2026-04-10 17:06:53 -03:00
|
|
|
{
|
|
|
|
|
"required_docs": [
|
|
|
|
|
{
|
|
|
|
|
"path": "README.md",
|
|
|
|
|
"description": "Top-level repository handbook."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"path": "Jenkinsfile",
|
|
|
|
|
"description": "Top-level Jenkins mirror for multibranch discovery."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"path": "ci/Jenkinsfile.titan-iac",
|
|
|
|
|
"description": "Canonical titan-iac Jenkins pipeline definition."
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"managed_modules": [
|
2026-08-17 13:11:34 +00:00
|
|
|
"scripts/ops/hermes_handoff_acceptance.py",
|
fix(hermes): close the zero-evidence fail-open in absence checks
evaluate_names_absent returned PASS when its step exited 0 with no output,
so five mandatory checks - the ones asserting that provider API keys, forge
credentials, a cluster-admin binding, and shared coordinator state are
absent - could report a pass on no evidence and turn a NO_GO into a GO.
Both name rules now resolve their step through one guard in _line_step, so
zero observations are NOT_RUN. Regressions pin all five real catalog specs
plus both reachable silence paths: a POSIX pipeline whose status comes from
its last stage, and a drifted kubectl -o jsonpath. The pool claim projection
emits one <volume>=<claim> line per template volume so a volume without a
PVC still counts as an observation rather than reading as drift.
Also closes the review's reachable hardening and evidence defects:
- pin Gitea paths to atlas/titan-iac on an exact segment boundary and
reject relative segments, including percent-encoded ones
- forbid impersonation structurally in every mode and vantage; the inner
command of kubectl exec is re-checked rather than exempted, and
validate_catalog no longer guards only the operator vantage
- drop flux and helm from the binary allowlist; they had no pinned release
digest, so no allowlisted binary can now be admitted that the executor
would refuse to attest
- remove the inert --concurrency and --expect-telegram-sessions flags and
the dead concurrency bound; Telegram continuity stays mandatory
- read the ephemeral pull index page by page, treat the create response as
an authoritative source for the pull number, close every number either
source names, and surface residue_ref plus exact manual_cleanup commands
when creation is uncertain
- keep executable_path and executable_sha256 on unrecorded bulk-evidence
steps so withholding bytes never withholds binary attestation
- revert the repo-wide hygiene legacy-exception mechanism; the contract
change here is purely additive and the four pre-existing over-cap files
are left to the canonical contract change in PR #14/#15
- correct the runbook ruff format scope so the documented command passes
Split hermes_handoff_arming.py out of hermes_handoff_ephemeral.py to keep
both modules under the 500-line cap. All 16 handoff modules hold at least
95% line and branch coverage; the mutation gate is 13/13.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 16:24:37 +00:00
|
|
|
"scripts/ops/hermes_handoff_arming.py",
|
2026-08-17 13:11:34 +00:00
|
|
|
"scripts/ops/hermes_handoff_catalog.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_access.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_delivery.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_platform.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_workers.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_ephemeral.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_evaluators.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_exec.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_json_rules.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_model.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_policy.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_redaction.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_rules.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_run.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"ci/scripts/publish_test_metrics.py",
|
2026-04-20 21:39:53 -03:00
|
|
|
"ci/scripts/publish_test_metrics_quality.py",
|
refactor: restructure services layout, retire oceanus, add aether scaffolding
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
|
|
|
"ci/scripts/semgrep_report.py",
|
2026-04-22 00:41:40 -03:00
|
|
|
"ci/scripts/supply_chain_report.py",
|
2026-04-22 02:53:00 -03:00
|
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
|
|
|
"services/mailu/scripts/mailu_sync_listener.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"testing/__init__.py",
|
|
|
|
|
"testing/quality_contract.py",
|
|
|
|
|
"testing/quality_docs.py",
|
|
|
|
|
"testing/quality_hygiene.py",
|
|
|
|
|
"testing/quality_coverage.py",
|
2026-08-17 13:11:34 +00:00
|
|
|
"testing/quality_handoff_mutation.py",
|
2026-04-20 21:39:53 -03:00
|
|
|
"testing/quality_gate.py",
|
|
|
|
|
"ci/tests/glue/test_ariadne_schedules.py",
|
|
|
|
|
"ci/tests/glue/test_glue_metrics.py",
|
2026-04-22 00:41:40 -03:00
|
|
|
"testing/tests/test_publish_test_metrics.py",
|
|
|
|
|
"testing/tests/test_supply_chain_report.py",
|
refactor: restructure services layout, retire oceanus, add aether scaffolding
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
|
|
|
"testing/tests/test_semgrep_report.py",
|
2026-04-22 00:41:40 -03:00
|
|
|
"testing/tests/test_quality_contract.py",
|
2026-04-20 21:39:53 -03:00
|
|
|
"testing/tests/test_quality_gate.py"
|
2026-04-10 17:06:53 -03:00
|
|
|
],
|
|
|
|
|
"lint_paths": [
|
2026-08-17 13:11:34 +00:00
|
|
|
"scripts/ops/hermes_handoff_acceptance.py",
|
fix(hermes): close the zero-evidence fail-open in absence checks
evaluate_names_absent returned PASS when its step exited 0 with no output,
so five mandatory checks - the ones asserting that provider API keys, forge
credentials, a cluster-admin binding, and shared coordinator state are
absent - could report a pass on no evidence and turn a NO_GO into a GO.
