agent: repoint FLM-NPU model roles off the retired provider; sync memory/skills

config.yml: vision -> llamacpp (dankclaw)/frank-large:auto, tiny -> llamacpp (dankserver)/frank-small:off, task -> llamacpp (dankclaw)/frank-large:medium (was flm dankclaw-npu), matching the flm (dankclaw-npu) provider removal in models.yml. Memories/managed skills: rollouts and learned notes from the frank-large KV-pool + sampler work and the noctalia recolor; merged the duplicate noctalia-palette-recolor skill into noctalia-custom-palette-recolor (adds the dotfiles-tracking step and the +show-config delta gotcha) and dropped the superseded legacy memory skills whose ghostty USR1 reload recipe is wrong for this fleet.
2026-09-13 23:51:43 -07:00
1 parent c32584e093
commit 872e86399a
@@ -0,0 +1,17 @@
+# frank-large Operations
+Deployed as rootless Quadlet on dankclaw. ~68 GiB weights + 14.4 GiB KV pool (524k positions, 3 slots). Total ~103.4 GiB.
+## Ports
+- Engine: :8730 (loopback)
+- Front-end: :8731
+- Published: :7770
+## Logging & Env
+- `podman logs frank-large` / `journalctl --user -u frank-large`
+- Avoid `TEMP`, `HOST`, `GPU_MAX_HEAP_SIZE` (HIP bare TEMP)
+## Sampling & API
+- Large: greedy | Small: sampling (temp=1.0, top_k=20, top_p=0.95)
+- Small determinism: `temperature: 0` or `--sampling-defaults none`
+- `preserve_thinking`: client-side per-request (`chat_template_kwargs`)
+- `max_tokens: 200` w/ empty content = thinking consumed budget
+- File-cache shortage → uninterruptible sleep. `host_reserve_gib=24` protects n-gram table.
+## Tests
+- 285/286 pass (test 73 comfyui bug). `pyyaml` missing on system py3; `uv` available.
@@ -0,0 +1,5 @@
+{
+  "model": "frank-small",
+  "temperature": 0,
+  "chat_template_kwargs": {"preserve_thinking": true}
+}
@@ -0,0 +1,6 @@
+#!/bin/bash
+# Verify KV pool slots and memory stability
+docker inspect frank-large --format '{{.Config.Env}}'
+podman logs frank-large 2>&1 | grep -E '^(dmalloc|kv pool):'
+echo "Slots: HALOGEN_KV_SLOTS"
+echo "Memory: ~103.4 GiB (68W + 14.4KV + 21W)"
@@ -0,0 +1,6 @@
+[Service]
+ExecStart=/usr/bin/podman run ...
+Environment=TEMP=...
+Environment=HALOGEN_KV_SLOTS=3
+[Install]
+WantedBy=default.target
@@ -1,17 +0,0 @@
-Rootless Quadlet service 'frank-large' on dankclaw.
-
-Ports:
- Engine: :8730 (loopback, unauth)
- Front-end: :8731
- Published: :7770
-
-Constraints:
- Weights: Pinned (~68 GiB)
- Env Vars: Avoid TEMP, HOST, GPU_MAX_HEAP_SIZE (HIP runtime issue)
-
-Logging:
- Use podman logs or journalctl.
-
-Test Env:
- pyyaml missing, uv available, pip missing.
- Failures likely pre-existing.
@@ -1,11 +0,0 @@
-#!/bin/bash
-# Retrieve logs for frank-large service
-
-# Full logs
-podman logs frank-large
-
-# Filtered logs
-podman logs frank-large 2>&1 | grep -E '^(dmalloc|kv pool):'
-
-# Journald logs
-journalctl --user -u frank-large
@@ -0,0 +1,12 @@
+# Marreta & Authentik Deployment
+Podman compose on dankclaw. Shares gluetun egress with searxng.
+## Guard Chain
+Caddy TLS → Anubis (:8923) → Authentik outpost → internal :8017 → marreta
+## Auth Fix & Pitfalls
+- Login-wall caused by null `ProxyProvider.application` & flows crashing Rust outpost.
+- Fix: Link `Application(slug=marreta)`, populate auth/authz/invalidation flows.
+- Probe: `localhost:8017` returns HTTP 000 (Caddy netns). Use internal probe or grep config.
+- Non-browser clients fail JS challenges. Audit service-to-service URLs for public guarded hostnames.
+- Exempt: IdP, Gitea (git smart-HTTP), self-auth services.
+## Verification
+- E2E: `tests/e2e/specs/16-marreta.spec.ts` asserts homepage tile passes guard chain.
@@ -0,0 +1,2 @@
+Run: npx playwright test tests/e2e/specs/16-marreta.spec.ts
+Assert: Homepage tile passes Anubis/ProxyProvider guard chain without login-wall parking.
@@ -0,0 +1,5 @@
+#!/bin/bash
+# Health check through netns
+podman exec marreta_caddy wget -qO- http://localhost:8017/ || echo "HTTP 000 expected"
+# Grep config for route flip
+cat /etc/caddy/config.json | grep "reverse_proxy"
@@ -0,0 +1,8 @@
+application:
+  name: Marreta
+  slug: marreta
+  provider: marreta-proxy
+flows:
+  authentication: enabled
+  authorization: enabled
+  invalidation: enabled