kind: context
name: airouter
version: 1
description: "Airouter.ch Qwen3.6 — OpenAI-compatible agentic runner"
requires: []
provides: [agentic-runner]

# Label-gated capability: only dispatchers with the `airouter` label have the
# ESO mount + Ollama setup needed to run this context. Filter prevents the
# main dispatcher from claiming airouter tasks (real incident: 2026-05-08
# dogfood batch, gotchas-airouter.md item 29).
requires_labels: [airouter]

env:
  OPENAI_BASE_URL: "https://api.airouter.ch/v1"
  # Agentic runner reads the api key from this file at request time.
  # init.sh stages a 0600 agent-owned copy from the ESO mount to this path.
  OPENAI_API_KEY_FILE: "/var/agent-secrets/airouter/api_key"

secrets_required:
  - name: airouter
    account_ref: "airouter"
    mount_path: /run/agent/secrets/airouter
    # 0400 (root-only) — defense in depth. The agent user CANNOT read this
    # mount; init.sh runs as root and installs a 0600 agent-owned copy at
    # OPENAI_API_KEY_FILE (above). Matches the minimax pattern.
    mode: "0400"

scripts:
  init: ./init.sh