[hermes] ananke #298: ssh_known_hosts_repair_test_failure #15

New Issue

hermes-automation · 2026-08-31T06:31:30Z

hermes-automation commented

2026-08-31 06:31:30 +00:00

Hermes auto-triage classified incident ananke/298 as ssh_known_hosts_repair_test_failure (confidence 0.92); first failed gate: tests.

Why a human is needed

Build 298 failed because the SSH known-hosts repair behavior did not remove the titan-0a record that its unit test expected it to remove. The failure is reproducible at the unit-test level from the captured assertion: after repair, titan-0a remained in the generated known-hosts content while titan-0b was also present. The repair code and test fixture were not included in the evidence bundle, so a maintainer must decide the intended matching semantics and update the implementation accordingly, then run the affected sshutil test and the full test suite.

Ariadne did not authorize automated remediation: human_required.

Facts

jenkins — Jenkins build 298 for job ananke finished with result FAILURE. (https://ci.bstein.dev/job/ananke/298/)
jenkins — The build reported its failed pipeline stage as Enforce quality gate. (jenkins.first_failed_stage)
jenkins — The earliest concrete failing test output is TestRepairKnownHostsRemovesEntries in internal/sshutil; its assertion expected titan-0a known-hosts entries to be removed, but the resulting content still contained "titan-0a ssh-ed25519 AAAATESTKEYONE". (jenkins.console_failures[2], lines around 199)
jenkins — jenkins.failed_tests is present but empty, so the test name and assertion are taken from the chronological Jenkins console excerpt rather than structured test results. (jenkins.failed_tests)
jenkins — The test command reported FAIL for scm.bstein.dev/bstein/ananke/internal/sshutil after the failing test, while the other displayed package test results succeeded. (jenkins.console_failures[2], lines around 199)
jenkins — SonarQube later reported Go parser errors for several source files, but the quality-gate tail set sonar_status=ok before exiting with status 1. (jenkins.console_failures[3], lines around 295; jenkins.console_tail)
opensearch — No correlated OpenSearch records were available because the OpenSearch request was refused. (log_evidence.error)

Evidence

The earliest failure region of the build console:

tty: true
    volumeMounts:
    - mountPath: "/home/jenkins/agent"
      name: "workspace-volume"
  - command:
    - "cat"
    image: "registry.bstein.dev/bstein/quality-tools:sonar8.0.1-trivy0.70.0-db20260422-arm64"
    name: "quality-tools"
    tty: true
    volumeMounts:
    - mountPath: "/home/jenkins/agent"
      name: "workspace-volume"
  - env:
    - name: "JENKINS_SECRET"
      value: "********"
    - name: "JENKINS_TUNNEL"
      value: "jenkins.jenkins.svc.cluster.local:50000"
    - name: "JENKINS_AGENT_NAME"
      value: "ananke-298-61w5n-hbt85-06f26"

Inferences

The first enforced failing gate is the tests gate: the known-hosts repair unit test failed before the final Enforce quality gate stage terminated the pipeline. The final stage appears to aggregate previously collected gate results rather than being the origin of the failure.
The known-hosts repair implementation did not remove an entry for titan-0a under the input exercised by TestRepairKnownHostsRemovesEntries. A maintainer should inspect the matching/removal logic and ensure it removes all intended titan-0a host-key records without removing unrelated hosts such as ...
The SonarQube parser messages are secondary diagnostic noise for this build, not the first demonstrated enforcement failure, because the test failure occurred earlier and the final gate recorded sonar_status=ok.

Links

Failed build: https://ci.bstein.dev/job/ananke/298/
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_3861dd6d9a0f41f7932e022b87b37471). Hermes has no write access to this repository; no files or infrastructure were changed.

Hermes auto-triage classified incident `ananke/298` as **ssh_known_hosts_repair_test_failure** (confidence 0.92); first failed gate: `tests`. ## Why a human is needed Build 298 failed because the SSH known-hosts repair behavior did not remove the titan-0a record that its unit test expected it to remove. The failure is reproducible at the unit-test level from the captured assertion: after repair, titan-0a remained in the generated known-hosts content while titan-0b was also present. The repair code and test fixture were not included in the evidence bundle, so a maintainer must decide the intended matching semantics and update the implementation accordingly, then run the affected sshutil test and the full test suite. Ariadne did not authorize automated remediation: `human_required`. ## Facts - **jenkins** — Jenkins build 298 for job ananke finished with result FAILURE. (`https://ci.bstein.dev/job/ananke/298/`) - **jenkins** — The build reported its failed pipeline stage as Enforce quality gate. (`jenkins.first_failed_stage`) - **jenkins** — The earliest concrete failing test output is TestRepairKnownHostsRemovesEntries in internal/sshutil; its assertion expected titan-0a known-hosts entries to be removed, but the resulting content still contained "titan-0a ssh-ed25519 AAAATESTKEYONE". (`jenkins.console_failures[2], lines around 199`) - **jenkins** — jenkins.failed_tests is present but empty, so the test name and assertion are taken from the chronological Jenkins console excerpt rather than structured test results. (`jenkins.failed_tests`) - **jenkins** — The test command reported FAIL for scm.bstein.dev/bstein/ananke/internal/sshutil after the failing test, while the other displayed package test results succeeded. (`jenkins.console_failures[2], lines around 199`) - **jenkins** — SonarQube later reported Go parser errors for several source files, but the quality-gate tail set sonar_status=ok before exiting with status 1. (`jenkins.console_failures[3], lines around 295; jenkins.console_tail`) - **opensearch** — No correlated OpenSearch records were available because the OpenSearch request was refused. (`log_evidence.error`) ## Evidence The earliest failure region of the build console: ``` tty: true volumeMounts: - mountPath: "/home/jenkins/agent" name: "workspace-volume" - command: - "cat" image: "registry.bstein.dev/bstein/quality-tools:sonar8.0.1-trivy0.70.0-db20260422-arm64" name: "quality-tools" tty: true volumeMounts: - mountPath: "/home/jenkins/agent" name: "workspace-volume" - env: - name: "JENKINS_SECRET" value: "********" - name: "JENKINS_TUNNEL" value: "jenkins.jenkins.svc.cluster.local:50000" - name: "JENKINS_AGENT_NAME" value: "ananke-298-61w5n-hbt85-06f26" ``` ## Inferences - The first enforced failing gate is the tests gate: the known-hosts repair unit test failed before the final Enforce quality gate stage terminated the pipeline. The final stage appears to aggregate previously collected gate results rather than being the origin of the failure. - The known-hosts repair implementation did not remove an entry for titan-0a under the input exercised by TestRepairKnownHostsRemovesEntries. A maintainer should inspect the matching/removal logic and ensure it removes all intended titan-0a host-key records without removing unrelated hosts such as ... - The SonarQube parser messages are secondary diagnostic noise for this build, not the first demonstrated enforcement failure, because the test failure occurred earlier and the final gate recorded sonar_status=ok. ## Links - Failed build: https://ci.bstein.dev/job/ananke/298/ - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_3861dd6d9a0f41f7932e022b87b37471](https://triage.bstein.dev/chat?resume=run_3861dd6d9a0f41f7932e022b87b37471)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/ananke#15