Run agents on a Prized box with OpenRouter models

BOX / Prized box terminal (dashboard terminal or prized ssh <box>). Use Bash as the box's login user, not root.
Goal: Node 22.21+, the takibi CLI + skill, the pi agent harness, and (if this agent needs the web) the Composio CLI, all for this user.
1. Node: curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs. node -v must report v22.21.0 or newer (older 22.x ignores NODE_USE_ENV_PROXY, which the worker needs). Stop if it doesn't.
2. CLIs: sudo npm i -g takibibase @earendil-works/pi-coding-agent. takibi --version and pi --version must both print a version.
3. Stop and let the human enter the Takibi key (next step of the guide). Then: mkdir -p ~/.agents/skills && takibi skill --install --force. pi reads skills from ~/.agents/skills; confirm ~/.agents/skills/takibi-use/SKILL.md exists.
4. Gate: takibi projects must list the collection the agent will work on. An empty or unexpected list means the Profile's grants are wrong; stop.
5. Web access (skip if this agent won't use the web): the human runs curl -fsSL https://composio.dev/install | sh, then ~/.composio/composio login. The installer adds ~/.local/bin/composio and the composio-cli skill under ~/.agents/skills. Confirm with composio whoami. Never print or paste any key.
6. Report the versions, the takibi projects result, and the ~/.agents/skills listing. Do not start any service yet.

# TERMINAL / human only. Open Bash in the Prized box terminal.
# Type the key at the hidden prompt, never as a shell command or in chat.
# Refuse placeholders such as <PASTE-KEY-HERE>; preserve any existing key.
(
  set +x
  umask 077
  mkdir -p "$HOME/.takibi" || exit 1
  chmod 700 "$HOME/.takibi" || exit 1
  if [ -e "$HOME/.takibi/key" ] || [ -L "$HOME/.takibi/key" ]; then
    printf '%s\n' 'Key already exists. Review its grants; do not overwrite it.'
    exit 1
  fi
  IFS= read -r -s -p 'Takibi key (hidden): ' takibi_key
  printf '\n'
  case "$takibi_key" in
    ''|*'<'*|*'>'*) unset takibi_key; printf '%s\n' 'Empty key or placeholder refused.'; exit 1 ;;
  esac
  set -C
  printf '%s\n' "$takibi_key" > "$HOME/.takibi/key" || exit 1
  unset takibi_key
  chmod 600 "$HOME/.takibi/key"
)

LOCAL / laptop, with a Prized API key read from your local secret store (never chat). Inputs: the box id from the dashboard, and the ids of two Prized Secrets the human already created in the dashboard: OPENROUTER_API_KEY and TAKIBI_KEY (the agent Profile's Takibi key).
1. Each secret must be granted to this box only (an ungranted secret is open to every box in the workspace) and allow only its own host. Check with GET https://api.prized.dev/api/v1/secrets, then set hosts where missing:
   PATCH https://api.prized.dev/api/v1/secrets/<openrouterSecretId>  {"hosts":["openrouter.ai"]}
   PATCH https://api.prized.dev/api/v1/secrets/<takibiSecretId>      {"hosts":["app.takibibase.com"]}
   If a secret has no box grant, stop and tell the human to grant it to this box in the dashboard.
2. Mount both on the box (envName is required):
   POST https://api.prized.dev/api/v1/boxes/<boxId>/secrets  {"secretId":"<openrouterSecretId>","envName":"OPENROUTER_API_KEY"}
   POST https://api.prized.dev/api/v1/boxes/<boxId>/secrets  {"secretId":"<takibiSecretId>","envName":"TAKIBI_KEY"}
3. Report each status code and the two dpsec_… placeholders the mounts return (placeholders are not secrets; the real values never leave Prized).
Auth header on every call: Authorization: Bearer <Prized API key>. Never print the key.

{
  "tagOwners": {
    "tag:agent": ["autogroup:admin"]
  },
  "grants": [
    // Replaces the default allow-all ("src": ["*"]). Tagged devices are not
    // members, so tag:agent can't start connections to anything.
    // autogroup:member is every member, invited users included; use your own
    // login instead if you share the tailnet.
    {"src": ["autogroup:member"], "dst": ["*"], "ip": ["*"]}
  ],
  "ssh": [
    {"action": "check", "src": ["autogroup:member"], "dst": ["autogroup:self"], "users": ["autogroup:nonroot", "root"]},
    {"action": "check", "src": ["autogroup:member"], "dst": ["tag:agent"], "users": ["autogroup:nonroot"]}
  ],
  "nodeAttrs": [
    // Only agent boxes may publish a port with Funnel.
    {"target": ["tag:agent"], "attr": ["funnel"]}
  ]
}

# TERMINAL / human only, in the Prized box terminal, after installing Tailscale
# (curl -fsSL https://tailscale.com/install.sh | sh). Paste the auth key at the hidden
# prompt; it goes to a temporary 600 file, never into history or an agent.
(
  set +x
  umask 077
  IFS= read -r -s -p 'Tailscale auth key (hidden): ' ts_key
  printf '\n'
  case "$ts_key" in tskey-*) ;; *) unset ts_key; printf '%s\n' 'Not a tskey- auth key.'; exit 1 ;; esac
  keyfile=$(mktemp) || exit 1
  printf '%s' "$ts_key" > "$keyfile"
  unset ts_key
  sudo tailscale up --auth-key="file:$keyfile" --advertise-tags=tag:agent --hostname="$(hostname)" --ssh
  status=$?
  rm -f "$keyfile"
  exit $status
)
sudo tailscale funnel --bg 8787
sudo tailscale funnel status

