From 84e9849e4645b7ffe9d05de3f9a2e1795b477c2f Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Wed, 5 Aug 2026 21:30:24 -0300
Subject: [PATCH] feat(hermes-triage): real-repo patch proposals + Alertmanager
 email escalation

- Ariadne: per-repo code config for metis, lesavka, soteria,
  bstein-dev-home and ariadne, each with its own base branch, source path
  prefixes and file suffixes so a proposal can only touch that repo's
  source tree
- Alertmanager: the only receiver was an empty "default", so every alert
  fired into a void. HermesTriageHumanRequired now routes to an email
  receiver via Mailu's in-cluster local-domain relay, with resolved
  notices; scoped to service=hermes-triage so nothing else mails yet.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../maintenance/apps/ariadne-deployment.yaml  | 13 +++++++++++++
 services/monitoring/helmrelease.yaml          | 19 +++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml
index 6e1e9eea7..1e0e3ca3f 100644
--- a/services/maintenance/apps/ariadne-deployment.yaml
+++ b/services/maintenance/apps/ariadne-deployment.yaml
@@ -515,6 +515,19 @@ spec:
               value: classification
             - name: ARIADNE_HERMES_ISSUE_MAX_PER_TICK
               value: "2"
+            # Homegrown repositories that may receive a Hermes patch proposal.
+            # Escalated incidents on these jobs get an issue AND, when the
+            # evidence implicates source files, a pull request on a
+            # hermes-repair/<build> branch. Path allowlists are per repo so a
+            # proposal can only ever touch that repo's source tree.
+            - name: ARIADNE_HERMES_CODE_REPOS
+              value: metis=bstein/metis,lesavka=bstein/lesavka,soteria=bstein/soteria,bstein-dev-home=bstein/bstein-dev-home,ariadne=bstein/ariadne
+            - name: ARIADNE_HERMES_CODE_BASE_BRANCHES
+              value: metis=master,lesavka=master,soteria=main,bstein-dev-home=master,ariadne=master
+            - name: ARIADNE_HERMES_CODE_PREFIXES
+              value: metis=cmd/|pkg/,lesavka=server/|client/|common/,soteria=cmd/|internal/,bstein-dev-home=backend/|frontend/,ariadne=ariadne/
+            - name: ARIADNE_HERMES_CODE_SUFFIXES
+              value: metis=.go,lesavka=.rs,soteria=.go,bstein-dev-home=.py|.ts|.tsx|.js,ariadne=.py
             - name: ARIADNE_HERMES_GITEA_TOKEN
               valueFrom:
                 secretKeyRef:
diff --git a/services/monitoring/helmrelease.yaml b/services/monitoring/helmrelease.yaml
index 7242b6c15..21b5ca75a 100644
--- a/services/monitoring/helmrelease.yaml
+++ b/services/monitoring/helmrelease.yaml
@@ -749,10 +749,29 @@ spec:
     config:
       global:
         resolve_timeout: 5m
+        # Mailu accepts relay for local domains from inside the cluster, so no
+        # submission credentials are needed for mail addressed to bstein.dev.
+        smtp_smarthost: mailu-front.mailu-mailserver.svc.cluster.local:25
+        smtp_from: alertmanager@bstein.dev
+        smtp_require_tls: false
       route:
         receiver: default
         group_wait: 30s
         group_interval: 5m
         repeat_interval: 2h
+        routes:
+          # Triage escalations are the only alerts mailed today; everything
+          # else stays on the silent default receiver until it is tuned.
+          - receiver: email
+            matchers:
+              - service = hermes-triage
+            group_wait: 60s
+            repeat_interval: 12h
       receivers:
         - name: default
+        - name: email
+          email_configs:
+            - to: brad@bstein.dev
+              send_resolved: true
+              headers:
+                Subject: '[atlas] {{ .Status | toUpper }} {{ .CommonLabels.alertname }} {{ .CommonLabels.jenkins_job }}/{{ .CommonLabels.build }}'