25 Commits

Include renames

Author	SHA1	Message	Date
root	ce48070f21	no-mistakes(review): Derive model fields recursively; fix historical latency and key claims	2026-09-12 16:33:58 +00:00
root	9e581ab203	no-mistakes(review): Complete retired-alias field coverage; fix misleading example labels	2026-09-12 16:26:14 +00:00
root	9cac3589cf	no-mistakes(review): Fix compression example alias; make retired aliases fail audit	2026-09-12 16:19:43 +00:00
abiba	221f9f79f3	fix(audit): reject retired aliases; sweep gpu-light/gemma-4-12b to gpu-vision ... audit-hermes-config.py Rule 8 required auxiliary.vision.model and auxiliary.web_extract.model to equal the retired 'gpu-light', so a config adopting the live canonical 'gpu-vision' FAILED our own audit - the audit was enforcing a dead alias (400 Invalid model name). Rule 8 now requires gpu-vision; retired names gpu-light/crew-auto join the raw-name rejection set; the guidance message names the live aliases. Sweep of the remaining references: gpu-self-heal stops canonicalizing gpu-light; hermes-config-template, hermes-agent-baseline, hermes-key-enforcement, inference-optimization, litellm-client-timeouts and gpu-fleet now use the live gpu-vision alias. Where a file restated model/rpm/weight/fallback state it now points at CT 116 /opt/inference-harness/litellm_config.yaml instead of duplicating it. koby's .129 config is report-only and recorded, not edited. Adds tests/test_audit_hermes_config_alias.py: executes the audit CLI and asserts gpu-vision passes while gpu-light and gemma-4-12b fail.	2026-09-12 16:11:46 +00:00
mumuni-bot	e898048baf	fix: repoint Mumuni refs from CT100/.24 to kagentz CT105/.14 post-migration ... Mumuni migrated off Abiba CT100 (192.168.68.24, purged) to dedicated CT kagentz (192.168.68.14) on minipve. Verified live on kagentz: - Gateway: systemd unit hermes-gateway.service (User=hermes), active - Hermes home: /home/hermes/.hermes - gateway_state.json present at ~/.hermes/gateway_state.json Updates Mumuni rows/references in 9 contracts. Abiba-owned refs (.24 pi agent, GPU monitor, infrastructure-control CRITICAL file) and historical runs/ logs intentionally left unchanged. Per relay #738 follow-ups. Refs #735-#738.	2026-08-29 21:41:07 +00:00
root	994ae1b7ac	fix: standardize base URLs to authenticated /litellm/v1 path in remaining contracts ... - Update hermes-agent-baseline.prose.md: change /v1 → /litellm/v1 in all base_url references - Update hermes-key-enforcement.prose.md: change workaround section base_url to /litellm/v1 - Ensures all contracts consistently use the authenticated LiteLLM path - DeepSeek harness exemption remains documented for external providers	2026-08-28 15:32:24 +00:00
root	9f0a940cee	Fix no-mistakes warnings: prose out of YAML fence, Rule 16 rename, table cell fix	2026-08-11 18:02:08 +00:00
root	5c3ba31b17	Ship: Koby external-agent ruling (Resolve conflict and merge master)	2026-08-11 17:48:36 +00:00
root	d0144d6db6	Ship: Koby external-agent ruling (fix api_key_env hygiene + docs)	2026-08-11 17:22:25 +00:00
root	38a32f8b32	Ship: enforcement-rules-reality-fix (captain directive 2026-08-09)	2026-08-10 13:28:53 +00:00
root	93fb0d8e1e	feat(contracts): add MCP URL validation and verify virtual keys on LiteLLM	2026-08-07 21:33:59 +00:00
root	3b6cf44a30	fix: update all Mumuni IP references from .123 to .24 (inside Abiba CT100) ... Mumuni CT114 destroyed. Mumuni now runs inside Abiba CT100 at 192.168.68.24. Updated all contract files and agent-health-check.py.	2026-07-28 08:56:45 +00:00
Abiba	15a826457e	vault: canonical Production Vault Access Process + sync vault + migrate koby/koonimo ... - Vault SYNCED: mumuni/koby/koonimo rotated keys written to Infisical (all validate 200). Vault is source of truth again (was stale since session-13 rotations). - Koby (.129) + Koonimo (.114) migrated from hardcoded systemd drop-ins to infisical-gateway.sh wrapper (live vault injection, .env fallback safety net). 4/5 agents now vault-backed (abiba/mumuni/koby/koonimo). - New § Production Vault Access Process: canonical 7-step pattern, migration status table, key rotation procedure, why-it's-non-fail rationale. - Fixed stale notes: 'vault sync PENDING' (now synced), 'Abiba key IS master key' (now a proper agent key sk-sxbphLvk1OU). - Tanko (user jerome, not systemd) documented as pending migration. - hermes-key-enforcement: cross-ref to canonical process, drop-ins deprecated.	2026-07-16 17:51:53 +00:00
root	79d4a73895	docs: lessons learned from 2026-07-12 session ... - gpu-fleet: Corrected architecture (direct GPU, no router in path). Updated context values (RTX 3090=256K, not 128K). Added api-key standardization requirement. - gpu-self-heal: Added Lessons Learned section with 5 critical findings: L1: API key standardization (RTX 5070 sk-loc...5678 vs not-needed) L2: Fallback chain cascading failure loop detection L3: Verify running state, not documentation L4: Infisical fallback requirement (.env must have uncommented key) L5: Zulip event queue can silently die after ~40 reconnects - litellm-self-heal: Updated status manual-only→deployed, cron schedule - litellm-api-keys: Added Infisical token expiry warning + .env fallback - hermes-config-template: Rule 3 updated with .env fallback requirement	2026-07-12 22:49:39 +00:00
