fix_embedding_dims_to_1024_match_db

- Update Dockerfile to clone from code.lazyworkhorse.net/Hermes/honcho.git
  (uses build arg HONCHO_REPO, can be overridden at build time)
- Add config.toml volume mount from HoardingCow persistent path
- Use named volume honcho_data instead of host bind mount
- Declare honcho_data as external volume in top-level volumes section

ai/compose.yml

@@ -161,55 +161,52 @@ services:
       - "303"
       - "26"
 
-  # --- Honcho: AI-native user modeling ---
+  # --- Honcho + OpenConcho combiné: API + Web UI nginx/FastAPI ---
   honcho:
-    build: ./honcho
+    build:
+      context: ./honcho
+      ssh:
+        - default
     container_name: honcho
     restart: unless-stopped
-    ports:
-      - "127.0.0.1:8001:8000"
     environment:
       - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
       - CACHE_URL=redis://honcho-redis:6379/0
       - CACHE_ENABLED=true
-      - EMBEDDING_VECTOR_DIMENSIONS=1536
-      - VECTOR_STORE_DIMENSIONS=
+      - EMBEDDING_VECTOR_DIMENSIONS=1024
+      - AUTH_USE_AUTH=true
+      - AUTH_JWT_SECRET=${HONCHO_AUTH_JWT_SECRET}
+      # Needed by deriver/dream to make LLM calls (api_key_env = "HONCHO_OPENAI_API_KEY" in config.toml)
+      - HONCHO_OPENAI_API_KEY=${HONCHO_OPENAI_API_KEY}
     volumes:
-      - /mnt/HoardingCow_docker_data/Honcho/data:/app/data
-    networks:
-      - ai_backend
-      - ai_net
-    depends_on:
-      honcho-db:
-        condition: service_healthy
-      honcho-redis:
-        condition: service_healthy
-
-  # --- OpenConcho: Honcho web UI ---
-  openconcho:
-    build: ./openconcho
-    container_name: openconcho
-    restart: unless-stopped
+      - honcho_data:/app/data
+      - /mnt/HoardingCow_docker_data/Honcho/config.toml:/app/config.toml:ro
     networks:
       - ai_backend
       - ai_net
     labels:
       - "traefik.enable=true"
+      - "traefik.docker.network=ai_net"
 
       # Router for HTTP + redirect to HTTPS
-      - "traefik.http.routers.openconcho-http.rule=Host(`honcho.lazyworkhorse.net`)"
-      - "traefik.http.routers.openconcho-http.entrypoints=web"
-      - "traefik.http.routers.openconcho-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.honcho-http.rule=Host(`honcho.lazyworkhorse.net`)"
+      - "traefik.http.routers.honcho-http.entrypoints=web"
+      - "traefik.http.routers.honcho-http.middlewares=redirect-to-https"
 
       # Router for HTTPS with TLS — protected by Authelia
-      - "traefik.http.routers.openconcho-https.rule=Host(`honcho.lazyworkhorse.net`)"
-      - "traefik.http.routers.openconcho-https.entrypoints=websecure"
-      - "traefik.http.routers.openconcho-https.tls=true"
-      - "traefik.http.routers.openconcho-https.tls.certresolver=njalla"
-      - "traefik.http.routers.openconcho-https.middlewares=hermes-auth"
+      - "traefik.http.routers.honcho-https.rule=Host(`honcho.lazyworkhorse.net`)"
+      - "traefik.http.routers.honcho-https.entrypoints=websecure"
+      - "traefik.http.routers.honcho-https.tls=true"
+      - "traefik.http.routers.honcho-https.tls.certresolver=njalla"
+      - "traefik.http.routers.honcho-https.middlewares=hermes-auth"
 
-      # Service Loadbalancer
-      - "traefik.http.services.openconcho.loadbalancer.server.port=80"
+      # Service Loadbalancer (nginx port)
+      - "traefik.http.services.honcho.loadbalancer.server.port=80"
+    depends_on:
+      honcho-db:
+        condition: service_healthy
+      honcho-redis:
+        condition: service_healthy
 
   honcho-db:
     image: pgvector/pgvector:pg15
@@ -257,6 +254,11 @@ networks:
   ai_backend:
     driver: bridge
     name: ai_backend
+
+volumes:
+  honcho_data:
+    external: true
+    name: honcho_data
     
