18 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
root	b3ab3a6850	fix: remove all Gitea expression syntax from ai-review script	2026-07-04 23:09:29 +00:00
root	105844cf7b	fix: ai-review script — handle Gitea env vars + push event diffs	2026-07-04 23:08:19 +00:00
root	52566ff36e	fix: remove test file, add missing descriptions to zulip-health + memory-audit-maintenance	2026-07-04 23:06:40 +00:00
root	36da6cb1f7	fix: use http://git.sysloggh.net for checkout (no TLS inside network)	2026-07-04 23:00:55 +00:00
root	3dd2698ef8	fix: add native git checkout + fix validator increment/exit bugs ... - Replaced actions/checkout@v4 with native git clone (no Node.js needed) - Fixed FAILED counter: increment instead of resetting to 1 - Fixed exit condition: -gt 0 instead of -eq 1 (caught >1 violation) - Test-violations.prose.md still present — pipeline should now catch it	2026-07-04 23:00:03 +00:00
root	89af42fa4c	test: intentional violations — should fail pipeline	2026-07-04 22:58:15 +00:00
root	b669d1becf	fix: remove Node.js dependency from CI pipeline + add enforcement kind ... - Removed actions/checkout@v4 (requires Node.js, unavailable on runner) - Gitea act runner provides repo checkout automatically - Added 'enforcement' to valid kind list for hermes-key-enforcement - All steps are now pure shell — zero external dependencies	2026-07-04 22:54:42 +00:00
root	ae5fb4d335	ci: verify pipeline with Node.js on runner CT 110	2026-07-04 22:53:25 +00:00
root	d27892f7a5	ci: trigger pipeline — Node.js installed on runner CT 110	2026-07-04 22:52:37 +00:00
root	031a8253c7	fix: add push trigger for master branch to CI pipeline ... Previously the pipeline only triggered on pull_request events. Direct pushes to master bypassed all validation (auth, lint, ai-review). Now push to master also triggers the pipeline.	2026-07-04 22:50:02 +00:00
root	895858c60a	feat: LiteLLM API key management contract + longevity policy ... - New contract: litellm-api-keys.prose.md — create/rotate/verify named API keys - Renamed tanko key alias from tanko-jul2026 to tanko (bare name) - Added Key Longevity Policy: permanent keys (duration:null), event-driven rotation - Added default_key_generate_params to litellm config (permanent + 00 budget) - Updated hermes-key-enforcement verified agents table for 2026-07-04	2026-07-04 22:48:48 +00:00
root	4eec96b851	docs: link authoring guide from AGENTS.md	2026-07-04 22:31:44 +00:00
root	436f583882	docs: add prose contract authoring guide (Anthropic-inspired) ... NEW: docs/AUTHORING-GUIDE.md — canonical style guide for writing contracts Patterns borrowed from Anthropic's frontend-design skill: - Ground it in the subject: verify live state before writing - Two-pass process: draft → critique → revise → ship - Restraint: one contract, one concern; cut one thing before shipping - Self-critique: would an agent trust this at 3am with 30s of context? Core rules: - Specificity over generality (lists rot, vagueness is invisible) - Live-state fields in tables, not prose (grep-able) - Descriptions answer: what, to what, why care? - Templates for function and responsibility contracts - CI enforces structure; author enforces quality Linked from AGENTS.md for agent discovery.	2026-07-04 22:31:33 +00:00