Both name rules now resolve their step through one guard in _line_step, so
zero observations are NOT_RUN. Regressions pin all five real catalog specs
plus both reachable silence paths: a POSIX pipeline whose status comes from
its last stage, and a drifted kubectl -o jsonpath. The pool claim projection
emits one <volume>=<claim> line per template volume so a volume without a
PVC still counts as an observation rather than reading as drift.
Also closes the review's reachable hardening and evidence defects:
- pin Gitea paths to atlas/titan-iac on an exact segment boundary and
reject relative segments, including percent-encoded ones
- forbid impersonation structurally in every mode and vantage; the inner
command of kubectl exec is re-checked rather than exempted, and
validate_catalog no longer guards only the operator vantage
- drop flux and helm from the binary allowlist; they had no pinned release
digest, so no allowlisted binary can now be admitted that the executor
would refuse to attest
- remove the inert --concurrency and --expect-telegram-sessions flags and
the dead concurrency bound; Telegram continuity stays mandatory
- read the ephemeral pull index page by page, treat the create response as
an authoritative source for the pull number, close every number either
source names, and surface residue_ref plus exact manual_cleanup commands
when creation is uncertain
- keep executable_path and executable_sha256 on unrecorded bulk-evidence
steps so withholding bytes never withholds binary attestation
- revert the repo-wide hygiene legacy-exception mechanism; the contract
change here is purely additive and the four pre-existing over-cap files
are left to the canonical contract change in PR #14/#15
- correct the runbook ruff format scope so the documented command passes
Split hermes_handoff_arming.py out of hermes_handoff_ephemeral.py to keep
both modules under the 500-line cap. All 16 handoff modules hold at least
95% line and branch coverage; the mutation gate is 13/13.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 16:24:37 +00:00
|
|
|
"scripts/ops/hermes_handoff_arming.py",
|
2026-08-17 13:11:34 +00:00
|
|
|
"scripts/ops/hermes_handoff_catalog.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_access.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_delivery.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_platform.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_workers.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_ephemeral.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_evaluators.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_exec.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_json_rules.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_model.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_policy.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_redaction.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_rules.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_run.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"ci/scripts/publish_test_metrics.py",
|
2026-04-20 21:39:53 -03:00
|
|
|
"ci/scripts/publish_test_metrics_quality.py",
|
refactor: restructure services layout, retire oceanus, add aether scaffolding
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
|
|
|
"ci/scripts/semgrep_report.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"ci/tests/glue",
|
|
|
|
|
"scripts/tests",
|
|
|
|
|
"services/comms/scripts/tests",
|
|
|
|
|
"services/mailu/scripts/mailu_sync.py",
|
2026-04-22 02:53:00 -03:00
|
|
|
"services/mailu/scripts/mailu_sync_listener.py",
|
2026-04-20 21:39:53 -03:00
|
|
|
"testing/tests",
|
2026-04-10 17:06:53 -03:00
|
|
|
"testing"
|
|
|
|
|
],
|
|
|
|
|
"pytest_suites": {
|
|
|
|
|
"unit": {
|
|
|
|
|
"description": "Fast unit and contract tests for repo automation.",
|
|
|
|
|
"paths": [
|
|
|
|
|
"scripts/tests",
|
|
|
|
|
"services/comms/scripts/tests",
|
|
|
|
|
"testing/tests"
|
|
|
|
|
],
|
|
|
|
|
"junit": "build/junit-unit.xml",
|
|
|
|
|
"coverage_sources": [
|
|
|
|
|
"ci/scripts",
|
2026-08-17 13:11:34 +00:00
|
|
|
"scripts/ops",
|
refactor: restructure services layout, retire oceanus, add aether scaffolding
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
|
|
|
"scripts.render.dashboards_render_atlas",
|
2026-04-10 17:06:53 -03:00
|
|
|
"services/mailu/scripts",
|
|
|
|