   # llama_cpp_devstral:
   #   image: ghcr.io/ggml-org/llama.cpp:server-rocm

ai/honcho/Dockerfile

@@ -1,17 +1,16 @@
 # build stage — fetches and builds Honcho from source
-# Using buildkit cache mounts for speed across rebuilds
-FROM python:3.13-slim-bookworm AS builder
+FROM python:3.13-slim-bookworm AS honcho-builder
 
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends git && \
+    apt-get install -y --no-install-recommends git openssh-client && \
     rm -rf /var/lib/apt/lists/*
 
 COPY --from=ghcr.io/astral-sh/uv:0.9.24 /uv /bin/uv
 
-# Clone Honcho at a pinned commit for reproducibility
-ARG HONCHO_REPO=https://github.com/plastic-labs/honcho
+ARG HONCHO_REPO=ssh://git@code.lazyworkhorse.net:2222/Hermes/honcho.git
 ARG HONCHO_REF=main
-RUN git clone --depth 1 --branch ${HONCHO_REF} ${HONCHO_REPO} /app
+RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan -p 2222 code.lazyworkhorse.net >> ~/.ssh/known_hosts 2>/dev/null
+RUN --mount=type=ssh git clone --depth 1 --branch ${HONCHO_REF} ${HONCHO_REPO} /app
 
 WORKDIR /app
 
@@ -21,21 +20,56 @@ ENV UV_PYTHON=/usr/local/bin/python3.13
 
 RUN uv sync --frozen
 
-# --- runtime stage ---
+# build stage — builds OpenConcho SPA
+FROM node:22-bookworm AS openconcho-builder
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+RUN corepack enable && corepack prepare pnpm@latest --activate
+
+WORKDIR /app
+RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+
+ARG OPENCONCHO_SHA=e490d911fcb27ee193558fd9a28856cde2057665
+RUN git clone --depth 1 https://github.com/offendingcommit/openconcho.git /app && \
+    git -C /app fetch --depth 1 origin ${OPENCONCHO_SHA} && \
+    git -C /app checkout ${OPENCONCHO_SHA}
+
+RUN pnpm install --frozen-lockfile
+RUN pnpm --filter @openconcho/web build
+
+# runtime stage — nginx + Honcho FastAPI
 FROM python:3.13-slim-bookworm
 
-RUN groupadd --system app && \
-    useradd --system --gid app --create-home app
+# Install nginx and create runtime dirs before dropping permissions
+RUN apt-get update && apt-get install -y --no-install-recommends nginx && \
+    rm -rf /var/log/nginx/* && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -f /etc/nginx/sites-enabled/default
 
-COPY --from=builder /app /app
+# Patch nginx.conf: comment out "user www-data;" so nginx master stays as root
+# (workers inherit root inside a container — fine for single-service isolation)
+RUN sed -i 's/^user /# user /' /etc/nginx/nginx.conf
 
+# Pre-create nginx runtime directories with proper ownership
+RUN mkdir -p /var/lib/nginx/body /var/lib/nginx/proxy /var/lib/nginx/fastcgi \
+             /var/lib/nginx/uwsgi /var/lib/nginx/scgi /var/lib/nginx/proxy_temp \
+             /var/cache/nginx && \
+    chown -R root:root /var/lib/nginx /var/cache/nginx
+
+# Honcho
+COPY --from=honcho-builder /app /app
 WORKDIR /app
 ENV PATH="/app/.venv/bin:$PATH"
 ENV HOME=/app
+COPY config.toml /app/config.toml
 
-COPY --chown=app:app config.toml /app/config.toml
+# OpenConcho SPA
+COPY --from=openconcho-builder /app/packages/web/dist /usr/share/nginx/html
 
-USER app
-EXPOSE 8000
+# nginx config (proxies /v3/, /v2/ to Honcho on localhost:8000)
+COPY honcho-nginx.conf /etc/nginx/conf.d/default.conf
 
-CMD ["fastapi", "run", "--host", "0.0.0.0", "src/main.py"]
+EXPOSE 80
+
+CMD ["bash", "-c", "nginx -g 'daemon off;' & fastapi run --host 127.0.0.1 --port 8000 src/main.py & python3 -m src.deriver & wait -n"]

ai/honcho/config.toml

@@ -29,17 +29,17 @@ URL = "redis://honcho-redis:6379/0"
 [llm]
 DEFAULT_MAX_TOKENS = 4096
 