root	57605c6f16	docs: add AGENTS.md + authorization enforcement gates ... NEW: AGENTS.md — complete agent workflow documentation - Step-by-step PR workflow for all agents - Authorization matrix (who can change which contracts) - Emergency bypass procedure - Quick start commands NEW: scripts/prose-auth-check.sh — authorization enforcement - Blocks unauthorized agents from changing CRITICAL contracts - infrastructure-control, proxmox-monitor: abiba only - hermes-config-template: abiba, mumuni, tanko - zulip-health: abiba, mumuni - All scripts: abiba only - Fails CI if unauthorized changes detected UPDATED: .gitea/workflows/pr-pipeline.yaml - Added Stage 0: auth check (runs first) - Added gate job that confirms all 4 checks passed - Expanded trigger paths to include scripts/*.sh UPDATED: branch protection — now requires 4 contexts: pr-pipeline / auth, validate, lint, ai-review	2026-07-04 22:25:05 +00:00
root	263c4080f3	ci: add automated PR validation pipeline + fix regressions ... NEW: Gitea Actions CI pipeline (.gitea/workflows/pr-pipeline.yaml) - Stage 1 (validate): YAML frontmatter validation for all .prose.md files - Stage 2 (lint): Structural checks + regression detection * /grafana/ nginx route (reverted 2026-07-02) * Stale CT IDs (122→112, no 123) * Verified: .19/.122/.123 = correct bridge IPs - Stage 3 (ai-review): LiteLLM-powered diff review against ground truth - Stage 4 (auto-merge): Gate — safe to merge when all green NEW: scripts/prose-lint.sh — contract structure + regression checker NEW: scripts/prose-ai-review.sh — AI review via syslog-auto model FIXES FOUND BY LINT: - gpu-fleet.prose.md: removed /grafana/ from nginx routing diagram - gpu-fleet.prose.md: removed /grafana/ from config file description - infrastructure-control.prose.md: CT 122→112 in topology diagram - scripts/prose-lint.sh: updated to not flag .19 (verified correct IP)	2026-07-04 22:13:51 +00:00
root	dd985f0e49	pm2-self-heal: migrate alerts from Zulip to Telegram ... - abiba-zulip PM2 process decommissioned (2026-07-04) - Replace Zulip stream alerts (agent-hub > alerts-pm2) with Telegram DM - Remove stale abiba-zulip monitoring block (process no longer exists) - Retain abiba-telegram auto-restart (critical — sole communication bridge) - Token sourced from extension .env, not hardcoded	2026-07-04 22:07:35 +00:00
root	0d0215e9dd	prose: annotate infrastructure-monitoring with current deployment status ... - Core stack (Prometheus + Grafana + pve/node/docker exporters) already deployed by proxmox-monitor contract (Jul 2) - GPU exporters (.8/.110/.15) NOT yet live — gpu-exporter crash-loops, sidecars never deployed - Strike nginx /monitoring/ proxy suggestion (sub-path pattern already tried and reverted for /grafana/ per proxmox-monitor) - Add cross-reference: this contract defines target state, proxmox-monitor is the as-built	2026-07-04 21:55:43 +00:00
root	253e19f680	prose: review, fix, and consolidate infrastructure contracts ... - DELETE infrastructure-monitoring.prose.md (redundant — proxmox-monitor already deployed this) - FIX infrastructure-control.prose.md: remove /grafana/ nginx route (reverted Jul 2, broke gpu-fleet) - FIX infrastructure-update.prose.md: wrong CT IDs (122→112 Tanko, 123→114 Mumuni, .19→storepve Zulip) - FIX infrastructure-update.prose.md: Strix Halo :8080→router health check (firewalled to .116 only) - FIX proxmox-monitor.prose.md: stale /grafana/ URLs→:3001 (post-revert cleanup) - ADD disk-gc-threat-response.prose.md: verified run (2026-07-04, reclaimed 35.67GB from kagentz) - ADD infrastructure-update.prose.md, pi-approval-architecture.prose.md, zulip-approval-fix.prose.md, zulip-self-heal.prose.md - UPDATE hermes-config, litellm-health/self-heal, pm2-self-heal, zulip-* contracts - ADD runs/20260704-005804-51f9a9 (disk-gc-threat-response run artifacts) All contracts verified against live PVE API, nginx config, and firewall state.	2026-07-04 21:47:33 +00:00