Adolf: decommission Cognee (H4) + standalone hindsight-llm + vault access

H4 (kb#76) - Cognee -> Hindsight migration finished:
- New openai/hindsight-llm/ (clone of cognee-llm, :8012, own volume) so
  Hindsight's Kimi LLM no longer depends on the cognee stack
- Repointed hindsight service LLM at hindsight-llm:8012 (+ depends_on)
- Removed cognee, cognee-mcp, cognee-llm services + cognee-llm-home volume
  from openai/docker-compose.yml
- Removed the disabled cognee-memory plugin entry from openclaw.json

Vault access (kb#64): wired the shared agap-mcp (:3100, same MCP Claude uses)
into Adolf's registry - "agap" server in shared-mcp.json + openclaw.json
mcp.servers. Adolf can now fetch credentials from Vaultwarden (verified).

Note: agap-mcp/docker-compose.yml (repointed to the adolf46 account) is
deliberately NOT in this commit - it holds the master password in plaintext.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014t8Qg9gi7H7HtT8MncoXAB

openai/docker-compose.yml

@@ -210,17 +210,17 @@ services:
       ["node", "dist/index.js", "gateway", "--bind", "lan", "--port", "18789"]
     restart: unless-stopped
 
-  # cognee-llm — stateless one-shot Kimi-CLI wrapper for Cognee's batch cognify
-  # (P3). Opposite policy to kimi-agent: no resume, non-streaming, text-only.
-  # Note (SPIKE-FINDINGS gate 5): Cognee should DEFAULT its LLM to LiteLLM; this
-  # is the optional low-volume path. Needs `kimi login` in its own volume.
-  cognee-llm:
-    build: ./cognee-llm
-    container_name: cognee-llm
+  # hindsight-llm — standalone clone of cognee-llm (kb#76, H4 option B): the
+  # dedicated Kimi-CLI wrapper that is now Hindsight's LLM, so the whole cognee
+  # stack (incl. cognee-llm) can be decommissioned. Own port (:8012) + own
+  # kimi-code volume; needs a one-time `kimi login` seeded into hindsight-llm-home.
+  hindsight-llm:
+    build: ./hindsight-llm
+    container_name: hindsight-llm
     ports:
-      - "8011:8011"
+      - "8012:8012"
     volumes:
-      - cognee-llm-home:/root/.kimi-code
+      - hindsight-llm-home:/root/.kimi-code
     restart: unless-stopped
 
   # adolf-llm — conversational Kimi-CLI wrapper (:8010), the model backend for
@@ -244,68 +244,6 @@ services:
       - "host.docker.internal:host-gateway"
     restart: unless-stopped
 
