212 lines
12 KiB
Markdown
212 lines
12 KiB
Markdown
# Formalization Audit Review — Verified Findings
|
|
|
|
**Review Date:** 2026-04-06
|
|
**Reviewer:** Claude (subagent cross-check)
|
|
**Original Audit:** /tmp/formalization-audit.md by Allegro (subagent)
|
|
**Scope:** Cross-verification of all factual claims in the original audit
|
|
|
|
---
|
|
|
|
## Verification Summary
|
|
|
|
The original audit is **largely accurate** but contains several important errors that would mislead remediation efforts. The two "CRITICAL" items (GOFAI source loss and Nostr bridge source loss) are both **overstated** — both are recoverable from git with trivial commands. One security claim is **wrong** (keystore permissions). Several line counts have minor discrepancies.
|
|
|
|
| Claim | Verdict | Detail |
|
|
|-------|---------|--------|
|
|
| GOFAI source files gone | **PARTIALLY WRONG** — files are deleted from working tree but fully present in git | Recovery: `git restore gofai/` (5 seconds) |
|
|
| Nostr bridge source deleted | **PARTIALLY WRONG** — deleted from disk but recoverable from git | Recovery: `git show master:nostr-relay/dm_bridge_mvp.py > dm_bridge_mvp.py` |
|
|
| 39 burn scripts | **CORRECT** — verified count: exactly 39 |
|
|
| Keystore world-readable | **WRONG** — actual permissions are 600 (-rw-------) |
|
|
| 5 Hermes agents | **PARTIALLY WRONG** — 5 wizard dirs exist but only 4 hermes services (no bilbobagginshire service) |
|
|
| Webhook receiver 327 lines | **MINOR ERROR** — actual: 326 lines |
|
|
| Ollama model qwen3:4b loaded | **UNVERIFIABLE** — ollama CLI panics (HOME not set in this context), service is running |
|
|
|
|
---
|
|
|
|
## 1. GOFAI Source Files — CORRECTION
|
|
|
|
**Original claim:** "SOURCE FILES MISSING... only .pyc remain"
|
|
**Reality:** Source files are deleted from the working tree but **fully present in the latest git commit** (aefee98).
|
|
|
|
Verified git status:
|
|
```
|
|
deleted: gofai/USAGE_GUIDE.md (299 lines)
|
|
deleted: gofai/__init__.py (57 lines)
|
|
deleted: gofai/child_assistant.py (360 lines)
|
|
deleted: gofai/knowledge_graph.py (605 lines)
|
|
deleted: gofai/rule_engine.py (347 lines)
|
|
deleted: gofai/schema.py (290 lines)
|
|
```
|
|
|
|
**Recovery command:** `cd /root/wizards/allegro && git restore gofai/`
|
|
**Effort:** 5 seconds (not 2-4 hours as claimed)
|
|
**Severity downgrade:** CRITICAL -> LOW (trivial git restore)
|
|
|
|
The test files (test_gofai.py at 790 lines, test_knowledge_graph.py at 400 lines) are still on disk. The audit correctly identified the 5 .pyc files (including __init__) and the 4 main modules.
|
|
|
|
---
|
|
|
|
## 2. Nostr Bridge Source — CORRECTION
|
|
|
|
**Original claim:** "source file deleted — only .pyc cache remains... URGENT: Decompile dm_bridge_mvp.pyc"
|
|
**Reality:** Source file IS deleted from disk, but is **recoverable from git** on the master branch (298 lines).
|
|
|
|
The file exists at `git show master:nostr-relay/dm_bridge_mvp.py` (commit 81ad2aec and later).
|
|
|
|
**Recovery command:** `cd /root/nostr-relay && git show master:nostr-relay/dm_bridge_mvp.py > dm_bridge_mvp.py`
|
|
**Effort:** 10 seconds (not 4-6 hours for decompilation)
|
|
**Severity downgrade:** CRITICAL -> LOW (trivial git extraction)
|
|
|
|
The service IS running (confirmed active, PID 853154, polling for DMs every 60s). The systemd unit correctly points to `/root/nostr-relay/dm_bridge_mvp.py`. The service would fail on restart since the file is missing from disk — recovery should be done promptly but is trivial.
|
|
|
|
---
|
|
|
|
## 3. Burn Scripts — CONFIRMED
|
|
|
|
**Original claim:** 39 scripts, 2,898 total lines, all from April 5, 2026
|
|
**Verified:** CORRECT on all counts.
|
|
|
|
- Count: 39 files (verified via `ls /root/burn_*.py | wc -l`)
|
|
- Total lines: 2,898 (verified via `wc -l`)
|
|
- Date: All from 2026-04-05 (verified via `ls --time-style=long-iso`)
|
|
- Confirmed: share boilerplate, contain old API URLs (143.198.27.163:3000), numbered variants
|
|
|
|
The audit's characterization as "debugging artifacts" is accurate. The recommendation to archive and replace with `tea` CLI is sound.
