🗂 VCell-AI — AI discovery/analysis platform

[jcschaff]

🗂 Master issue — VCell-AI · on the VCell board.

Why — Make VCell models and simulation results discoverable and analyzable through natural-language / AI assistance, lowering the barrier for researchers to find, understand, and work with VCell content.

What — An AI-powered discovery/analysis platform for VCell: an authenticated web service with an LLM gateway, deployed to Kubernetes, with an on-prem LLM hosting option.

Scope — virtualcell/VCell-AI (frontend + backend).

How — Auth0 authentication (+ Supabase); an LLM gateway (LiteLLM) with observability (Langfuse) and local models (Ollama); Kubernetes deployment via kustomize + sealed secrets. A GSoC student is involved.

Status / active

• ✅ Auth0 auth, k8s deployment, backend test structure; ported to the VxRails Kubernetes cluster.
• ✅ DNS resolved — vcell-ai.cam.uchc.edu and vcell-ai-dev.cam.uchc.edu point at the VxRails ingress.
• ✅ LiteLLM gateway + in-cluster Ollama added to the deployment (feat(k8s): LiteLLM + Ollama deployment, validated on dev (incl. #70 /api fix) #73): openai-model alias (Azure or hosted OpenAI), local phi4-mini fallback, per-user virtual keys/budgets in Supabase Postgres.
• ✅ Dev DEPLOYED and serving — https://vcell-ai-dev.cam.uchc.edu (trusted Let's Encrypt cert). All workloads healthy; LiteLLM migrated its Supabase schema; backend on hosted OpenAI (gpt-4o-mini / text-embedding-3-small); Auth0 Authorization-Code+PKCE login flow live. (feat(k8s): LiteLLM + Ollama deployment, validated on dev (incl. #70 /api fix) #73)
• 🔲 To finish dev: add the dev host to the Auth0 callback/logout allowlist; the frontend's NEXT_PUBLIC_API_URL is baked at build time (Frontend NEXT_PUBLIC_API_URL is baked into the image at build time (not environment-portable) #70), so browser-side data calls don't yet hit the dev ingress.
• 🔲 Local LLM hosting on the HPC cluster, exposed via an AI router (serve models from on-prem HPC, not only external providers).

Coordination inbox: comment with progress/handoffs (what moved + PR/commit links); the lead posts a periodic status summary.

[jcschaff]

Progress / handoff — LiteLLM + Ollama deployment

• DNS is live for vcell-ai.cam.uchc.edu and vcell-ai-dev.cam.uchc.edu → the earlier go-operational blocker is cleared.
• feat(k8s): LiteLLM + Ollama deployment, validated on dev (incl. #70 /api fix) #73 extends the kustomize deployment for the LiteLLM architecture (from Integrate LiteLLM: multi-model chat, per-user budgets, and automatic fallback #72): adds a LiteLLM gateway (:4000) and an in-cluster Ollama (phi4-mini, CPU) as the local-model fallback, wires per-user virtual keys/budgets to Supabase Postgres, and seals a new litellm-secrets. The openai-model alias accepts either an Azure or a hosted-OpenAI key.
• Verified end-to-end on the VxRails cluster short of real creds: kubectl kustomize renders all overlays, sealed-secret tooling + kubeseal work against the live controller, and a prior server-side dry-run passed.

Blocked on / waiting for: Azure endpoint + OpenAI credentials (and the Supabase DATABASE_URL). These are the only gates left to deploy #73 to dev and merge it — LiteLLM won't start without a valid DATABASE_URL, and chat/embeddings need the provider creds. Expected once the proprietary-LLM credentials land.

Note on incremental bring-up: because this is kustomize + sealed secrets, once the values arrive it's just ./secrets.sh + kubectl apply -k (rolling update, no image rebuild) — so we can light up providers without redeploying.

[jcschaff]

Progress — dev environment deployed & serving 🎉

vcell-ai-rke-dev is live on the VxRails cluster (#73):

• All workloads Running 1/1 — qdrant, backend, frontend, LiteLLM, Ollama (phi4-mini).
• LiteLLM ↔ Supabase Postgres working — Prisma migrations created its schema (66 tables).
• Backend runs on hosted OpenAI (gpt-4o-mini chat, text-embedding-3-small embeddings) — so dev did not need the Azure endpoint after all; the openai-model alias is provider-flexible.
• https://vcell-ai-dev.cam.uchc.edu reachable with a trusted Let's Encrypt cert; backend served via the ingress /api rewrite; Auth0 login redirects to the tenant with Authorization-Code + PKCE.

Issues fixed during bring-up (all in #73): expired ghcr GH_PAT, LiteLLM OOMKilled at 1Gi → raised to 2Gi, and dev config pointed at hosted OpenAI.

Remaining to finish dev (not blocking #73):

• Add https://vcell-ai-dev.cam.uchc.edu/auth/callback to the Auth0 app's allowed callbacks (login initiates but the callback needs allowlisting).
• Frontend NEXT_PUBLIC_API_URL is baked into the image at build time (not environment-portable) #70 — the frontend bakes NEXT_PUBLIC_API_URL at build time, so browser-side data calls don't yet reach the dev ingress.

#73 is now ready for review.

[jcschaff]

Feature request. Enable fluxcd deploy for. Vcell-ai to allow Karthik to safely deploy from GitHub, as gitops. Do this today or tomorrow