|
"testing"
|
|
|
|
|
],
|
|
|
|
|
"coverage_xml": "build/coverage-unit.xml"
|
|
|
|
|
},
|
|
|
|
|
"glue": {
|
|
|
|
|
"description": "Cluster-live glue checks that validate CronJobs and exported metrics.",
|
|
|
|
|
"paths": [
|
|
|
|
|
"ci/tests/glue"
|
|
|
|
|
],
|
|
|
|
|
"junit": "build/junit-glue.xml"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"profiles": {
|
|
|
|
|
"local": [
|
|
|
|
|
"docs",
|
|
|
|
|
"smell",
|
|
|
|
|
"hygiene",
|
|
|
|
|
"unit",
|
|
|
|
|
"coverage"
|
|
|
|
|
],
|
|
|
|
|
"jenkins": [
|
|
|
|
|
"docs",
|
|
|
|
|
"smell",
|
|
|
|
|
"hygiene",
|
|
|
|
|
"unit",
|
|
|
|
|
"coverage",
|
2026-04-20 21:39:53 -03:00
|
|
|
"sonarqube",
|
|
|
|
|
"ironbank",
|
2026-04-10 17:06:53 -03:00
|
|
|
"glue"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
"manual_scripts": [
|
|
|
|
|
{
|
refactor: restructure services layout, retire oceanus, add aether scaffolding
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
|
|
|
"path": "scripts/manual-tests/test_atlas_user_cleanup.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"description": "Manual cleanup validation for Atlas user lifecycle automation."
|
|
|
|
|
},
|
|
|
|
|
{
|
refactor: restructure services layout, retire oceanus, add aether scaffolding
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
|
|
|
"path": "scripts/manual-tests/test_user_cleanup.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"description": "Manual cleanup validation for shared user lifecycle automation."
|
|
|
|
|
},
|
|
|
|
|
{
|
refactor: restructure services layout, retire oceanus, add aether scaffolding
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
|
|
|
"path": "scripts/manual-tests/test_vaultwarden_user_cleanup.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"description": "Manual cleanup validation for Vaultwarden user lifecycle automation."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"path": "services/bstein-dev-home/scripts/test_portal_onboarding_flow.py",
|
|
|
|
|
"description": "Portal onboarding end-to-end flow validation with mail delivery checks."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"path": "services/keycloak/scripts/tests/test_keycloak_execute_actions_email.py",
|
|
|
|
|
"description": "Standalone Keycloak SMTP execute-actions-email validation script."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"path": "services/keycloak/scripts/tests/test_portal_token_exchange.py",
|
|
|
|
|
"description": "Standalone Keycloak token-exchange validation script."
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"hygiene": {
|
|
|
|
|
"max_lines": 500,
|
|
|
|
|
"line_limit_globs": [
|
2026-08-17 13:11:34 +00:00
|
|
|
"scripts/ops/hermes_handoff_*.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"testing/**/*.py",
|
|
|
|
|
"ci/scripts/*.py",
|
|
|
|
|
"ci/tests/**/*.py",
|
|
|
|
|
"scripts/tests/**/*.py",
|
|
|
|
|
"services/*/scripts/tests/**/*.py",
|
2026-04-22 02:53:00 -03:00
|
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
|
|
|
"services/mailu/scripts/mailu_sync_listener.py"
|
2026-04-10 17:06:53 -03:00
|
|
|
],
|
|
|
|
|
"naming_rules": [
|
|
|
|
|
{
|
|
|
|
|
"glob": "testing/*.py",
|
|
|
|
|
"pattern": "^(?:__init__|quality_[a-z0-9_]+)\\.py$",
|
|
|
|
|
"description": "Top-level testing helpers use quality_* module names."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"glob": "testing/tests/*.py",
|
|
|
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
|
|
|
"description": "Top-level pytest files use test_*.py names."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"glob": "ci/tests/**/*.py",
|
|
|
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
|
|
|
"description": "CI pytest files use test_*.py names."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"glob": "scripts/tests/**/*.py",
|
|
|
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
|
|
|
"description": "Script pytest files use test_*.py names."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"glob": "scripts/test_*.py",
|
|
|
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
|
|
|
"description": "Standalone script tests use test_*.py names."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"glob": "services/*/scripts/tests/**/*.py",
|
|
|
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
|
|
|
"description": "Service pytest files use test_*.py names."
