIKING_VLM_API_KEY}"  # Placeholder: "local-llama" or similar
+    model: "llama3.1-8b"  # Confirm exact alias from astro-orbiter /v1/models before applying
+    provider: "openai"
+    temperature: 0.0
+    max_retries: 2
+    thinking: false
+    max_concurrent: 4  # Cap background indexing pressure on shared VLM
+
+# ============================================================================
+# Extra environment variables: secrets from ExternalSecret
+# Injected by ArgoCD Application via kustomize or helm hook
+# ============================================================================
+extraEnv:
+  - name: OPENVIKING_ROOT_API_KEY
+    valueFrom:
+      secretKeyRef:
+        name: openviking-credentials
+        key: root_api_key
+  - name: OPENVIKING_EMBEDDING_API_KEY
+    valueFrom:
+      secretKeyRef:
+        name: openviking-credentials
+        key: embedding_api_key
+  - name: OPENVIKING_VLM_API_KEY
+    valueFrom:
+      secretKeyRef:
+        name: openviking-credentials
+        key: vlm_api_key
+
+# ============================================================================
+# Probes
+# ============================================================================
+livenessProbe:
+  httpGet:
+    path: /health
+    port: http
+  initialDelaySeconds: 30
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+readinessProbe:
+  httpGet:
+    path: /ready
+    port: http
+  initialDelaySeconds: 15
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+nodeSelector: {}
+tolerations: []
+affinity: {}