openai: deploy cognee + cognee-mcp memory service [Adolf P4]

Resolves the 4 P4 blockers and wires cognee/cognee-mcp into the openai
compose stack:

- qdrant: container was gone (data intact under /mnt/ssd/dbs/qdrant);
  brought back up, confirmed healthy on :6333.
- Embeddings: switched from a dead LiteLLM route to ollama directly
  (host.docker.internal:11436, nomic-embed-text, 768-dim), using cognee's
  dedicated OllamaEmbeddingEngine and its native /api/embed endpoint.
  Requires extra_hosts: host.docker.internal:host-gateway since ollama
  lives in a separate compose project.
- cognee-llm kimi auth: root cause was that cognee-llm had never been
  started, so its kimi-agent-home-equivalent volume didn't exist yet.
  Seeded cognee-llm-home from the already-authed kimi-agent-home volume
  (read-only copy of config/credentials/oauth/device_id); cognee-llm now
  serves real completions.
- mkdir'd cognee data/system dirs: confirmed present (done by user).

Also fixed three issues found only during a live end-to-end smoke test:
- VECTOR_DB_PROVIDER must be a real container env var, not just present in
  the mounted cognee.env — the qdrant adapter's sitecustomize.py
  registration hook reads os.environ directly, which pydantic-settings'
  env_file parsing never populates.
- Baked the Kuzu/Ladybug JSON extension into the cognee image. This
  deployment's egress to extension.ladybugdb.com is bandwidth-throttled to
  ~1.2 KB/s, so cognee's own runtime auto-download reliably timed out,
  leaving /health permanently unhealthy and graph queries failing. Fetched
  the ~827KB extension out-of-band (16-way parallel ranged GETs) and added
  it to the image via COPY.
- LLM_ENDPOINT needed an explicit /v1 suffix (litellm appends
  "/chat/completions" verbatim) and LLM_INSTRUCTOR_MODE=json_mode is
  required since cognee-llm's Kimi wrapper is a text-only pass-through with
  no real tool-calling support.

Verified with a full remember -> recall round trip through cognee-mcp's
MCP tool surface: stored a fact containing a codeword, recalled it via
GRAPH_COMPLETION search, got the exact codeword back. Exercises cognee-llm,
ollama embeddings, Qdrant, and Kuzu together.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

openai/docker-compose.yml

@@ -181,6 +181,63 @@ services:
       - adolf-llm-home:/root/.kimi-code
     restart: unless-stopped
 
+  # cognee — Adolf's memory backend (P4). FastAPI + embedded Kuzu graph +
+  # Qdrant vectors. LLM via cognee-llm:8011 (Kimi CLI wrapper), embeddings via
+  # ollama directly (host.docker.internal:11436, separate compose project —
+  # hence extra_hosts below). Sole owner of the on-disk Kuzu/SQLite files
+  # under /mnt/ssd/dbs/cognee/ (Kuzu is not safe for concurrent multi-process
+  # access) — never run a second process against those files.
+  cognee:
+    build: ./cognee
+    container_name: cognee
+    restart: unless-stopped
+    environment:
+      # Real OS env var, not just the mounted .env file: the qdrant vector
+      # adapter's registration hook (cognee/Dockerfile's sitecustomize.py)
+      # gates on os.environ.get("VECTOR_DB_PROVIDER") at Python interpreter
+      # start, which only sees actual container env vars — pydantic-settings'
+      # env_file=".env" parsing (used for the rest of cognee.env) never
+      # populates os.environ itself. Without this, cognee raises
+      # "Unsupported vector database provider: qdrant" at startup even though
+      # cognee.env sets VECTOR_DB_PROVIDER=qdrant. Verified 2026-07-05.
+      - VECTOR_DB_PROVIDER=qdrant
+    volumes:
+      - ./cognee/cognee.env:/app/.env
+      - /mnt/ssd/dbs/cognee/data:/data
+      - /mnt/ssd/dbs/cognee/system:/system
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    # Not published to the host — only cognee-mcp (same compose network)
+    # needs to reach it. Uncomment for local debugging:
+    # ports:
+    #   - "8000:8000"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+  # cognee-mcp — thin MCP-to-HTTP proxy in API mode (API_URL=cognee:8000).
+  # Never opens the graph/vector files itself, so it's safe to run alongside
+  # `cognee` without a second writer on the same Kuzu database. Exposes 3
+  # tools: remember / recall / forget.
+  cognee-mcp:
+    image: cognee/cognee-mcp:1.2.2
+    container_name: cognee-mcp
+    restart: unless-stopped
+    environment:
+      - ENV=local
+      - LOG_LEVEL=INFO
+      - PYTHONUNBUFFERED=1
+      - TRANSPORT_MODE=http
+      - API_URL=http://cognee:8000
+      - MCP_ALLOWED_HOSTS=cognee-mcp:*
+    ports:
+      - "8001:8000"
+    depends_on:
+      - cognee
+
 volumes:
   kimi-agent-home:
   adolf-state: