diff --git a/services/hermes/configmap.yaml b/services/hermes/configmap.yaml index 8c397638c..51debef57 100644 --- a/services/hermes/configmap.yaml +++ b/services/hermes/configmap.yaml @@ -299,6 +299,16 @@ data: then resolve the reported hint claims before retrying. This needs operator approval because it can spend money or rerun an expensive generation. + ## Proof 5: live Hermes Soteria triage + + - Hermes read the fresh 2026-08-03 Ariadne bundle without an approval + timeout and chose Soteria build 270 as the worst terminal failure. + - It proved that all 318 tests passed and local coverage was 96.195%, then + isolated the enforced failure to SonarQube reporting new-code coverage + as 0.0%. It did not blame the optional supply-chain advisory. + - It kept running titan-iac, Data Prepper, and Lesavka builds out of the + terminal-failure list and requested approval before any rerun or edit. + ## Use Hermes next - `What is broken in the cluster right now?` diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml index 8fa2ec2b1..a09c54b73 100644 --- a/services/hermes/deployment.yaml +++ b/services/hermes/deployment.yaml @@ -24,7 +24,7 @@ spec: ai.bstein.dev/model: openai-codex/gpt-5.6-terra with local gpt-oss:20b fallback ai.bstein.dev/role: testing-triage ai.bstein.dev/placement: arm64 gateway lane (rpi5 preferred) - ai.bstein.dev/config-rev: "20260803-triage-proofs-and-smart-approvals" + ai.bstein.dev/config-rev: "20260803-all-service-triage-map" spec: serviceAccountName: hermes-triage automountServiceAccountToken: true diff --git a/services/hermes/skills/triage-atlas-service-health/references/service-map.md b/services/hermes/skills/triage-atlas-service-health/references/service-map.md index f8eefafb7..9d0105f1c 100644 --- a/services/hermes/skills/triage-atlas-service-health/references/service-map.md +++ b/services/hermes/skills/triage-atlas-service-health/references/service-map.md @@ -2,21 +2,21 @@ Use this map for ownership and canonical names. Discover third-party services live from Flux and Kubernetes. -| Capability | Canonical workload/repository | Notes | -| --- | --- | --- | -| Cluster automation and state analysis | Ariadne / `bstein/Ariadne` | Runs in `maintenance`; provides deterministic triage bundles. | -| Quality policy and CI telemetry | titan-iac / `bstein/titan-iac` | Owns Jenkins configuration, Grafana generators, alert provisioning, and Data Prepper pipeline. | -| Simulation registry and execution | Cassandra / Cassandra application repository | Cassandra is authoritative after the Veles migration. | -| Legacy simulation stack | Veles | Retired migration residue. Pod failures are not current impact; only a proven Cassandra dependency or broken redirect is actionable. | -| Backup and maintenance policy | Soteria / `bstein/soteria` | Backup inventory and maintenance signals run in `maintenance`. | -| Media client | Pegasus / `bstein/pegasus` | Correlate with Jellyfin and OIDC dependencies. | -| Cluster sentinel | Metis / `bstein/metis` | Runs through the maintenance stack. | -| User and service automation | Ananke / `bstein/ananke` | In-scope CI suite and custom software. | -| Chat automation | Atlasbot / `bstein/atlasbot` | In-scope CI suite and custom software. | -| Public site | bstein_home / `bstein/bstein-dev-home` | Canonical metric suite uses underscore form. | -| Data Prepper integration | data_prepper / `bstein/titan-iac` | Pipeline is under `services/logging`. | -| Desktop test application | Lesavka / `bstein/lesavka` | Test suite is in scope; some runtime evidence may come from titan-jh. | -| Hermes operator | `hermes` namespace / `services/hermes` | Read-only cluster operator with Codex primary and local fallback. | -| Hermes consumer chat | `hermes-chat` namespace / `services/hermes-chat` | Isolated from cluster operation; do not use it for infrastructure triage. | +| Capability | Canonical workload/repository | Runtime location | Notes | +| --- | --- | --- | --- | +| Cluster automation and state analysis | Ariadne / `bstein/Ariadne` | `maintenance/ariadne` | Provides deterministic triage bundles. | +| Quality