feat(buy-x402): --set-default — agent self-adopts paid/<model> as its primary model

[bussyjd]

What

Adds --set-default to buy.py buy <name> --model <id>. After a persistent inference buy publishes the paid model in LiteLLM as paid/<remote-model>, the obol-agent adopts it as its own primary chat model, in-pod, by itself — with no host-side obol model prefer/obol model sync, no new RBAC, no controller change, no LiteLLM mutation, and no pod restart.

This closes the last manual step in "agent buys paid inference → agent uses it": previously a human had to run obol model prefer paid/<id> && obol model sync from the host.

Mechanism

• On a successful inference buy (PurchaseRequest Ready), the agent runs the native hermes config set model.default paid/<id> — an atomic write to its own /data/.hermes/config.yaml (the PVC it already owns rw). Hermes resolves model.default per request (_resolve_gateway_model), and the atomic inode swap busts its mtime-keyed config cache, so the change takes effect on the next chat turn with no restart.
• Existence guard: queries LiteLLM /v1/models and refuses if paid/<id> isn't selectable (never points the agent at an unpublished model).
• Auto-refill safety: --set-default without --auto-refill warns loudly — once a paid model is the primary, every turn fails when the pre-signed pool empties.
• Fallback: if the hermes binary path moves or the call fails, a PyYAML edit of config.yaml preserves sibling keys.

Why this design (validated by a 10-agent design + adversarial-validation workflow): it needs none of the permissions the agent lacks (kubectl auth can-i confirms the agent cannot patch configmaps/deployments or exec pods), and it reuses Hermes' own config writer + per-request model resolution instead of reordering LiteLLM's model_list.

Test results — live CLI smoke against a running obol-agent

Cluster eager-airedale; seller aeon7 = AEON-7/Qwen3.6-35B-A3B-heretic-NVFP4 on Ethereum mainnet (OBOL/Permit2); agent wallet 0xf441…F373.

1. Buy + set-default (CLI, in-pod):

   buy.py buy aeon7 --endpoint https://inference.v1337.org/services/aeon7 \
     --model AEON-7/Qwen3.6-35B-A3B-heretic-NVFP4 \
     --count 8 --auto-refill --refill-threshold 3 --refill-count 8 --set-default
   

   → PurchaseRequest Ready, controller published paid/AEON-7/…, auto-refill armed → Agent default model set to 'paid/AEON-7/Qwen3.6-35B-A3B-heretic-NVFP4' (effective next chat turn; no restart).
2. Config write confirmed: /data/.hermes/config.yaml → model.default: paid/AEON-7/Qwen3.6-35B-A3B-heretic-NVFP4 (siblings api_key/base_url/provider preserved), via the native hermes config set path (no fallback, guard passed).
3. Live-chat proof: a chat through the agent with no model specified (so it used its default) drove the x402-buyer pool spent 0 → 1, remaining 8 → 7 on aeon7 — a real on-chain settlement via paid/AEON-7, proving the new default took effect on the next turn with no restart.
4. Rollback verified: hermes config set model.default qwen36-deep reverts cleanly.

Spend: 0.008 OBOL (8 auths) + 0.001 OBOL (1 chat).

Build / static

• python3 -m py_compile internal/embed/skills/buy-x402/scripts/buy.py ✓
• go build ./cmd/obol ✓ (embed intact)
• repo pre-commit Python checks ✓

Notes / follow-ups

• The chat response's cosmetic model label still reflects the static API_SERVER_MODEL_NAME (e.g. qwen36-deep); it does not govern routing — the x402-buyer spend is the ground truth. Cosmetic-only.
• Auto-refill needs a scheduled runner (buy.py process --all on a cron/heartbeat) so a paid primary model stays funded. The flag records intent and the controller honors it on reconcile, but nothing currently invokes process --all on a schedule for the default agent. Tracked as a follow-up.

Scope

Two files, additive: internal/embed/skills/buy-x402/scripts/buy.py (+159) and internal/embed/skills/buy-x402/SKILL.md (+2). No changes to the controller, RBAC, LiteLLM config, or any Go code.

[OisinKyne]

I wonder does this / can this do a throw away one shot pay test of inference, before it sets it as its litellm brain?

[bussyjd]

Superseded by the consolidated integration PR #598, which merges this branch together with the other PRs ≥ #593 into integration/pr-593-plus for a single reviewable diff. Review hardening fixes ride in #599 (targets the integration branch). Closing in favour of the consolidated review — reopen if you'd prefer to land this one standalone.