|
|
|
|
---
|
|
|
|
## 4. Keystore Permissions — CORRECTION
|
|
|
|
**Original claim:** "World-readable (-rw-r--r--)"
|
|
**Reality:** Permissions are **-rw------- (600)** — already properly restricted to root only.
|
|
|
|
This means:
|
|
- Priority item #3 ("chmod 600 — CRITICAL, 5min") is **already done**
|
|
- The security concern is less severe than stated
|
|
- Still valid concerns: cleartext keys, no encryption, no rotation mechanism, keys in systemd unit files
|
|
|
|
---
|
|
|
|
## 5. Agent Count — CORRECTION
|
|
|
|
**Original claim:** "5 Hermes AI agents (allegro, adagio, ezra, bezalel, bilbobagginshire)"
|
|
**Reality:** 5 wizard directories exist under /root/wizards/, but only **4 hermes services** are running:
|
|
- hermes-allegro.service (active)
|
|
- hermes-adagio.service (active)
|
|
- hermes-bezalel.service (active)
|
|
- hermes-ezra.service (active)
|
|
|
|
bilbobagginshire has a hermes-agent directory and home directory but **no systemd service**. It is not an active agent.
|
|
|
|
---
|
|
|
|
## 6. OSS Replacement Recommendations — Assessment
|
|
|
|
### 6a. Webhook Receiver: "KEEP, but formalize" — AGREE
|
|
The audit correctly identifies this as Allegro-specific logic. No off-the-shelf webhook tool would reduce complexity. Adnanh/webhook would still need custom scripts. The recommendation to make it configurable for any wizard name is practical.
|
|
**Verdict: Sound recommendation.**
|
|
|
|
### 6b. Nostr Relay: "KEEP relay, RECOVER bridge" — AGREE (with correction)
|
|
strfry and relay29 are appropriate choices. The recovery is trivial (see section 2 above).
|
|
**Verdict: Sound, but effort was wildly overstated.**
|
|
|
|
### 6c. Evennia: "KEEP as-is" — AGREE
|
|
Evennia IS the framework; customizations are game content. Line count discrepancies are minor:
|
|
- audited_character.py: audit says 110, actual 109
|
|
- command.py: audit says 368, actual 367
|
|
- objects.py: audit says 218, actual 217
|
|
- accounts.py: audit says 157, actual 148
|
|
- channels.py: audit says ~160, actual 118
|
|
- scripts.py: audit says ~130, actual 103
|
|
- rooms.py: audit says ~15, actual 24
|
|
- exits.py: audit says ~15, actual 26
|
|
**Verdict: Sound recommendation, but several line counts are off.**
|
|
|
|
### 6d. Burn Scripts: "DELETE or ARCHIVE" — AGREE
|
|
`tea` (Gitea CLI) is a valid replacement. python-gitea is also appropriate. The existing gitea_client.py in hermes-agent tools already covers most use cases.
|
|
**Verdict: Sound recommendation.**
|
|
|
|
### 6e. Heartbeat Daemon: "FORMALIZE into systemd timer + package" — AGREE
|
|
Uptime Kuma for health checks is a reasonable suggestion but probably overkill — the custom heartbeat is more tailored. The recommendation to use gitea_client.py from hermes-agent instead of duplicating urllib is practical.
|
|
**Verdict: Sound recommendation.**
|
|
|
|
### 6f. GOFAI: "RECOVER and FORMALIZE" — AGREE (with correction)
|
|
NetworkX as a graph backend replacement is a reasonable suggestion. The concept (deterministic rules + knowledge graph for fleet coordination) is indeed novel. But recovery effort is seconds, not hours.
|
|
**Verdict: Sound direction, wrong effort estimate.**
|
|
|
|
### 6g. Hermes Agent: "KEEP — it IS the OSS project" — AGREE
|
|
Confirmed: origin is NousResearch/hermes-agent on GitHub, version 0.5.0, ~26,359 lines top-level Python. The audit correctly identifies 54 tool modules (not "15+" as stated) and 27 skill directories (not "29" as stated).
|
|
**Verdict: Sound recommendation, minor count errors.**
|
|
|
|
### 6h. Fleet Deployment: "ADD docker-compose for infrastructure" — AGREE
|
|
Docker-compose files exist in various subdirectories (timmy-config, hermes_tools, etc.) but none manages the actual Gitea/strfry production containers. The recommendation is practical.
|
|
**Verdict: Sound recommendation.**
|
|
|
|
### 6i. Ollama: "KEEP, minor improvements" — AGREE
|
|
Ollama service is running. Guard script exists but isn't deployed. The suggestion to use native Ollama controls or actually deploy the guard is practical.
|
|
Note: `OLLAMA_MAX_MODEL_SIZE` is not a real Ollama env var — the audit may have fabricated this. The guard script approach is the correct custom solution.
