fix(honcho): add Ollama Token Auth bridge and JSON fallback #360

Merged

pdurlej merged 1 commit from codex/honcho-ollama-runtime-secret-json-fallback into main

2026-05-18 07:56:25 +02:00

codex commented

2026-05-18 07:51:33 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Honcho's Gemma/Ollama switch needs a durable way to read OLLAMA_CLOUD_API_KEY on RS2000. The key exists in Infisical under /home-platform/providers, but the deploy runner token path must be explicit and testable instead of depending on an interactive Infisical CLI session.

What changed

Added token-auth backend support to write_canary_env.py, including configurable parent/output modes for runtime env files.
Updated Honcho's Ollama/Gemma compatibility smoke so JSON checks can fall back from native response_format to strict plain-prompt JSON when needed.
Documented the RS2000 provider-env render flow and deploy-runner PLATFORMCTL_COMPOSE_ENV_FILE update.
Added contract tests for Token Auth env rendering and JSON fallback behavior.

Why it changed

The first Honcho deploy path failed because the deploy runner's existing Infisical Token Auth access was scoped for Forgejo PAT lookup, not /home-platform/providers. This PR makes the intended provider-secret bridge explicit and keeps the Ollama key out of git, Forgejo variables, Forgejo secrets, and logs.

Files touched

control-plane/platformctl/ci/write_canary_env.py
scripts/honcho/ollama-gemma-compat-smoke.py
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
control-plane/platformctl/tests/test_honcho_ollama_contract.py
runbooks/honcho-ollama-gemma-switch.md
runbooks/forgejo-actions-runner.md
docs/ci/README.md
docs/ci/runner-contract.md
docs/forgejo-agent-operations.md

Relevant context

Honcho LLM-only switch remains separate from BGE-M3 embedding migration.
/home-platform/providers:OLLAMA_CLOUD_API_KEY is the Infisical source of truth.
Runtime env files may need 0640 root:platform-host-agent; canary env files still default to 0600.

Runtime evidence

Local Infisical raw-secret fetch for /home-platform/providers:OLLAMA_CLOUD_API_KEY: HTTP 200, value present, value not printed.
Synthetic Ollama smoke against https://ollama.com/v1 and gemma4:31b-cloud: chat_completion=pass, json_response=pass json_mode=response_format, tool_call=pass.

Known constraints

This does not install or widen the RS2000 Token Auth ACL by itself.
The deploy runner token must have describeSecret + readValue for /home-platform/providers/** in prod before the Honcho deploy can proceed.
No production Honcho service is restarted by this PR.

Explicit out-of-scope

BGE-M3 production switch.
Honcho vector schema/data migration.
Direct production mutation on RS2000.
Storing provider keys in Forgejo repository secrets or variables.

Requested decision

Approve the runtime secret bridge and JSON smoke behavior so the operator can merge, then apply the documented RS2000 Token Auth ACL/env-file step before retrying the Honcho LLM deploy.

Merge blockers

Any secret value printed or committed.
Token Auth backend weakening default canary env permissions.
JSON fallback hiding auth/model/timeout errors instead of failing clearly.

Spec sources read

runbooks/honcho-ollama-gemma-switch.md — target switch procedure.
docs/forgejo-agent-operations.md — Forgejo/Infisical provider-secret rules.
docs/ci/runner-contract.md — runner-local secret bridge contract.
runbooks/forgejo-actions-runner.md — trusted runner env generation flow.
control-plane/platformctl/ci/write_canary_env.py — env-file generator implementation.
scripts/honcho/ollama-gemma-compat-smoke.py — compatibility smoke implementation.
pdurlej/agent-souls practices via Forgejo API — confirmed Token Auth direct Bearer is the canonical non-interactive MVP.

Test Plan

python3 -m py_compile control-plane/platformctl/ci/write_canary_env.py scripts/honcho/ollama-gemma-compat-smoke.py
control-plane/.venv/bin/python -m pytest -q control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_honcho_ollama_contract.py
ruff check control-plane/platformctl/ci/write_canary_env.py scripts/honcho/ollama-gemma-compat-smoke.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_honcho_ollama_contract.py
git diff --check
Local synthetic Ollama smoke through Infisical-fetched key: pass; no secret printed.