-# Embeddings via Ollama (nomic-embed-text recommended on this system)
+# Embeddings via Ollama — bge-m3 provides 1024-dim
 [embedding]
-VECTOR_DIMENSIONS = 768
+VECTOR_DIMENSIONS = 1024
 MAX_INPUT_TOKENS = 8192
 
 [embedding.model_config]
 transport = "openai"
-model = "nomic-embed-text"
-base_url = "http://ollama:11434/v1"
+model = "bge-m3"
+overrides = {base_url = "http://ollama:11434/v1", api_key = "ollama"}
 
-# --- Deriver (user representation builder) ---
+# --- Deriver ---
 [deriver]
 ENABLED = true
 WORKERS = 1
@@ -47,9 +47,9 @@ POLLING_SLEEP_INTERVAL_SECONDS = 5.0
 FLUSH_ENABLED = true
 
 [deriver.model_config]
+overrides = {base_url = "https://opencode.ai/zen/go/v1", api_key_env = "HONCHO_OPENAI_API_KEY"}
 transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
+model = "deepseek-v4-flash"
 
 # --- Dialectic ---
 [dialectic]
@@ -60,37 +60,37 @@ SESSION_HISTORY_MAX_TOKENS = 8192
 MAX_TOOL_ITERATIONS = 1
 MAX_OUTPUT_TOKENS = 512
 [dialectic.levels.minimal.model_config]
+overrides = {base_url = "https://opencode.ai/zen/go/v1", api_key_env = "HONCHO_OPENAI_API_KEY"}
 transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
+model = "deepseek-v4-flash"
 
 [dialectic.levels.low]
 MAX_TOOL_ITERATIONS = 3
 [dialectic.levels.low.model_config]
+overrides = {base_url = "https://opencode.ai/zen/go/v1", api_key_env = "HONCHO_OPENAI_API_KEY"}
 transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
+model = "deepseek-v4-flash"
 
 [dialectic.levels.medium]
 MAX_TOOL_ITERATIONS = 2
 [dialectic.levels.medium.model_config]
+overrides = {base_url = "https://opencode.ai/zen/go/v1", api_key_env = "HONCHO_OPENAI_API_KEY"}
 transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
+model = "deepseek-v4-flash"
 
 [dialectic.levels.high]
 MAX_TOOL_ITERATIONS = 4
 [dialectic.levels.high.model_config]
+overrides = {base_url = "https://opencode.ai/zen/go/v1", api_key_env = "HONCHO_OPENAI_API_KEY"}
 transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
+model = "deepseek-v4-flash"
 
 [dialectic.levels.max]
 MAX_TOOL_ITERATIONS = 10
 [dialectic.levels.max.model_config]
+overrides = {base_url = "https://opencode.ai/zen/go/v1", api_key_env = "HONCHO_OPENAI_API_KEY"}
 transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
+model = "deepseek-v4-flash"
 
 # --- Summary ---
 [summary]
@@ -99,13 +99,28 @@ MESSAGES_PER_SHORT_SUMMARY = 20
 MESSAGES_PER_LONG_SUMMARY = 60
 
 [summary.model_config]
+overrides = {base_url = "https://opencode.ai/zen/go/v1", api_key_env = "HONCHO_OPENAI_API_KEY"}
 transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
+model = "deepseek-v4-flash"
 
 # --- Dream ---
 [dream]
-ENABLED = false
+ENABLED = true
+
+[dream.model_config]
+overrides = {base_url = "https://opencode.ai/zen/go/v1", api_key_env = "HONCHO_OPENAI_API_KEY"}
+transport = "openai"
+model = "deepseek-v4-flash"
+
+[dream.deduction_model_config]
+overrides = {base_url = "https://opencode.ai/zen/go/v1", api_key_env = "HONCHO_OPENAI_API_KEY"}
+transport = "openai"
+model = "deepseek-v4-flash"
+
+[dream.induction_model_config]
+overrides = {base_url = "https://opencode.ai/zen/go/v1", api_key_env = "HONCHO_OPENAI_API_KEY"}
+transport = "openai"
+model = "deepseek-v4-flash"
 
