OpenHuman on Oracle Cloud: headless core with no account, governed Oracle Database through the managed MCP server, all Always Free, all Terraform

[fede-kamel]

I ran the headless core on Oracle Cloud Infrastructure with three properties the default setup does not have: no TinyHumans account (inference from OCI Generative AI through its OpenAI-compatible endpoint, wired in as a caller-owned local-openai runtime), governed Oracle Database access (agents reach data only through Oracle's managed Database Tools MCP Server under IAM policy and identity-domain app roles, no wallet or SQL driver in the container), and everything else on OCI's Always Free tier (one Ampere A1 VM, one Autonomous AI Database, one load balancer, Vault, Bastion). It is all Terraform, one apply builds it in about twenty minutes, and the whole thing is public.

Repository: https://github.com/kamelhar/openhuman-oci (Apache-2.0)
Architecture reference: https://github.com/kamelhar/openhuman-oci/blob/main/docs/OPENHUMAN-ON-OCI.md
Two recorded sessions: a platform tour (edge checks, headless browser drive through Playwright MCP, research turn, memory read-back) and a clinical research scenario: 4,300 public Alzheimer's trials from ClinicalTrials.gov in the database, three researcher turns in parallel on the live web, a synthesis, a regulator-only deep dive, and the brief recalled from memory.

What runs on the VM

openhuman-core from the published aarch64 release tarball on Ubuntu 24.04 (the tarball needs glibc 2.39), plus SearXNG for search, Microsoft's Playwright MCP for headless browsing, and Ollama with bge-m3 for embeddings. A small renderer pulls every secret from OCI Vault with the instance principal and pushes model settings, MCP registrations and a custom researcher agent through the core's own RPC, so nothing secret is baked into the image or cloud-init.

What I learned about the core along the way, now filed

• Compose read_only root leaves the agent projects directory uncreatable #6925 / fix(compose): give the agent projects dir a writable volume under read_only #6928 (merged): read_only compose root left ~/OpenHuman/projects uncreatable.
• Document headless deployment gaps: glibc floor, no-account BYOK route, container keyring, OCI recipe #6927 / docs(cloud-deploy): glibc floor, headless without a TinyHumans account, container keyring, OCI recipe #6929 (merged): cloud-deploy docs now cover the glibc floor, running headless without an account, the container keyring, and an OCI recipe.
• Let headless deployments supply the encrypted_file keyring master key #6926 / feat(keyring): let headless deployments supply the encrypted_file master key #6935 (open): let headless deployments supply the encrypted_file keyring master key via env or file.
• OpenAI-compatible endpoints reject tool_call ids longer than 64 characters (harness mints 69) #6933 (open): OpenAI-compatible endpoints cap tool_call_id at 64 characters; the harness mints 69.
• agent_registry_update of the orchestrator's subagents allowlist does not reach the spawn_async_subagent enum #6934 / fix(agent): honour a saved subagents.allowlist override and resolve custom sub-agents at spawn #6939 (open): a saved subagents.allowlist override never reaches spawn_async_subagent.
• test(agent): update orchestrator iteration-cap snapshot after the 15 -> 50 raise #6937 (merged): a stale max_iterations snapshot that was failing every outside contributor's rust-cov lane.
• Comment on Key-first onboarding: run OpenHuman with a TinyHumans API key or your own providers, no sign-in wall #6601 with evidence for a key-first onboarding path: custom cloud providers are gated behind a session in serve mode, caller-owned local runtimes are not.

Two things I would love maintainer input on: an OCI Generative AI provider preset in tinyinference (it is OpenAI-compatible with a regional endpoint and a bearer API key; embeddings and rerank are native-API only), and whether a local-openai profile could opt into native tool calling for hosted endpoints. Happy to open either as an issue first if that is the preferred order.

Thanks for merging the first three so quickly.