Mirrors the minimax fix to z-ai. Replaces bin/anthropic-compat-wrapper.sh
(which did `exec env ANTHROPIC_AUTH_TOKEN="$(cat ...)" claude "$@"`,
exposing the secret in the claude subprocess' /proc/<pid>/environ) with
init.sh that writes ~/.claude/settings.json with:
apiKeyHelper: "cat /run/agent/secrets/z-ai/auth_token"
Claude Code routes apiKeyHelper output to `Authorization: Bearer <value>`
when ANTHROPIC_BASE_URL is non-anthropic.com — exactly what the Z.ai
proxy at api.z.ai/api/anthropic requires.
The legacy K8s Secret may still ship a `base_url` file; it is
intentionally ignored by init.sh (the base URL is not a credential and
lives in harness.yaml).
Mirrors agent-runtimes commit (z-ai apiKeyHelper). CRS serves these
harness files to dispatchers, so this repo must match.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Mirrors agent-runtimes commit 1b83c81. CRS serves these harness files
to dispatchers, so this repo must match for the fix to take effect.
The minimax harness now writes ~/.claude/settings.json with an
apiKeyHelper that `cat`s the ESO-mounted /run/agent/secrets/minimax/
api_key file. Claude Code routes apiKeyHelper output to
`Authorization: Bearer <value>` for non-anthropic.com base URLs, which
is what MiniMax's /anthropic proxy requires. The secret is never read
into env, never written into a config file, and ESO rotation is
auto-recovered via Claude Code's per-session helper invocation
(also re-runs after a 401).
- harness.yaml: drop ANTHROPIC_AUTH_TOKEN_FILE env var
- init.sh: write (or jq-merge) settings.json with apiKeyHelper, chmod 0600
- bin/anthropic-compat-wrapper.sh: deleted
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Mirrors agent-runtimes — adds ANTHROPIC_AUTH_TOKEN_FILE pointer so the
Claude runner sets apiKeyHelper. Without it Claude Code CLI exits with
'Not logged in'.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
gitea-ssh has 3 accounts (ai_enablement, accelerators, homelab) and
gitea-https has 2 (primary, admin) — bare provider_type refs hit
MultipleAccountsError per SR-DISP-8. Switch to scoped name.space:platform
form. Mirrors the agent-runtimes commit; the dispatcher-side parser
also gains underscore support for account names like 'ai_enablement'.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.
Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).
Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
planning/v1 is a bare context with no provider credentials; any review node
using it fails with "Not logged in". The correct composite is
planning-minimax-repo/v1 which includes minimax/v1 auth.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AR-27b filters clone pre_actions when agent-repo is active, so the source
repo was never cloned and the spec was unreachable. Use reference_branches
instead: the source repo is cloned read-only to /workspace/reference/main/
by agent-repo/v1/init.sh.
Both write_tests and review_coverage nodes now declare:
reference_branches:
- repo_url: "{{ repo_url }}"
branch: main
name: main
Prompts updated to read from /workspace/reference/main/{{ spec_file }}
and write output to /workspace/project/{{ test_output_dir }}.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Single-node airouter workflow for one-requirement/one-test tasks.
Optional test_target param focuses the agent on a specific pytest
node ID. Cost-optimised: labels=[airouter], cost_efficiency≥9.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- minimax.yaml: scores copied from Opus (placeholder until real benchmark),
cost 0.0/0.0 (subscription), provider=minimax. Now auto-selectable by
min_scores routing (smart-agent at complexity≥9 will reach it).
- tdd-impl → write-code-following-tdd (name field updated)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Two agents (impl_a: airouter, impl_b: best-complexity model) implement
in parallel against pre-written tests using TDD composites. An audit
node compares both outputs and emits a JSON verdict (pass/more_work_needed,
winner: a/b/neither, gaps). Harnesses are param-overridable for
provider flexibility. F-WE-PDIV note in description for future
unique_providers enforcement.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds the tdd-gate harness context (TEST_PASS_REQUIRED=true + CLAUDE.md
methodology) and five provider-specific TDD composites that layer
tdd-protect + tdd-gate + python-dev + tdd-file-lock on top of the
existing code-* layer stacks. Matching task templates for sonnet, opus,
haiku, minimax, and airouter. allowed_failing_tests support noted in
warnings pending M19 pre-test hook implementation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add optional provider field (anthropic, openai, alibaba, github,
openrouter, opencode) as groundwork for F-WE-PDIV provider diversity
enforcement in auto-model selection.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Mount best-practices context at /workspace/best-practices/ (was
/opt/harness/context/best-practices/) for consistent agent access
- Fix /workspace/working/ → /workspace/project/ in all CLAUDE.md files
(planning, spec-writing, security-review, code-methodology,
qwen-code-methodology, test-writing)
- Update best-practices path references in all CLAUDE.md files to
/workspace/best-practices/
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
