170 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
root	e59f59d776	fix: ai-review gracefully skips when LiteLLM secrets not configured	2026-07-04 23:30:25 +00:00
root	889f4e4dd1	docs: update key enforcement — all agents named keys, systemd fix, CI pipeline ... - All 4 Hermes agents now have dedicated named LiteLLM keys (tanko, mumuni, koby, koonimo) - Documented systemd drop-in pattern fix (litellm-key.conf) - Added one-step rotation procedure - Added CI pipeline and branch protection documentation - Removed old mumuni keys, generated fresh keys for koby/koonimo	2026-07-04 23:28:59 +00:00
root	cd7d038f91	ci: verify branch protection — abiba-bot push should work	2026-07-04 23:15:56 +00:00
root	b3ab3a6850	fix: remove all Gitea expression syntax from ai-review script	2026-07-04 23:09:29 +00:00
root	105844cf7b	fix: ai-review script — handle Gitea env vars + push event diffs	2026-07-04 23:08:19 +00:00
root	52566ff36e	fix: remove test file, add missing descriptions to zulip-health + memory-audit-maintenance	2026-07-04 23:06:40 +00:00
root	36da6cb1f7	fix: use http://git.sysloggh.net for checkout (no TLS inside network)	2026-07-04 23:00:55 +00:00
root	3dd2698ef8	fix: add native git checkout + fix validator increment/exit bugs ... - Replaced actions/checkout@v4 with native git clone (no Node.js needed) - Fixed FAILED counter: increment instead of resetting to 1 - Fixed exit condition: -gt 0 instead of -eq 1 (caught >1 violation) - Test-violations.prose.md still present — pipeline should now catch it	2026-07-04 23:00:03 +00:00
root	89af42fa4c	test: intentional violations — should fail pipeline	2026-07-04 22:58:15 +00:00
root	b669d1becf	fix: remove Node.js dependency from CI pipeline + add enforcement kind ... - Removed actions/checkout@v4 (requires Node.js, unavailable on runner) - Gitea act runner provides repo checkout automatically - Added 'enforcement' to valid kind list for hermes-key-enforcement - All steps are now pure shell — zero external dependencies	2026-07-04 22:54:42 +00:00
root	ae5fb4d335	ci: verify pipeline with Node.js on runner CT 110	2026-07-04 22:53:25 +00:00
root	d27892f7a5	ci: trigger pipeline — Node.js installed on runner CT 110	2026-07-04 22:52:37 +00:00
root	031a8253c7	fix: add push trigger for master branch to CI pipeline ... Previously the pipeline only triggered on pull_request events. Direct pushes to master bypassed all validation (auth, lint, ai-review). Now push to master also triggers the pipeline.	2026-07-04 22:50:02 +00:00
root	895858c60a	feat: LiteLLM API key management contract + longevity policy ... - New contract: litellm-api-keys.prose.md — create/rotate/verify named API keys - Renamed tanko key alias from tanko-jul2026 to tanko (bare name) - Added Key Longevity Policy: permanent keys (duration:null), event-driven rotation - Added default_key_generate_params to litellm config (permanent + 00 budget) - Updated hermes-key-enforcement verified agents table for 2026-07-04	2026-07-04 22:48:48 +00:00
root	4eec96b851	docs: link authoring guide from AGENTS.md	2026-07-04 22:31:44 +00:00
root	436f583882	docs: add prose contract authoring guide (Anthropic-inspired) ... NEW: docs/AUTHORING-GUIDE.md — canonical style guide for writing contracts Patterns borrowed from Anthropic's frontend-design skill: - Ground it in the subject: verify live state before writing - Two-pass process: draft → critique → revise → ship - Restraint: one contract, one concern; cut one thing before shipping - Self-critique: would an agent trust this at 3am with 30s of context? Core rules: - Specificity over generality (lists rot, vagueness is invisible) - Live-state fields in tables, not prose (grep-able) - Descriptions answer: what, to what, why care? - Templates for function and responsibility contracts - CI enforces structure; author enforces quality Linked from AGENTS.md for agent discovery.	2026-07-04 22:31:33 +00:00