Commit: 47e256a

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Honcho's Gemma/Ollama switch needs a durable way to read `OLLAMA_CLOUD_API_KEY` on RS2000. The key exists in Infisical under `/home-platform/providers`, but the deploy runner token path must be explicit and testable instead of depending on an interactive Infisical CLI session. ### What changed - Added `token-auth` backend support to `write_canary_env.py`, including configurable parent/output modes for runtime env files. - Updated Honcho's Ollama/Gemma compatibility smoke so JSON checks can fall back from native `response_format` to strict plain-prompt JSON when needed. - Documented the RS2000 provider-env render flow and deploy-runner `PLATFORMCTL_COMPOSE_ENV_FILE` update. - Added contract tests for Token Auth env rendering and JSON fallback behavior. ### Why it changed The first Honcho deploy path failed because the deploy runner's existing Infisical Token Auth access was scoped for Forgejo PAT lookup, not `/home-platform/providers`. This PR makes the intended provider-secret bridge explicit and keeps the Ollama key out of git, Forgejo variables, Forgejo secrets, and logs. ### Files touched - `control-plane/platformctl/ci/write_canary_env.py` - `scripts/honcho/ollama-gemma-compat-smoke.py` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `control-plane/platformctl/tests/test_honcho_ollama_contract.py` - `runbooks/honcho-ollama-gemma-switch.md` - `runbooks/forgejo-actions-runner.md` - `docs/ci/README.md` - `docs/ci/runner-contract.md` - `docs/forgejo-agent-operations.md` ### Relevant context - Honcho LLM-only switch remains separate from BGE-M3 embedding migration. - `/home-platform/providers:OLLAMA_CLOUD_API_KEY` is the Infisical source of truth. - Runtime env files may need `0640 root:platform-host-agent`; canary env files still default to `0600`. ### Runtime evidence - Local Infisical raw-secret fetch for `/home-platform/providers:OLLAMA_CLOUD_API_KEY`: HTTP 200, value present, value not printed. - Synthetic Ollama smoke against `https://ollama.com/v1` and `gemma4:31b-cloud`: `chat_completion=pass`, `json_response=pass json_mode=response_format`, `tool_call=pass`. ### Known constraints - This does not install or widen the RS2000 Token Auth ACL by itself. - The deploy runner token must have `describeSecret` + `readValue` for `/home-platform/providers/**` in `prod` before the Honcho deploy can proceed. - No production Honcho service is restarted by this PR. ### Explicit out-of-scope - BGE-M3 production switch. - Honcho vector schema/data migration. - Direct production mutation on RS2000. - Storing provider keys in Forgejo repository secrets or variables. ### Requested decision Approve the runtime secret bridge and JSON smoke behavior so the operator can merge, then apply the documented RS2000 Token Auth ACL/env-file step before retrying the Honcho LLM deploy. ### Merge blockers - Any secret value printed or committed. - Token Auth backend weakening default canary env permissions. - JSON fallback hiding auth/model/timeout errors instead of failing clearly. ## Spec sources read - `runbooks/honcho-ollama-gemma-switch.md` — target switch procedure. - `docs/forgejo-agent-operations.md` — Forgejo/Infisical provider-secret rules. - `docs/ci/runner-contract.md` — runner-local secret bridge contract. - `runbooks/forgejo-actions-runner.md` — trusted runner env generation flow. - `control-plane/platformctl/ci/write_canary_env.py` — env-file generator implementation. - `scripts/honcho/ollama-gemma-compat-smoke.py` — compatibility smoke implementation. - `pdurlej/agent-souls` practices via Forgejo API — confirmed Token Auth direct Bearer is the canonical non-interactive MVP. ## Test Plan - `python3 -m py_compile control-plane/platformctl/ci/write_canary_env.py scripts/honcho/ollama-gemma-compat-smoke.py` - `control-plane/.venv/bin/python -m pytest -q control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_honcho_ollama_contract.py` - `ruff check control-plane/platformctl/ci/write_canary_env.py scripts/honcho/ollama-gemma-compat-smoke.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_honcho_ollama_contract.py` - `git diff --check` - Local synthetic Ollama smoke through Infisical-fetched key: pass; no secret printed. Commit: `47e256a`

codex added 1 commit

2026-05-18 07:51:33 +02:00

fix(honcho): add ollama token bridge and json fallback

canary-required / collect-diff (pull_request) Successful in 3s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 17s