Bifrost now enforces inference auth with a virtual key
(env.BIFROST_VIRTUAL_KEY) that agentgateway's /v1 route sends as x-bf-vk,
enables management auth with env-referenced admin credentials, publishes
no host port and sits only on an `llm` network shared with agentgateway.
The OpenRouter fallback names anthropic/claude-default, a model its key
allows.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012AuVk4nEvBXaTjs4G6wdW4
Bifrost v2.3.0 loads $APP_DIR/config.json (APP_DIR=/app/data) at startup
and never read the mounted compose/bifrost.yaml, so no providers or
failover routes were configured. Replace it with compose/bifrost.config.json
(validated against the transports/v2.3.0 config.schema.json), bind-mounted
read-only at /app/data/config.json over the writable bifrost-data volume:
- providers opencode-go (host :11434), openrouter, vllm (host :8000), keys
as env.BIFROST_API_KEY / env.OPENROUTER_API_KEY references
- one global routing rule targeting opencode-go with fallbacks
openrouter -> vllm
session_affinity and the Retry-After clamp have no config.json equivalent
in v2.3.0 (the schema rejects unknown top-level keys) and are dropped.
The verifier now applies its generic rules to compose/*.json; tests, the
wave-1 gate, README, .env.example and agentgateway.yaml point at the new file.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012AuVk4nEvBXaTjs4G6wdW4
11 of 15 pinned images did not exist in their registries. Published images
now use real release tags (bifrost v2.3.0, searxng 2026.10.16-0ce72dd2c,
docker-android emulator_14.0_v3.8.0-p1, devcontainers/base 2.2.3-bookworm).
Upstreams with no usable image get images/<service>/Dockerfile on a pinned
base, installing a checksum- or commit-verified upstream release, tagged
localhost/heretek/<service>:<version> with pull_policy: build. Stdio-only
servers are wrapped with a pinned mcp-proxy so every MCP service serves
streamable HTTP; compose labels declare each endpoint.
radare2-mcp now runs with -R (read-only); the previous -r enabled the
dangerous run_* tools.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012AuVk4nEvBXaTjs4G6wdW4
Claude