-  # cognee — Adolf's memory backend (P4). FastAPI + embedded Kuzu graph +
-  # Qdrant vectors. LLM via cognee-llm:8011 (Kimi CLI wrapper), embeddings via
-  # ollama directly (host.docker.internal:11436, separate compose project —
-  # hence extra_hosts below). Sole owner of the on-disk Kuzu/SQLite files
-  # under /mnt/ssd/dbs/cognee/ (Kuzu is not safe for concurrent multi-process
-  # access) — never run a second process against those files.
-  cognee:
-    build: ./cognee
-    container_name: cognee
-    restart: unless-stopped
-    environment:
-      # Real OS env var, not just the mounted .env file: the qdrant vector
-      # adapter's registration hook (cognee/Dockerfile's sitecustomize.py)
-      # gates on os.environ.get("VECTOR_DB_PROVIDER") at Python interpreter
-      # start, which only sees actual container env vars — pydantic-settings'
-      # env_file=".env" parsing (used for the rest of cognee.env) never
-      # populates os.environ itself. Without this, cognee raises
-      # "Unsupported vector database provider: qdrant" at startup even though
-      # cognee.env sets VECTOR_DB_PROVIDER=qdrant. Verified 2026-07-05.
-      - VECTOR_DB_PROVIDER=qdrant
-    volumes:
-      - ./cognee/cognee.env:/app/.env
-      - /mnt/ssd/dbs/cognee/data:/data
-      - /mnt/ssd/dbs/cognee/system:/system
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    # Not published to the host — only cognee-mcp (same compose network)
-    # needs to reach it. Uncomment for local debugging:
-    # ports:
-    #   - "8000:8000"
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 40s
-
-  # cognee-mcp — thin MCP-to-HTTP proxy in API mode (API_URL=cognee:8000).
-  # Never opens the graph/vector files itself, so it's safe to run alongside
-  # `cognee` without a second writer on the same Kuzu database. Exposes 3
-  # tools: remember / recall / forget.
-  #
-  # Built from a local Dockerfile (kb#70 fix) instead of the bare upstream
-  # image: forget was missing a data_id parameter end-to-end, so agents
-  # could delete a whole dataset but never a single entry. See
-  # ./cognee-mcp/Dockerfile and ./cognee-mcp/src/ for the patched files.
-  cognee-mcp:
-    build: ./cognee-mcp
-    container_name: cognee-mcp
-    restart: unless-stopped
-    environment:
-      - ENV=local
-      - LOG_LEVEL=INFO
-      - PYTHONUNBUFFERED=1
-      - TRANSPORT_MODE=http
-      - API_URL=http://cognee:8000
-      - MCP_ALLOWED_HOSTS=cognee-mcp:*
-    ports:
-      - "8001:8000"
-    depends_on:
-      - cognee
-
   # hindsight — Adolf memory backend, replacing cognee/cognee-mcp/cognee-llm
   # (kb#73, migration doc agap_git/adolf/HINDSIGHT-MIGRATION.md, H1). One
   # container: REST API :8888 (also serves the built-in MCP at /mcp/{bank}/),
@@ -317,7 +255,7 @@ services:
   # LLM + embeddings reconfigured 2026-07-15 (kb#84) to fix two wrong H1
   # choices for a Russian/multilingual use case:
   #
-  # LLM -> cognee-llm:8011 (the existing Kimi-CLI wrapper, same shim cognee
+  # LLM -> hindsight-llm:8012 (dedicated Kimi-CLI wrapper cloned from the shim cognee
   # uses — see cognee/cognee.env's LLM section for the full precedent,
   # including why LLM_INSTRUCTOR_MODE=json_mode isn't needed here since
   # Hindsight's own client doesn't go through `instructor`). Replaces the
@@ -353,11 +291,11 @@ services:
     restart: unless-stopped
     environment:
       - HINDSIGHT_API_LLM_PROVIDER=openai
-      - HINDSIGHT_API_LLM_BASE_URL=http://cognee-llm:8011/v1
-      - HINDSIGHT_API_LLM_MODEL=openai/cognee-llm
-      # cognee-llm ignores the key entirely (Kimi CLI wrapper, no real
-      # OpenAI auth) — same dummy value cognee.env uses for LLM_API_KEY.
-      - HINDSIGHT_API_LLM_API_KEY=sk-cognee-llm-local
+      - HINDSIGHT_API_LLM_BASE_URL=http://hindsight-llm:8012/v1
+      - HINDSIGHT_API_LLM_MODEL=openai/hindsight-llm
+      # hindsight-llm ignores the key entirely (Kimi CLI wrapper, no real
+      # OpenAI auth) — dummy value, non-empty so the client constructs.
+      - HINDSIGHT_API_LLM_API_KEY=sk-hindsight-llm-local
       - HINDSIGHT_API_EMBEDDINGS_PROVIDER=openai
       - HINDSIGHT_API_EMBEDDINGS_OPENAI_BASE_URL=http://host.docker.internal:11436/v1
       - HINDSIGHT_API_EMBEDDINGS_OPENAI_MODEL=bge-m3
@@ -393,7 +331,7 @@ services:
       # file.
       - "host.docker.internal:host-gateway"
     depends_on:
-      - cognee-llm
+      - hindsight-llm
 
   # openclaw-tools — MCP bridge (P5) exposing a minimal slice of the Adolf
   # OpenClaw gateway's agent tools (message/cron/nodes/browser) over MCP
@@ -417,6 +355,6 @@ services:
 volumes:
   kimi-agent-home:
   adolf-state:
-  cognee-llm-home:
+  hindsight-llm-home:
   adolf-llm-workspace:
   adolf-llm-home: