configuring-compute

Configure Compute

Configure DesireCore compute through governed tools. Do not call the local /api/compute/* management endpoints from Bash, HttpRequest, or scripts: those endpoints intentionally require a trusted renderer Origin and instance token.

Security contract

• API keys are write-only for agents. Never read secrets.json, request ComputeCredential(action='get', raw=true), or repeat a key in tool results or chat.
• Use ComputeCredential(action='set') to create or replace the key of an existing user-managed provider. If the provider has no credential reference, the tool creates and attaches one without returning the plaintext. This path is approval-gated and audited; approval cards, tool events, receipts, and session history redact the sensitive value. System-managed credentials are not writable.
• Pass a value to ComputeCredential(action='set') only when the user already supplied the replacement key in the current request. If the agent must never handle the plaintext, use the GUI to focus the password field, let the user type into it directly, then continue the save flow. Never ask for the key in ordinary chat or read the masked field back into the model.
• credentialMode=none means the provider needs no key. Ollama is treated as none even when an older config does not declare the field.
• If the user asks for the current key, explain that the agent can replace it but cannot read it back. The human-only UI reveal flow remains separate.

Workflow for an existing provider

First confirm ManageCompute is available through the current tool catalog. If it is absent (for example on an older installed client), use the governed GUI workflow below for the whole task; do not fall back to local HTTP.

1. Call ManageCompute(action='list'). Record the exact provider ID, enabled state, credential mode, status, and model count.
2. If credential mode is required and the user supplied a new key in the current request, call ComputeCredential(action='set', providerId=..., value=...). Do not echo the value. If the agent must not handle plaintext, use the human-entry GUI flow below. For none, skip this step.
3. Call ManageCompute(action='set_enabled', providerId=..., enabled=true).
4. Call ManageCompute(action='sync_models', providerId=...). For Ollama this discovers locally installed models; for supported cloud providers it merges the built-in model list.
5. Call InspectModels to verify the intended model is selectable. When the user asked for a real test, run one short fixed-model conversation and verify the run receipt names the requested provider/model.