Refs #79 — opened retroactively; the commit was written first, so the message has no Refs line.
What. One additive provider in agent/models.yml: openwebui (franksdank.cloud) → https://ai.franksdank.cloud/api/v1, openai-completions, with frank-dragoon and frank-zealot. Away from home: omp --model 'openwebui (franksdank.cloud)/frank-dragoon:medium'.
Nothing local moves. LAN rows, modelRoles, compaction.remoteEndpoint, the frank-tts runner row and ~/.omp/agent/models.yml on the live checkout are untouched — 290 insertions, zero deletions. omp models from a scratch HOME still lists all four chat providers plus the tts runner, so the file validates (a failed validation would silently disable every custom provider).
Credential.apiKey: "!cat ~/.config/secrets/openwebui_api_key" — command-backed value (harness resolves !cmd → trimmed stdout, else env-name, else literal), secret in a 600 file like gitea/kagi_api_key. A literal sk-… in a tracked file is a key in every agent context on every box that pulls, and the shape gate would block the commit anyway. Rotation = rewrite the file, then restart omp: !cmd results are cached per process.
Probed through the door 2026-10-21, not assumed:
streaming SSE carries reasoning_content and tool_calls deltas, finish_reason: tool_calls, final usage under stream_options.include_usage;
image_url parts reach both vision towers (64 px red PNG → "Red" from each);
chat_template_kwargs is forwarded — proven on frank-zealot: enable_thinking false → 0 reasoning, true → a real block on the same prompt. That is why the compat blocks are copies of their LAN twins rather than simplifications.
API-key completions create no OpenWebUI chat row (chat list unchanged after probing).
Verification. Real harness runs from a scratch HOME whose LAN baseUrls were rewritten to http://127.0.0.1:9/v1, so no answer could come from home: text on frank-dragoon, and a real bash tool round-trip on frank-zealot, both clean. Server side: OpenWebUI logged 12 POST /api/v1/chat/completions 200s in the window; no fleet state changed. bats tests/ 137/137, kb-lint 0 violations.
Not behind this door.frank-archon — GET /api/v1/models omits it and the API answers 400 "Model not found", because OpenWebUI's picker never published it; a WAN path for it is a Dankclaw change. Speech likewise: OpenWebUI does forward /api/v1/audio/speech to frank-tts:7772 but substitutes its own voice enum first, so a cloned pack name 400s upstream. modelRoles.speech stays on the LAN row.
Docs: omp-docs/core/wan-model-access.md, indexed, with a dated work-log entry.
Refs #79 — opened retroactively; the commit was written first, so the message has no `Refs` line.
**What.** One additive provider in `agent/models.yml`: `openwebui (franksdank.cloud)` → `https://ai.franksdank.cloud/api/v1`, `openai-completions`, with `frank-dragoon` and `frank-zealot`. Away from home: `omp --model 'openwebui (franksdank.cloud)/frank-dragoon:medium'`.
**Nothing local moves.** LAN rows, `modelRoles`, `compaction.remoteEndpoint`, the `frank-tts` runner row and `~/.omp/agent/models.yml` on the live checkout are untouched — 290 insertions, zero deletions. `omp models` from a scratch HOME still lists all four chat providers plus the tts runner, so the file validates (a failed validation would silently disable every custom provider).
**Credential.** `apiKey: "!cat ~/.config/secrets/openwebui_api_key"` — command-backed value (harness resolves `!cmd` → trimmed stdout, else env-name, else literal), secret in a 600 file like `gitea`/`kagi_api_key`. A literal `sk-…` in a tracked file is a key in every agent context on every box that pulls, and the shape gate would block the commit anyway. **Rotation = rewrite the file, then restart omp**: `!cmd` results are cached per process.
**Probed through the door 2026-10-21, not assumed:**
- streaming SSE carries `reasoning_content` and `tool_calls` deltas, `finish_reason: tool_calls`, final `usage` under `stream_options.include_usage`;
- `image_url` parts reach both vision towers (64 px red PNG → "Red" from each);
- `chat_template_kwargs` is forwarded — proven on `frank-zealot`: `enable_thinking` false → 0 reasoning, true → a real block on the same prompt. That is why the compat blocks are copies of their LAN twins rather than simplifications.
- API-key completions create no OpenWebUI chat row (chat list unchanged after probing).
**Verification.** Real harness runs from a scratch HOME whose LAN `baseUrl`s were rewritten to `http://127.0.0.1:9/v1`, so no answer could come from home: text on `frank-dragoon`, and a real bash tool round-trip on `frank-zealot`, both clean. Server side: OpenWebUI logged 12 `POST /api/v1/chat/completions` 200s in the window; no fleet state changed. `bats tests/` 137/137, `kb-lint` 0 violations.
