# Tatlock Claudification Handover - portainer-core

## Context

Tatlock (the butler) is being upgraded to use Claude as its primary LLM backend instead of Ollama. This requires infrastructure changes to support the new configuration.

**Parent Issue:** See `/mnt/media/Projects/tatlock/PROJECT_CLAUDIFICATION.md`

## Impact on portainer-core

Portainer-core manages Docker Swarm stacks. The Tatlock stack needs updated configuration.

## Required Changes

### Priority: High (Required for Claude backend)

- [ ] **Update `stacks/agents.yml`** (or wherever Tatlock is defined)

  Add new environment variables:
  ```yaml
  services:
    tatlock:
      environment:
        # Anthropic Configuration (Claude - preferred backend)
        - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
        - ANTHROPIC_MODEL=claude-sonnet-4-20250514
        - PREFER_CLOUD_BACKEND=true
        # Existing Ollama config remains as fallback
        - OLLAMA_HOST=http://ollama:11434
        - OLLAMA_DEFAULT_MODEL=mistral-nemo:latest
  ```

- [ ] **Configure secrets management**

  Options:
  1. **Docker secrets** (recommended for Swarm):
     ```yaml
     secrets:
       anthropic_api_key:
         external: true
     services:
       tatlock:
         secrets:
           - anthropic_api_key
         environment:
           - ANTHROPIC_API_KEY_FILE=/run/secrets/anthropic_api_key
     ```

  2. **Environment file** (simpler but less secure):
     ```yaml
     services:
       tatlock:
         env_file:
           - ./secrets/tatlock.env
     ```

- [ ] **Update `CONTAINERS.md`**
  - Document new environment variables
  - Note Claude as preferred backend with Ollama fallback
  - Update any API documentation

### Priority: Medium (Phase 2 - MCP Server)

- [ ] **Add `tatlock-mcp` service definition** (when Phase 2 is ready)
  ```yaml
  tatlock-mcp:
    image: git.schweitz.net/jpmschweitzer/tatlock:latest
    command: ["python", "-m", "src.mcp.server"]
    ports:
      - "8778:8778"
    environment:
      - MCP_AUTH_TOKEN=${MCP_AUTH_TOKEN}
    # ... other config
  ```

### Priority: Low (Optimization)

- [ ] **Review resource limits**
  - Claude backend may have different resource profile than Ollama
  - Monitor memory/CPU after deployment
  - Adjust limits if needed

## Testing

After stack update:

```bash
# Check Tatlock logs for backend selection
docker service logs tatlock_tatlock 2>&1 | grep -E "claude|backend"

# Should see:
# model_backend_configured backend=claude model=claude-sonnet-4-20250514
# OR (if no API key):
# claude_health_check_skipped reason=no_api_key
# model_backend_configured backend=ollama
```

## Timeline

- **Blocking:** Yes - required for production Claude deployment
- **When to implement:** When ANTHROPIC_API_KEY is available
- **Effort:** ~1 hour for stack updates, ~30 min for secrets setup