bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(hermes): map custom service runtimes

Browse Source
This commit is contained in:
jenkins 2026-08-03 04:37:07 -03:00
parent fdb74fa9f9
commit c91ad76fdf
4 changed files with 32 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
services/hermes/configmap.yaml
View File

@ -299,6 +299,16 @@ data:
then resolve the reported hint claims before retrying. This needs operator then resolve the reported hint claims before retrying. This needs operator
approval because it can spend money or rerun an expensive generation. approval because it can spend money or rerun an expensive generation.
## Proof 5: live Hermes Soteria triage
- Hermes read the fresh 2026-08-03 Ariadne bundle without an approval
timeout and chose Soteria build 270 as the worst terminal failure.
- It proved that all 318 tests passed and local coverage was 96.195%, then
isolated the enforced failure to SonarQube reporting new-code coverage
as 0.0%. It did not blame the optional supply-chain advisory.
- It kept running titan-iac, Data Prepper, and Lesavka builds out of the
terminal-failure list and requested approval before any rerun or edit.
## Use Hermes next ## Use Hermes next
- `What is broken in the cluster right now?` - `What is broken in the cluster right now?`

2
services/hermes/deployment.yaml
View File

@ -24,7 +24,7 @@ spec:
ai.bstein.dev/model: openai-codex/gpt-5.6-terra with local gpt-oss:20b fallback ai.bstein.dev/model: openai-codex/gpt-5.6-terra with local gpt-oss:20b fallback
ai.bstein.dev/role: testing-triage ai.bstein.dev/role: testing-triage
ai.bstein.dev/placement: arm64 gateway lane (rpi5 preferred) ai.bstein.dev/placement: arm64 gateway lane (rpi5 preferred)
ai.bstein.dev/config-rev: "20260803-triage-proofs-and-smart-approvals" ai.bstein.dev/config-rev: "20260803-all-service-triage-map"
spec: spec:
serviceAccountName: hermes-triage serviceAccountName: hermes-triage
automountServiceAccountToken: true automountServiceAccountToken: true

32
services/hermes/skills/triage-atlas-service-health/references/service-map.md
View File

@ -2,21 +2,21 @@
Use this map for ownership and canonical names. Discover third-party services live from Flux and Kubernetes. Use this map for ownership and canonical names. Discover third-party services live from Flux and Kubernetes.
| Capability | Canonical workload/repository | Notes | | Capability | Canonical workload/repository | Runtime location | Notes |
| --- | --- | --- | | --- | --- | --- | --- |
| Cluster automation and state analysis | Ariadne / `bstein/Ariadne` | Runs in `maintenance`; provides deterministic triage bundles. | | Cluster automation and state analysis | Ariadne / `bstein/Ariadne` | `maintenance/ariadne` | Provides deterministic triage bundles. |
| Quality policy and CI telemetry | titan-iac / `bstein/titan-iac` | Owns Jenkins configuration, Grafana generators, alert provisioning, and Data Prepper pipeline. | | Quality policy and CI telemetry | titan-iac / `bstein/titan-iac` | Jenkins plus Flux; no single app Deployment | Owns Jenkins configuration, Grafana generators, alert provisioning, and the Data Prepper pipeline. |
| Simulation registry and execution | Cassandra / Cassandra application repository | Cassandra is authoritative after the Veles migration. | | Simulation registry and execution | Cassandra / Cassandra application repository | `cassandra/cassandra-frontend`, `cassandra-backend`, `cassandra-postgres`, `cassandra-vault-sync` | Cassandra is authoritative after the Veles migration. |
| Legacy simulation stack | Veles | Retired migration residue. Pod failures are not current impact; only a proven Cassandra dependency or broken redirect is actionable. | | Legacy simulation stack | Veles | `veles` namespace | Retired migration residue. Pod failures are not current impact; only a proven Cassandra dependency or broken redirect is actionable. |
| Backup and maintenance policy | Soteria / `bstein/soteria` | Backup inventory and maintenance signals run in `maintenance`. | | Backup and maintenance policy | Soteria / `bstein/soteria` | `maintenance/soteria` | Correlate CI failures separately from runtime backup health. |
| Media client | Pegasus / `bstein/pegasus` | Correlate with Jellyfin and OIDC dependencies. | | Media client | Pegasus / `bstein/pegasus` | `jellyfin/pegasus` | Correlate with Jellyfin and OIDC dependencies. |
| Cluster sentinel | Metis / `bstein/metis` | Runs through the maintenance stack. | | Cluster sentinel | Metis / `bstein/metis` | `maintenance/metis` plus sentinel DaemonSets | Distinguish controller health from per-node sentinel evidence. |
| User and service automation | Ananke / `bstein/ananke` | In-scope CI suite and custom software. | | User and service automation | Ananke / `bstein/ananke` | No current dedicated in-cluster Deployment | Treat its Jenkins suite as the authoritative runtime evidence unless discovery proves otherwise. |
| Chat automation | Atlasbot / `bstein/atlasbot` | In-scope CI suite and custom software. | | Chat automation | Atlasbot / `bstein/atlasbot` | `comms/atlasbot` | Correlate with comms and OIDC dependencies. |
| Public site | bstein_home / `bstein/bstein-dev-home` | Canonical metric suite uses underscore form. | | Public site | bstein_home / `bstein/bstein-dev-home` | `bstein-dev-home` frontend, backend, and Vault sync | Canonical metric suite uses underscore form. |
| Data Prepper integration | data_prepper / `bstein/titan-iac` | Pipeline is under `services/logging`. | | Data Prepper integration | data_prepper / `bstein/titan-iac` | `logging/data-prepper` | Pipeline is under `services/logging`. |
| Desktop test application | Lesavka / `bstein/lesavka` | Test suite is in scope; some runtime evidence may come from titan-jh. | | Desktop test application | Lesavka / `bstein/lesavka` | Desktop test host, not a normal Kubernetes Deployment | Test suite is in scope; runtime evidence may come from titan-jh. |
| Hermes operator | `hermes` namespace / `services/hermes` | Read-only cluster operator with Codex primary and local fallback. | | Hermes operator | `hermes` namespace / `services/hermes` | `hermes/hermes`, model gate, and Ollama | Read-only cluster operator with Codex primary and local fallback. |
| Hermes consumer chat | `hermes-chat` namespace / `services/hermes-chat` | Isolated from cluster operation; do not use it for infrastructure triage. | | Hermes consumer chat | `hermes-chat` namespace / `services/hermes-chat` | `hermes-chat/hermes-chat` | Isolated from cluster operation; do not use it for infrastructure triage. |
Canonical CI suites are `ananke`, `ariadne`, `atlasbot`, `bstein_home`, `data_prepper`, `lesavka`, `metis`, `pegasus`, `soteria`, and `titan_iac`. Canonical CI suites are `ananke`, `ariadne`, `atlasbot`, `bstein_home`, `data_prepper`, `lesavka`, `metis`, `pegasus`, `soteria`, and `titan_iac`.

