cc-ci host: the orchestrator is an opencode agent; no Claude on the box; /secrets convention

Operator 2026-09-07 (evening): Claude sessions stay on notplants-orchestrator;
on the cc-ci host the orchestrator is an opencode agent (agents.toml:
opencode/glm-5.2) steered from https://oc.ci.commoninternet.net, next to the
upgrader/report sessions. claude-install and CLAUDE_BIN are gone from the
modules; launch-upgrader/report print the real UI URL; README "Operating the
orchestrator" rewritten and a "Weekly upgrade run" section added.

Secrets: only cc-ci's, under /secrets/files with runtime paths symlinked
(README §4 table), nothing from other projects — tangled key and the
tailscale line dropped from the host.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

cc-ci-plan/agents.toml

@@ -53,8 +53,9 @@ log_dir = "/srv/cc-ci/.cc-ci-logs"
 [[agent]]
 name    = "orchestrator"       # tmux session: cc-ci-orchestrator
 kind    = "persistent"
-backend = "claude"             # operator 2026-09-07: Claude Code under remote-control so they can talk to it
-model   = "claude-fable-5-1"   # Fable 5.1
+backend = "opencode"           # operator 2026-09-07 (evening): NO Claude on the cc-ci host — the
+model   = "opencode/glm-5.2"   # orchestrator is an opencode agent, steered via the opencode web UI
+                               # (https://oc.ci.commoninternet.net). Claude sessions live on notplants-orchestrator.
 resume  = false                # opencode backend has no --resume equivalent (fresh session each launch)
 watch   = "heal"               # restart if dead / FATAL / backend-mismatch; never stall-reboot
 wake    = { interval = 3600, prompt_file = "ai-progress-monitor-prompt.txt" }

cc-ci-plan/launch-report.py

@@ -124,7 +124,7 @@ def start(mode, date):
         _lu._pin_new_session(_prev_ids)
     if BACKEND == "opencode":
         if OPENCODE_SHARE:
-            log(f"  attached to {OPENCODE_SERVER} → http://oc.commoninternet.net  +public --share link")
+            log(f"  attached to {OPENCODE_SERVER} → https://oc.ci.commoninternet.net  +public --share link")
         # Watchdog for the report too: it runs on glm-5.2 sharing the same opencode-go budget the
         # upgrade run just drained, so a 429 stall is likely. Reuse launch-upgrader.py's watchdog,
         # pointed at THIS (cc-ci-report) session with a report-specific marker + resume prompt. It

cc-ci-plan/launch-upgrader.py

@@ -67,7 +67,7 @@ REMOTE_CONTROL = os.environ.get("REMOTE_CONTROL", "1") == "1"
 OPENCODE_BIN    = os.environ.get("OPENCODE_BIN",    "/home/loops/.local/bin/opencode")
 OPENCODE_SERVER = os.environ.get("OPENCODE_SERVER", "http://127.0.0.1:4096")
 # Web visibility for the opencode backend: attach the session to the shared opencode
-# web server (viewable at http://oc.commoninternet.net, tailnet-only) AND optionally
+# web server (viewable at https://oc.ci.commoninternet.net (basic auth)) AND optionally
 # create a public opencode.ai --share link. Default both on so the run is monitorable.
 OPENCODE_SHARE = os.environ.get("OPENCODE_SHARE", "1") == "1"
 
@@ -220,7 +220,7 @@ def start(mode="use-or-create"):
             f"{OPENCODE_BIN} run {model_flag} {share_flag} --attach '{OPENCODE_SERVER}' "
             f"--title '{SESSION}' \"$(cat '{kf}')\""
         )
-        log(f"  attached to {OPENCODE_SERVER} → http://oc.commoninternet.net (tailnet only)"
+        log(f"  attached to {OPENCODE_SERVER} → https://oc.ci.commoninternet.net"
             + ("  +public --share link (printed in the session)" if OPENCODE_SHARE else ""))
     else:
         die(f"unknown LOOP_BACKEND '{BACKEND}' — use 'claude' or 'opencode'")
@@ -655,7 +655,7 @@ Model:   {MODEL}  (LOOP_MODEL or UPGRADER_MODEL env var)
 Args:    {UPGRADER_ARGS or '<none>'}  (UPGRADER_ARGS env var, passed to /upgrade-all)
 
 claude:   viewable at claude.ai/code
-opencode: viewable at http://oc.commoninternet.net  server={OPENCODE_SERVER}
+opencode: viewable at https://oc.ci.commoninternet.net  server={OPENCODE_SERVER}
 """)