feat(v2): Obsidian memory vault — GUI service + file-based memory-vault MCP

[AlienWalker1995]

Design

A shared markdown memory substrate for the stack — plain .md files, no hidden store — usable by both a browser GUI and the agents:

• Vault data/memory-vault (seeded): README.md, CONVENTIONS.md (frontmatter schema name/description/type: user|project|feedback|reference, wikilinks, one-fact-per-note), memories/{user,project,feedback,reference}/, research/, inbox/, plus one worked example note.
• obsidian (kind=service): linuxserver/obsidian digest-pinned (@sha256:b8a0b254…), SUBFOLDER=/obsidian/, no host port (the GUI embeds a passwordless-sudo terminal → SSO-edge only, never published), /config app-state + the shared vault at /config/vaults/memory.
• memory-vault (kind=mcp): @bitbonsai/[email protected] (node:22-bookworm-slim digest-pinned base, docker/mcpvault-mcp), CMD mcpvault /vault, 15 tools. longLived + disableNetwork (pure fs).
• Edge: /obsidian/* → obsidian:3000 in the SSO-protected :443 block (handle, no strip — the app is subfolder-aware).

Root-cause render fix (not a per-artifact workaround)

The v2 MCP render emitted only image+env, so a file-based MCP could not write its data dir. render.py now passes the upstream gateway-catalog fields (volumes, command, longLived, disableNetwork) through when a manifest declares them — opt-in, so existing image+env MCP entries render byte-identically. The vault volume is a read-write host bind (no :ro) whose source is substituted from MEMORY_VAULT_PATH by gateway-wrapper.sh (mirrors the existing CODE_ROOT placeholder pattern); compose.py adds MEMORY_VAULT_PATH to the gateway env.

Also reconciles a pre-existing drift surfaced during the work: the tracked auth/caddy/Caddyfile was missing the live /grafana/ route (PR #71 deployed on a branch, never merged to source) — added so the source matches the running runtime copy.

Validation evidence (live)

• (a) obsidian healthy; container-to-container GET obsidian:3000/obsidian/ → HTTP 200 (SUBFOLDER honored); through the edge https://ultracam…/obsidian/ → 302 → /oauth2/start (Google SSO). Operator does the visual login check.
• (b) Gateway log: Those servers are enabled: memory-vault, qdrant-rag, searxng and memory-vault: (15 tools), spawned --network none -v C:/dev/ordo-ai-stack/data/memory-vault:/vault. Real round-trip through the gateway: write_note → Successfully wrote note: memories/reference/roundtrip-canary.md; the file exists on host disk (data/memory-vault/memories/reference/roundtrip-canary.md, frontmatter intact); read_note returns it; search_notes "OBSIDIANMEMORYPROOF" finds it; seeded CONVENTIONS.md readable via read_note.
• (c) Vault visible inside the obsidian container at /config/vaults/memory/ (README/CONVENTIONS/tree present).
• (d) llamacpp (c8ba78363863) + agent (ac79a12620ef) + comfyui/voice container IDs unchanged; 24→25 services (only +obsidian); /dash/ & /grafana/ still 302 SSO; /healthz 200.

Render discipline: re-rendered in a --gpus all CUDA container from out/ordo.yaml; diff vs live out/ = ONLY the new obsidian service + MEMORY_VAULT_PATH gateway env + the memory-vault mcp registry entry; llamacpp block byte-identical (GPU-97fe65ee preserved). docker compose config (both env files, all profiles incl. obsidian) → exit 0. Live .env runtime-appended keys preserved.

Pins: obsidian linuxserver/obsidian@sha256:b8a0b2542f9c…2919024; mcpvault @bitbonsai/[email protected]; base node:22-bookworm-slim@sha256:53ada149….

Tests: 172 → 181 passed, 2 skipped; ruff clean (throwaway python:3.11-slim container).

Deliberate follow-ups (not in this PR)

• Dashboard services-catalog entry (services_catalog.py + index.html SSO_ROUTES) — needs a rebuild of the shared ordo-v2/dashboard-v1 image (changes its container ID); deferred to keep blast radius minimal. Routing/health/MCP all work without it.
• Hermes SOUL/skill adoption of the memory-vault tools (agent-side guidance; also: pass trashMode: local so deletes go to the vault's .trash/ instead of permanent).
• Qdrant semantic indexing of the vault (phase-2).

🤖 Generated with Claude Code