5
services/hermes/skills/triage-titan-test-failures/SKILL.md
View File

@ -37,6 +37,11 @@ Treat Ariadne's bundle as the evidence source of truth. A local-model diagnosis
- Ariadne runs as the `ariadne` Deployment and Service in the `maintenance` namespace. - Ariadne runs as the `ariadne` Deployment and Service in the `maintenance` namespace.
- Hermes local inference runs through `hermes-model-gate` in the `hermes` namespace. Ollama is the `hermes-ollama` Deployment and Service in that namespace. - Hermes local inference runs through `hermes-model-gate` in the `hermes` namespace. Ollama is the `hermes-ollama` Deployment and Service in that namespace.
- OpenClaw is not part of this inference path. Never suggest an `openclaw` resource unless a read-only query first proves one exists. - OpenClaw is not part of this inference path. Never suggest an `openclaw` resource unless a read-only query first proves one exists.
- Custom runtime namespaces do not always match suite names. In particular,
Soteria, Metis, and Ariadne run in `maintenance`; Pegasus runs in `jellyfin`;
Atlasbot runs in `comms`; Data Prepper runs in `logging`; and Lesavka is a
desktop-hosted application. Read the service-health skill's
`references/service-map.md` before claiming that a suite has no runtime.
- A connection error recorded inside an older diagnosis proves only that the model request failed at that timestamp. It does not prove the service is currently down. - A connection error recorded inside an older diagnosis proves only that the model request failed at that timestamp. It does not prove the service is currently down.
- Never invent a namespace, workload, container, port, URL, log line, metric, commit, or pod condition. Verify a target with a read-only query before presenting an exact follow-up command; otherwise state what must be discovered first. - Never invent a namespace, workload, container, port, URL, log line, metric, commit, or pod condition. Verify a target with a read-only query before presenting an exact follow-up command; otherwise state what must be discovered first.
- HTTP POST collection and diagnosis endpoints are state-changing operations. Put them only under `Approval required`; never describe them as read-only or include them in the read-only command list. - HTTP POST collection and diagnosis endpoints are state-changing operations. Put them only under `Approval required`; never describe them as read-only or include them in the read-only command list.