autonomic-bot
a0d6fc9417
The weekly /upgrade-all parent session and the /recipe-report session now run on tinfoil/deepseek-v4-pro (LOOP_MODEL + REPORT_MODEL in upgrader.env). The hourly supervisor stays on opencode-go/glm-5.2 (SUPERVISOR_MODEL default in launch-supervisor.py, not overridden). Subagents already bind deepseek via the cc-ci repo's opencode config (fix from 2026-08-10, verified this week: all 16 subagents across both waves ran deepseek-v4-pro). LOOP_TIER=zen is kept so the tier check passes; the watchdog's usage-limit probe sends the deepseek model name to the zen endpoint, which returns 200 (not 429) → resume immediately — correct, since tinfoil has no rolling usage limit to wait out. Verified the probe behaviour with a direct curl. Root cause: the 2026-08-14 run stalled mid-recipe on 'Insufficient balance' (opencode zen workspace balance exhausted), then sat unfinished for 40h while the supervisor cron spun hourly unable to recover it. Deepseek (pay-per-use API key) has no rolling balance limit, so this can't recur. Also documents the session recovery in JOURNAL.md (the stalled run was completed via a fresh scoped upgrader — the original 2.58M-token session was unresumable: the inference endpoint silently drops the oversized request).
cc-ci-orchestrator
⚠️ HISTORICAL. This README describes the retired Incus VM (
100.116.55.106). The orchestrator now runs on Hetzner — the live host config isnix/hosts/cc-ci-orchestrator-hetzner/configuration.nix. Seecc-ci-plan/plan-orchestrator-hetzner-migration.mdfor the current setup. Kept for history.
NixOS config for the cc-ci-orchestrator Incus VM (b1, project terraform-ci, tailnet
100.116.55.106) — the reboot-resilient host for the cc-ci Builder/Adversary loops + watchdog +
orchestrator session, moved off the unstable 905 MiB Pi.
See cc-ci-plan/plan-orchestrator-migration.md for the full migration.
Files
configuration.nix— the VM's NixOS config (channel-based,nixos-24.11). Deployed to/etc/nixos/configuration.nixon the VM. Provides: nix-ld (so the standalone Claude Code Bun binary runs), tmux/git/python/jq + tools, a 4 GB swapfile, direct ssh to cc-ci (the VM is a tailnet peer — no SOCKS proxy needed, unlike the Pi), an idempotentclaude-installoneshot, and thecc-ci-loopssupervisor service (defined, enabled in Phase D once the workspace is staged).
Deploy (until this is wired to a flake/auto-pull)
# copy configuration.nix to the VM, then:
ssh cc-ci-orchestrator 'nixos-rebuild switch' # or run detached: see below
Over the (currently flaky) Pi→VM link, run the rebuild detached on the VM so an ssh/proxy drop
doesn't abort it, e.g. systemd-run --unit=orch-rebuild --collect nixos-rebuild switch then poll
journalctl -u orch-rebuild.
Status
- Phase A: VM created (2 GB / 2 vCPU / 30 GB), on tailnet, ssh-able. ✅
- Phase B: this config (DRAFT) — nix-ld/claude validation pending on the VM.
- Operator step pending (Phase C):
claude auth loginon the VM (device-code; can't be scripted). - Secrets to stage (Phase C, out-of-band):
/srv/cc-ci/.testenv,~/.ssh/cc-ci-root-ed25519, Incus mTLS certs, the sops master age key.