titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity
5,461 Commits 81 Branches 0 Tags
Commit Graph

105 Commits

Author SHA1 Message Date
jenkins
a3077224e0 Merge origin/main (#14 + #16) into PR #15 decomposition reliability 
Reconcile two independent test/gate reorganizations:
- Gate/semgrep/mailu: keep main's #16 dual-metric implementation.
- quality_contract.json: union #16 image-builder + #14 scm/node + #15 cli_lane.
- agent-deployment.yaml: keep #14 gitea removal + #16 image-build-token + #15 probe.
- Test splits: main's chat/coordinator/agent organization is authoritative;
  drop #15's redundant competing splits and #14's stale cli-lane duplicates;
  keep #15's cli-lane decomposition suite and port the execution-safety test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-18 00:42:53 -03:00
jenkins
9d42ff33f5 Merge origin/main (#16 image-builder) into hermes-safe-gitea-pr 
Resolve 8 conflicts, uniting #16's daemonless image-release lane with
#14's SCM broker + node-audit boundary. Nothing dropped from either side.

- quality_coverage.py / test_quality_coverage_helpers.py: take main's
  dual-metric gate (line+branch enforced per file at minimum_percent);
  drop #14's now-dead branch_tracked_files/minimum_branch_percent keys.
- quality_contract.json: union all lists (managed_modules, lint_paths,
  coverage_sources, tracked_files, hygiene globs) so #14's scm-broker,
  git_pack_objects, receive_pack_scan, deadline_http and node_polkit_audit
  are branch-checked alongside #16's image-builder modules.
- Vault auth (vault_k8s_auth_configure.sh): coexist both role sets. Keep
  #16's hermes-switchyard split + hermes-jenkins-token-seed; keep #14's
  hermes-scm-broker role. Preserve #14's security property: hermes-agent
  no longer holds developer-gitea (broker role carries it).
- agent-deployment.yaml / stage_runtime_access.py: keep #16's
  jenkins-image-build-token injection/staging; keep #14's removal of the
  agent's gitea-token/gitea-username.
- Bump vault-k8s-auth-hermes job -9 -> -10 (and its health check + test)
  so the merged auth config re-applies over any -9 already in-cluster.
- flux hermes dependsOn: union jenkins + hermes-scm-broker + observer-rbac.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-17 21:07:06 -03:00
jenkins
6c1123201e hermes: audit every sudo include spelling 
A quoted, space-bearing #include path failed the include regex and fell
through to the comment branch, leaving a second authority file
unenumerated. Detect any include directive before the comment rule and
fail closed on every form except the exact bare includedir into the
audited /etc/sudoers.d.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-17 20:37:30 -03:00
jenkins
6e9e8c6ab5 hermes: reject regex literals in polkit grants 
A regex literal embedding a quote desynced the string tokenizer and
swallowed an unconditional Result.YES, so the grant read as unscoped and
slipped past the literal-identity check. Fail closed on any slash outside
a string or comment; neither regex nor division belongs in an
identity-scoped grant.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-17 20:37:30 -03:00
jenkins
b8f2163af0 hermes: prove sudo and polkit denial closed 
Expand sudoers User_Alias chains so aliases, wildcards, netgroups, and
undefined names cannot smuggle authority to the Hermes account, and
require polkit grants to scope through exact literal identity
comparisons: computed strings, bracket lookups, subject aliasing,
operator-built values, and unconditional or wildcard grants fail closed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-17 15:15:47 -03:00
jenkins
e3ecc18d0e hermes: refresh capabilities and readiness per loop 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-17 15:03:50 -03:00
jenkins
e8c26ecf85 hermes: add daemonless agent image release lane 2026-08-17 08:25:52 -03:00
