launchers: the opencode UI is oc.ci.commoninternet.net (not tailnet-only); journal the key switch

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

cc-ci-plan/JOURNAL.md

@@ -1101,3 +1101,32 @@ generation and restores the lock. One-line outcome in `.cc-ci-logs/auto-update-s
   generation, front doors (oc.ci must be 401), sops, fail2ban, all four timers, the orchestrator
   agent session, and a secrets-inventory check that flags sprawl. Verdict updated.
   Verified against the box: 0 failed units, 10/10 swarm services, disk 33%, all timers armed.
+
+## 2026-09-08 16:55 UTC — cc-ci host moved to the operator's OpenCode **Go** key; extra credentials purged
+
+**The key.** `AUTONOMIC_OPENCODE_KEY` (operator, in `/secrets/files/cc-ci.testenv`) is an OpenCode
+**Go subscription** key, not a ZEN one. Installed into the ZEN slot it authenticates but every
+request dies `Insufficient balance` (ZEN = pay-as-you-go credit); on the `opencode-go` endpoint the
+same key answers immediately. Diagnosis was the operator's — worth remembering as the first thing
+to check when an opencode key "does not work".
+
+- `auth.json` (→ `/secrets/files/opencode-auth.json`) now holds **exactly one** provider,
+  `opencode-go`, carrying that key. The previous ZEN key is deleted; `opencode/glm-5.2` now errors.
+- `agents.toml` orchestrator → `opencode-go/glm-5.2`; `upgrader.env` → `LOOP_TIER=go` and
+  LOOP/REPORT/SUPERVISOR models all `opencode-go/glm-5.2`; cc-ci PR #36 moved the subagent model in
+  `cc-ci/opencode.json` the same way.
+- **Model note:** `opencode-go/deepseek-v4-flash` (what the weekly run used on ZEN) is China-hosted
+  on the Go tier and returns an opt-in error until the operator enables it at
+  `https://opencode.ai/workspace/wrk_01M20RVAY3D3B28XAYY1Z2Q6AZ/go`. `glm-5.2` is used meanwhile.
+- Verified: `opencode-go/glm-5.2` answers, the orchestrator agent restarted on it, ZEN gone.
+
+**Purged while there** (same "only what cc-ci strictly needs" rule): `auth.json` had also carried
+`openai` (oauth), `opencode-go` (old) and `infomaniak` credentials copied from the notplants box,
+and `~/.config/opencode/opencode.jsonc` carried a **Tinfoil API key inline in plaintext**. All
+removed; the config is now a 4-line file with no `apiKey` anywhere. That Tinfoil key still lives in
+the notplants-orchestrator config it came from — **operator: consider rotating it**, since it was
+briefly present on a second host.
+
+**Also:** `vim`/`vi` (absent, the operator hit it over ssh), `sqlite`, `bat`, `bc`, `moreutils`,
+`pv`, `man-pages` added to the host toolbox with `EDITOR=vim`; on PATH for root and loops.
+Stale `oc.commoninternet.net` URLs in the launchers → `oc.ci.commoninternet.net`.

cc-ci-plan/launch-assistant.py

@@ -116,7 +116,7 @@ def start(mode="resume"):
             f"NO_COLOR=1 {OPENCODE_BIN} attach {OPENCODE_SERVER} --dir {WORKDIR}"
         )
         log(f"starting {SESSION} (backend=opencode, model={LOOP_MODEL or 'default'})")
-        log("  visible at http://oc.commoninternet.net (tailnet only)")
+        log("  visible at https://oc.ci.commoninternet.net")
     else:
         die(f"unknown LOOP_BACKEND '{BACKEND}' — use 'claude' or 'opencode'")
 

cc-ci-plan/launch-orchestrator.py

@@ -158,7 +158,7 @@ def start(mode="resume"):
             f"{model_env}NO_COLOR=1 {OPENCODE_BIN} attach {OPENCODE_SERVER} --dir {shlex.quote(WORKDIR)}"
         )
         log(f"starting {SESSION} (backend=opencode, model={LOOP_MODEL or 'default'})")
-        log(f"  visible at http://oc.commoninternet.net (tailnet only)")
+        log(f"  visible at https://oc.ci.commoninternet.net")
     else:
         die(f"unknown LOOP_BACKEND '{BACKEND}' — use 'claude' or 'opencode'")
 
@@ -212,7 +212,7 @@ def main():
     else:
         backend_note = (
             "claude:   --resume preserves conversation across reboots; viewable at claude.ai/code\n"
-            "  opencode: fresh session each launch (no --resume); viewable at http://oc.commoninternet.net"
+            "  opencode: fresh session each launch (no --resume); viewable at https://oc.ci.commoninternet.net"
         )
         print(f"""cc-ci orchestrator launcher
 

cc-ci-plan/launch.py

@@ -327,7 +327,7 @@ def start_agent(role, session, workdir):
             f"NO_COLOR=1 {OPENCODE_BIN} attach {OPENCODE_SERVER} --dir {session_cwd}"
         )
         log(f"starting {session} (backend=opencode, phase={pid}, model={model or 'default'})")
-        log(f"  visible at http://oc.commoninternet.net (tailnet only)")
+        log(f"  visible at https://oc.ci.commoninternet.net")
     else:
         die(f"unknown BACKEND '{BACKEND}' — set LOOP_BACKEND=claude or LOOP_BACKEND=opencode")