feat: add custom Dockerfile with Hermes adapter baked in

Creates ai/paperclip/ with:
- Dockerfile: extends upstream paperclip image, pre-installs
  hermes-paperclip-adapter@0.3.0 npm package as seed data
- docker-entrypoint.sh: seeds the adapter plugin on first boot
  if the persistent volume is empty, then runs original startup

This ensures the Hermes adapter is available on first boot without
requiring network access — no npm install needed at runtime. The
adapter persists on the Docker volume across restarts.

ai/compose.yml

@@ -32,7 +32,7 @@ services:
         - default
     container_name: hermes
     entrypoint: ["/bin/bash", "-c",
-      "bash /opt/data/hermes-tools/install.sh && . /opt/hermes/.venv/bin/activate && uv pip install openai 'mautrix[encryption]' -q && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
+      "bash /opt/data/hermes-tools/install.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
       "hermes-entrypoint"]
     restart: always
     # Gateway run enables the internal API server on port 8642
@@ -54,12 +54,6 @@ services:
       - TZ=America/Montreal
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
-      # Syncthing-shared org files — read-only view of user's agenda
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
-      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
-      # Persist Python venv across container recreation (Matrix bridge deps, etc.)
-      - /mnt/HoardingCow_docker_data/Hermes/venv:/opt/hermes/.venv
     devices:
       - /dev/kfd:/dev/kfd
       - /dev/dri:/dev/dri
@@ -68,37 +62,6 @@ services:
       - "26"
     networks:
       - ai_backend
-    depends_on:
-      - honcho
-
-  syncthing:
-    image: syncthing/syncthing:latest
-    container_name: syncthing
-    hostname: syncthing
-    restart: always
-    ports:
-      - "8384:8384"
-      - "22000:22000"
-      - "21027:21027/udp"
-    environment:
-      - TZ=America/Montreal
-    volumes:
-      - /mnt/HoardingCow_docker_data/Syncthing/config:/var/syncthing/config
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/telos-ro
-      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/telos-rw
-    networks:
-      - ai_backend
-      - ai_net
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
-      - "traefik.http.routers.syncthing-http.entrypoints=web"
-      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
-      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
-      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
-      - "traefik.http.routers.syncthing-https.tls=true"
-      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
-      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
 
   ollama:
     build:
@@ -133,65 +96,61 @@ services:
       - "303"
       - "26"
 
-  # --- Honcho: AI-native user modeling ---
-  honcho:
-    build: ./honcho
-    container_name: honcho
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:8000:8000"
+  paperclip-db:
+    image: postgres:17-alpine
+    container_name: paperclip-db
+    restart: always
     environment:
-      - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
-      - CACHE_URL=redis://honcho-redis:6379/0
-      - CACHE_ENABLED=true
+      POSTGRES_USER: paperclip
+      POSTGRES_PASSWORD: ${PAPERCLIP_DB_PASSWORD:?PAPERCLIP_DB_PASSWORD must be set}
+      POSTGRES_DB: paperclip
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U paperclip -d paperclip"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
     volumes:
-      - /mnt/HoardingCow_docker_data/Honcho/data:/app/data
+      - /mnt/HoardingCow_docker_data/Paperclip/pgdata:/var/lib/postgresql/data
     networks:
       - ai_backend
+
+  paperclip:
+    build:
+      context: ./paperclip
+    container_name: paperclip
+    restart: always
+    ports:
+      - "127.0.0.1:3100:3100"
+    environment:
+      - HOST=0.0.0.0
+      - PORT=3100
+      - SERVE_UI=true
+      - DATABASE_URL=postgres://paperclip:${PAPERCLIP_DB_PASSWORD}@paperclip-db:5432/paperclip
+      - BETTER_AUTH_SECRET=${PAPERCLIP_AUTH_SECRET:?PAPERCLIP_AUTH_SECRET must be set}
+      - PAPERCLIP_PUBLIC_URL=https://paperclip.lazyworkhorse.net
+      - PAPERCLIP_DEPLOYMENT_MODE=authenticated
+      - PAPERCLIP_DEPLOYMENT_EXPOSURE=private
+    volumes:
+      - /mnt/HoardingCow_docker_data/Paperclip/data:/paperclip
     depends_on:
-      honcho-db:
+      paperclip-db:
         condition: service_healthy
-      honcho-redis:
-        condition: service_healthy
-
-  honcho-db:
-    image: pgvector/pgvector:pg15
-    container_name: honcho-db
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:5432:5432"
-    command: ["postgres", "-c", "max_connections=200"]
-    environment:
-      - POSTGRES_DB=honcho
-      - POSTGRES_USER=honcho
-      - POSTGRES_PASSWORD=honcho_pass
-      - PGDATA=/var/lib/postgresql/data/pgdata
-    volumes:
-      - /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data
-      - ./honcho/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
     networks:
+      - ai_net
       - ai_backend
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U honcho -d honcho"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
+    labels:
+      - "traefik.enable=true"
 