root	57605c6f16	docs: add AGENTS.md + authorization enforcement gates ... NEW: AGENTS.md — complete agent workflow documentation - Step-by-step PR workflow for all agents - Authorization matrix (who can change which contracts) - Emergency bypass procedure - Quick start commands NEW: scripts/prose-auth-check.sh — authorization enforcement - Blocks unauthorized agents from changing CRITICAL contracts - infrastructure-control, proxmox-monitor: abiba only - hermes-config-template: abiba, mumuni, tanko - zulip-health: abiba, mumuni - All scripts: abiba only - Fails CI if unauthorized changes detected UPDATED: .gitea/workflows/pr-pipeline.yaml - Added Stage 0: auth check (runs first) - Added gate job that confirms all 4 checks passed - Expanded trigger paths to include scripts/*.sh UPDATED: branch protection — now requires 4 contexts: pr-pipeline / auth, validate, lint, ai-review	2026-07-04 22:25:05 +00:00
root	263c4080f3	ci: add automated PR validation pipeline + fix regressions ... NEW: Gitea Actions CI pipeline (.gitea/workflows/pr-pipeline.yaml) - Stage 1 (validate): YAML frontmatter validation for all .prose.md files - Stage 2 (lint): Structural checks + regression detection * /grafana/ nginx route (reverted 2026-07-02) * Stale CT IDs (122→112, no 123) * Verified: .19/.122/.123 = correct bridge IPs - Stage 3 (ai-review): LiteLLM-powered diff review against ground truth - Stage 4 (auto-merge): Gate — safe to merge when all green NEW: scripts/prose-lint.sh — contract structure + regression checker NEW: scripts/prose-ai-review.sh — AI review via syslog-auto model FIXES FOUND BY LINT: - gpu-fleet.prose.md: removed /grafana/ from nginx routing diagram - gpu-fleet.prose.md: removed /grafana/ from config file description - infrastructure-control.prose.md: CT 122→112 in topology diagram - scripts/prose-lint.sh: updated to not flag .19 (verified correct IP)	2026-07-04 22:13:51 +00:00
root	dd985f0e49	pm2-self-heal: migrate alerts from Zulip to Telegram ... - abiba-zulip PM2 process decommissioned (2026-07-04) - Replace Zulip stream alerts (agent-hub > alerts-pm2) with Telegram DM - Remove stale abiba-zulip monitoring block (process no longer exists) - Retain abiba-telegram auto-restart (critical — sole communication bridge) - Token sourced from extension .env, not hardcoded	2026-07-04 22:07:35 +00:00
root	0d0215e9dd	prose: annotate infrastructure-monitoring with current deployment status ... - Core stack (Prometheus + Grafana + pve/node/docker exporters) already deployed by proxmox-monitor contract (Jul 2) - GPU exporters (.8/.110/.15) NOT yet live — gpu-exporter crash-loops, sidecars never deployed - Strike nginx /monitoring/ proxy suggestion (sub-path pattern already tried and reverted for /grafana/ per proxmox-monitor) - Add cross-reference: this contract defines target state, proxmox-monitor is the as-built	2026-07-04 21:55:43 +00:00
jerome	0a3b62a598	hermes-config-template: update to v2.1.0 — max_tokens, auxiliary consistency, compression threshold ... - Add model.max_tokens: 4096 (thermal safety — Rule 6) - Add context_length: 262144 to template - Add Rule 7: Auxiliary model consistency (gemma-4-12b + base_url + api_key_env) - Add Rule 8: Compression threshold for 256K models (0.65, not 0.25) - Fix compression section: threshold 0.65, max_context_window 262144, protect_last_n 40 - Remove stray api_key_env from compression block (not propagated) - Update agent Keys table to show key aliases instead of redacted values - Add base_url and timeout to all auxiliary service configs - Add auxiliary: compression: section matching main compression config - Update version 2.0.0 → 2.1.0	2026-07-04 17:54:43 -04:00
