From 0af41aa995030bf062d3c24a2debd7c1413716d2 Mon Sep 17 00:00:00 2001 From: jenkins Date: Thu, 6 Aug 2026 20:46:55 -0300 Subject: [PATCH] feat(ariadne): declare the fix categories, and show them beside the actions The three categories now appear in the deployment next to the action allowlist, and the monitor prints both at the policy gate so the difference is visible during a demo rather than asserted: two ids Ariadne may execute on its own authority, three categories it may only ask Hermes to propose a patch for. Co-Authored-By: Claude Opus 5 --- scripts/ops/hermes_triage_monitor.py | 5 +++++ services/maintenance/apps/ariadne-deployment.yaml | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/scripts/ops/hermes_triage_monitor.py b/scripts/ops/hermes_triage_monitor.py index 452dba36..2cd0dbca 100755 --- a/scripts/ops/hermes_triage_monitor.py +++ b/scripts/ops/hermes_triage_monitor.py @@ -302,6 +302,11 @@ def evidence_for(key: str, incident: str = "") -> None: "printenv", "ARIADNE_HERMES_ALLOWED_ACTIONS"], limit=2) run(["kubectl", "-n", NS_ARIADNE, "exec", "deploy/ariadne", "-c", "ariadne", "--", "printenv", "ARIADNE_HERMES_MIN_CONFIDENCE"], limit=2) + print(f" {DIM}a separate setting governs what Hermes may be asked to propose a fix" + f" for. It is separate because these become pull requests rather than" + f" changes Ariadne makes itself:{RESET}") + run(["kubectl", "-n", NS_ARIADNE, "exec", "deploy/ariadne", "-c", "ariadne", "--", + "printenv", "ARIADNE_HERMES_FIX_CATEGORIES"], limit=2) print() elif key == "route": if IS_CODE_JOB: diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml index 418453ff..65b91d2d 100644 --- a/services/maintenance/apps/ariadne-deployment.yaml +++ b/services/maintenance/apps/ariadne-deployment.yaml @@ -536,6 +536,12 @@ spec: # and expensive to read. Below this ceiling an open pull request on # a repository is no reason to withhold a fix for a different # failure; at it, new proposals wait. + # What Hermes may be asked to propose a fix for. Deliberately not + # in ARIADNE_HERMES_ALLOWED_ACTIONS: that list gates what Ariadne + # executes on its own authority, whereas everything here becomes a + # pull request a person reads before anything changes. + - name: ARIADNE_HERMES_FIX_CATEGORIES + value: lint_violation,undefined_name,failing_assertion - name: ARIADNE_HERMES_CODE_MAX_OPEN_PROPOSALS value: "64" - name: ARIADNE_HERMES_CODE_REPOS