f8a529e196
Triage has only ever entered on a failure. Static analysis is the opposite shape - a standing backlog that never fails a build and so never asks anyone for attention. On this instance that backlog is 139 open findings on Ariadne alone, each already naming its file, its line, its rule and what is wrong. That is better-located evidence than the console text the code-repair flow normally mines, and it was being thrown away. This is a second way into the same flow, not a second flow. A scheduled sweep picks one finding and hands it to the existing proposal path, which is unchanged: Hermes returns a patch as data, Ariadne validates it against the file it names, pushes a branch, opens a pull request nobody merges. A finding arriving from outside the build is not a reason to relax the gates that make a proposal worth reading, so it does not. Three deliberate limits. Security hotspots are never fetched: SonarQube models them as needing human review, the quality gate here fails on exactly that condition, and an automation that resolved them would be marking them reviewed without review - defeating the control rather than satisfying it. Findings already marked won't-fix carry a judgement someone made, and reopening it produces pull requests that argue with a person. And the sweep proposes one fix per run by default, because 139 pull requests nobody reads would make the review gate theatre. Selection is by SonarQube's own effort estimate rather than severity: effort is the closest available proxy for the one-anchor change the patch validator can actually check, so a trivial CRITICAL beats an involved MINOR. An unparseable estimate is treated as ineligible, not as free. Off by default. Triage reacts to a failure someone already cares about; this opens pull requests nobody asked for, and that is a decision an operator makes deliberately rather than inherits on upgrade. Branch naming now sanitizes its token, since it arrives from a finding key as well as a build number and a ref is one of the few places where an unexpected character stops being cosmetic. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ariadne
Ariadne is the Atlas admin and account automation service.
It sits behind the portal and handles the jobs that are annoying or risky to do by hand: approving access, syncing account state, rotating service passwords, cleaning stale Kubernetes work, checking platform health, and keeping a few service integrations lined up.
How it works
Ariadne is a FastAPI service with a small scheduler. It talks to Keycloak, Vault, Mailu, Nextcloud, Wger, Firefly, Jenkins, Metis, Kubernetes, and a few Atlas-specific services through focused adapters under ariadne/services/.
The API is split between admin routes, account self-service routes, internal event hooks, and Prometheus metrics. Background jobs store run history in the Ariadne database so failures can be inspected later instead of vanishing into logs.
The following are notes for future Brad.
Bring-up dependencies
Ariadne needs:
- Kubernetes API, service DNS, and Ariadne's service account/RBAC
- the Ariadne database, plus the portal database if portal/account sync is enabled
- Vault or the Kubernetes secrets that Vault normally feeds it
- Keycloak/OIDC, because auth and profile sync assume it exists
- ingress/proxy plumbing if humans are going to use it through the portal
- the services for whatever jobs are enabled: Mailu, Nextcloud, Vaultwarden, Wger, Firefly, Jenkins, Metis, OpenSearch, and the comms/game-mode pieces
It can start before every integration is perfect, but the matching scheduled jobs will fail or no-op until their service is actually alive. In a total bring-up, wait for storage, Flux, Postgres, Vault, Keycloak, and ingress first. Afterwards Ariadne becomes useful glue.
Useful routes:
GET /healthGET /metricsGET /api/admin/cluster/statePOST /api/admin/access/requests/{username}/approvePOST /api/account/mailu/rotatePOST /api/account/wger/resetPOST /api/account/firefly/resetPOST /events
Development
python -m pytest
ruff check .
Most runtime behavior is configured through environment variables in ariadne/settings.py. Service-specific logic is in the small adapter modules; ariadne/app.py is focused on request flow and task orchestration.