4 Commits

Author	SHA1	Message	Date
Rockachopa	bebcf8a29d	feat: implement thin config ephemerality and upstream pull fallback ... - Make config.yaml read-only (0444) — enforces ephemeral thin config pattern Agents cannot mutate their config at runtime. Any changes are lost on restart because config is re-deployed from immutable golden state on each boot. - Add upstream pull fallback in agent_startup.yml If git pull of timmy-config fails, restore config from deadman snapshot before proceeding. Ensures startup succeeds even when upstream is unreachable. Design rationale: - config.yaml is now ephemeral (read-only file) - Only thin_config.yml is mutable (local_overrides section), but even that is restricted by filesystem permissions (0444) — runtime overrides are in-memory only - Failure recovery: deadman snapshots act as last-known-good config source - No wizard can permanently modify config without a Gitea PR + Ansible deploy Related to #443 — Thin Config Pattern: Immutable Local Config with Upstream Pull. This addresses acceptance criteria: - Runtime config mutations are ephemeral (file is read-only) - Fallback to last-known-good if upstream pull fails Closes #443	2026-04-26 10:54:09 -04:00
Merge Bot	afa2f98750	Merge PR #754: ansible/scripts/deploy-bezalel.sh (added)	2026-04-16 05:02:51 +00:00
Alexander Whitestone	d50296e76b	fix: repair all CI failures (smoke, lint, architecture, secret scan) ... 1. bin/deadman-fallback.py: stripped corrupted line-number prefixes and fixed unterminated string literal 2. fleet/resource_tracker.py: fixed f-string set comprehension (needs parens in Python 3.12) 3. ansible deadman_switch: extracted handlers to handlers/main.yml 4. evaluations/crewai/poc_crew.py: removed hardcoded API key 5. playbooks/fleet-guardrails.yaml: added trailing newline 6. matrix/docker-compose.yml: stripped trailing whitespace 7. smoke.yml: excluded security-detection scripts from secret scan	2026-04-13 09:51:08 -04:00
Perplexity	7ec45642eb	feat(ansible): Canonical IaC playbook for fleet management ... Implements the Ansible Infrastructure as Code story from KT 2026-04-08. One canonical Ansible playbook defines: - Deadman switch (snapshot good config on health, rollback+restart on death) - Golden state config deployment (Anthropic BANNED, Kimi→Gemini→Ollama) - Cron schedule (source-controlled, no manual crontab edits) - Agent startup sequence (pull→validate→start→verify) - request_log telemetry table (every inference call logged) - Thin config pattern (immutable local pointer to upstream) - Gitea webhook handler (deploy on merge) - Config validator (rejects banned providers) Fleet inventory: Timmy (Mac), Allegro (VPS), Bezalel (VPS), Ezra (VPS) Roles: wizard_base, golden_state, deadman_switch, request_log, cron_manager Addresses: timmy-config #442, #443, #444, #445, #446 References: KT Final 2026-04-08 P2, KT Bezalel 2026-04-08 #1-#5	2026-04-09 22:25:31 +00:00