-  honcho-redis:
-    image: redis:8
-    container_name: honcho-redis
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:6379:6379"
-    volumes:
-      - /mnt/HoardingCow_docker_data/Honcho/redis:/data
-    networks:
-      - ai_backend
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
+      - "traefik.http.routers.paperclip-http.rule=Host(`paperclip.lazyworkhorse.net`)"
+      - "traefik.http.routers.paperclip-http.entrypoints=web"
+      - "traefik.http.routers.paperclip-http.middlewares=redirect-to-https"
+
+      - "traefik.http.routers.paperclip-https.rule=Host(`paperclip.lazyworkhorse.net`)"
+      - "traefik.http.routers.paperclip-https.entrypoints=websecure"
+      - "traefik.http.routers.paperclip-https.tls=true"
+      - "traefik.http.routers.paperclip-https.tls.certresolver=njalla"
+
+      - "traefik.http.services.paperclip.loadbalancer.server.port=3100"
 
 networks:
   ai_net:

ai/hermes/Dockerfile

@@ -48,14 +48,6 @@ RUN apt-get update && \
 # ---------- UV ----------
 COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/
 
-WORKDIR /opt/hermes
-
-# ---------- Memory provider dependencies ----------
-# httpx: HTTP client for OpenViking plugin
-# honcho-ai: already installed in upstream image (v2.1.1+)
-RUN . /opt/hermes/.venv/bin/activate && \
-    uv pip install --no-cache-dir httpx
-
 # ---------- Piper TTS ----------
 RUN . /opt/hermes/.venv/bin/activate && \
     uv pip install --no-cache-dir piper-tts sounddevice numpy && \

ai/honcho/Dockerfile

@@ -1,42 +0,0 @@
-# build stage — fetches and builds Honcho from source
-# Using buildkit cache mounts for speed across rebuilds
-FROM python:3.13-slim-bookworm AS builder
-
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends git && \
-    rm -rf /var/lib/apt/lists/*
-
-COPY --from=ghcr.io/astral-sh/uv:0.9.24 /uv /bin/uv
-
-# Clone Honcho at a pinned commit for reproducibility
-ARG HONCHO_REPO=https://github.com/plastic-labs/honcho
-ARG HONCHO_REF=main
-RUN git clone --depth 1 --branch ${HONCHO_REF} ${HONCHO_REPO} /app
-
-WORKDIR /app
-
-ENV UV_COMPILE_BYTECODE=1
-ENV UV_LINK_MODE=copy
-
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --frozen --no-group dev
-
-# --- runtime stage ---
-FROM python:3.13-slim-bookworm
-
-RUN groupadd --system app && \
-    useradd --system --gid app --create-home app
-
-COPY --from=builder /app /app
-COPY --from=builder /root/.cache/uv /root/.cache/uv
-
-WORKDIR /app
-ENV PATH="/app/.venv/bin:$PATH"
-ENV HOME=/app
-
-COPY --chown=app:app config.toml /app/config.toml
-
-USER app
-EXPOSE 8000
-
-CMD ["fastapi", "run", "--host", "0.0.0.0", "src/main.py"]

ai/honcho/config.toml

@@ -1,117 +0,0 @@
-[app]
-LOG_LEVEL = "INFO"
-MAX_MESSAGE_SIZE = 25000
-EMBED_MESSAGES = true
-NAMESPACE = "honcho"
-
-[db]
-CONNECTION_URI = "postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho"
-SCHEMA = "public"
-POOL_SIZE = 10
-MAX_OVERFLOW = 20
-
-[auth]
-USE_AUTH = false
-
-[sentry]
-ENABLED = false
-
-[telemetry]
-ENABLED = false
-
-[webhook]
-ENABLED = false
-
-[cache]
-ENABLED = true
-URL = "redis://honcho-redis:6379/0"
-
-[llm]
-DEFAULT_MAX_TOKENS = 4096
-
-# Embeddings via Ollama (nomic-embed-text recommended on this system)
-[embedding]
-VECTOR_DIMENSIONS = 768
-MAX_INPUT_TOKENS = 8192
-
-[embedding.model_config]
-transport = "openai"
-model = "nomic-embed-text"
-base_url = "http://ollama:11434/v1"
-
-# --- Deriver (user representation builder) ---
-[deriver]
-ENABLED = true
-WORKERS = 1
-POLLING_SLEEP_INTERVAL_SECONDS = 5.0
-FLUSH_ENABLED = true
-
-[deriver.model_config]
-transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
-
-# --- Dialectic ---
-[dialectic]
-MAX_INPUT_TOKENS = 4096
-SESSION_HISTORY_MAX_TOKENS = 8192
-
-[dialectic.levels.minimal]
-MAX_TOOL_ITERATIONS = 1
-MAX_OUTPUT_TOKENS = 512
-[dialectic.levels.minimal.model_config]
-transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
-
-[dialectic.levels.low]
-MAX_TOOL_ITERATIONS = 3
-[dialectic.levels.low.model_config]
-transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
-
-[dialectic.levels.medium]
-MAX_TOOL_ITERATIONS = 2
-[dialectic.levels.medium.model_config]
-transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
-
-[dialectic.levels.high]
-MAX_TOOL_ITERATIONS = 4
-[dialectic.levels.high.model_config]
-transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
-
-[dialectic.levels.max]
-MAX_TOOL_ITERATIONS = 10
-[dialectic.levels.max.model_config]
-transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
-
-# --- Summary ---
-[summary]
-ENABLED = true
-MESSAGES_PER_SHORT_SUMMARY = 20
-MESSAGES_PER_LONG_SUMMARY = 60
-
-[summary.model_config]
-transport = "openai"
-model = "hermes-3"
-base_url = "http://ollama:11434/v1"
-
-# --- Dream ---
-[dream]
-ENABLED = false
-
-# --- Peer Card ---
-[peer_card]
-ENABLED = true
-
-# --- Vector Store ---
-[vector_store]
-TYPE = "pgvector"
-DIMENSIONS = 768