root	253e19f680	prose: review, fix, and consolidate infrastructure contracts ... - DELETE infrastructure-monitoring.prose.md (redundant — proxmox-monitor already deployed this) - FIX infrastructure-control.prose.md: remove /grafana/ nginx route (reverted Jul 2, broke gpu-fleet) - FIX infrastructure-update.prose.md: wrong CT IDs (122→112 Tanko, 123→114 Mumuni, .19→storepve Zulip) - FIX infrastructure-update.prose.md: Strix Halo :8080→router health check (firewalled to .116 only) - FIX proxmox-monitor.prose.md: stale /grafana/ URLs→:3001 (post-revert cleanup) - ADD disk-gc-threat-response.prose.md: verified run (2026-07-04, reclaimed 35.67GB from kagentz) - ADD infrastructure-update.prose.md, pi-approval-architecture.prose.md, zulip-approval-fix.prose.md, zulip-self-heal.prose.md - UPDATE hermes-config, litellm-health/self-heal, pm2-self-heal, zulip-* contracts - ADD runs/20260704-005804-51f9a9 (disk-gc-threat-response run artifacts) All contracts verified against live PVE API, nginx config, and firewall state.	2026-07-04 21:47:33 +00:00
Abiba	3077fda0b7	README: surface verify-before-mutate doctrine, field trust levels, verify-before-fix pattern ... - New 'Operating Doctrine (read first)' section with the .117 rule, safe-mutate wrapper usage, field trust taxonomy, and contract-native verify-before-fix flow - Added hermes-key-enforcement to templates table - Added stirling-pdf-agent-access to functions table - Noted VERIFY-BEFORE-USE labels on infrastructure-control	2026-07-03 20:54:42 +00:00
Abiba	d31ae0c25a	Verify-before-mutate doctrine: annotate live-state fields, fix stale Zulip IP (.117→.19) ... - Added FIELD TRUST convention to frontmatter (live-state vs policy fields) - Marked credentials/IPs with VERIFY-BEFORE-USE labels - Fixed 3 stale Zulip IP references (.117 → .19) that caused the 2026-07-03 outage - Added verify-before-mutate skill reference - See knowledge graph node #604 for post-mortem	2026-07-03 20:10:45 +00:00
Abiba	ae143d7a88	Add Stirling-PDF agent API access contract + skill. OAuth2 configured but disabled (needs license).	2026-07-03 19:10:22 +00:00
Abiba	8dfbad5415	Remove stale Bento-PDF reference from migration note	2026-07-03 18:20:08 +00:00
Abiba	c1bdbbc491	2026-07-03: Hermes key enforcement contract + Stirling-PDF docs + config standardization ... - hermes-key-enforcement.prose.md: NEW contract enforcing api_key_env for all harness/LiteLLM providers, exempting external providers - hermes-config-template.prose.md: Updated with full fix log (15 total fixes across Koby/Koonimo/Mumuni/Tanko), model:auto detection rule, key-to-agent mapping - infrastructure-control.prose.md: Added Stirling-PDF service details (port 8989, credentials, API key, Swagger URL) replacing Bento-PDF	2026-07-03 18:19:41 +00:00
jerome	a985748994	Update hermes-config-template.prose.md ... update wrong searxng address	2026-07-03 17:59:39 +00:00
Abiba	e991fc7ea0	fix(hermes-config-template): remove stale key table, add Key Management section ... - REMOVED hardcoded Agent Keys table (keys became stale after LiteLLM downgrade). - ADDED Key Management section: verify loop, rotate + deploy procedure, key deployment rules (plaintext in /etc/environment only, api_key_env pattern), current aliases (2026-07-02 rotation). - LiteLLM DB is the single source of truth for keys; contracts never store plaintext. - Mumuni sub-agent profiles documented (6, all inherit auth from main config).	2026-07-02 20:49:14 +00:00
Abiba	57178e4647	feat(zulip-health): v3 rewrite — full OpenProse responsibility structure ... - kind: contract -> responsibility (valid kind fix) - Add Requires, Maintains (JSON schema), Strategies, Invariants, Continuity - Merge Platform A/B/C into structured Step 1-6 under Execution - Add response_pipeline, queue_healthy, agent_busy_duration diagnostics - Add restart debounce (300s) and PM2 crash-loop safety invariants - Add runtime_contract: 2 versioning	2026-07-02 20:47:17 +00:00
