Engrami is deploying.

1. Create the secret it reads (do NOT put secrets in values.yaml):

   kubectl create secret generic {{ .Values.existingSecret }} \
     --from-literal=ENGRAMI_PGVECTOR_DSN='postgresql://engrami:PASS@HOST:5432/engrami' \
     --from-literal=ENGRAMI_LICENSE_KEY='<cryptlex-license-key>' \
     --from-literal=ANTHROPIC_API_KEY='sk-ant-...' \
     --from-literal=ENGRAMI_CRYPTLEX_PRODUCT_DATA='<product.dat contents>' \
     --from-literal=ENGRAMI_CRYPTLEX_PRODUCT_ID='<product-id>'

2. Agents reach the shared MCP server in-cluster at:
     http://{{ .Release.Name }}-mcp.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.mcp.port }}/mcp

3. The glass-box UI (put behind your IdP proxy, do not expose publicly):
     http://{{ .Release.Name }}-api.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.api.port }}/viz

Health: GET /healthz on either service.
