25 Commits

Include renames

Author	SHA1	Message	Date
root	8245716286	Remove all hardcoded credentials from repository ... Audit results (all patterns checked across .md, .prose.md, .sh, .py, .js, .ts, .json, .yaml, .yml, .env): - sk-or-v1 (OpenRouter): 0 occurrences - sk- prefix (20+ chars): 0 occurrences - sk_live: 0 occurrences - Bearer <key>: 0 occurrences - api_key: <value>: 0 occurrences - PASSWORD=: 0 occurrences - TOKEN=: 0 occurrences - SECRET=: 0 occurrences Files changed: - agent-zero-fix-summary.md (removed 2 OpenRouter keys) - agent-zero-openrouter-key.prose.md (removed 1 OpenRouter key) - hermes-key-enforcement.prose.md (removed 1 LiteLLM key, 1 external key) - litellm-api-keys.prose.md (removed 1 LiteLLM key) - litellm-self-heal.prose.md (removed 1 stale key reference) - scripts/agent-health-check.py (INFISICAL_TOKEN now required) - scripts/daily-infra-report.py (EMAIL_PASSWORD now required) - zulip-health.prose.md (TOKEN references annotated)	2026-09-17 06:11:42 +00:00
root	88b6decb31	fix: remove false Infisical claim - master key NOT in infrastructure project ... - Replace Infisical retrieval path with proven docker exec + .env note - State explicitly that master key is NOT in Infisical project=infrastructure - Keep the live-key check and never-trust-a-literal instruction - All other corrections from PR #95 preserved Signed-off-by: Abiba	2026-09-15 04:42:31 +00:00
root	dd9e68329e	fix: correct infisical --plain flag and use verified localhost:4000 endpoint ... - Replace broken --plain flag (prints nothing on CLI 0.43.110) with awk parsing - Note that --plain is broken so nobody fixes it back - Replace unproven nginx path with verified direct endpoint http://127.0.0.1:4000/key/list Signed-off-by: Abiba	2026-09-15 03:05:30 +00:00
root	cd9ec6a0df	fix: correct key-lifecycle contracts to match measured reality ... - hermes-key-enforcement.prose.md: - State that expiry must be set EXPLICITLY at creation with duration - Record that config default is NOT honoured by LiteLLM 1.99.1 - Describe daily audit as AUDIT-ONLY (reports non-expiring and soon-to-expire) - State that renewal is NOT implemented - Document exclusions: abiba-pi and all crewmate keys stay WITHOUT expiry - koby is report-only - litellm-api-keys.prose.md: - Replace literal master key with retrieval path (docker exec + infisical) - State that literal values must never be trusted again (key rotates) - Add live-key check (200 from /key/list) Signed-off-by: Abiba	2026-09-15 02:59:19 +00:00
root	3d55764799	no-mistakes(review): Split retired-alias audit into fail vs warn; fix key claim	2026-09-12 16:41:35 +00:00
abiba	221f9f79f3	fix(audit): reject retired aliases; sweep gpu-light/gemma-4-12b to gpu-vision ... audit-hermes-config.py Rule 8 required auxiliary.vision.model and auxiliary.web_extract.model to equal the retired 'gpu-light', so a config adopting the live canonical 'gpu-vision' FAILED our own audit - the audit was enforcing a dead alias (400 Invalid model name). Rule 8 now requires gpu-vision; retired names gpu-light/crew-auto join the raw-name rejection set; the guidance message names the live aliases. Sweep of the remaining references: gpu-self-heal stops canonicalizing gpu-light; hermes-config-template, hermes-agent-baseline, hermes-key-enforcement, inference-optimization, litellm-client-timeouts and gpu-fleet now use the live gpu-vision alias. Where a file restated model/rpm/weight/fallback state it now points at CT 116 /opt/inference-harness/litellm_config.yaml instead of duplicating it. koby's .129 config is report-only and recorded, not edited. Adds tests/test_audit_hermes_config_alias.py: executes the audit CLI and asserts gpu-vision passes while gpu-light and gemma-4-12b fail.	2026-09-12 16:11:46 +00:00
mumuni-bot	11076ad174	feat: add Agent Zero OpenRouter integration to litellm-api-keys ... - Added Agent Zero (kagentz .14) to .env fallback inventory - Documented direct OpenRouter API access (not via LiteLLM proxy) - Included key prefix, user ID, model config, and rotation procedure - Cross-referenced with agent-zero-openrouter-key.prose.md	2026-09-01 17:59:02 +00:00
