Install the customer control plane on an existing cluster.

2 · Brain providers

Choose generation and embeddings independently.

The credential-free default is deterministic mock mode. A live hosted provider uses an existing Kubernetes Secret reference; API-key bytes never enter Helm values, command arguments, installer output, or the non-secret receipt. The installer checks only the credentials selected by your flags and fails before mutation with the exact missing Secret and key.

Current model qualification matrix

The machine-readable qualification policy and support matrix pins the exact 92-case corpus, three-run thresholds, and evidence-derived status. The receipt schema forbids a mock run from becoming support-eligible. A customer may evaluate an experimental target in its own environment; that does not change Clavenar's published support status.

For the lowest-cost current hosted option, create a Google AI API key, store it in an existing Kubernetes Secret, and select Google explicitly. Both Brain tiers then use gemini-3.5-flash-lite. The key travels through standard input rather than a process argument:

# Run in the shell that already holds the provider key.
export CLAVENAR_BRAIN_GOOGLE_API_KEY="..."

kubectl --context my-cluster create namespace clavenar \
  --dry-run=client --output=yaml | \
  kubectl --context my-cluster apply --server-side \
    --field-manager=clavenar-provider-bootstrap -f -

printf %s "$CLAVENAR_BRAIN_GOOGLE_API_KEY" | \
  kubectl --context my-cluster --namespace clavenar \
    create secret generic clavenar-brain-provider \
    --from-file=google-api-key=/dev/stdin \
    --dry-run=client --output=yaml | \
  kubectl --context my-cluster apply --server-side \
    --field-manager=clavenar-provider-secret -f -

curl -fsSL https://clavenar.ai/install.sh | \
  sh -s -- --context my-cluster --brain-provider google

Get the key from Google AI Studio. Anthropic uses --brain-provider anthropic with Secret key anthropic-api-key; OpenAI uses --brain-provider openai with openai-api-key. Ollama needs no Secret and accepts --brain-base-url. Override the provider defaults with --brain-fast-model and --brain-deep-model only for an explicitly reviewed evaluation; a custom model remains experimental unless the published matrix links a current passing receipt.

Persona-drift embeddings are disabled by default and have no fallback. To add Voyage, provision clavenar-brain-embedding key voyage-api-key with the same stdin pattern, then run:

curl -fsSL https://clavenar.ai/install.sh | \
  sh -s -- --context my-cluster \
    --brain-provider anthropic \
    --embedding-provider voyage

Embedding choices are disabled, voyage, openai, and ollama. Use --embedding-model, --embedding-dimensions, and --embedding-base-url for an explicit identity. An OpenAI embedding can reuse the selected OpenAI generation Secret automatically; other hosted combinations default to the separate embedding Secret.

Rotate or roll back a provider credential

Keep the previous credential available in your secret manager until the new Brain pod is ready and a real provider-backed canary succeeds. Replace the existing Secret atomically, then restart only Brain so its environment projection is re-read. The key stays in a mode-restricted file and never appears in shell history or Helm values:

# Example for the default Anthropic Secret. Use the selected provider's key name.
kubectl --context my-cluster --namespace clavenar \
  create secret generic clavenar-brain-provider \
  --from-file=anthropic-api-key=/secure/provider-key.next \
  --dry-run=client --output=yaml | \
  kubectl --context my-cluster apply --server-side \
    --field-manager=clavenar-provider-secret -f -

kubectl --context my-cluster --namespace clavenar \
  rollout restart deployment/clavenar-brain
kubectl --context my-cluster --namespace clavenar \
  rollout status deployment/clavenar-brain --timeout=5m

Authentication and credential failures stop on the selected target; Clavenar does not replay them to a fallback provider. Automatic fallback is available only in an explicitly reviewed external v2 routing ConfigMap and only for replay-safe availability failures. Watch the Brain provider-route dashboard by workload, provider alias, model, outcome, latency, and bounded fallback reason before retiring the old credential.

Rollback: reapply /secure/provider-key.previous to the same Secret key, restart Brain, and wait for readiness again. For an external routing ConfigMap, restore the previous complete routing document and restart Brain in the same transaction. Do not combine a credential rotation with model, endpoint, fallback-order, or policy changes; that makes a failed canary ambiguous.

4 · Install

Converge the full customer stack.

Run the stable bootstrap from an operator workstation or directly on the cluster host. Interactive mode confirms the selected context and shows the complete plan before mutation.

# Default customer install: full Console with passkey authentication.
curl -fsSL https://clavenar.ai/install.sh | sh

This shortest command keeps Brain in credential-free mock mode and embeddings disabled. Use the live-provider command from step 2 for a semantic customer deployment; an explicit live selection never falls back to mock when its Secret is missing.

The bootstrap verifies its immutable installer payload and release assets before execution. The installer records ownership, converges the Helm release, waits for bootstrap Jobs and workloads, exercises tools/list, proves that the Ledger chain advanced, and writes a non-secret receipt ConfigMap.

The default operator profile enables the full role-gated WebAuthn Console, disables anonymous demo access, and prepares one First Admin passkey registration. A customer install never falls back to the demo console.

6 · Automation and evaluation

Keep unattended installs explicit.

Automation must name its Kubernetes context. The evaluation profile is a deliberate demo-only opt-in and is not a customer installation shortcut.

# Non-interactive customer installation.
curl -fsSL https://clavenar.ai/install.sh | \
  sh -s -- --context my-cluster --yes

# Explicit evaluation only: anonymous demo access is enabled.
curl -fsSL https://clavenar.ai/install.sh | \
  sh -s -- --context my-cluster --profile evaluation

Use --profile evaluation only for a disposable evaluation environment. Production and customer environments use the default operator profile or an explicitly reviewed custom-values path with anonymous demo access disabled.

8 · Safe uninstall

Remove workloads without silently deleting state.

Persistent data and the namespace are retained by default. Data deletion is a separate destructive operation with exact target confirmation.

The chart-managed shared authentication Secret is retained so the one-time Admin bootstrap and existing HIL sessions cannot reset silently. An optional public-only operator trust registry is also retained; it contains no signer or client private key. The uninstaller verifies its immutable payload, cluster identity, Helm release, installer receipt, and PVC retention policy before showing its plan. It never deletes the namespace.

# Read-only uninstall preflight.
curl -fsSL https://clavenar.ai/uninstall.sh | \
  sh -s -- --context my-cluster --check --yes

# Remove the Helm release; retain namespace and persistent data.
curl -fsSL https://clavenar.ai/uninstall.sh | sh

# Non-interactive removal must name the context.
curl -fsSL https://clavenar.ai/uninstall.sh | \
  sh -s -- --context my-cluster --yes

curl -fsSL https://clavenar.ai/uninstall.sh | \
  sh -s -- --context my-cluster --yes --delete-data \
    --confirm-data-deletion clavenar/clavenar