From 7f5508c930793dcb067172bd6b3cf33f337cf12c Mon Sep 17 00:00:00 2001 From: jenkins Date: Thu, 6 Aug 2026 20:46:55 -0300 Subject: [PATCH] feat(ariadne): declare the fix categories, and show them beside the actions The three categories now appear in the deployment next to the action allowlist, and the monitor prints both at the policy gate so the difference is visible during a demo rather than asserted: two ids Ariadne may execute on its own authority, three categories it may only ask Hermes to propose a patch for. Co-Authored-By: Claude Opus 5 --- scripts/ops/hermes_triage_monitor.py | 5 +++++ services/maintenance/apps/ariadne-deployment.yaml | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/scripts/ops/hermes_triage_monitor.py b/scripts/ops/hermes_triage_monitor.py index 452dba36b..2cd0dbca0 100755 --- a/scripts/ops/hermes_triage_monitor.py +++ b/scripts/ops/hermes_triage_monitor.py @@ -302,6 +302,11 @@ def evidence_for(key: str, incident: str = "") -> None: "printenv", "ARIADNE_HERMES_ALLOWED_ACTIONS"], limit=2) run(["kubectl", "-n", NS_ARIADNE, "exec", "deploy/ariadne", "-c", "ariadne", "--", "printenv", "ARIADNE_HERMES_MIN_CONFIDENCE"], limit=2) + print(f" {DIM}a separate setting governs what Hermes may be asked to propose a fix" + f" for. It is separate because these become pull requests rather than" + f" changes Ariadne makes itself:{RESET}") + run(["kubectl", "-n", NS_ARIADNE, "exec", "deploy/ariadne", "-c", "ariadne", "--", + "printenv", "ARIADNE_HERMES_FIX_CATEGORIES"], limit=2) print() elif key == "route": if IS_CODE_JOB: diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml index 418453ffb..65b91d2d7 100644 --- a/services/maintenance/apps/ariadne-deployment.yaml +++ b/services/maintenance/apps/ariadne-deployment.yaml @@ -536,6 +536,12 @@ spec: # and expensive to read. Below this ceiling an open pull request on # a repository is no reason to withhold a fix for a different # failure; at it, new proposals wait. + # What Hermes may be asked to propose a fix for. Deliberately not + # in ARIADNE_HERMES_ALLOWED_ACTIONS: that list gates what Ariadne + # executes on its own authority, whereas everything here becomes a + # pull request a person reads before anything changes. + - name: ARIADNE_HERMES_FIX_CATEGORIES + value: lint_violation,undefined_name,failing_assertion - name: ARIADNE_HERMES_CODE_MAX_OPEN_PROPOSALS value: "64" - name: ARIADNE_HERMES_CODE_REPOS