b1e3ee7052
The airouter ESO ExternalSecret materialises a single key `api_key` (matching the provider schema in agent-runtimes M22 Phase 8e cutover, acct-59b7fb0b). The harness init script was checking for `auth_token` + `base_url` (an Anthropic-compat shape that never existed in real Vault state) and failing on every dispatch: ERROR: /run/agent/secrets/airouter/auth_token not readable. Check ESO ExternalSecret for airouter. Surfaced as the second blocker for the M16 Wave A1 dogfood (the first was the airouter dispatcher missing CRS sync; that fix went into agent-runtimes-deploy@0f11cd1). Same shape of bug as the minimax + gitea-ssh init scripts that landed during the same M22 phase — those were fixed at the time, airouter was not. Changes: - init.sh: verify the single `api_key` file (root-only, 0400 ESO mount). Stage to /var/agent-secrets/airouter/api_key with mode 0600 agent-owned (mirrors minimax pattern). H-SECRET-4 compliant — no exports. - harness.yaml: add OPENAI_API_KEY_FILE pointing at the staged path. Agentic runner reads the file at request time per entrypoint/runners/agentic.py:146 (OPENAI_API_KEY_FILE precedence). - Delete dead bin/anthropic-compat-wrapper.sh — confirmed unused per agent-runtimes/memory/log/2026-05-07.214249.md (post-M22-Phase-9 cleanup found these per-provider wrappers were never invoked; runner only prepends /opt/agent/claude-wrapper.sh). CRS picks this up automatically on next CP poll; no agent-runtimes image rebuild needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
25 lines
782 B
YAML
25 lines
782 B
YAML
kind: context
|
|
name: airouter
|
|
version: 1
|
|
description: "Airouter.ch Qwen3.6 — OpenAI-compatible agentic runner"
|
|
requires: []
|
|
provides: [agentic-runner]
|
|
|
|
env:
|
|
OPENAI_BASE_URL: "https://api.airouter.ch/v1"
|
|
# Agentic runner reads the api key from this file at request time.
|
|
# init.sh stages a 0600 agent-owned copy from the ESO mount to this path.
|
|
OPENAI_API_KEY_FILE: "/var/agent-secrets/airouter/api_key"
|
|
|
|
secrets_required:
|
|
- name: airouter
|
|
account_ref: "airouter"
|
|
mount_path: /run/agent/secrets/airouter
|
|
# 0400 (root-only) — defense in depth. The agent user CANNOT read this
|
|
# mount; init.sh runs as root and installs a 0600 agent-owned copy at
|
|
# OPENAI_API_KEY_FILE (above). Matches the minimax pattern.
|
|
mode: "0400"
|
|
|
|
scripts:
|
|
init: ./init.sh
|