 # --- Peer Card ---
 [peer_card]
@@ -114,4 +129,4 @@ ENABLED = true
 # --- Vector Store ---
 [vector_store]
 TYPE = "pgvector"
-DIMENSIONS = 768
+# DIMENSIONS is deprecated — EMBEDDING.VECTOR_DIMENSIONS is authoritative

ai/honcho/honcho-nginx.conf

@@ -0,0 +1,52 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Honcho API proxy
+    location /v3/ {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /v2/ {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Honcho health
+    location /health {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # OpenAPI docs
+    location /openapi.json {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # SPA: fallback to index.html for client-side routing
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}

ai/openconcho/Dockerfile

@@ -1,23 +0,0 @@
-# build stage
-FROM node:22-bookworm AS builder
-
-ENV PNPM_HOME=/pnpm
-ENV PATH=$PNPM_HOME:$PATH
-RUN corepack enable && corepack prepare pnpm@latest --activate
-
-WORKDIR /app
-RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
-
-ARG OPENCONCHO_SHA=e490d911fcb27ee193558fd9a28856cde2057665
-RUN git clone --depth 1 https://github.com/offendingcommit/openconcho.git /app && \
-    git -C /app fetch --depth 1 origin ${OPENCONCHO_SHA} && \
-    git -C /app checkout ${OPENCONCHO_SHA}
-
-RUN pnpm install --frozen-lockfile
-RUN pnpm --filter @openconcho/web build
-
-# runtime stage
-FROM nginx:alpine
-COPY --from=builder /app/packages/web/dist /usr/share/nginx/html
-EXPOSE 80
-CMD ["nginx", "-g", "daemon off;"]

copy_script.txt

@@ -0,0 +1,7 @@
+import shutil, os
+src = "/opt/data/projects/gortium/compose/ai/compose_updated.txt"
+dst = "/opt/data/projects/gortium/compose/ai/compose.yml"
+print(f"Source exists: {os.path.exists(src)}, size: {os.path.getsize(src)}")
+print(f"Dest exists: {os.path.exists(dst)}")
+shutil.copy2(src, dst)
+print(f"Copied, dest size: {os.path.getsize(dst)}")