# ~/agent/agent.env on the box, mode 600 (chmod 600 ~/agent/agent.env)
# Real values, checked on the box: the broker can't hold these.
WEBHOOK_SECRET=<signing secret, shown once when you create the Takibi endpoint>
RECEIVER_AUTH=Bearer <output of: openssl rand -hex 32>
# Prized placeholders, not the real keys:
TAKIBI_KEY=<dpsec_ placeholder for the Takibi secret>
OPENROUTER_API_KEY=<dpsec_ placeholder for the OpenRouter secret>
TAKIBI_BASE=https://app.takibibase.com
MODEL=openai/gpt-6-luna-pro
REVIEW_MODEL=xiaomi/mimo-v2.6-pro
RUN_TIMEOUT_MIN=20
REVIEW_TIMEOUT_MIN=12

# ~/.config/systemd/user/takibi-agent.service
[Unit]
Description=Takibi webhook worker
After=network-online.target

[Service]
EnvironmentFile=%h/agent/agent.env
# Composio installs to ~/.local/bin, which systemd's default PATH lacks.
Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
# Prized's broker: services don't read /etc/profile.d, so set the proxy here.
Environment=HTTPS_PROXY=http://127.0.0.1:7379
Environment=NO_PROXY=localhost,127.0.0.1,::1,169.254.169.254
Environment=NODE_USE_ENV_PROXY=1
Environment=NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/prized-secretsd.crt
Environment=NODE_NO_WARNINGS=1
ExecStart=/usr/bin/node %h/agent/agent.mjs
Restart=always
RestartSec=5

[Install]
WantedBy=default.target

# then, once agent.env and agent.mjs exist:
#   systemctl --user daemon-reload
#   sudo loginctl enable-linger "$USER"     # loginctl show-user "$USER" -p Linger must say yes
#   systemctl --user enable --now takibi-agent.service
#   journalctl --user -u takibi-agent -f

BOX / write ~/agent/agent.mjs: one dependency-free Node file (node:http, node:crypto, node:child_process, node:fs) that the systemd unit runs. It reads its settings from the environment (agent.env).
Receive (HTTP on 127.0.0.1:8787, POST only):
1. Verify Standard Webhooks signatures: HMAC-SHA256 with WEBHOOK_SECRET over `${webhook-id}.${webhook-timestamp}.${rawBody}`, base64; the webhook-signature header holds one or more space-separated "v1,<sig>" values; compare in constant time; refuse timestamps more than 5 minutes off. If RECEIVER_AUTH is set, the Authorization header must equal it (constant time). Refuse with 401 otherwise.
2. Parse the JSON body; require schemaVersion 1 and deliveryId equal to webhook-id. Dedupe on eventId (keep the seen ids on disk).
3. webhook.ping: answer 200 and log "ping ok". Task events: act only on task.assignment_changed with cause assigned or reassigned (in collapsed deliveries, look through the changes array); for those, persist {taskId: resource.id, projectId} to a pending queue on disk. Answer 200 for everything that verified, then work the queue one card at a time.
Work one card:
4. GET ${TAKIBI_BASE}/v1/tasks/<id>?projectId=<projectId> with "Authorization: Bearer ${TAKIBI_KEY}"; skip if archived, blocked or not in todo. POST …/claim: 200 means it's yours, 409 means another Profile holds it. PATCH status in_progress.
5. Drafter: MODEL, unless the card body has a line "model: <openrouter id>" (allow backticks or bold around it; ignore anything that isn't an id like "vendor/model"). Make a per-card work dir and run pi -p --model openrouter/<drafter> --session-dir <new dir> "<draft prompt>" with RUN_TIMEOUT_MIN as a hard timeout. Draft prompt: the card id and collection id; the run is unattended and ends when it replies; use the takibi-use skill and the takibi CLI, and the composio CLI for the web; write the whole deliverable to draft.md in the work dir with a closing "Notes for the reviewer" section (sources, what couldn't be verified); do not change the card in Takibi.
6. Reviewer: run pi -p --model openrouter/${REVIEW_MODEL} --session-dir <another new dir> "<review prompt>" with REVIEW_TIMEOUT_MIN. Review prompt: this is a review pass, not a redo; verify the draft's key claims and the points in its reviewer notes; check the collection's own docs in Takibi and apply them; fix errors and fill only clear gaps; don't re-scrape what the draft covered or chase what it marks unverifiable; attach ONE final markdown artifact; then finish the card as the takibi-use skill says. Do not tell it which command to finish with: the skill hands the card off when the card names someone, and a dictated command overrides that.
7. If the reviewer times out, run pi once more with the same --session-dir plus --continue and the prompt "Time's up. Stop researching, attach your final deliverable with what you have (mark anything unverified), finish the card as the takibi-use skill says." (3-minute timeout).
8. Close every pi child's stdin right after starting it: pi -p waits on piped stdin otherwise and the run hangs.
9. Afterwards GET the card. If it is not in review, attach draft.md (if any) as a markdown artifact titled "Draft (not reviewed)", then PATCH status review with reviewNote "Needs you: <what happened>". Never mark it blocked: blocked review cards drop out of the inbox. On any error, do the same.
10. Log, per stage: model, seconds, turns and cost (sum message.usage.cost.total from the .jsonl in that stage's session dir).