Every manual launch of launch-report/launch-upgrader bypasses the systemd EnvironmentFile (/srv/cc-ci/upgrader.env sets LOOP_TIER=go + the go models) and fell back to hardcoded zen defaults, which die instantly here (ProviderModelNotFoundError: opencode/glm-5.2 — the host holds no ZEN key and zen models vanished from the provider catalogue, 2026-09-14). This crashed the 2026-09-11 report agent at launch and again on every manual retry.
- launch-upgrader.py + launch-report.py: default TIER go, go-tier model default glm-5.3-flash (mirrors the 2026-09-08 operator choice in upgrader.env); zen stays an explicit opt-in on a host with a key.
- launch-supervisor.py: default SUPERVISOR_MODEL glm-5.3-flash.
- docstrings updated to match.
Verified with env -i: bare invocation resolves tier=go, model=opencode-go/glm-5.3-flash on all three. The 2026-09-11 weekly report is published live (report.ci.commoninternet.net/week-2026-09-11.html) after a fresh glm-5.3-flash report run.
Operator rule: secrets live in /secrets and consumers reach them from there.
Three subdirectories with the ownership each consumer needs — files/ (loops),
host/ (root: ssh host keys + sops age identity), nginx/ (root:nginx: the
opencode UI htpasswd) — under a 0711 /secrets so nginx can traverse to its own
without the directory being listable.
sshd's hostKeys and sops-nix's sshKeyPaths/keyFile are pointed at /secrets
DIRECTLY rather than through symlinks: the ed25519 host key is load-bearing
beyond ssh, since its age identity (age1tmvg…) is a recipient of cc-ci-secrets,
and a dangling symlink would let sshd write a NEW key and silently make every
cc-ci secret undecryptable. The /etc/ssh symlinks are added for discoverability
only, so nothing depends on activation ordering.
nginx's htpasswd path becomes an option (opencodeUiHtpasswdFile) defaulting
under /secrets, rather than a hard-coded /etc/nginx path.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
The operator's AUTONOMIC_OPENCODE_KEY is a Go subscription key. Put in the
`opencode` (ZEN) slot it authenticates but every request fails "Insufficient
balance", because ZEN is pay-as-you-go credit; on the `opencode-go` endpoint
the same key answers fine. So the orchestrator agent moves to
opencode-go/glm-5.2, and README records that this host is a Go host and that
its opencode config must carry no inline apiKey.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
`vi` and `vim` were both absent on the cc-ci host (operator hit it over ssh);
the vim package ships a `vi` binary, so one entry covers both names, and
EDITOR=vim makes git/systemctl/visudo open something that exists.
sqlite earns its place beyond convenience: Drone's build and step logs live in
its sqlite volume, and the runbook plus /cc-ci-status tell you to read them
there — until now every such check needed an ad-hoc `nix-shell -p sqlite`.
Installed via environment.systemPackages, so they are on PATH for BOTH root and
loops through /run/current-system/sw/bin.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
autonomic-bot
loops
autonomic-bot
nptest2
notplants
cc-ci-orchestrator
auto-update