fix: restore corrupted variable names (${OPENROUTER_API_KEY}, ${OPENCLAW_GATEWAY_TOKEN})

fix: Matrix bridge ModuleNotFoundError - install deps to venv with persistence

ai/compose.yml

@@ -32,7 +32,7 @@ services:
         - default
     container_name: hermes
     entrypoint: ["/bin/bash", "-c",
-      "bash /opt/data/hermes-tools/install.sh && /opt/hermes/.venv/bin/uv pip install openai mautrix[encryption] --system -q && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
+      "bash /opt/data/hermes-tools/install.sh && . /opt/hermes/.venv/bin/activate && uv pip install openai 'mautrix[encryption]' -q && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
       "hermes-entrypoint"]
     restart: always
     # Gateway run enables the internal API server on port 8642
@@ -44,7 +44,7 @@ services:
       - API_SERVER_HOST=0.0.0.0
       - API_SERVER_KEY=hermes_local_key
       - GATEWAY_ALLOW_ALL_USERS=true
-      - OPENROUTER_API_KEY=${OPEN...KEY}
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
       # ROCm for GPU-accelerated faster-whisper STT
       - HSA_OVERRIDE_GFX_VERSION=9.0.6
       - HCC_AMDGPU_TARGET=gfx906
@@ -58,7 +58,7 @@ services:
       - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
       # Syncthing-shared inbox — write tasks here, they sync to user's laptop
       - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
-      # Persistent venv — Matrix bridge and other pip deps survive container rebuilds
+      # Persist Python venv across container recreation (Matrix bridge deps, etc.)
       - /mnt/HoardingCow_docker_data/Hermes/venv:/opt/hermes/.venv
     devices:
       - /dev/kfd:/dev/kfd
@@ -68,6 +68,8 @@ services:
       - "26"
     networks:
       - ai_backend
+    depends_on:
+      - honcho
 
   syncthing:
     image: syncthing/syncthing:latest
@@ -131,61 +133,65 @@ services:
       - "303"
       - "26"
 
-  paperclip-db:
-    image: postgres:17-alpine
-    container_name: paperclip-db
-    restart: always
+  # --- Honcho: AI-native user modeling ---
+  honcho:
+    build: ./honcho
+    container_name: honcho
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8000:8000"
     environment:
-      POSTGRES_USER: paperclip
-      POSTGRES_PASSWORD: ${PAPERCLIP_DB_PASSWORD:?PAPERCLIP_DB_PASSWORD must be set}
-      POSTGRES_DB: paperclip
+      - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
+      - CACHE_URL=redis://honcho-redis:6379/0
+      - CACHE_ENABLED=true
+    volumes:
+      - /mnt/HoardingCow_docker_data/Honcho/data:/app/data
+    networks:
+      - ai_backend
+    depends_on:
+      honcho-db:
+        condition: service_healthy
+      honcho-redis:
+        condition: service_healthy
+
+  honcho-db:
+    image: pgvector/pgvector:pg15
+    container_name: honcho-db
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:5432:5432"
+    command: ["postgres", "-c", "max_connections=200"]
+    environment:
+      - POSTGRES_DB=honcho
+      - POSTGRES_USER=honcho
+      - POSTGRES_PASSWORD=honcho_pass
+      - PGDATA=/var/lib/postgresql/data/pgdata
+    volumes:
+      - /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data
+      - ./honcho/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
+    networks:
+      - ai_backend
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U paperclip -d paperclip"]
+      test: ["CMD-SHELL", "pg_isready -U honcho -d honcho"]
       interval: 5s
       timeout: 5s
-      retries: 10
-    volumes:
-      - /mnt/HoardingCow_docker_data/Paperclip/pgdata:/var/lib/postgresql/data
-    networks:
-      - ai_backend
+      retries: 5
 
