b1e3ee7052
The airouter ESO ExternalSecret materialises a single key `api_key` (matching the provider schema in agent-runtimes M22 Phase 8e cutover, acct-59b7fb0b). The harness init script was checking for `auth_token` + `base_url` (an Anthropic-compat shape that never existed in real Vault state) and failing on every dispatch: ERROR: /run/agent/secrets/airouter/auth_token not readable. Check ESO ExternalSecret for airouter. Surfaced as the second blocker for the M16 Wave A1 dogfood (the first was the airouter dispatcher missing CRS sync; that fix went into agent-runtimes-deploy@0f11cd1). Same shape of bug as the minimax + gitea-ssh init scripts that landed during the same M22 phase — those were fixed at the time, airouter was not. Changes: - init.sh: verify the single `api_key` file (root-only, 0400 ESO mount). Stage to /var/agent-secrets/airouter/api_key with mode 0600 agent-owned (mirrors minimax pattern). H-SECRET-4 compliant — no exports. - harness.yaml: add OPENAI_API_KEY_FILE pointing at the staged path. Agentic runner reads the file at request time per entrypoint/runners/agentic.py:146 (OPENAI_API_KEY_FILE precedence). - Delete dead bin/anthropic-compat-wrapper.sh — confirmed unused per agent-runtimes/memory/log/2026-05-07.214249.md (post-M22-Phase-9 cleanup found these per-provider wrappers were never invoked; runner only prepends /opt/agent/claude-wrapper.sh). CRS picks this up automatically on next CP poll; no agent-runtimes image rebuild needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
agent-runtime-framework
Framework reference config repo for the agent-runtimes platform.
This repo is attached at CP scope with tags [harnesses, templates, workflows, model-registry, models]
and provides the default content that all installations inherit.
Contents
harnesses/— capabilities, contexts, compositestask-templates/— dispatch-task template YAMLsworkflows/— workflow DAG definitionsmodel-registry/— model scoring YAMLsmodels/— model endpoint YAMLs
Usage
Registered as a CRS attachment at CP scope (priority 100). Customer installations attach their own repos at lower priority to override or extend.