ai/honcho/init-db.sql

@@ -1 +0,0 @@
-CREATE EXTENSION IF NOT EXISTS vector;

ai/paperclip/Dockerfile

@@ -0,0 +1,47 @@
+# syntax=docker/dockerfile:1.20
+FROM ghcr.io/paperclipai/paperclip:v2026.517.0
+
+# ── Install Hermes adapter npm package into seed directory ──────────
+# This seed data gets copied to the persistent volume on first boot
+# so the adapter is available without network access.
+USER root
+
+RUN npm install --no-save --prefix /opt/paperclip-seed/adapter-plugins \
+    hermes-paperclip-adapter@0.3.0
+
+# Create adapter-plugins.json metadata (Paperclip reads this on startup
+# to discover which external adapters to load)
+RUN mkdir -p /opt/paperclip-seed && python3 -c "
+import json
+record = {
+    'packageName': 'hermes-paperclip-adapter',
+    'version': '0.3.0',
+    'type': 'hermes',
+    'installedAt': '2026-05-18T00:00:00.000Z',
+}
+with open('/opt/paperclip-seed/adapter-plugins.json', 'w') as f:
+    json.dump([record], f, indent=2)
+"
+
+# Ensure the adapter-plugins dir has a package.json (Paperclip expects one)
+RUN python3 -c "
+import json
+pkg = {
+    'name': 'paperclip-adapter-plugins',
+    'version': '0.0.0',
+    'private': True,
+    'description': 'Managed directory for Paperclip external adapter plugins.',
+}
+with open('/opt/paperclip-seed/adapter-plugins/package.json', 'w') as f:
+    json.dump(pkg, f, indent=2)
+"
+
+# ── Custom entrypoint ──────────────────────────────────────────────
+# Seeds the Hermes adapter on fresh volumes, then runs original logic.
+COPY docker-entrypoint.sh /usr/local/bin/paperclip-entrypoint.sh
+RUN chmod +x /usr/local/bin/paperclip-entrypoint.sh
+
+USER node
+
+ENTRYPOINT ["/usr/local/bin/paperclip-entrypoint.sh"]
+CMD ["node", "--import", "./server/node_modules/tsx/dist/loader.mjs", "server/dist/index.js"]

ai/paperclip/docker-entrypoint.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -e
+
+# ── Seed Hermes adapter if volume is fresh ──────────────────────────
+PAPERCLIP_HOME="${PAPERCLIP_HOME:-/paperclip}"
+if [ ! -f "${PAPERCLIP_HOME}/adapter-plugins.json" ]; then
+    echo "[paperclip] Seeding Hermes adapter plugin..."
+    cp -r /opt/paperclip-seed/* "${PAPERCLIP_HOME}/"
+    chown -R "${USER_UID:-1000}:${USER_GID:-1000}" \
+        "${PAPERCLIP_HOME}/adapter-plugins" \
+        "${PAPERCLIP_HOME}/adapter-plugins.json"
+    echo "[paperclip] Hermes adapter seeded. Ready to create Hermes agents."
+fi
+
+# ── Original entrypoint logic (UID/GID adjustment) ──────────────────
+PUID="${USER_UID:-1000}"
+PGID="${USER_GID:-1000}"
+changed=0
+
+if [ "$(id -u node)" -ne "$PUID" ]; then
+    usermod -o -u "$PUID" node
+    changed=1
+fi
+
+if [ "$(id -g node)" -ne "$PGID" ]; then
+    groupmod -o -g "$PGID" node
+    usermod -g "$PGID" node
+    changed=1
+fi
+
+if [ "$changed" = "1" ]; then
+    chown -R node:node "${PAPERCLIP_HOME}"
+fi
+
+exec gosu node "$@"