recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

launchers: the opencode UI is oc.ci.commoninternet.net (not tailnet-only); journal the key switch

Browse Source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
This commit is contained in:
notplants
2026-09-08 16:53:20 +00:00
co-authored by Claude Opus 5
parent 79f69b0d35
commit c14c56147d
4 changed files with 33 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/JOURNAL.md
+29
View File
@@ -1101,3 +1101,32 @@ generation and restores the lock. One-line outcome in `.cc-ci-logs/auto-update-s
generation, front doors (oc.ci must be 401), sops, fail2ban, all four timers, the orchestrator
agent session, and a secrets-inventory check that flags sprawl. Verdict updated.
Verified against the box: 0 failed units, 10/10 swarm services, disk 33%, all timers armed.
## 2026-09-08 16:55 UTC — cc-ci host moved to the operator's OpenCode **Go** key; extra credentials purged
**The key.** `AUTONOMIC_OPENCODE_KEY` (operator, in `/secrets/files/cc-ci.testenv`) is an OpenCode
**Go subscription** key, not a ZEN one. Installed into the ZEN slot it authenticates but every
request dies `Insufficient balance` (ZEN = pay-as-you-go credit); on the `opencode-go` endpoint the
same key answers immediately. Diagnosis was the operator's — worth remembering as the first thing
to check when an opencode key "does not work".
- `auth.json` (→ `/secrets/files/opencode-auth.json`) now holds **exactly one** provider,
`opencode-go`, carrying that key. The previous ZEN key is deleted; `opencode/glm-5.2` now errors.
- `agents.toml` orchestrator → `opencode-go/glm-5.2`; `upgrader.env` → `LOOP_TIER=go` and
LOOP/REPORT/SUPERVISOR models all `opencode-go/glm-5.2`; cc-ci PR #36 moved the subagent model in
`cc-ci/opencode.json` the same way.
- **Model note:** `opencode-go/deepseek-v4-flash` (what the weekly run used on ZEN) is China-hosted
on the Go tier and returns an opt-in error until the operator enables it at
`https://opencode.ai/workspace/wrk_01M20RVAY3D3B28XAYY1Z2Q6AZ/go`. `glm-5.2` is used meanwhile.
- Verified: `opencode-go/glm-5.2` answers, the orchestrator agent restarted on it, ZEN gone.
**Purged while there** (same "only what cc-ci strictly needs" rule): `auth.json` had also carried
`openai` (oauth), `opencode-go` (old) and `infomaniak` credentials copied from the notplants box,
and `~/.config/opencode/opencode.jsonc` carried a **Tinfoil API key inline in plaintext**. All
removed; the config is now a 4-line file with no `apiKey` anywhere. That Tinfoil key still lives in
the notplants-orchestrator config it came from — **operator: consider rotating it**, since it was
briefly present on a second host.
**Also:** `vim`/`vi` (absent, the operator hit it over ssh), `sqlite`, `bat`, `bc`, `moreutils`,
`pv`, `man-pages` added to the host toolbox with `EDITOR=vim`; on PATH for root and loops.
Stale `oc.commoninternet.net` URLs in the launchers → `oc.ci.commoninternet.net`.