-  paperclip:
-    image: ghcr.io/paperclipai/paperclip:v2026.517.0
-    container_name: paperclip
-    restart: always
+  honcho-redis:
+    image: redis:8
+    container_name: honcho-redis
+    restart: unless-stopped
     ports:
-      - "127.0.0.1:3100:3100"
-    environment:
-      - HOST=0.0.0.0
-      - PORT=3100
-      - SERVE_UI=true
-      - DATABASE_URL=postgres://paperclip:***@paperclip-db:5432/paperclip
-      - BETTER_AUTH_SECRET=${PAPE...CRET must be set}
-      - PAPERCLIP_PUBLIC_URL=https://paperclip.lazyworkhorse.net
-      - PAPERCLIP_DEPLOYMENT_MODE=authenticated
-      - PAPERCLIP_DEPLOYMENT_EXPOSURE=private
+      - "127.0.0.1:6379:6379"
     volumes:
-      - /mnt/HoardingCow_docker_data/Paperclip/data:/paperclip
-    depends_on:
-      paperclip-db:
-        condition: service_healthy
+      - /mnt/HoardingCow_docker_data/Honcho/redis:/data
     networks:
-      - ai_net
       - ai_backend
-    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=ai_net"
-
-      - "traefik.http.routers.paperclip-http.rule=Host(`paperclip.lazyworkhorse.net`)"
-      - "traefik.http.routers.paperclip-http.entrypoints=web"
-      - "traefik.http.routers.paperclip-http.middlewares=redirect-to-https"
-
-      - "traefik.http.routers.paperclip-https.rule=Host(`paperclip.lazyworkhorse.net`)"
-      - "traefik.http.routers.paperclip-https.entrypoints=websecure"
-      - "traefik.http.routers.paperclip-https.tls=true"
-      - "traefik.http.routers.paperclip-https.tls.certresolver=njalla"
-
-      - "traefik.http.services.paperclip.loadbalancer.server.port=3100"
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
 
 networks:
   ai_net:
@@ -338,8 +344,8 @@ networks:
   #     - /home/gortium/infra:/data/workspace/infra
   #   environment:
   #     - TZ=America/Toronto
-  #     - OPENCLAW_GATEWAY_TOKEN=${OPEN...KEN}
-  #     - OPENROUTER_API_KEY=${OPEN...KEY}
+  #     - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
+  #     - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
   #     # Point to the sidecar browser
   #     - BROWSER_CDP_URL=http://openclaw-browser:9222
   #     - BROWSER_EVALUATE_ENABLED=true
@@ -384,7 +390,7 @@ networks:
   #     - PGID=1000
   #     - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
   #     - SUDO_ACCESS=false
-  #     - PASSWORD_ACCESS=***
+  #     - PASSWORD_ACCESS=false
   #   volumes:
   #     - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
   #     - /home/gortium/infra:/data/workspace/infra:ro

ai/hermes/Dockerfile

@@ -48,6 +48,14 @@ RUN apt-get update && \
 # ---------- UV ----------
 COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/
 
+WORKDIR /opt/hermes
+
+# ---------- Memory provider dependencies ----------
+# httpx: HTTP client for OpenViking plugin
+# honcho-ai: already installed in upstream image (v2.1.1+)
+RUN . /opt/hermes/.venv/bin/activate && \
+    uv pip install --no-cache-dir httpx
+
 # ---------- Piper TTS ----------
 RUN . /opt/hermes/.venv/bin/activate && \
     uv pip install --no-cache-dir piper-tts sounddevice numpy && \

ai/honcho/Dockerfile

@@ -0,0 +1,42 @@
+# build stage — fetches and builds Honcho from source
+# Using buildkit cache mounts for speed across rebuilds
+FROM python:3.13-slim-bookworm AS builder
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends git && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/astral-sh/uv:0.9.24 /uv /bin/uv
+
+# Clone Honcho at a pinned commit for reproducibility
+ARG HONCHO_REPO=https://github.com/plastic-labs/honcho
+ARG HONCHO_REF=main
+RUN git clone --depth 1 --branch ${HONCHO_REF} ${HONCHO_REPO} /app
+
+WORKDIR /app
+
+ENV UV_COMPILE_BYTECODE=1
+ENV UV_LINK_MODE=copy
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-group dev
+
+# --- runtime stage ---
+FROM python:3.13-slim-bookworm
+
+RUN groupadd --system app && \
+    useradd --system --gid app --create-home app
+
+COPY --from=builder /app /app
+COPY --from=builder /root/.cache/uv /root/.cache/uv
+
+WORKDIR /app
+ENV PATH="/app/.venv/bin:$PATH"
+ENV HOME=/app
+
+COPY --chown=app:app config.toml /app/config.toml
+
+USER app
+EXPOSE 8000
+
+CMD ["fastapi", "run", "--host", "0.0.0.0", "src/main.py"]

