fix: incorporate Mumuni review — recursive detection query + safe-mutate cross-reference

Test results: - Test #1: Recursive grep finds sub-profile violations old query missed (2/2 vs 1/2) - Test #2: safe-mutate step correctly positioned in Violation Response, YAML valid
fix: remove hardcoded LiteLLM defaults — rely on Gitea secrets
2026-07-05 08:49:58 +00:00 · 2026-07-04 23:33:34 +00:00 · 2026-07-04 23:32:19 +00:00 · 2026-07-04 23:15:56 +00:00
2 changed files with 6 additions and 4 deletions
@@ -74,8 +74,9 @@ model:
 Run on any Hermes host to detect violations:

 ```bash
-grep -n 'api_key: sk-' /root/.hermes/config.yaml \
-  | grep -v 'deepseek\|b7d9\|openai\|anthropic\|DEEPSEEK'
+grep -rn 'api_key: sk-' /root/.hermes/ \
+  --include='config.yaml' \
+  | grep -v 'deepseek\|openai\|anthropic\|DEEPSEEK'
 ```

 If any output — violation. Fix immediately.
@@ -157,6 +158,7 @@ EnvironmentFile=/etc/environment
 4. **Restart** — gateway must restart to pick up env var
 5. **Confirm** — test key against LiteLLM: `curl -H "Authorization: Bearer $KEY" .../v1/models` → 200
 6. **Update** — bump the verified table above
+7. **Use safe-mutate** — if the fix requires changing `/etc/environment` or restarting the gateway on a remote host, use `safe-mutate` to verify current state before mutating.

 ## Related Contracts

@@ -4,8 +4,8 @@
 # Posts review comments via Gitea API.
 set -euo pipefail

-LITELLM_URL="${LITELLM_URL:-https://litellm.sysloggh.net}"
-LITELLM_KEY="${LITELLM_KEY:-sk-litellm-7f96080dd99b15c36bd4b333b58a6796}"
+LITELLM_URL="${LITELLM_URL:-}"
+LITELLM_KEY="${LITELLM_KEY:-}"
 GITEA_TOKEN="${GITEA_TOKEN:-$(grep GITEA_TOKEN /root/.pi/agent/extensions/telegram/.env 2>/dev/null | cut -d= -f2 || echo '')}"
 GITEA_API="https://git.sysloggh.net/api/v1"
Author	SHA1	Message	Date
root	7ce6cad01f	fix: incorporate Mumuni review — recursive detection query + safe-mutate cross-reference Test results: - Test #1: Recursive grep finds sub-profile violations old query missed (2/2 vs 1/2) - Test #2: safe-mutate step correctly positioned in Violation Response, YAML valid	2026-07-05 08:49:58 +00:00
root	9cf6304e23	fix: remove hardcoded LiteLLM defaults — rely on Gitea secrets PR Pipeline — Authorize → Validate → Review → Merge / auth (push) Successful in 2s Details PR Pipeline — Authorize → Validate → Review → Merge / validate (push) Successful in 3s Details PR Pipeline — Authorize → Validate → Review → Merge / lint (push) Successful in 3s Details PR Pipeline — Authorize → Validate → Review → Merge / ai-review (push) Successful in 2s Details PR Pipeline — Authorize → Validate → Review → Merge / gate (push) Successful in 1s Details	2026-07-04 23:33:34 +00:00
root	91ec7ea3d2	Merge PR #1 : docs: update key enforcement — all agents named keys, systemd fix, CI pipeline PR Pipeline — Authorize → Validate → Review → Merge / auth (push) Successful in 2s Details PR Pipeline — Authorize → Validate → Review → Merge / validate (push) Successful in 3s Details PR Pipeline — Authorize → Validate → Review → Merge / lint (push) Successful in 2s Details PR Pipeline — Authorize → Validate → Review → Merge / ai-review (push) Failing after 3s Details PR Pipeline — Authorize → Validate → Review → Merge / gate (push) Has been skipped Details	2026-07-04 23:32:19 +00:00
root	cd7d038f91	ci: verify branch protection — abiba-bot push should work	2026-07-04 23:15:56 +00:00