Abiba	b0c0331727	feat: infrastructure-control network-verification + IP-first doctrine, plus 3 supporting contracts ... - infrastructure-control: add Section 5.3 (Network Verification & Routing) with dual-path checks, NetBird ingress health, DNS drift detection, and routing regression alerts. Add Section 7 (Configuration Doctrine — IP-First) mandating LAN IPs for all configs/agents, URLs reserved for human browser access only. Also enrich access matrix (Mumuni, Koonimo, LiteLLM Admin, Grafana entries), reachability matrix, and CT 116 nginx routing + Prometheus targets. - build-zulip-plugin: fold Success Criteria into Maintains postconditions. - pi-approval-architecture: new reference doc — pi approval model vs Hermes, architectural limits, /approve and /deny stub commands. - zulip-approval-fix: new responsibility — documents the Zulip HTML/prefix bug that broke /approve and /deny, and the one-line fix applied.	2026-07-02 20:39:40 +00:00
Abiba	c1d993fe01	fix: GPU table correction + OpenProse v0.15 alignment + self-heal rules 7-9 ... - hello-world: Ensures -> Maintains (v0.15.0 rename). - zulip-mention-reliability: fold Success Criteria into Maintains postconditions. - litellm-self-heal: swap gemma/qwen GPU hosts to match actual deployment; add Strix Halo 64GB UMA detail; add Rules 7 (roster stuck), 8 (agent keys invalid/401), 9 (stale Redis active counter).	2026-07-02 20:39:17 +00:00
Abiba	dfacab12f5	docs: reorganize README — all 17 contracts listed, grouped by domain & kind ... - All 17 contracts now documented (was 7). Grouped by domain (Infra, GPU, LiteLLM, Zulip, Memory, Ops, Agent-config) and kind (responsibility/function/pattern). - Patterns split: 'Instantiable Templates' vs 'Reference Documents' for clarity. - Contract Structure section now distinguishes responsibility/function/pattern section sets (was incorrectly claiming all contracts share one structure). - Scripts table now covers all 3 scripts/ files (was missing daily-infra-report and zulip-monitor). - Functions: litellm-health, infrastructure-monitoring, hello-world. Templates: hermes-config-template. Reference: infrastructure-control, pi-approval-architecture, zulip-adapter-lessons.	2026-07-02 20:36:37 +00:00
Abiba	9101026a0d	chore: move pm2-self-heal.sh into scripts/ ... All companion scripts now live under scripts/ for a single, discoverable location.	2026-07-02 20:36:37 +00:00
Abiba	bb20637b32	fix: align contract name fields to filenames (litellm-health, infrastructure-monitoring) ... - litellm-health: 'check-litellm-health' -> 'litellm-health' - infrastructure-monitoring: 'deploy-monitoring-stack' -> 'infrastructure-monitoring' Fixes 'prose run <filename>' mismatch. No external references broken.	2026-07-02 20:35:44 +00:00
root	b15771bfd9	prose: add Strix Halo thermal safeguard (-n 8192 cap) to gpu-fleet ... Runaway request from .123 (Mumuni) decoded 39,868 tokens over 24 min, pushing Tctl to 98°C (9°C past critical) and throttling 70->29 t/s. Server-side -n 8192 hard cap now bounds generation. Documented connection source (all from .116/LiteLLM) and the thermal constraint (fanless APU).	2026-07-02 03:51:36 +00:00
root	3700b3bf46	prose: fix proxmox-monitor access to direct :3001 (revert sub-path) ... Revert the /grafana/ nginx sub-path I wrongly added — it broke the existing http://192.168.68.116:3001/d/gpu-fleet URL. Restored direct 0.0.0.0:3001 LAN access. Contract is now the source of truth: no GF_SERVER_SERVE_FROM_SUB_PATH, no nginx /grafana/ route. gpu-fleet + 3 new dashboards all at :3001.	2026-07-02 02:56:27 +00:00
root	4df2fa8329	prose: add proxmox-monitor contract (Grafana Pulse replacement) ... - New proxmox-monitor.prose.md: pve-exporter + node_exporter(5) + docker-stats-exporter - Replaces Pulse with file-provisioned Grafana dashboards (cluster/node/docker) - Documents cAdvisor/Docker-29 incompatibility + custom exporter workaround - PVE API token, access URL, config file map, operations	2026-07-02 02:50:59 +00:00
root	a07ff2d96a	prose: align all contracts with Vulkan rebuild + Koby key regen ... - gpu-fleet: Koby key updated (sk-lDTsWy7H3T...), config table (ornith service + masked services), benchmarks (prompt 209→532 tok/s), ROCm→Vulkan status - gpu-monitor: topology (sidecars :8090 removed, .15 via router), subsystem polling (router /health/unified as source of truth), execution steps, alert threshold (sidecar-unreachable downgraded from critical)	2026-07-02 00:29:10 +00:00