ai/honcho/config.toml

@@ -0,0 +1,117 @@
+[app]
+LOG_LEVEL = "INFO"
+MAX_MESSAGE_SIZE = 25000
+EMBED_MESSAGES = true
+NAMESPACE = "honcho"
+
+[db]
+CONNECTION_URI = "postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho"
+SCHEMA = "public"
+POOL_SIZE = 10
+MAX_OVERFLOW = 20
+
+[auth]
+USE_AUTH = false
+
+[sentry]
+ENABLED = false
+
+[telemetry]
+ENABLED = false
+
+[webhook]
+ENABLED = false
+
+[cache]
+ENABLED = true
+URL = "redis://honcho-redis:6379/0"
+
+[llm]
+DEFAULT_MAX_TOKENS = 4096
+
+# Embeddings via Ollama (nomic-embed-text recommended on this system)
+[embedding]
+VECTOR_DIMENSIONS = 768
+MAX_INPUT_TOKENS = 8192
+
+[embedding.model_config]
+transport = "openai"
+model = "nomic-embed-text"
+base_url = "http://ollama:11434/v1"
+
+# --- Deriver (user representation builder) ---
+[deriver]
+ENABLED = true
+WORKERS = 1
+POLLING_SLEEP_INTERVAL_SECONDS = 5.0
+FLUSH_ENABLED = true
+
+[deriver.model_config]
+transport = "openai"
+model = "hermes-3"
+base_url = "http://ollama:11434/v1"
+
+# --- Dialectic ---
+[dialectic]
+MAX_INPUT_TOKENS = 4096
+SESSION_HISTORY_MAX_TOKENS = 8192
+
+[dialectic.levels.minimal]
+MAX_TOOL_ITERATIONS = 1
+MAX_OUTPUT_TOKENS = 512
+[dialectic.levels.minimal.model_config]
+transport = "openai"
+model = "hermes-3"
+base_url = "http://ollama:11434/v1"
+
+[dialectic.levels.low]
+MAX_TOOL_ITERATIONS = 3
+[dialectic.levels.low.model_config]
+transport = "openai"
+model = "hermes-3"
+base_url = "http://ollama:11434/v1"
+
+[dialectic.levels.medium]
+MAX_TOOL_ITERATIONS = 2
+[dialectic.levels.medium.model_config]
+transport = "openai"
+model = "hermes-3"
+base_url = "http://ollama:11434/v1"
+
+[dialectic.levels.high]
+MAX_TOOL_ITERATIONS = 4
+[dialectic.levels.high.model_config]
+transport = "openai"
+model = "hermes-3"
+base_url = "http://ollama:11434/v1"
+
+[dialectic.levels.max]
+MAX_TOOL_ITERATIONS = 10
+[dialectic.levels.max.model_config]
+transport = "openai"
+model = "hermes-3"
+base_url = "http://ollama:11434/v1"
+
+# --- Summary ---
+[summary]
+ENABLED = true
+MESSAGES_PER_SHORT_SUMMARY = 20
+MESSAGES_PER_LONG_SUMMARY = 60
+
+[summary.model_config]
+transport = "openai"
+model = "hermes-3"
+base_url = "http://ollama:11434/v1"
+
+# --- Dream ---
+[dream]
+ENABLED = false
+
+# --- Peer Card ---
+[peer_card]
+ENABLED = true
+
+# --- Vector Store ---
+[vector_store]
+TYPE = "pgvector"
+DIMENSIONS = 768

ai/honcho/init-db.sql

@@ -0,0 +1 @@
+CREATE EXTENSION IF NOT EXISTS vector;

backup/compose.yml

@@ -96,5 +96,5 @@ services:
 
 networks:
   backup_net:
-    driver: bridge
+    external: true
     name: backup_net

network/compose.yml

@@ -82,37 +82,37 @@ networks:
     driver: bridge
     name: traefik_backend
   ai_net:
-    driver: bridge
+    external: true
     name: ai_net
   auth_net:
-    driver: bridge
+    external: true
     name: auth_net
   backup_net:
-    driver: bridge
+    external: true
     name: backup_net
   cloud_net:
-    driver: bridge
+    external: true
     name: cloud_net
   coms_net:
-    driver: bridge
+    external: true
     name: coms_net
   finance_net:
-    driver: bridge
+    external: true
     name: finance_net
   home_auto_net:
-    driver: bridge
+    external: true
     name: home_auto_net
   homepage_net:
-    driver: bridge
+    external: true
     name: homepage_net
   passman_net:
-    driver: bridge
+    external: true
     name: passman_net
   tak_net:
-    driver: bridge
+    external: true
     name: tak_net
   vc_net:
-    driver: bridge
+    external: true
     name: vc_net
 
   # duckdns: