AI-Dev-BMS4-1 Claude Runner (on bms-4)
Environment ID: ai-dev-bms4-1
Type: agent-runner
Status: active
Purpose
Autonomous Claude Code agent runner hosted on bms-4 (OVH Kimsufi). Handles saas-dev tasks: implementing GitHub issues for p24-infra and et-operational-platform, running worker queue jobs, building n8n workflows, and SaaS integrations.
Host
Runs on bms-4 (54.36.123.110 / Ubuntu 22.04.5 LTS). See docs/environments/bms-4.md for host hardware specs. Shares the server with the n8n stack (3 workers + Redis) and MongoDB arbiter.
Agent Configuration
| Field | Value |
|---|---|
| GitHub user | AI-Dev-BMS4-1 |
| User | claude-runner (dedicated non-root user) |
| Credentials | /home/claude-runner/.claude/.credentials.json |
| Auth type | OAuth subscription (Claude Max) — not ANTHROPIC_API_KEY |
| Max parallel agents | 4 |
| Role | saas-dev |
| Repos | radieu/p24-infra (write), radieu/et-operational-platform (write) |
Resource Sharing
bms-4 has 8 vCPU / 32 GB RAM shared between:
- Claude Code agents (up to 4 parallel)
- n8n queue-mode + 3 workers + Redis
- MongoDB arbiter (minimal footprint)
Effective agent resources: ~16 GB RAM available for Claude agents under normal load.
Typical Tasks
- Feature implementation (worker-queue issues dispatched by orchestrator)
- n8n workflow development and testing
- Infrastructure migrations and fixes
- Code review and PR preparation
Re-auth Procedure
Same as AI-Dev-IO1. OAuth tokens expire every 8–12 hours:
-
Automated (preferred): Playwright automation to complete OAuth flow
- Run reauth script:
python d:\tmp\reauth-bms4.py - Use Playwright browser MCP to navigate and capture the OAuth code
- Send code to server:
tmux send-keys -t claude_auth "<code>" Enter
- Run reauth script:
-
Human escalation (if Playwright fails twice):
- Discord alert via
P24_DISCORD_INFRA_SCRIPTS_ERRORS_WEBHOOK_URL - GitHub issue with
human-actionlabel:"CRITICAL: claude-runner auth expired on bms-4"
- Discord alert via
Notes
- Max 4 parallel agents — respect this limit to avoid resource contention with n8n
- Do not use ANTHROPIC_API_KEY — OAuth subscription (Claude Max) only
- n8n workflows on this host should NOT call claude-proxy (no proxy on bms-4); use direct ANTHROPIC_API_KEY in n8n if needed, or route through vps-i1
Secrets Access
| Secret store | Access method | Can decrypt SOPS? |
|---|---|---|
All secrets/*.env.sops files | age key at /home/claude-runner/.age/p24-infra-keys.txt | Yes � claude-runner has the age key (verified 2026-06-24) |
| On-server plaintext fallback | /opt/p24-infra/bms-4/.env (deployed by CI) | N/A � already plaintext |
| GitHub Actions secrets | Not accessible from VPS directly | N/A |
AI-Dev-BMS4-1 (claude-runner on bms-4) does hold the SOPS age key and can decrypt all SOPS files directly. CI also deploys a plaintext copy to /opt/p24-infra/bms-4/.env on each merge as a fallback.
CLAUDE.md in Effect
The following rule layers are active for every AI-Dev-BMS4-1 session, in priority order (highest first):
| Source | File on VPS | Key rules active |
|---|---|---|
| Global (user) | /home/claude-runner/.claude/CLAUDE.md | Use Bash (not PowerShell); SOPS lookup order; worktree workflow mandatory |
| Project | /opt/p24-infra/CLAUDE.md | Stack architecture; error notification standard; n8n credential rules |
| Skills | ~/.claude/commands/*.md | /role-*, /new-issue, /n8n, /n8n-nodes |
| Role standards | /opt/p24-infra/standards/project-types/saas/* | Loaded when P4_CLAUDE_ROLE=saas-dev |
The global CLAUDE.md (/home/claude-runner/.claude/CLAUDE.md) is sourced from scripts/vps-global-claude.md in this repo and deployed by the claude-env-sync Ansible role.