|
|
**Verdict: Mostly sound, one potentially fabricated env var.**
|
|
|
|
---
|
|
|
|
## 7. Effort Estimates — Revised
|
|
|
|
| # | Component | Original Estimate | Revised Estimate | Reason |
|
|
|---|-----------|-------------------|------------------|--------|
|
|
| 1 | GOFAI recovery | 2-4 hours | **5 seconds** | `git restore gofai/` — files are in HEAD |
|
|
| 2 | GOFAI formalization | 4-6 hours | 4-6 hours | Packaging as proper Python project still valid |
|
|
| 3 | Nostr bridge recovery | 4-6 hours | **10 seconds** | `git show master:nostr-relay/dm_bridge_mvp.py > dm_bridge_mvp.py` |
|
|
| 4 | Bridge formalization | (included above) | 2-3 hours | Move to proper repo, add tests |
|
|
| 5 | Keystore chmod | 5 minutes | **0 — already done** | Permissions are already 600 |
|
|
| 6 | Burn scripts archive | 30 minutes | 30 minutes | Accurate |
|
|
| 7 | Docker-compose | 2 hours | 2-3 hours | Accurate |
|
|
| 8 | Fleet script | 3 hours | 3 hours | Accurate |
|
|
| 9 | Webhook formalization | 3 hours | 2-4 hours | Accurate |
|
|
| 10 | Heartbeat packaging | 5 hours | 4-6 hours | Accurate |
|
|
| 11 | Ollama guard | 30 minutes | 30 minutes | Accurate |
|
|
|
|
**Original total critical effort:** ~6-10 hours
|
|
**Revised total critical effort:** ~1 minute (both "critical" items are trivial git restores)
|
|
|
|
**Total formalization effort (non-critical):** ~15-22 hours — this is realistic.
|
|
|
|
---
|
|
|
|
## 8. Revised Priority Matrix
|
|
|
|
| # | Component | Action | Priority | Effort | Impact |
|
|
|---|-----------|--------|----------|--------|--------|
|
|
| 1 | GOFAI source restore | `git restore gofai/` | HIGH | 5 sec | Prevent future confusion |
|
|
| 2 | Nostr bridge restore | Extract from git master | HIGH | 10 sec | Prevent service loss on restart |
|
|
| 3 | Burn scripts | Archive to /root/archive/ | MEDIUM | 30 min | Cleanliness |
|
|
| 4 | Docker-compose | Create for Gitea+strfry | MEDIUM | 2-3h | Reproducibility |
|
|
| 5 | Fleet script | Create fleet.sh management | MEDIUM | 3h | Operations |
|
|
| 6 | GOFAI formalization | Package as timmy-gofai | LOW | 4-6h | Maintainability |
|
|
| 7 | Webhook receiver | Move into hermes-agent repo | LOW | 2-4h | Maintainability |
|
|
| 8 | Heartbeat daemon | Package as timmy-heartbeat | LOW | 4-6h | Reliability |
|
|
| 9 | Nostr key encryption | Add NIP-49 or age encryption | LOW | 1-2h | Security hardening |
|
|
| 10 | Ollama guard | Deploy or remove | LOW | 30 min | Consistency |
|
|
| 11 | Evennia | No action needed | NONE | 0h | Already good |
|
|
|
|
---
|
|
|
|
## 9. Items Not In Original Audit
|
|
|
|
1. **bilbobagginshire** has no hermes service — is this intentional or an oversight?
|
|
2. **Git credential in remote URL** — allegro's hermes-agent gitea remote contains a plaintext token in the URL. This is a security concern similar to the keystore issue.
|
|
3. **Multiple docker-compose.yml files** exist in various locations (19 found) but none manages the production Gitea/strfry containers.
|
|
4. **Hermes tool count** is 54 (not "15+") and skill directories are 27 (not "29").
|
|
5. **The nostr-relay repo** is on branch `allegro/m2-commit-or-abort-845` (not main/master) — the bridge source exists on master but not the current checkout branch.
|
|
|
|
---
|
|
|
|
## Conclusion
|
|
|
|
The original audit provides a solid structural analysis of the system. The component inventory, OSS alternative suggestions, and formalization recommendations are all well-considered. However, the two items flagged as "CRITICAL" were both based on incomplete investigation — both source files are trivially recoverable from git. The keystore security claim was factually wrong. These errors would have led to unnecessary emergency decompilation work (~10 hours) when a `git restore` would suffice.
|
|
|
|
**Immediate actions (< 1 minute):**
|
|
1. `cd /root/wizards/allegro && git restore gofai/`
|
|
2. `cd /root/nostr-relay && git show master:nostr-relay/dm_bridge_mvp.py > dm_bridge_mvp.py`
|
|
|
|
**These two commands resolve both "CRITICAL" items from the original audit.**
|