chore(wiki): build.1790257176 (read API and pages); TypeSafe key as ExternalSecret

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

kubernetes/PROPOSAL-wiki-web-api.md

@@ -72,8 +72,7 @@ Rules that keep it modular, enforced by project references and a test:
 
 | port | what it abstracts | first adapter | examples of the next ones |
 |---|---|---|---|
-| `INoteStore` | read notes, raw sources and reports; enumerate by kind; observe changes (content hash per document) | Gitea repository API (`k.renner/notes`, blob SHA) | git checkout on a volume; a database (CNPG Postgres) with the vault imported; an Obsidian sync folder |
-| `IFactSink` | append a new raw source with provenance | Gitea contents API, new file on `main` | database insert; git commit on a checkout |
+| `INoteStore` | read notes, raw sources and reports at a head; create a new document (a fact becomes a raw note in the application layer, the store only moves text) | Gitea repository API (`k.renner/notes`, blob SHA) | git checkout on a volume; a database (CNPG Postgres) with the vault imported; an Obsidian sync folder |
 | `IEmbeddingModel` | text → vector, with a model id and dimension | llama-server `/v1/embeddings` (bge-m3 via wiki-embed, the model that won the German-document comparison on accuracy per cost) | the qwen3 embedding variants from that comparison; ONNX in-process; any OpenAI-compatible endpoint |
 | `IVectorIndex` | store vectors per (model id, document), query top-k | in-memory cosine with a file snapshot per model, as today | pgvector in the database; Qdrant |
 | `IChunker` | split a document into addressable units for typed questions | paragraph splitter (headings, fences), as in `wiki_ask.py` | sentence windows; semantic chunks |
@@ -99,7 +98,7 @@ Wiki.slnx
 src/
   Wiki.Core/               domain types, ports, frontmatter and link parsing
   Wiki.Application/        use cases; depends on Core only
-  Wiki.Adapters.Gitea/     INoteStore, IFactSink
+  Wiki.Adapters.Gitea/     INoteStore (read at a head, create)
   Wiki.Adapters.LlamaCpp/  IEmbeddingModel (OpenAI-compatible embeddings)
   Wiki.Adapters.TypeSafe/  IJudge (System One client)
   Wiki.Adapters.FileIndex/ IVectorIndex (memory + snapshot per model)
@@ -291,7 +290,7 @@ until phase 3 proves parity.
    Verify: `test_wiki_ask.py` passes against the API; a wiki-synth run with
    the definition unchanged. Then the Python service is retired and the
    `wiki-index` hostname points at the new one.
-4. **Facts.** API keys as an ExternalSecret, `IFactSink`, `/api/v1/facts`. Verify:
+4. **Facts.** API keys as an ExternalSecret, the deposit-fact use case, `/api/v1/facts`. Verify:
    a fact posted from the workstation shows as a `claude-bot` commit and in
    the next distill.
 5. **Questions.** Anthropic adapter, `/api/v1/questions` with streaming,

kubernetes/apps/wiki/deployment.yaml

@@ -47,8 +47,8 @@ spec:
           type: RuntimeDefault
       containers:
         - name: wiki
-          # build.<unix-ts> tags from the Wiki repo's release pipeline (commit c4e193b).
-          image: gitea.renner.uno/konairius/wiki:build.1790245544
+          # build.<unix-ts> tags from the Wiki repo's release pipeline (commit a02e4df).
+          image: gitea.renner.uno/konairius/wiki:build.1790257176
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -77,6 +77,8 @@ spec:
                 name: wiki-gitea
             - secretRef:
                 name: wiki-api-keys
+            - secretRef:
+                name: wiki-typesafe
           ports:
             - name: http
               containerPort: 8080

kubernetes/apps/wiki/externalsecrets.yaml

@@ -41,3 +41,22 @@ spec:
       remoteRef:
         key: apps/ai/wiki-api-keys
         property: workstation
+---
+# TypeSafe System One key for the judge adapter (Wiki:Judges:Models:typesafe).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wiki-typesafe
+  namespace: ai
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: wiki-typesafe
+  data:
+    - secretKey: Wiki__Judges__Models__typesafe__ApiKey
+      remoteRef:
+        key: apps/ai/wiki-typesafe
+        property: api_key

kubernetes/infrastructure/network-policies/gitea-ns.yaml

@@ -65,11 +65,14 @@ spec:
               protocol: UDP
             - port: "53"
               protocol: TCP
-    # Push webhook of the notes repo to wiki-index.
+    # Push webhook of the notes repo to wiki-index and the wiki service.
     - toEndpoints:
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": ai
             app.kubernetes.io/name: wiki-index
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ai
+            app.kubernetes.io/name: wiki
       toPorts:
         - ports:
             - port: "8080"