witty-service (openEuler packaging)

openEuler RPM packaging for witty-service, the FastAPI backend of PolyMind (AI agent lifecycle management: agent sandbox, sessions, messages, skill marketplace and model management).

Source

• Upstream: https://atomgit.com/openeuler/witty-service

• Local source checkout: /root/witty-service (branch test_all, HEAD 0c1c7fe)

• witty-service-1.2.2.tar.gz is generated from the upstream git tree with:

  git -C /root/witty-service archive --format=tar.gz \
      --prefix=witty-service-1.2.2/ \
      -o witty-service-1.2.2.tar.gz HEAD
  

  Current tarball: branch test_all, HEAD 0c1c7fe, sha256 0c16288339bc979dcef3387b5f159df63d5f0b983f73b8deb266237147efccc4. It is exactly git ls-files at that commit, taken from a clean checkout.

  Two tarballs were staged earlier while this package was being prepared, and both are superseded by the one above (neither was ever published):

  • feat_token_usage HEAD c97b543 -- 48 files fewer than the current tree (the dsh runtime integration, agent_templates.py, the seven preset_agents templates, the new alembic revision, ...); nothing in it was removed since.
  • the working tree of /home/tt/workspace/witty-service (base commit c97b543), which was not a commit archive: it carried the uncommitted fix for "agent task suddenly flips to error" (SQLite WAL + batched stream persistence, abnormal-stream finalization, ws keepalive timeout, abort of an orphaned turn) and the two new regression test modules (test_agent_manager_stream_recovery.py, test_session_ws_router_abort.py). Both the fix and both test modules are part of the current tarball, which additionally carries the IM channel backend that landed on top of them.

  Commit the source change upstream and regenerate the canonical git archive HEAD tarball before publishing; until then the tarball and the checkout are the source of truth, and the sha256 above identifies exactly the tree this package is built from.

Packaging approach (self-contained)

• %build compiles a bundled Python 3.12.12 and downloads the OpenClaw CLI (openclaw@2026.6.10, with all of its npm dependencies) and a Node.js 22.23.2 runtime (used by OpenClaw). The OpenCode CLI is not bundled: it comes from the opencode rpm in the same repository (see below).
• %install creates the Python venv at the final path (/opt/witty-service/.venv) and installs all Python runtime dependencies plus the application, so the installed RPM works offline.
• %post only does offline initialization (user, docker group, systemd units).
• The backend runs as witty-backend.service on 127.0.0.1:8000 and exposes /api + /api/ws for the PolyMind frontend rpm.
• The bundled CLI lives in the package's own tree, never in /usr/bin: the only /usr/bin entries this package owns are the two launchers nobody else provides (/usr/bin/witty-service, /usr/bin/openclaw). OpenCode is a separate rpm and is reached as /usr/bin/opencode through PATH -- see the /usr/bin/opencode note below.

Runtime requirements

• no system nodejs requirement: a bundled Node.js 22.23.2 serves the OpenClaw CLI
• opencode >= 1.17.13 (hard Requires): the opencode agent runtime -- the default runtime, and the one every preset agent template uses -- is the /usr/bin/opencode binary that package installs
• moby-engine is a Recommends (Docker sandbox backend); the default local-process sandbox works without docker
• git, tmux, systemd

Notes / open items

• /usr/bin/opencode belongs to the opencode package, not to this one. Both packages are in the 26.09-DevStation repository (src-openeuler/opencode, built from opencode.spec, installs its CLI as %{_bindir}/opencode), and this spec used to ship a launcher at the same path, so installing both aborted with
• The bundled app version is 0.1.0 (pyproject.toml); the package Version is kept at 1.2.2 so it stays monotonic with the previously published 1.2.1-7 (CI check_spec_file rejects version downgrades). Align with upstream releases when tags exist.
• Build-time network is required: Huawei Cloud mirrors for the Python source, PyPI (runtime deps), npm (OpenClaw, the only npm payload left) and the Node.js binary tarball.
• Since polymind 1.0.1-11 the frontend rpm is a self-contained Electron shell: it serves its static export over an in-process app:// handler and proxies /api to this backend from the main process. No nginx configuration is involved any more.
• deepseek-harness-sdk==0.1.2rc1 -- a dependency of the feat_token_usage tree -- pulls in deepseek-harness-runtime-bin==0.1.2rc1, whose dsh runtime is a Bun single-file executable whose whole payload lives in a 140,902,236 byte PT_NOTE segment. file-libs 5.45 refuses to classify a note section above 128 MiB, and rpmbuild escalates that to a fatal "identification failed" error for any file carrying the executable bit. The spec clears that bit before packaging and a %post scriptlet puts it back at 0755; the reasoning is written out in the %install section.
• AUTH_TOKEN defaults to dev-token in /etc/witty-service/witty-service.env; change it before production use.