jenkins
73fefbb5d9 hermes: gate mixed image lane APIs 2026-08-17 08:16:35 -03:00
jenkins
8c6e3acdac hermes: isolate Atlas SCM write authority 2026-08-17 07:58:44 -03:00
jenkins
2c1d97e551 hermes: match canonical Forgejo PR URL 2026-08-17 07:22:26 -03:00
jenkins
cf3e46c2b6 hermes: harden Forgejo client boundary 2026-08-17 07:22:26 -03:00
jenkins
762784da6b hermes: bound Atlas pull request client 2026-08-17 07:22:26 -03:00
jenkins
1ba9f13959 hermes: bind terminal commit to journal inode 2026-08-17 07:19:10 -03:00
jenkins
8c71d55853 hermes: harden journal quarantine races 2026-08-17 07:15:31 -03:00
jenkins
c20bc263e0 hermes: close terminal replay edge cases 2026-08-17 07:15:31 -03:00
jenkins
64ea6d685c hermes: harden replay and decomposition races 2026-08-17 07:15:31 -03:00
jenkins
f04a524738 hermes: preserve terminal results and prevent duplicate fanout 2026-08-17 07:15:31 -03:00
jenkins
0dd6ea0f02 hermes: add durable Telegram topics 2026-08-16 15:59:09 -03:00
jenkins
ba590c2518 hermes: retain native auth failure health 2026-08-16 13:47:19 -03:00
jenkins
e8b4f0c57c hermes: widen local goal judge timeout 2026-08-16 13:29:10 -03:00
jenkins
2a103f9895 hermes: require findings in worker schema 2026-08-16 12:04:27 -03:00
jenkins
1ea8e16286 hermes: separate review findings from blockers 2026-08-16 11:54:26 -03:00
jenkins
42ac76fe67 hermes: carry goal-loop controller evidence 2026-08-16 11:27:24 -03:00
jenkins
1527fd1af0 hermes: enforce goal completion evidence 2026-08-16 11:11:38 -03:00
jenkins
2a94c7c74f hermes: isolate worker database lifetimes 2026-08-16 10:30:58 -03:00
jenkins
e758ee1059 hermes: survive transient Kanban storage faults 2026-08-16 09:33:30 -03:00
jenkins
18eeeabb62 hermes: avoid unavailable worker providers 2026-08-16 09:19:23 -03:00
jenkins
c0eda84fa1 hermes: recover stale Codex worker threads 2026-08-16 08:54:19 -03:00
jenkins
3b003b850d hermes: preserve Vault CLI credentials for workers 2026-08-16 08:39:45 -03:00
jenkins
46f37f32a3 hermes: streamline forge evidence tools 2026-08-16 08:21:33 -03:00
jenkins
c7ac16d206 hermes: harden Atlas forge workflow 2026-08-16 07:59:35 -03:00
jenkins
ece52b1f2e hermes: harden routed vision normalization 2026-08-16 07:24:20 -03:00
jenkins
8f7b57419a hermes: accept routed base64 vision 2026-08-16 07:12:11 -03:00
jenkins
bfd53100d9 hermes: normalize routed vision messages 2026-08-16 07:00:50 -03:00
jenkins
5dd13368c6 hermes: normalize vision requests for Codex 2026-08-16 06:55:49 -03:00
jenkins
bebd92212e hermes: install pinned Go toolchain 2026-08-16 05:38:01 -03:00
jenkins
612cefad23 monitoring(ai): add provider quota operations dashboard 2026-08-16 05:13:20 -03:00
jenkins
012e5fc2ba hermes: recover stale kanban status pages 2026-08-16 04:49:02 -03:00
jenkins
eace0ed0df hermes: scope stale activity lineage 2026-08-16 02:51:33 -03:00
jenkins
9bc47f9ce3 hermes: keep durable worker activity visible 2026-08-16 01:20:08 -03:00
jenkins
e9efec4ddf hermes: keep provider lanes available under load 2026-08-15 22:15:40 -03:00
jenkins
89b9f1a4c7 hermes: isolate runtime access and expose activity 2026-08-15 22:15:40 -03:00
jenkins
6fd7b9bbba hermes: close stale API worker sessions 2026-08-15 14:20:12 -03:00
jenkins
d27a9649cf hermes: secure node access and expose live workers 2026-08-15 13:58:42 -03:00
jenkins
c7dc81c0c3 hermes: sanitize classifier tool history 2026-08-15 13:35:31 -03:00
jenkins
29eeb1ebf8 hermes: recover workers after pod restart 2026-08-15 07:07:21 -03:00
jenkins
e9b36181e4 hermes: isolate durable worker lifecycle 2026-08-15 06:31:16 -03:00
jenkins
dca4249599 hermes: recover Kanban event indexes 2026-08-15 05:37:53 -03:00
jenkins
f072685a69 hermes: resolve durable lane model ids 2026-08-15 04:07:30 -03:00
jenkins
846c890527 hermes: load tool credentials before s6 2026-08-15 03:44:00 -03:00