mumuni-bot	e898048baf	fix: repoint Mumuni refs from CT100/.24 to kagentz CT105/.14 post-migration ... Mumuni migrated off Abiba CT100 (192.168.68.24, purged) to dedicated CT kagentz (192.168.68.14) on minipve. Verified live on kagentz: - Gateway: systemd unit hermes-gateway.service (User=hermes), active - Hermes home: /home/hermes/.hermes - gateway_state.json present at ~/.hermes/gateway_state.json Updates Mumuni rows/references in 9 contracts. Abiba-owned refs (.24 pi agent, GPU monitor, infrastructure-control CRITICAL file) and historical runs/ logs intentionally left unchanged. Per relay #738 follow-ups. Refs #735-#738.	2026-08-29 21:41:07 +00:00
root	3b6cf44a30	fix: update all Mumuni IP references from .123 to .24 (inside Abiba CT100) ... Mumuni CT114 destroyed. Mumuni now runs inside Abiba CT100 at 192.168.68.24. Updated all contract files and agent-health-check.py.	2026-07-28 08:56:45 +00:00
root	aebc98ead6	fix: remove trailing whitespace from litellm-api-keys.prose.md	2026-07-18 17:48:52 +00:00
root	17a77e6b3f	fix: fleet config issues from 2026-07-18 relay review ... - hermes-agent-baseline: add gpu-dense and gpu-light to models list - hermes-config-template: fix pgrep traps (exclude infisical wrapper) + add vault empty-key guard documentation in Rule 13 - litellm-api-keys: fix pgrep pattern in auditable check - scripts/agent-health-check: fix pgrep to exclude infisical bash wrapper Addresses issues found during relay inbox resolution session: 1. pgrep -f 'hermes_cli.main gateway run' matches both the real python gateway and the infisical bash wrapper, causing false health readings 2. infisical vault stores empty key silently — no guard/monitoring 3. gpu-dense/gpu-light stable aliases missing from baseline config	2026-07-18 17:39:46 +00:00
root	65c99dab50	contract: update litellm-api-keys to v2026-07-17 — fleet standardization ... - Document canonical systemd drop-in pattern (ExecStart= reset + wrapper) - Hardcode venv paths — never use variables in single-quoted bash -c - Update migration status: all 4 agents on while-true wrapper + st.8e848433 - Infisical CLI update procedure (0.38.0 → 0.43.109 via artifacts-cli) - Service token inventory + .env fallback inventory - Key rotation log: fleet standardize + tanko fix-zulip entries - Remove git merge conflict artifacts - Add fleet-wide standardization lessons section	2026-07-17 10:17:23 +00:00
root	8215b84f88	merge: resolve conflicts with master (delegation delete + gpu-fleet)	2026-07-16 21:22:34 +00:00
root	b7e23e2592	vault: Infisical cleanup + contract sync (WAL #1316) ... - litellm-api-keys: vault audit, tanko/koby/koonimo migration, key rotation log - gpu-fleet: ornith-1.0-35b→strix-moe (remaining refs) - hermes-agent-baseline: 256K all GPUs, CT IPs updated, Shumba retired - delegation-prose-contract: removed (renamed to mumuni-delegation) - contract-registry.yaml + cron-prompts-review.md: from feat/contract-registry	2026-07-16 21:17:09 +00:00
root	369c312ccb	vault: BAGGY_LITELLM_API_KEY deleted — one secret per agent	2026-07-16 19:54:51 +00:00
root	7f39a444d6	vault: BAGGY+LITELLM synced, deletion needs Infisical UI	2026-07-16 19:28:28 +00:00
Abiba	17f4c79fe4	vault: sync BAGGY_LITELLM_API_KEY = KOONIMO_LITELLM_API_KEY (same agent CT113) ... Baggy = Koonimo (CT 113). The vault had two divergent keys: - BAGGY_LITELLM_API_KEY = sk-QT-kDt8Szo... (stale, 401) - KOONIMO_LITELLM_API_KEY = sk-OEK7z26n6... (valid, 200, session-13 rotation) Synced BAGGY to match KOONIMO (the valid key). Added contract note: both secrets MUST mirror each other. This was the root cause of Koonimo's 401 after migration — the ghost process had BAGGY in its env instead of KOONIMO.	2026-07-16 19:22:48 +00:00