root	35e864bdb7	audit: all 4 Hermes agents verified — no master key, api_key workaround applied ... Agent audit (2026-07-05): Tanko CT 112: sk-CggiHWlamQyShxWC3Hx6uw — vision+compression patched Mumuni CT 114: sk-VrqCNlwUgzoNGOpikJ7nwQ — vision patched Tdunna CT 111: sk-6sbCNjz2T6lTVDBdlNHXsA — vision+compression patched Baggy CT 113: sk-krnw_zGBwvvL5b7l2t-s-A — vision+compression patched All 4 agents: zero master key references, dedicated LiteLLM keys, api_key workaround applied to bypass auxiliary_client bug.	2026-07-05 23:36:00 +00:00
root	53d4290886	docs: document auxiliary_client api_key_env bug + workaround ... _resolve_task_provider_model() in agent/auxiliary_client.py ignores api_key_env for auxiliary tasks (vision, compression). The custom provider path resolves it, but aux tasks take a different code path. Workaround: set api_key directly alongside api_key_env. Applied to Tanko (vision + compression).	2026-07-05 23:17:37 +00:00
root	c8dcd8b63d	fix: Tanko key regenerated, Mumuni key verified from /etc/environment ... Tanko: old key sk-620a05e95a... was from docker-compose router config, not LiteLLM key DB. Deleted + regenerated via LiteLLM API: sk-CggiHWlamQyShxWC3Hx6uw (alias: tanko, budget: $100) Mumuni: verified via pct-run 114 — key is sk-VrqCNlwUgzoNGOpikJ7nwQ (was previously listed as sk-XY2aUfvy2... in contracts)	2026-07-05 20:18:05 +00:00
root	5c90eb8f6c	rename: Koonimo→Baggy, Koby→Tdunna — match hostnames ... Standardize agent names across all contracts and pct-run.sh. No functional changes — same CT IDs, same keys, same nodes.	2026-07-05 20:04:22 +00:00
root	0db95a4d1c	fix: correct IPs, CT IDs, and key status across all contracts ... hermes-key-enforcement.prose.md: - Add IP column to verified agents table - Fix Tanko status: was using master key via systemd drop-in (not compliant) - Add detection query step 2: check systemd drop-ins for master key leaks - Add step 3: verify running process env against dedicated key - Mark Mumuni, Koby, Koonimo as Unverified (last check was surface-level only) gpu-fleet.prose.md: - Add CT ID column to agent table for cross-reference - Fix Abiba IP .24 → .65 (pi agent runs on RA-H OS host) - Update Abiba LiteLLM key to match actual models.json key - Set Koonimo IP to unknown (was .114 — incorrect per user) - Fix pi-specific paths .24 → .65 hermes-config-template.prose.md: - Set Koonimo IP to unknown infrastructure-control.prose.md: - Set Koonimo IP to unknown - Fix Koonimo CT reference	2026-07-05 19:58:14 +00:00
root	7ce6cad01f	fix: incorporate Mumuni review — recursive detection query + safe-mutate cross-reference ... Test results: - Test #1: Recursive grep finds sub-profile violations old query missed (2/2 vs 1/2) - Test #2: safe-mutate step correctly positioned in Violation Response, YAML valid	2026-07-05 08:49:58 +00:00
root	889f4e4dd1	docs: update key enforcement — all agents named keys, systemd fix, CI pipeline ... - All 4 Hermes agents now have dedicated named LiteLLM keys (tanko, mumuni, koby, koonimo) - Documented systemd drop-in pattern fix (litellm-key.conf) - Added one-step rotation procedure - Added CI pipeline and branch protection documentation - Removed old mumuni keys, generated fresh keys for koby/koonimo	2026-07-04 23:28:59 +00:00
root	b669d1becf	fix: remove Node.js dependency from CI pipeline + add enforcement kind ... - Removed actions/checkout@v4 (requires Node.js, unavailable on runner) - Gitea act runner provides repo checkout automatically - Added 'enforcement' to valid kind list for hermes-key-enforcement - All steps are now pure shell — zero external dependencies	2026-07-04 22:54:42 +00:00
root	ae5fb4d335	ci: verify pipeline with Node.js on runner CT 110	2026-07-04 22:53:25 +00:00
root	895858c60a	feat: LiteLLM API key management contract + longevity policy ... - New contract: litellm-api-keys.prose.md — create/rotate/verify named API keys - Renamed tanko key alias from tanko-jul2026 to tanko (bare name) - Added Key Longevity Policy: permanent keys (duration:null), event-driven rotation - Added default_key_generate_params to litellm config (permanent + 00 budget) - Updated hermes-key-enforcement verified agents table for 2026-07-04	2026-07-04 22:48:48 +00:00
Abiba	c1bdbbc491	2026-07-03: Hermes key enforcement contract + Stirling-PDF docs + config standardization ... - hermes-key-enforcement.prose.md: NEW contract enforcing api_key_env for all harness/LiteLLM providers, exempting external providers - hermes-config-template.prose.md: Updated with full fix log (15 total fixes across Koby/Koonimo/Mumuni/Tanko), model:auto detection rule, key-to-agent mapping - infrastructure-control.prose.md: Added Stirling-PDF service details (port 8989, credentials, API key, Swagger URL) replacing Bento-PDF	2026-07-03 18:19:41 +00:00