**Not behind this door.** `frank-archon` — `GET /api/v1/models` omits it and the API answers `400 "Model not found"`, because OpenWebUI's picker never published it; a WAN path for it is a Dankclaw change. Speech likewise: OpenWebUI does forward `/api/v1/audio/speech` to `frank-tts:7772` but substitutes its own voice enum first, so a cloned pack name 400s upstream. `modelRoles.speech` stays on the LAN row.
Docs: `omp-docs/core/wan-model-access.md`, indexed, with a dated work-log entry.
Closes #79.
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a160b2-c87c-705b-8c10-b0f23e2d9bee
Every provider in agent/models.yml is a LAN address, so a workstation that
leaves the house has no model at all. Add `openwebui (franksdank.cloud)`:
the already-public OpenWebUI vhost as an OpenAI-compatible provider that
proxies the same engines, with frank-dragoon and frank-zealot rows and the
WAN row as its own compaction target. LAN rows, modelRoles and the speech
runner stay untouched — the door is purely additive.
The key is command-backed (`apiKey: "!cat ~/.config/secrets/openwebui_api_key"`,
mode 600) instead of inline: a literal sk-... in a tracked file is a key in
every agent context on every box that pulls this repo, and the pre-commit
shape gate would block it anyway. Rotate = rewrite the file + restart omp,
because a `!cmd` value is cached for the process lifetime.
Compat blocks copy their LAN twins because the proxy was probed, not assumed
(2026-10-21): streaming SSE carries reasoning_content and tool_calls deltas
plus final usage, image_url content parts reach both vision towers, and
chat_template_kwargs is forwarded — proven on frank-zealot, where
enable_thinking false yields zero reasoning and true a real block.
frank-archon gets no WAN row: OpenWebUI answers 400 "Model not found"
because its picker never published it, so that path is a fleet change.
Verified end-to-end from a scratch HOME whose LAN baseUrls point at a dead
port, so any answer can only have come through the door (text and a real
tool round-trip); `omp models` still lists all four chat providers and the
tts runner, so the file validates. bats 137/137, kb-lint clean.
Docs: omp-docs/core/wan-model-access.md.
dank
merged commit c0d840a8bb into main2026-10-21 16:59:51 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Refs #79 — opened retroactively; the commit was written first, so the message has no
Refsline.What. One additive provider in
agent/models.yml:openwebui (franksdank.cloud)→https://ai.franksdank.cloud/api/v1,openai-completions, withfrank-dragoonandfrank-zealot. Away from home:omp --model 'openwebui (franksdank.cloud)/frank-dragoon:medium'.Nothing local moves. LAN rows,
modelRoles,compaction.remoteEndpoint, thefrank-ttsrunner row and~/.omp/agent/models.ymlon the live checkout are untouched — 290 insertions, zero deletions.omp modelsfrom a scratch HOME still lists all four chat providers plus the tts runner, so the file validates (a failed validation would silently disable every custom provider).Credential.
apiKey: "!cat ~/.config/secrets/openwebui_api_key"— command-backed value (harness resolves!cmd→ trimmed stdout, else env-name, else literal), secret in a 600 file likegitea/kagi_api_key. A literalsk-…in a tracked file is a key in every agent context on every box that pulls, and the shape gate would block the commit anyway. Rotation = rewrite the file, then restart omp:!cmdresults are cached per process.Probed through the door 2026-10-21, not assumed:
reasoning_contentandtool_callsdeltas,finish_reason: tool_calls, finalusageunderstream_options.include_usage;image_urlparts reach both vision towers (64 px red PNG → "Red" from each);chat_template_kwargsis forwarded — proven onfrank-zealot:enable_thinkingfalse → 0 reasoning, true → a real block on the same prompt. That is why the compat blocks are copies of their LAN twins rather than simplifications.Verification. Real harness runs from a scratch HOME whose LAN
baseUrls were rewritten tohttp://127.0.0.1:9/v1, so no answer could come from home: text onfrank-dragoon, and a real bash tool round-trip onfrank-zealot, both clean. Server side: OpenWebUI logged 12POST /api/v1/chat/completions200s in the window; no fleet state changed.bats tests/137/137,kb-lint0 violations.Not behind this door.
frank-archon—GET /api/v1/modelsomits it and the API answers400 "Model not found", because OpenWebUI's picker never published it; a WAN path for it is a Dankclaw change. Speech likewise: OpenWebUI does forward/api/v1/audio/speechtofrank-tts:7772but substitutes its own voice enum first, so a cloned pack name 400s upstream.modelRoles.speechstays on the LAN row.Docs:
omp-docs/core/wan-model-access.md, indexed, with a dated work-log entry.Closes #79.
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a160b2-c87c-705b-8c10-b0f23e2d9bee