root	49e8d968f5	gpu-fleet: Strix Halo Vulkan rebuild + LiteLLM alignment (2026-07-01) ... - ornith now on Vulkan build 4fc4ec5, 256K ctx, ~70 tok/s - Fixed GPU_MOE_URL bug in docker-compose (.110→.15) - Added router sidecar fallback for health-checks - Updated roster context 4096→262144 + correct model_path - Documented port 8080 firewall (restricted to .116)	2026-07-02 00:01:56 +00:00
root	38d2f7d956	feat: update contracts with GPU optimizations, Strix Halo/ROCm status, alert migration ... - gpu-fleet: documented parallel=2/batch=4096 optimizations for RTX 3090/5070 - gpu-fleet: added Strix Halo ROCm status (installed, blocked by HSA runtime on Debian 13) - gpu-fleet: documented alert migration from DM → #agent-hub stream topics - gpu-monitor: added Alert Delivery section with stream topic conventions - All GPU alerts now go to #agent-hub for cross-agent visibility	2026-07-01 22:25:26 +00:00
root	0c976ddbf7	feat: add 2 new failure modes — rate limiting and streaming fallback ... - Rate limiting during reconnection (429): honor retry-after headers - Placeholder edit fails silently: fallback to sending as new message - Both fixes deployed to pi Zulip extension	2026-06-30 22:56:09 +00:00
root	45641e7ae7	feat: gpu-monitor — real-time GPU fleet dashboard with live metrics ... - Polls GPU sidecars every 15s for temp, VRAM, power, utilization - Creates responsive HTML dashboard at /root/dashboard/gpu-fleet.html - Served via nginx at /gpu/ on CT 116 - PM2-managed gpu-monitor server on port 9100 - Tracks Strix Halo llama-server via SSH - Exposes JSON API at /gpu-data for integrations	2026-06-29 22:35:30 +00:00
root	4ee441f622	feat: zulip-adapter-lessons — document 8 known failure modes + deployment checklist ... Documents lessons from building pi Zulip extension and Hermes Zulip plugin: 1. Queue registration content-type 2. Missing bot_user_id for @mentions 3. Zero stream subscriptions 4. Stale errors never cleared 5. Stuck detection too aggressive 6. Env var name mismatch 7. Poll interval too aggressive 8. A2A port conflict Also: fixed Hermes adapter to clear stale errors on successful poll	2026-06-29 22:22:52 +00:00
root	1f90c3dc74	fix(pm2-self-heal): document permanent stuck-detection fix, reset PM2 counter ... Root cause: abiba-zulip extension had STUCK_THRESHOLD_MS=30min. After 30min of inactivity (overnight), it reported stuck=True, which triggered the health monitor to restart it — cycling restarts up to 18. Permanent fixes: 1. STUCK_THRESHOLD_MS raised 30min → 4 hours in extension index.js 2. PM2 restart counter reset: delete+re-add abiba-zulip (was 18, now 0) 3. pm2-self-heal.sh alert threshold documented at 30 (implementation already) 4. Prose contract updated with historical note and threshold rationale	2026-06-29 16:07:47 +00:00
root	85ce80cf2f	Merge branch 'master' of https://git.sysloggh.net/SyslogSolution/prose-contracts	2026-06-29 04:07:11 +00:00
root	aa55634571	feat: tighten contracts with GPU fleet topology, model routing, Strix Halo details ... litellm-health: added GPU fleet topology table, model routing map, 3-tier GPU checks (reachability, VRAM, temp, test inference) litellm-self-heal: added GPU fleet reference, rules for GPU unreachable and model not responding Infrastructure topology now fully documented: - amdpve: Strix Halo CPU (35B, 16 threads, 262K ctx, llama-server) - llm-gpu: RTX 3090 24GB (Dense tier) - ocu-llm: RTX 5070 12GB (MoE + Light tiers)	2026-06-29 04:07:05 +00:00
Jerome	9813c12895	v5: Full per-agent isolation separate ledgers, writer registries, canaries. No data crosses agent boundaries.	2026-06-29 01:47:10 +00:00
Jerome	9cf428579c	v4: Add Hermes agent roster (Mumuni, Tanko, Koby, Koonimo), per-agent isolation notes	2026-06-29 01:40:14 +00:00
Jerome	9ac383e812	v3: Add ledger, drift detection, canary checks, per-agent privacy, writer registry	2026-06-29 00:42:54 +00:00