Sync chart from pieced-operator 0.1.46

deploy/helm/pieced-operator/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: pieced-operator
 description: PieCed IT tenant lifecycle operator
-version: 0.1.45
+version: 0.1.46
-appVersion: "0.1.45"
+appVersion: "0.1.46"
 type: application

deploy/helm/pieced-operator/templates/catalog-cm.yaml

@@ -115,31 +115,86 @@ data:
         name: Voice Interaction
         category: core
         description: >
-          Speech-to-text on incoming voice notes and text-to-speech on
+          Speech-to-text on incoming voice notes, automatic text-to-speech
-          replies. Routed through PieCed's LiteLLM gateway so audio cost
+          on replies, and interactive Talk mode. Audio is routed through
-          is tracked per-tenant alongside chat.
+          PieCed's LiteLLM gateway so STT/TTS spend is tracked per-tenant
-        # PHASE A: catalog entry only. No config_patch yet — toggling
+          alongside chat usage. Inbound TTS uses kani-tts; Talk mode uses
-        # this package stores customer intent but does not change the
+          kokoro-fastapi; STT uses self-hosted Whisper (faster-whisper-
-        # OCI config. PHASE B (next iteration) wires in chatterbox-tts
+          large-v3). All three are private to the cluster.
-        # and a whisper adapter (or speaches-server) behind LiteLLM and
+        # PHASE B — wired in. Toggling this package now installs the full
-        # adds the config_patch below, roughly:
+        # voice surface into the tenant's OpenClawInstance config:
         #
-        # config_patch:
+        #   - messages.tts: auto TTS on inbound replies, routed to
-        #   tools:
+        #     `pieced-tts-inbound` (kani-tts behind LiteLLM).
-        #     media:
+        #   - talk: interactive Talk mode, routed to `pieced-tts-talk`
-        #       audio:
+        #     (kokoro-fastapi behind LiteLLM). `interruptOnSpeech: true`
-        #         enabled: true
+        #     so the agent stops talking when the user starts talking.
-        #         models:
+        #   - tools.media.audio: STT for inbound voice notes, capped at
-        #           - provider: openai
+        #     20 MiB per message, routed to `pieced-stt` (whisper-openai
-        #             model: pieced-whisper
+        #     behind LiteLLM).
-        #             apiBase: http://litellm.inference.svc:4000/v1
+        #
-        #   messages:
+        # Provider config notes
-        #     tts:
+        # ---------------------
-        #       auto: inbound
+        # `models.providers.openai` is declared here with no chat models
-        #       provider: openai
+        # (`models: []`) — its only role is to give the STT block under
-        #       openai:
+        # `tools.media.audio` a place to resolve its apiKey/baseUrl from.
-        #         model: pieced-tts
+        # The agent's primary chat model still lives under
-        #         voice: nova
+        # `models.providers.litellm` (set in builder.go base) and is
+        # unaffected by this patch — deep-merge adds `openai` as a
+        # sibling provider, not a replacement.
+        #
+        # `allowPrivateNetwork: true` on the openai provider is required
+        # because the LiteLLM endpoint is a `http://*.svc` private-
+        # network address. Without it OpenClaw refuses the outbound
+        # call as a private-network destination.
+        #
+        # `${LITELLM_API_KEY}` is supplied via the tenant's envFrom
+        # secretRef (see builder.go), populated by ESO from
+        # secret/data/tenants/<ns>/litellm.
+        #
+        # Network policy
+        # --------------
+        # Audio traffic shares the existing LiteLLM egress hole in the
+        # per-tenant CiliumNetworkPolicy (toEndpoints inference ns,
+        # port 4000). No additional CNP rule needed — voice routes
+        # through the same gateway as chat completions.
+        config_patch:
+          models:
+            providers:
+              openai:
+                apiKey: "${LITELLM_API_KEY}"
+                baseUrl: "http://litellm.inference.svc:4000/v1"
+                models: []
+                request:
+                  allowPrivateNetwork: true
+          messages:
+            tts:
+              auto: "inbound"
+              provider: "openai"
+              providers:
+                openai:
+                  apiKey: "${LITELLM_API_KEY}"
+                  baseUrl: "http://litellm.inference.svc:4000/v1"
+                  model: "pieced-tts-inbound"
+                  voice: "alloy"
+          talk:
+            provider: "openai"
+            providers:
+              openai:
+                apiKey: "${LITELLM_API_KEY}"
+                baseUrl: "http://litellm.inference.svc:4000/v1"
+                model: "pieced-tts-talk"
+                voice: "af_bella"
+            interruptOnSpeech: true
+          tools:
+            media:
+              audio:
+                enabled: true
+                maxBytes: 20971520
+                models:
+                  - provider: "openai"
+                    model: "pieced-stt"
+                    baseUrl: "http://litellm.inference.svc:4000/v1"
 
       # =====================================================================
       # CHANNELS — messaging integrations. Each ships a Channels map that
@@ -201,16 +256,14 @@ data:
 
       # =====================================================================
       # SKILLS — ClawHub skill installs. Operator passes each entry through
-      # to OpenClawInstance.spec.skills, where the OpenClaw operator's init
+      # to spec.skills on the OpenClawInstance.
-      # container fetches it before the agent starts. Bare "<owner>/<slug>"
-      # resolves through ClawHub by default.
       # =====================================================================
 
       git-cli:
         name: Git CLI
         category: skill
         description: >
-          Standalone git command-line operations (clone, commit, branch,
+          Use git from the assistant's shell (clone, commit, push, pull,
           diff, log, status). For private repositories, configure
           credentials in your workspace.
         skills:

deploy/helm/pieced-operator/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: registry.c5ai.ch/pieced/pieced-operator
-  tag: "0.1.45"
+  tag: "0.1.46"
   pullPolicy: IfNotPresent
 
 imagePullSecrets: