Refs #83
The first vendor-cloud chat row in agent/models.yml. The provider label is the
bare word `deepseek` because pi-catalog/src/hosts.ts keys the direct-DeepSeek
behaviour set (max_tokens field, thinking extraBody, thinking-disable mode) off
that exact name and off api.deepseek.com; the house `<api> (<host>)` pattern
would not match and the row would lose the quirks the endpoint answers to.
The key is command-backed (`!cat ~/.config/secrets/deepseek_api_key`, 600), so
no sk-… value enters the tracked tree, and the row declares the model card's own
pair: contextWindow 1048576 / maxTokens 262144, input [text, image], with the
October 2026 peak rate card in cost. Docs move to the new
omp-docs/core/deepseek-provider.md, indexed and logged in the same commit.
Live probe against frank-archon (212,916-char archive, 8 planted facts):
auto shape 8on22-bw reads back 8/8 recall at 47% of raw-text billed
tokens; both denser grids drop characters. Lands the docs for the paired
live-config changes (thresholdPercent 95->85, imageCountBudget 16) and
records the catalog-only frame-pricing law (radiance ~2,400 tok/frame vs
the harness's blind 5,024 floor).
Refs #81
Every provider in agent/models.yml is a LAN address, so a workstation that
leaves the house has no model at all. Add `openwebui (franksdank.cloud)`:
the already-public OpenWebUI vhost as an OpenAI-compatible provider that
proxies the same engines, with frank-dragoon and frank-zealot rows and the
WAN row as its own compaction target. LAN rows, modelRoles and the speech
runner stay untouched — the door is purely additive.
The key is command-backed (`apiKey: "!cat ~/.config/secrets/openwebui_api_key"`,
mode 600) instead of inline: a literal sk-... in a tracked file is a key in
every agent context on every box that pulls this repo, and the pre-commit
shape gate would block it anyway. Rotate = rewrite the file + restart omp,
because a `!cmd` value is cached for the process lifetime.
Compat blocks copy their LAN twins because the proxy was probed, not assumed
(2026-10-21): streaming SSE carries reasoning_content and tool_calls deltas
plus final usage, image_url content parts reach both vision towers, and
chat_template_kwargs is forwarded — proven on frank-zealot, where
enable_thinking false yields zero reasoning and true a real block.
frank-archon gets no WAN row: OpenWebUI answers 400 "Model not found"
because its picker never published it, so that path is a fleet change.
Verified end-to-end from a scratch HOME whose LAN baseUrls point at a dead
port, so any answer can only have come through the door (text and a real
tool round-trip); `omp models` still lists all four chat providers and the
tts runner, so the file validates. bats 137/137, kb-lint clean.
Docs: omp-docs/core/wan-model-access.md.
The audit's vulnerability clusters are now filed on Gitea as
dank/command-center#67..#77, one issue per host-and-package cluster. Link
them from omp-docs/reports/index.md and record the PR/issue references on
the matching log.md entry, so a reader of the audit can find the open work
without leaving the bundle.
Fold the Dankclaw and Dankserver vulnerability passes into
fleet-security-audit-2026-10-21.html: the stub "Advisory cross-reference (in
progress)" section becomes the full matrix (host advisories, GHSA coverage,
image-vulnerability matrix, no-advisory census, observed-without-credentials
rows for the two livingroom hosts) and the header links the two working files,
which move into omp-docs/reports/ with an index of their own.
Correct three figures the audit had wrong, all found by re-probing: the
mutable-tag census (17 -> 19 Dankclaw manifests / 17 unique references, +4 on
Dankserver), the Dankserver OpenSSH advisory count (0 -> 5 unpatched CVEs; the
first OSV query omitted the version epoch, and OSV answers "0 vulns" rather
than "unknown" for a malformed purl), and the Plex version ("12.1.0" is
Jellyfin's - the live container reports 1.43.5.11029-6bf8af3f0-ls329). Also
repair a malformed <code> tag in F1's evidence cell.
kb-lint and kb-coverage both report 0 issues; index.md gains the Reports
section and log.md the matching entry.
A generated See Also pass left `- ](index.md)` style links on the gitea pages, tools/cachyos.md,
and tools/applications.md. Rendered, an empty-text link is a bullet with nothing clickable in it,
so it reads as a formatting quirk and never as the broken reference it is. All five now name the
page they point at and use the absolute bundle path the spec recommends; the grep that finds them
is recorded in the log so the sweep is repeatable.
Refs #64
The day had three `## 2026-10-21` headings — three logs wearing one date, which is the sprawl the
spec's one-dated-section rule exists to prevent. One date now, one `###` per campaign. `okf-maintenance.md`
states the multi-campaign shape explicitly so nobody has to infer it, and names `AGENTS.md` as the
co-owner of the entry law so an editor changes both.
The new entry records what the dedupe sweep actually taught: an index that restates its own
reference pages becomes the stale authority, and a subagent ledger is a claim until it is re-read
against the file it accuses — most rows returned by the audit fan-out were checkably false, and
half the ledgers never arrived at all. `skills/ecosystem.md` gains the `resource:` frontmatter the
bundle's other externally-sourced pages carry.
Refs #64
The intro carried "388 engine entries" from a 2026-10-19 probe; upstream is at 385 today. The
number moves every week, which makes a precise one a liability in a runbook. The page now states
the size class, names `/config` as the only authority for what an instance loads, and keeps the
fleet's live 262 with today's date.
Refs #64
Frank