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"glob": "services/*/scripts/test_*.py",
|
|
|
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
|
|
|
"description": "Standalone service test scripts use test_*.py names."
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
"coverage": {
|
|
|
|
|
"minimum_percent": 95.0,
|
2026-08-17 13:11:34 +00:00
|
|
|
"minimum_branch_percent": 95.0,
|
|
|
|
|
"branch_tracked_files": [
|
|
|
|
|
"scripts/ops/hermes_handoff_acceptance.py",
|
fix(hermes): close the zero-evidence fail-open in absence checks
evaluate_names_absent returned PASS when its step exited 0 with no output,
so five mandatory checks - the ones asserting that provider API keys, forge
credentials, a cluster-admin binding, and shared coordinator state are
absent - could report a pass on no evidence and turn a NO_GO into a GO.
Both name rules now resolve their step through one guard in _line_step, so
zero observations are NOT_RUN. Regressions pin all five real catalog specs
plus both reachable silence paths: a POSIX pipeline whose status comes from
its last stage, and a drifted kubectl -o jsonpath. The pool claim projection
emits one <volume>=<claim> line per template volume so a volume without a
PVC still counts as an observation rather than reading as drift.
Also closes the review's reachable hardening and evidence defects:
- pin Gitea paths to atlas/titan-iac on an exact segment boundary and
reject relative segments, including percent-encoded ones
- forbid impersonation structurally in every mode and vantage; the inner
command of kubectl exec is re-checked rather than exempted, and
validate_catalog no longer guards only the operator vantage
- drop flux and helm from the binary allowlist; they had no pinned release
digest, so no allowlisted binary can now be admitted that the executor
would refuse to attest
- remove the inert --concurrency and --expect-telegram-sessions flags and
the dead concurrency bound; Telegram continuity stays mandatory
- read the ephemeral pull index page by page, treat the create response as
an authoritative source for the pull number, close every number either
source names, and surface residue_ref plus exact manual_cleanup commands
when creation is uncertain
- keep executable_path and executable_sha256 on unrecorded bulk-evidence
steps so withholding bytes never withholds binary attestation
- revert the repo-wide hygiene legacy-exception mechanism; the contract
change here is purely additive and the four pre-existing over-cap files
are left to the canonical contract change in PR #14/#15
- correct the runbook ruff format scope so the documented command passes
Split hermes_handoff_arming.py out of hermes_handoff_ephemeral.py to keep
both modules under the 500-line cap. All 16 handoff modules hold at least
95% line and branch coverage; the mutation gate is 13/13.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 16:24:37 +00:00
|
|
|
"scripts/ops/hermes_handoff_arming.py",
|
2026-08-17 13:11:34 +00:00
|
|
|
"scripts/ops/hermes_handoff_catalog.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_access.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_delivery.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_platform.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_workers.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_ephemeral.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_evaluators.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_exec.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_json_rules.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_model.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_policy.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_redaction.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_rules.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_run.py",
|
|
|
|
|
"ci/scripts/semgrep_report.py",
|
|
|
|
|
"testing/quality_coverage.py",
|
fix(hermes): close the zero-evidence fail-open in absence checks
evaluate_names_absent returned PASS when its step exited 0 with no output,
so five mandatory checks - the ones asserting that provider API keys, forge
credentials, a cluster-admin binding, and shared coordinator state are
absent - could report a pass on no evidence and turn a NO_GO into a GO.
Both name rules now resolve their step through one guard in _line_step, so
zero observations are NOT_RUN. Regressions pin all five real catalog specs
plus both reachable silence paths: a POSIX pipeline whose status comes from
its last stage, and a drifted kubectl -o jsonpath. The pool claim projection
emits one <volume>=<claim> line per template volume so a volume without a
PVC still counts as an observation rather than reading as drift.