entrypoint-combined.sh

@@ -0,0 +1,154 @@
+#!/bin/bash
+# ── Hermes Workspace Combined Entrypoint ──
+# Waits for the Hermes gateway container (hermes:8642) to become healthy,
+# then starts the Hermes Workspace web UI in the foreground.
+# Supports graceful shutdown via SIGTERM/SIGINT.
+# ──────────────────────────────────────────
+
+set -euo pipefail
+
+# ── Configuration ──────────────────────────────────────────────
+GATEWAY_HOST="${GATEWAY_HOST:-hermes}"
+GATEWAY_PORT="${GATEWAY_PORT:-8642}"
+GATEWAY_URL="http://${GATEWAY_HOST}:${GATEWAY_PORT}"
+
+HEALTH_ENDPOINT="${HEALTH_ENDPOINT:-/health}"
+MAX_RETRIES="${HEALTH_MAX_RETRIES:-60}"
+RETRY_INTERVAL="${HEALTH_RETRY_INTERVAL:-2}"
+
+WORKSPACE_DIR="${WORKSPACE_DIR:-/workspace}"
+WORKSPACE_ENTRY="${WORKSPACE_ENTRY:-server-entry.js}"
+
+PID_FILE="${PID_FILE:-/tmp/workspace.pid}"
+
+# ── Logging ────────────────────────────────────────────────────
+log_info()  { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [INFO]  $*"; }
+log_warn()  { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [WARN]  $*"; }
+log_error() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [ERROR] $*"; }
+
+# ── Graceful Shutdown ──────────────────────────────────────────
+_workspace_pid=""
+_shutting_down=false
+
+cleanup() {
+    if [ "$_shutting_down" = true ]; then
+        return
+    fi
+    _shutting_down=true
+
+    log_info "Shutdown signal received, cleaning up..."
+
+    # Stop workspace process if running
+    if [ -n "$_workspace_pid" ] && kill -0 "$_workspace_pid" 2>/dev/null; then
+        log_info "Stopping workspace (PID: $_workspace_pid)..."
+        kill -TERM "$_workspace_pid" 2>/dev/null || true
+
+        # Give it time to shut down gracefully
+        local wait_sec=10
+        while kill -0 "$_workspace_pid" 2>/dev/null && [ "$wait_sec" -gt 0 ]; do
+            sleep 1
+            wait_sec=$((wait_sec - 1))
+        done
+
+        # Force kill if still running
+        if kill -0 "$_workspace_pid" 2>/dev/null; then
+            log_warn "Workspace did not shut down gracefully, force killing..."
+            kill -KILL "$_workspace_pid" 2>/dev/null || true
+        fi
+    fi
+
+    # Clean up PID file
+    [ -f "$PID_FILE" ] && rm -f "$PID_FILE"
+
+    log_info "Shutdown complete."
+    exit 0
+}
+
+# Trap termination signals for graceful shutdown
+trap cleanup SIGTERM SIGINT
+
+# ── Gateway Health Check ───────────────────────────────────────
+wait_for_gateway() {
+    local url="${GATEWAY_URL}${HEALTH_ENDPOINT}"
+    local retries="$MAX_RETRIES"
+    local interval="$RETRY_INTERVAL"
+    local attempt=0
+
+    log_info "Waiting for Hermes gateway at ${GATEWAY_URL}..."
+    log_info "Max retries: ${retries}, interval: ${interval}s"
+
+    while [ "$attempt" -lt "$retries" ]; do
+        attempt=$((attempt + 1))
+
+        if curl -fsS "${url}" >/dev/null 2>&1; then
+            log_info "Gateway is healthy after ${attempt} attempt(s) (${GATEWAY_URL})"
+            return 0
+        fi
+
+        if [ "$attempt" -lt "$retries" ]; then
+            log_info "Gateway not ready yet (attempt ${attempt}/${retries}), retrying in ${interval}s..."
+            sleep "$interval"
+        fi
+    done
+
+    log_error "Gateway did not become healthy after ${retries} attempts (${retries * interval}s)"
+    return 1
+}
+
+# ── Workspace Startup ──────────────────────────────────────────
+start_workspace() {
+    local entry="${WORKSPACE_DIR}/${WORKSPACE_ENTRY}"
+
+    if [ ! -d "$WORKSPACE_DIR" ]; then
+        log_error "Workspace directory not found: ${WORKSPACE_DIR}"
+        return 1
+    fi
+
+    if [ ! -f "$entry" ]; then
+        log_error "Workspace entry point not found: ${entry}"
+        return 1
+    fi
+
+    log_info "Starting Hermes Workspace web UI..."
+    log_info "  Directory: ${WORKSPACE_DIR}"
+    log_info "  Entry:     ${entry}"
+
+    cd "$WORKSPACE_DIR"
+
+    # Start workspace in background so we can trap signals
+    exec node --max-old-space-size=2048 "${entry}" &
+    _workspace_pid=$!
+    echo "$_workspace_pid" > "$PID_FILE"
+
+    log_info "Workspace started (PID: ${_workspace_pid})"
+
+    # Wait for workspace process
+    wait "$_workspace_pid"
+    local exit_code=$?
+
+    log_info "Workspace exited with code ${exit_code}"
+    return "$exit_code"
+}
+
+# ── Main ───────────────────────────────────────────────────────
+main() {
+    log_info "=== Hermes Workspace Combined Entrypoint ==="
+    log_info "Gateway:   ${GATEWAY_URL}"
+    log_info "Workspace: ${WORKSPACE_DIR}/${WORKSPACE_ENTRY}"
+    log_info "PID file:  ${PID_FILE}"
+
+    # Wait for gateway to be healthy
+    if ! wait_for_gateway; then
+        log_warn "Proceeding without confirmed gateway health..."
+    fi
+
+    # Start the workspace
+    start_workspace
+    local exit_code=$?
+
+    log_info "Entrypoint exiting with code ${exit_code}"
+    return "$exit_code"
+}
+
+# Run main; exit with its return code
+main "$@"

replace_compose.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+"""Copy the updated txt file over the original yml file."""
+import shutil
+import os
+
+src = "/opt/data/projects/gortium/compose/ai/compose_updated.txt"
+dst = "/opt/data/projects/gortium/compose/ai/compose.yml"
+
+# Check src exists
+print(f"Source exists: {os.path.exists(src)}")
+print(f"Source size: {os.path.getsize(src)} bytes")
+print(f"Destination exists: {os.path.exists(dst)}")
+
+# Copy
+shutil.copy2(src, dst)
+print(f"Copied {src} -> {dst}")
+print(f"Destination size: {os.path.getsize(dst)} bytes")