openai: compose healthchecks + dependency ordering, registries, LiteLLM routing

docker-compose.yml gains healthchecks and depends_on/condition chains for the
litellm/langfuse/postgres tier so dependants wait for a genuinely ready
service instead of a started container. Also plumbs AGAP_MCP_TOKEN into the
adolf and adolf-llm containers, sourced from openai/.env (gitignored), for the
kb#180 bearer auth on the agap MCP server; shared-mcp.json consumes it via
bearerTokenEnvVar so the Kimi backbone authenticates too.

agent-registry.yaml / agent_registry.py: the version-controlled source of
truth for agent identities and trust classes -- the same ids the agap-mcp
token map resolves to (`adolf`, `claude-coder`; note `claude-code-cli` is the
runtime entry, not an agent identity).

model-registry.yaml, litellm-config.yaml, auto-router-routes.json and
provision_litellm_keys.py: model tiering, virtual-key provisioning and
auto-router routes. tei-reranker/ is the local reranker service backing
Hindsight recall.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

openai/model-registry.yaml

@@ -15,6 +15,51 @@
 # (see routing.metered_opt_in: [] at the bottom — empty means unreachable).
 #
 # Read with model_registry.py (same directory): resolve(), preload_check().
+#
+# ── Coverage vs litellm-config.yaml (kb#195, 2026-07-26 audit) ──────────
+# Every model_name litellm-config.yaml defines must appear either as a
+# `litellm_model_name` below or in this exclusion list. litellm_key_spec()
+# default-denies anything not reachable via routing.tiers, so an excluded
+# model stays ungoverned-but-inert until someone wires it up (add it here
+# and to routing.tiers first).
+#
+#   GOVERNED (present below):
+#     - ollama/gemma3:4b -> id: local-small (hot path: Hindsight LLM/
+#       consolidation/reflect all route here as of 2026-07-26)
+#     - judge -> id: paid-fallback (metered; see kb#164 for the fact that
+#       the no-metered-API constraint has no runtime enforcement yet)
+#     - kimi-agent -> id: kimi-agent (own container, live; see below)
+#     - bge-m3 -> id: bge-m3 (kb#164, 2026-07-26: wired into litellm-config
+#       .yaml pointing at ollama on 11436, the real embedder/routing
+#       classifier; litellm_model_name below updated from null to "bge-m3")
+#
+#   INTENTIONAL EXCLUSIONS (not governed by this registry, by design):
+#     - tip-generator (ollama/qwen2.5:1.5b), embedder (ollama/nomic-embed-
+#       text): aliases consumed by the separate oO ml/serving project, not
+#       the a2a fabric. Tracked in oO/CLAUDE.md, not duplicated here.
+#     - Raw ollama/* passthrough exposures — ollama/qwen3.5:4b,
+#       ollama/qwen3:8b, ollama/qwen2.5:1.5b, ollama/qwen2.5:0.5b,
+#       ollama/gemma3:1b, ollama/nomic-embed-text — manual/dev-console
+#       access to the ollama instances for ad-hoc testing. No agent or
+#       fabric workflow is registered against them (grepped agent-registry
+#       .yaml and openai/*.py: no hits). Not in routing.tiers, so
+#       litellm_key_spec() grants no agent access to them either way.
+#       If one of these becomes a real dependency (as ollama/gemma3:4b
+#       did), give it its own registry entry at that point.
+#     - The 12 OpenRouter `*:free` models (meta-llama/llama-3.3-70b-
+#       instruct:free, meta-llama/llama-3.2-3b-instruct:free, deepseek/
+#       deepseek-r1:free, qwen/qwen3-4b:free, qwen/qwen3-coder:free,
+#       google/gemma-3-27b-it:free, google/gemma-3-12b-it:free, mistralai/
+#       mistral-small-3.1-24b-instruct:free, nvidia/nemotron-3-super-
+#       120b-a12b:free, openai/gpt-oss-120b:free, minimax/minimax-m2.5:free,
+#       nousresearch/hermes-3-llama-3.1-405b:free) — human-facing manual-
+#       selection models (e.g.
+#       via Open WebUI), outside the agent fabric's model plane. Not
+#       referenced by any agent registry entry, not in routing.tiers, so
+#       resolve()/litellm_key_spec() never route an agent to them. Free
+#       tier, so this is not the kb#164 metered-enforcement gap — flag
+#       for a proper entry only if an agent workflow starts depending on
+#       one of these.
 
 schema_version: 1
 
@@ -54,6 +99,34 @@ models:
     metered: false
     opt_in_required: false
 
+  # ── kimi-agent — own container, oO-adjacent Kimi CLI wrapper ───────────
+  # Distinct from `kimi` above: this is a third Kimi-CLI container
+  # (openai/kimi-agent/, own Moonshot/Kimi subscription via `kimi login`,
+  # own docker-compose service `kimi-agent`) that IS routed through
+  # LiteLLM today (litellm-config.yaml model_name: kimi-agent ->
+  # openai/kimi-agent -> http://kimi-agent:8000/v1). Documented here per
+  # kb#195 coverage audit; deliberately NOT added to routing.tiers in this
+  # pass (that would change litellm_key_spec() grants, out of scope for a
+  # docs-alignment task) — no agent is currently opted into it.
+  - id: kimi-agent
+    role: "Kimi-CLI wrapper, own container (openai/kimi-agent/) — purpose/consumer not yet documented outside this registry"
+    litellm_model_name: "kimi-agent"   # openai/litellm-config.yaml model_list entry
+    endpoints:
+      - name: kimi-agent
+        url: "http://kimi-agent:8000/v1"
+    tier: large
+    context_tokens: 200000  # same Moonshot Kimi K2 CLI as `kimi`; re-verify if the CLI's pinned model changes
+    tool_use_quality: high
+    lifecycle: quota-gated
+    quota:
+      probe_command: null   # not yet wired to a probe; own subscription, same caveat as `kimi`
+      windows: []
+      threshold_pct: null
+    gpu_residency: null
+    cost_class: subscription
+    metered: false
+    opt_in_required: false
+
   # ── local-small — the cheap tier ───────────────────────────────────────
   # ollama/gemma3:4b on the GPU ollama instance. Already the live model for
   # Hindsight consolidation/reflect (HINDSIGHT_API_CONSOLIDATION_LLM_MODEL /
@@ -86,7 +159,7 @@ models:
   # routing at once.
   - id: bge-m3
     role: "embedder — also the routing classifier (§3a, LiteLLM Auto Router / semantic-router)"
-    litellm_model_name: null   # NOT YET wired into litellm-config.yaml — gap, see model_registry.py module docstring
+    litellm_model_name: "bge-m3"   # kb#164, 2026-07-26: wired into litellm-config.yaml (ollama/bge-m3 @ 11436) -- was null (unwired gap)
     endpoints:
       - name: ollama-direct
         url: "http://host.docker.internal:11436"