diff --git a/compose.yaml b/compose.yaml
index ad233ccd..d15b6ec3 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -23,6 +23,7 @@ services:
       THT_BIN: /opt/venv/bin/tht
       SETTINGS_FILE: /data/settings/settings.json
       THT_CONFIG: /app/harness/workspaces/local.yaml   # configPath di default per i route tht senza workspace esplicito
+      THT_MODEL_API_KEY_FILE: /data/secrets/model_api_key   # provider key per buildPiChildEnv (codex)
       AUTH_MODE: ${AUTH_MODE:-none}
       MAX_PI_PROCESSES: ${MAX_PI_PROCESSES:-4}
     extra_hosts:
diff --git a/docker/core.Dockerfile b/docker/core.Dockerfile
index 0015857b..4406cbb7 100644
--- a/docker/core.Dockerfile
+++ b/docker/core.Dockerfile
@@ -30,12 +30,17 @@ RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
 # Utente non-root
 RUN useradd --create-home --uid 10001 --shell /bin/bash thoth
 
-# Harness: venv nativo (python 3.12) + tht installato NON editabile (nel venv, indipendente dal path sorgente).
-# psycopg2-binary è wheel → niente gcc/libpq-dev. yake/sqlglot/datasketch/pydantic hanno wheel per py3.12.
 COPY harness/ /app/harness/
+
+# Harness: venv nativo (python 3.12) + tht installato (non-editable).
+# tht carica workflow.yaml module-relative (Path(__file__).parent.parent); con il package
+# in site-packages quel path non contiene workflow.yaml -> lo copiamo dopo l'install.
+# (pip install -e non funziona: pip non riconosce /app/harness come editable req.)
+# psycopg2-binary è wheel → niente gcc/libpq-dev.
 RUN python -m venv /opt/venv \
     && /opt/venv/bin/pip install --no-cache-dir --upgrade pip \
-    && /opt/venv/bin/pip install --no-cache-dir /app/harness
+    && (cd /app/harness && /opt/venv/bin/pip install --no-cache-dir .) \
+    && cp /app/harness/workflow.yaml /opt/venv/lib/python3.12/site-packages/workflow.yaml
 # PiProcessManager (backend) prepende harnessDir/.venv/bin al PATH del child Pi → symlink al venv reale
 RUN ln -s /opt/venv /app/harness/.venv