Abiba	a9caf5b216	vault: fix koby platform connectivity + document migration lessons ... Koby was broken after migration — Zulip credentials lost (only in process memory), Telegram token overwritten (only existed in old .env.bak-20260603). Fix: Koby shares Tanko's Zulip bot (tanko-bot@, TANKO_ZULIP_API_KEY in vault). Telegram token recovered from .env.bak-20260603. Both platforms now connected. Added Koby migration lessons to contract (back up .env before migration, inject ALL platform env vars, cat /proc/pid/environ before killing old gateway). Added KOBY_ZULIP_API_KEY to vault (shares Tanko's key).	2026-07-16 18:19:27 +00:00
Abiba	15a826457e	vault: canonical Production Vault Access Process + sync vault + migrate koby/koonimo ... - Vault SYNCED: mumuni/koby/koonimo rotated keys written to Infisical (all validate 200). Vault is source of truth again (was stale since session-13 rotations). - Koby (.129) + Koonimo (.114) migrated from hardcoded systemd drop-ins to infisical-gateway.sh wrapper (live vault injection, .env fallback safety net). 4/5 agents now vault-backed (abiba/mumuni/koby/koonimo). - New § Production Vault Access Process: canonical 7-step pattern, migration status table, key rotation procedure, why-it's-non-fail rationale. - Fixed stale notes: 'vault sync PENDING' (now synced), 'Abiba key IS master key' (now a proper agent key sk-sxbphLvk1OU). - Tanko (user jerome, not systemd) documented as pending migration. - hermes-key-enforcement: cross-ref to canonical process, drop-ins deprecated.	2026-07-16 17:51:53 +00:00
Abiba	d0feb7881e	Contracts: Rule 13 two key-injection patterns + koby/baggy rotation log (WAL #1300)	2026-07-16 15:10:50 +00:00
Abiba	39e2fa0cfa	Contracts: Mumuni context-fix (WAL #1300) — strix-moe, 256K all GPUs, Rule 12/13, machine-identity vault procedure	2026-07-16 13:57:31 +00:00
root	be02b0e843	fix: stale dates, context values, and architecture references ... - gpu-fleet: Updated all context references (128K→256K for RTX 3090). Fixed parallel count (2→1 for RTX 3090). Updated architecture diagram (router labeled deprecated/not in path). Corrected VRAM values. Updated dates: June→July 2026. - hermes-config-template: Fixed description (removed incorrect '128K on NVIDIA' claim). Updated to reflect verified 256K on RTX 3090. - litellm-self-heal: Updated last-verified date. - litellm-api-keys: Updated last-verified date.	2026-07-12 22:54:30 +00:00
root	79d4a73895	docs: lessons learned from 2026-07-12 session ... - gpu-fleet: Corrected architecture (direct GPU, no router in path). Updated context values (RTX 3090=256K, not 128K). Added api-key standardization requirement. - gpu-self-heal: Added Lessons Learned section with 5 critical findings: L1: API key standardization (RTX 5070 sk-loc...5678 vs not-needed) L2: Fallback chain cascading failure loop detection L3: Verify running state, not documentation L4: Infisical fallback requirement (.env must have uncommented key) L5: Zulip event queue can silently die after ~40 reconnects - litellm-self-heal: Updated status manual-only→deployed, cron schedule - litellm-api-keys: Added Infisical token expiry warning + .env fallback - hermes-config-template: Rule 3 updated with .env fallback requirement	2026-07-12 22:49:39 +00:00
root	a2c5a14c74	fix: LiteLLM contracts — align with 2026-07-08 architecture changes ... - litellm-health: v4.0.0 — Router removed from path (nginx→LiteLLM→GPU directly), GPU engines corrected (Docker→systemd), timeouts updated (gemma 120s, qwen 90s), Strix Halo: CPU→Vulkan, context sizes + parallel slots added - litellm-self-heal: ornith context 262K→256K, Rule 7 marked DEPRECATED (router not in path), GPU topology synced with gpu-fleet - litellm-api-keys: reference gpu-fleet as source of truth for keys, removed qwen3.6-35B-A3B from model list (never deployed)	2026-07-09 05:37:16 +00:00
root	895858c60a	feat: LiteLLM API key management contract + longevity policy ... - New contract: litellm-api-keys.prose.md — create/rotate/verify named API keys - Renamed tanko key alias from tanko-jul2026 to tanko (bare name) - Added Key Longevity Policy: permanent keys (duration:null), event-driven rotation - Added default_key_generate_params to litellm config (permanent + 00 budget) - Updated hermes-key-enforcement verified agents table for 2026-07-04	2026-07-04 22:48:48 +00:00