Hindsight

cpln helm install RELEASE_NAME oci://ghcr.io/controlplane-com/templates/hindsight \
  --version 1.0.0 --gvc GVC_NAME \
  --set auth.apiKeySecretName=API_KEY_SECRET_NAME \
  --set pgvector.config.credentialsSecretName=DB_CREDENTIALS_SECRET_NAME \
  --set ui.accessKeySecretName=UI_KEY_SECRET_NAME \
  --set llm.apiKeySecretName=LLM_KEY_SECRET_NAME

auth:
  apiKeySecretName: my-hindsight-api-key

hindsight:
  image: ghcr.io/vectorize-io/hindsight-api:1.2.1
  # set hindsight.replicas: 2, worker.enabled: true and postgresHA.enabled: true for near-zero-downtime upgrades and failover
  replicas: 1                   # 1-10 interchangeable API replicas sharing PostgreSQL
  requestTimeoutSeconds: 300    # longest request (a sync retain or reflect waits on the LLM) before it is cut (1-3600)
  dbPoolMaxSize: 20             # PostgreSQL connections per process; (replicas + worker replicas) x this must be <= 90

publicAccess:
  api: false                    # true = REST + MCP on a public *.cpln.app URL (API key still required)
  ui: false                     # true = web UI on a public *.cpln.app URL (access key still required)
internalAccess:                 # who in Control Plane may call the API
  type: same-gvc                # none | same-gvc | same-org | workload-list (none needs ui.enabled: false)
  workloads: []                 # used with workload-list

llm:
  provider: openai              # e.g. openai, anthropic, gemini, groq, ollama, litellm
  model: gpt-5-mini             # must support JSON-schema output
  baseUrl: ""                   # "" = provider default; e.g. http://my-ollama.my-gvc.cpln.local:11434/v1
  apiKeySecretName: my-hindsight-llm-key

embeddings:
  provider: local               # local (bundled BAAI/bge-small-en-v1.5, 384 dims) | openai (OpenAI or OpenAI-compatible)
  model: ""                     # openai only; "" = text-embedding-3-small. Changing it later needs a re-embed
  baseUrl: ""                   # openai only; e.g. http://my-ollama.my-gvc.cpln.local:11434/v1
  apiKeySecretName: ""          # openai only; opaque secret. "" = use the LLM key

reranker:
  provider: local               # local (bundled hs-rerank-1) | rrf (no model; required with the slim image)

hindsight:
  image: ghcr.io/vectorize-io/hindsight-api:1.2.1-slim
embeddings:
  provider: openai
  model: nomic-embed-text
  baseUrl: http://my-ollama.my-gvc.cpln.local:11434/v1
  apiKeySecretName: ""          # openai only; opaque secret. "" = use the LLM key
reranker:
  provider: rrf

hindsight:
  # Plain upstream settings (HINDSIGHT_API_*), applied to the API and workers.
  extraEnv: []
  # extraEnv:
  #   - name: HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS   # needed for models with < 65k output tokens
  #     value: "16000"
  # Optional prerequisite `dictionary` secret: each listed key becomes an env var of the same name. "" = none.
  extraSecrets:
    secretName: ""              # e.g. my-hindsight-extra-secrets
    keys: []                    # e.g. [HINDSIGHT_API_RERANKER_COHERE_API_KEY]

worker:
  enabled: false                # true = background tasks move off the API into their own workload
  replicas: 1                   # 1-10

ui:
  enabled: true                 # browse banks, entities and documents; test recall and reflect
  image: ghcr.io/vectorize-io/hindsight-control-plane:1.2.1
  # REQUIRED PREREQUISITE SECRET when enabled — an `opaque` secret: the key you type to log in to the web UI.
  accessKeySecretName: my-hindsight-ui-access-key

pgvector:
  enabled: true
  config:
    # REQUIRED PREREQUISITE SECRET — CREATE IT BEFORE YOU INSTALL, or the deployment WEDGES silently.
    # A `dictionary` secret with exactly username, password and database, LETTERS AND DIGITS ONLY.
    credentialsSecretName: my-hindsight-db-credentials
  volumeset:
    capacity: 10                # GiB (minimum 10)
# set postgresHA.enabled: true (and pgvector.enabled: false) for near-zero-downtime upgrades and failover
postgresHA:
  enabled: false
  config:
    # REQUIRED PREREQUISITE SECRET when enabled — same keys and letters-and-digits rule as pgvector.config above.
    credentialsSecretName: my-hindsight-db-credentials
  replicas: 3
  volumeset:
    capacity: 10                # GiB per replica (minimum 10)

H="Authorization: Bearer $HINDSIGHT_API_KEY"
URL=http://RELEASE_NAME-hindsight.GVC_NAME.cpln.local:8888

curl -s -X POST "$URL/v1/default/banks/my-agent/memories" -H "$H" -H 'content-type: application/json' \
  -d '{"items":[{"content":"Alice prefers oolong tea and works on the billing team."}]}'
curl -s -X POST "$URL/v1/default/banks/my-agent/memories/recall" -H "$H" -H 'content-type: application/json' \
  -d '{"query":"What does Alice drink?"}'
curl -s -X POST "$URL/v1/default/banks/my-agent/reflect" -H "$H" -H 'content-type: application/json' \
  -d '{"query":"What do we know about Alice?"}'

claude mcp add --transport http hindsight https://CANONICAL_ENDPOINT/mcp/my-agent/ \
  --header "Authorization: Bearer $HINDSIGHT_API_KEY"

cpln port-forward RELEASE_NAME-hindsight 8888:8888 --gvc GVC_NAME
cpln port-forward RELEASE_NAME-hindsight-ui 9999:9999 --gvc GVC_NAME

cpln workload exec RELEASE_NAME-hindsight --gvc GVC_NAME --container hindsight -- env \
  HINDSIGHT_API_EMBEDDINGS_PROVIDER=openai HINDSIGHT_API_EMBEDDINGS_OPENAI_BASE_URL=NEW_URL \
  HINDSIGHT_API_EMBEDDINGS_OPENAI_MODEL=NEW_MODEL HINDSIGHT_API_EMBEDDINGS_OPENAI_API_KEY=KEY_OR_unused \
  hindsight-admin reembed --all-schemas
cpln helm upgrade RELEASE_NAME oci://ghcr.io/controlplane-com/templates/hindsight \
  --version 1.0.0 --gvc GVC_NAME -f values.yaml
cpln workload exec RELEASE_NAME-hindsight --gvc GVC_NAME --container hindsight -- hindsight-admin reembed --all-schemas --finish

hindsight:
  extraEnv:
    - name: HINDSIGHT_API_WEBHOOK_ALLOWED_HOSTS
      value: my-receiver.my-gvc.cpln.local

cpln workload exec RELEASE_NAME-hindsight --gvc GVC_NAME --container hindsight -- hindsight-admin worker-status
cpln workload exec RELEASE_NAME-hindsight --gvc GVC_NAME --container hindsight -- hindsight-admin decommission-worker WORKER_ID