Also closes the review's reachable hardening and evidence defects:
- pin Gitea paths to atlas/titan-iac on an exact segment boundary and
reject relative segments, including percent-encoded ones
- forbid impersonation structurally in every mode and vantage; the inner
command of kubectl exec is re-checked rather than exempted, and
validate_catalog no longer guards only the operator vantage
- drop flux and helm from the binary allowlist; they had no pinned release
digest, so no allowlisted binary can now be admitted that the executor
would refuse to attest
- remove the inert --concurrency and --expect-telegram-sessions flags and
the dead concurrency bound; Telegram continuity stays mandatory
- read the ephemeral pull index page by page, treat the create response as
an authoritative source for the pull number, close every number either
source names, and surface residue_ref plus exact manual_cleanup commands
when creation is uncertain
- keep executable_path and executable_sha256 on unrecorded bulk-evidence
steps so withholding bytes never withholds binary attestation
- revert the repo-wide hygiene legacy-exception mechanism; the contract
change here is purely additive and the four pre-existing over-cap files
are left to the canonical contract change in PR #14/#15
- correct the runbook ruff format scope so the documented command passes
Split hermes_handoff_arming.py out of hermes_handoff_ephemeral.py to keep
both modules under the 500-line cap. All 16 handoff modules hold at least
95% line and branch coverage; the mutation gate is 13/13.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 16:24:37 +00:00
|
|
|
"testing/quality_handoff_mutation.py"
|
2026-08-17 13:11:34 +00:00
|
|
|
],
|
2026-04-10 17:06:53 -03:00
|
|
|
"tracked_files": [
|
2026-08-17 13:11:34 +00:00
|
|
|
"scripts/ops/hermes_handoff_acceptance.py",
|
fix(hermes): close the zero-evidence fail-open in absence checks
evaluate_names_absent returned PASS when its step exited 0 with no output,
so five mandatory checks - the ones asserting that provider API keys, forge
credentials, a cluster-admin binding, and shared coordinator state are
absent - could report a pass on no evidence and turn a NO_GO into a GO.
Both name rules now resolve their step through one guard in _line_step, so
zero observations are NOT_RUN. Regressions pin all five real catalog specs
plus both reachable silence paths: a POSIX pipeline whose status comes from
its last stage, and a drifted kubectl -o jsonpath. The pool claim projection
emits one <volume>=<claim> line per template volume so a volume without a
PVC still counts as an observation rather than reading as drift.
Also closes the review's reachable hardening and evidence defects:
- pin Gitea paths to atlas/titan-iac on an exact segment boundary and
reject relative segments, including percent-encoded ones
- forbid impersonation structurally in every mode and vantage; the inner
command of kubectl exec is re-checked rather than exempted, and
validate_catalog no longer guards only the operator vantage
- drop flux and helm from the binary allowlist; they had no pinned release
digest, so no allowlisted binary can now be admitted that the executor
would refuse to attest
- remove the inert --concurrency and --expect-telegram-sessions flags and
the dead concurrency bound; Telegram continuity stays mandatory
- read the ephemeral pull index page by page, treat the create response as
an authoritative source for the pull number, close every number either
source names, and surface residue_ref plus exact manual_cleanup commands
when creation is uncertain
- keep executable_path and executable_sha256 on unrecorded bulk-evidence
steps so withholding bytes never withholds binary attestation
- revert the repo-wide hygiene legacy-exception mechanism; the contract
change here is purely additive and the four pre-existing over-cap files
are left to the canonical contract change in PR #14/#15
- correct the runbook ruff format scope so the documented command passes
Split hermes_handoff_arming.py out of hermes_handoff_ephemeral.py to keep
both modules under the 500-line cap. All 16 handoff modules hold at least
95% line and branch coverage; the mutation gate is 13/13.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 16:24:37 +00:00
|
|
|
"scripts/ops/hermes_handoff_arming.py",
|
2026-08-17 13:11:34 +00:00
|
|
|
"scripts/ops/hermes_handoff_catalog.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_access.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_delivery.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_platform.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_checks_workers.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_ephemeral.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_evaluators.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_exec.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_json_rules.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_model.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_policy.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_redaction.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_rules.py",
|
|
|
|
|
"scripts/ops/hermes_handoff_run.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"ci/scripts/publish_test_metrics.py",
|
2026-04-20 21:39:53 -03:00
|
|
|
"ci/scripts/publish_test_metrics_quality.py",
|
refactor: restructure services layout, retire oceanus, add aether scaffolding
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
|
|
|
"ci/scripts/semgrep_report.py",
|
2026-04-22 00:41:40 -03:00
|
|
|
"ci/scripts/supply_chain_report.py",
|
2026-04-22 02:53:00 -03:00
|
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
|
|
|
"services/mailu/scripts/mailu_sync_listener.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"testing/quality_contract.py",
|
|
|
|
|
"testing/quality_docs.py",
|
|
|
|
|
"testing/quality_hygiene.py",
|
|
|
|
|
"testing/quality_coverage.py",
|
2026-08-17 13:11:34 +00:00
|
|
|
"testing/quality_handoff_mutation.py",
|
2026-04-10 17:06:53 -03:00
|
|
|
"testing/quality_gate.py"
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
}
|