policy and CI telemetry | titan-iac / `bstein/titan-iac` | Jenkins plus Flux; no single app Deployment | Owns Jenkins configuration, Grafana generators, alert provisioning, and the Data Prepper pipeline. | +| Simulation registry and execution | Cassandra / Cassandra application repository | `cassandra/cassandra-frontend`, `cassandra-backend`, `cassandra-postgres`, `cassandra-vault-sync` | Cassandra is authoritative after the Veles migration. | +| Legacy simulation stack | Veles | `veles` namespace | Retired migration residue. Pod failures are not current impact; only a proven Cassandra dependency or broken redirect is actionable. | +| Backup and maintenance policy | Soteria / `bstein/soteria` | `maintenance/soteria` | Correlate CI failures separately from runtime backup health. | +| Media client | Pegasus / `bstein/pegasus` | `jellyfin/pegasus` | Correlate with Jellyfin and OIDC dependencies. | +| Cluster sentinel | Metis / `bstein/metis` | `maintenance/metis` plus sentinel DaemonSets | Distinguish controller health from per-node sentinel evidence. | +| User and service automation | Ananke / `bstein/ananke` | No current dedicated in-cluster Deployment | Treat its Jenkins suite as the authoritative runtime evidence unless discovery proves otherwise. | +| Chat automation | Atlasbot / `bstein/atlasbot` | `comms/atlasbot` | Correlate with comms and OIDC dependencies. | +| Public site | bstein_home / `bstein/bstein-dev-home` | `bstein-dev-home` frontend, backend, and Vault sync | Canonical metric suite uses underscore form. | +| Data Prepper integration | data_prepper / `bstein/titan-iac` | `logging/data-prepper` | Pipeline is under `services/logging`. | +| Desktop test application | Lesavka / `bstein/lesavka` | Desktop test host, not a normal Kubernetes Deployment | Test suite is in scope; runtime evidence may come from titan-jh. | +| Hermes operator | `hermes` namespace / `services/hermes` | `hermes/hermes`, model gate, and Ollama | Read-only cluster operator with Codex primary and local fallback. | +| Hermes consumer chat | `hermes-chat` namespace / `services/hermes-chat` | `hermes-chat/hermes-chat` | Isolated from cluster operation; do not use it for infrastructure triage. | Canonical CI suites are `ananke`, `ariadne`, `atlasbot`, `bstein_home`, `data_prepper`, `lesavka`, `metis`, `pegasus`, `soteria`, and `titan_iac`. diff --git a/services/hermes/skills/triage-titan-test-failures/SKILL.md b/services/hermes/skills/triage-titan-test-failures/SKILL.md index 7cd837c72..013ede383 100644 --- a/services/hermes/skills/triage-titan-test-failures/SKILL.md +++ b/services/hermes/skills/triage-titan-test-failures/SKILL.md @@ -37,6 +37,11 @@ Treat Ariadne's bundle as the evidence source of truth. A local-model diagnosis - Ariadne runs as the `ariadne` Deployment and Service in the `maintenance` namespace. - Hermes local inference runs through `hermes-model-gate` in the `hermes` namespace. Ollama is the `hermes-ollama` Deployment and Service in that namespace. - OpenClaw is not part of this inference path. Never suggest an `openclaw` resource unless a read-only query first proves one exists. +- Custom runtime namespaces do not always match suite names. In particular, + Soteria, Metis, and Ariadne run in `maintenance`; Pegasus runs in `jellyfin`; + Atlasbot runs in `comms`; Data Prepper runs in `logging`; and Lesavka is a + desktop-hosted application. Read the service-health skill's + `references/service-map.md` before claiming that a suite has no runtime. - A connection error recorded inside an older diagnosis proves only that the model request failed at that timestamp. It does not prove the service is currently down. - Never invent a namespace, workload, container, port, URL, log line, metric, commit, or pod condition. Verify a target with a read-only query before presenting an exact follow-up command; otherwise state what must be discovered first. - HTTP POST collection and diagnosis endpoints are state-changing operations. Put them only under `Approval required`; never describe them as read-only or include them in the read-only command list.