mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
58dd2e9fa7
Add svc-ai-agent-broker, an OpenAI-compatible endpoint for Open WebUI that serves the models hermes and openclaw. On a user's first prompt it checks the Keycloak group /roles/web-app-<platform>/agent-user, creates that user's own agent under the sandbox runtime, waits for its health endpoint and streams the answer back. A caller without the group gets 403 and any running agent of theirs is stopped. Each agent gets its own container (compose) or single-replica service (swarm), volume, network shared only with the broker, and bearer key. Its image, runtime, limits and mounts are fixed by the broker. An agent that comes up under runc is stopped and refused. The broker reaches the engine only through wollomatic/socket-proxy. The proxy has no network, serves a unix socket in a shared volume, allowlists the calls the broker makes and rejects host bind mounts. Agents hold no model credential. They call the broker's /llm/v1 relay, which forwards to LiteLLM with the broker's virtual key, sets the OpenAI user field to the owner, and logs a relay event with owner, platform, path and upstream status. agents.idle_stop, idle_minutes, max_running, start_timeout and access_cache_seconds in meta/services.yml control the lifecycle. The CLI test covers: - broker-key refusal (401) and RBAC refusal (403 with no container) - two owners getting separate runsc containers, volumes and networks - file and network isolation between them - a model answer relayed for both hermes and openclaw, proven from the relay events so the check does not depend on what the model writes Keycloak membership changes in the test run inside the broker container, because curl will not resolve the .onion Keycloak URL of a Tor deployment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>