Paul O'Reilly b1e3ee7052 fix(airouter): match ESO Secret schema (api_key) + drop dead wrapper ...

The airouter ESO ExternalSecret materialises a single key `api_key`
(matching the provider schema in agent-runtimes M22 Phase 8e cutover,
acct-59b7fb0b). The harness init script was checking for `auth_token` +
`base_url` (an Anthropic-compat shape that never existed in real Vault
state) and failing on every dispatch:

  ERROR: /run/agent/secrets/airouter/auth_token not readable.
  Check ESO ExternalSecret for airouter.

Surfaced as the second blocker for the M16 Wave A1 dogfood (the first
was the airouter dispatcher missing CRS sync; that fix went into
agent-runtimes-deploy@0f11cd1).

Same shape of bug as the minimax + gitea-ssh init scripts that landed
during the same M22 phase — those were fixed at the time, airouter was
not.

Changes:
- init.sh: verify the single `api_key` file (root-only, 0400 ESO mount).
  Stage to /var/agent-secrets/airouter/api_key with mode 0600 agent-owned
  (mirrors minimax pattern). H-SECRET-4 compliant — no exports.
- harness.yaml: add OPENAI_API_KEY_FILE pointing at the staged path.
  Agentic runner reads the file at request time per
  entrypoint/runners/agentic.py:146 (OPENAI_API_KEY_FILE precedence).
- Delete dead bin/anthropic-compat-wrapper.sh — confirmed unused per
  agent-runtimes/memory/log/2026-05-07.214249.md (post-M22-Phase-9 cleanup
  found these per-provider wrappers were never invoked; runner only
  prepends /opt/agent/claude-wrapper.sh).

CRS picks this up automatically on next CP poll; no agent-runtimes image
rebuild needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-08 12:24:58 +12:00

1.6 KiB

Executable File

Raw Blame History

View Raw