jenkins
603524ba6a
Merge remote-tracking branch 'origin/fix/hermes-result-decomposition-reliability' into feature/hermes-cli-auto-quota-routing
...
# Conflicts:
# services/hermes/networkpolicy.yaml
# testing/quality_contract.json
# testing/tests/test_hermes_agent_security.py
2026-08-18 00:57:54 -03:00
jenkins
a3077224e0
Merge origin/main ( #14 + #16 ) into PR #15 decomposition reliability
...
Reconcile two independent test/gate reorganizations:
- Gate/semgrep/mailu: keep main's #16 dual-metric implementation.
- quality_contract.json: union #16 image-builder + #14 scm/node + #15 cli_lane.
- agent-deployment.yaml: keep #14 gitea removal + #16 image-build-token + #15 probe.
- Test splits: main's chat/coordinator/agent organization is authoritative;
drop #15 's redundant competing splits and #14 's stale cli-lane duplicates;
keep #15 's cli-lane decomposition suite and port the execution-safety test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-18 00:42:53 -03:00
jenkins
9d42ff33f5
Merge origin/main ( #16 image-builder) into hermes-safe-gitea-pr
...
Resolve 8 conflicts, uniting #16 's daemonless image-release lane with
#14 's SCM broker + node-audit boundary. Nothing dropped from either side.
- quality_coverage.py / test_quality_coverage_helpers.py: take main's
dual-metric gate (line+branch enforced per file at minimum_percent);
drop #14 's now-dead branch_tracked_files/minimum_branch_percent keys.
- quality_contract.json: union all lists (managed_modules, lint_paths,
coverage_sources, tracked_files, hygiene globs) so #14 's scm-broker,
git_pack_objects, receive_pack_scan, deadline_http and node_polkit_audit
are branch-checked alongside #16 's image-builder modules.
- Vault auth (vault_k8s_auth_configure.sh): coexist both role sets. Keep
#16 's hermes-switchyard split + hermes-jenkins-token-seed; keep #14 's
hermes-scm-broker role. Preserve #14 's security property: hermes-agent
no longer holds developer-gitea (broker role carries it).
- agent-deployment.yaml / stage_runtime_access.py: keep #16 's
jenkins-image-build-token injection/staging; keep #14 's removal of the
agent's gitea-token/gitea-username.
- Bump vault-k8s-auth-hermes job -9 -> -10 (and its health check + test)
so the merged auth config re-applies over any -9 already in-cluster.
- flux hermes dependsOn: union jenkins + hermes-scm-broker + observer-rbac.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 21:07:06 -03:00
jenkins
034c8372c7
hermes: enforce quota-aware fail-closed cli-auto provider routing
...
Based on PR #15 (fix/hermes-result-decomposition-reliability); stacked
on the decomposed cli_lane modules.
- cli_lane_quota: soft-exclude a provider from NEW cli-auto work below
the remaining-quota threshold (both-below prefers more remaining;
fetch failure fails open with a metric).
- cli_lane_health: lane now writes provider health (G7) with classified
failure reasons splitting the capacity conflation (quota/auth/
rate-limit/transport) and cooldown hysteresis; re-admission only on
full cooldown expiry, passed quota reset, or fresh success (G4).
- cli_lane_routing: capacity-limited health now excludes a provider
(G3); cooldown/reset-aware re-admission.
- cli_lane_failover: explicit cli-codex-*/cli-claude-* assignees fail
closed as transient instead of switching providers (G5); fallback
depth stays bounded at two hosted providers (G1) with effort
preserved; Switchyard outages block transient, not capability (G9).
- cli_lane_metrics: route-decision/fallback counters, quota and
soft-exclusion gauges, pod-local scrape server (G6).
- cli_lane_provider: worker env drops ANTHROPIC_API_KEY, CLAUDE_API_KEY,
OPENAI_API_KEY, API_SERVER_KEY so no metered path exists (G10).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-08-17 20:31:05 -03:00
jenkins
6f993c049e
hermes: keep agent web reachable during lane deferral
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 15:20:43 -03:00
jenkins
5020e49057
hermes: track new boundary modules in gate
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 15:15:47 -03:00
jenkins
e8c26ecf85
hermes: add daemonless agent image release lane
2026-08-17 08:25:52 -03:00
jenkins
73fefbb5d9
hermes: gate mixed image lane APIs
2026-08-17 08:16:35 -03:00
jenkins
8c6e3acdac
hermes: isolate Atlas SCM write authority
2026-08-17 07:58:44 -03:00
jenkins
8f45f47e60
refactor: restructure services layout, retire oceanus, add aether scaffolding
...
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
jenkins
2477bf7512
test(titan-iac): cover dashboard generator contract
2026-04-22 15:31:36 -03:00
120efb9965
test(titan-iac): cover mailu sync scripts
2026-04-22 02:53:00 -03:00
b9ce28819b
ci(titan-iac): apply supply-chain waiver ledger
2026-04-22 00:42:03 -03:00
jenkins
d5bf4257b8
quality(titan-iac): widen enforced coverage contract
2026-04-20 21:39:53 -03:00
7958c54f48
testing(ci): stop requiring AGENTS.md in titan-iac quality gate
2026-04-10 17:39:07 -03:00
48eb2de826
testing(ci): document quality gate scope boundaries
2026-04-10 17:26:42 -03:00
d6d7cea6ad
testing(ci): centralize quality gate contract
2026-04-10 17:11:02 -03:00
