577a674743
Implements scripts/ssh_trust.py to validate SSH connections before executing remote commands. Addresses issue #434. Features: - SSH key existence and permission (600) validation - Host key fingerprint verification against known_hosts - Connection test with configurable timeout - Safe subprocess SSH wrapper (StrictHostKeyChecking=yes only) - Timestamped command execution logging (JSONL) - --dry-run mode to preview commands - --audit mode to scan for StrictHostKeyChecking=no across repo - --check-host mode for host-only verification - --json output for programmatic use - Exit codes: 0=success, 1=conn fail, 2=host key mismatch, 3=timeout Audit findings (12 files with StrictHostKeyChecking=no): - scripts/self_healing.py:29 - scripts/fleet_llama.py:33 - scripts/provision_wizard.py:109 - scripts/telemetry.py:44 - scripts/agent_dispatch.py:32 - fleet/auto_restart.py:161,213 - fleet/health_check.py:101,129 - bin/fleet-status.sh:57 - hermes-sovereign/orchestrator/orchestrator.py:289,423 Closes #434
Gemini Sovereign Infrastructure Suite
This directory contains the core systems of the Gemini Sovereign Infrastructure, designed to systematize fleet operations, governance, and architectural integrity.
Principles
- Systems, not Scripts: We build frameworks that solve classes of problems, not one-off fixes.
- Sovereignty First: All tools are designed to run locally or on owned VPSes. No cloud dependencies.
- Von Neumann as Code: Infrastructure should be self-replicating and automated.
- Continuous Governance: Quality is enforced by code (linters, gates), not just checklists.
Tools
[OPS] Provisioning & Fleet Management
provision_wizard.py: Automates the creation of a new Wizard node from zero.- Creates DigitalOcean droplet.
- Installs and builds
llama.cpp. - Downloads GGUF models.
- Sets up
systemdservices and health checks.
fleet_llama.py: Unified management ofllama-serverinstances across the fleet.status: Real-time health and model monitoring.restart: Remote service restart via SSH.swap: Hot-swapping GGUF models on remote nodes.
skill_installer.py: Packages and deploys Hermes skills to remote wizards.model_eval.py: Benchmarks GGUF models for speed and quality before deployment.phase_tracker.py: Tracks the fleet's progress through the Paperclips-inspired evolution arc.cross_repo_test.py: Verifies the fleet works as a system by running tests across all core repositories.self_healing.py: Auto-detects and fixes common failures across the fleet.agent_dispatch.py: Unified framework for tasking agents across the fleet.telemetry.py: Operational visibility without cloud dependencies.gitea_webhook_handler.py: Handles real-time events from Gitea to coordinate fleet actions.
[ARCH] Governance & Architecture
architecture_linter_v2.py: Automated enforcement of architectural boundaries.- Enforces sidecar boundaries (no sovereign code in
hermes-agent). - Prevents hardcoded IPs and committed secrets.
- Ensures
SOUL.mdandREADME.mdstandards.
- Enforces sidecar boundaries (no sovereign code in
adr_manager.py: Streamlines the creation and tracking of Architecture Decision Records.new: Scaffolds a new ADR from a template.list: Provides a chronological view of architectural evolution.
Usage
Most tools require DIGITALOCEAN_TOKEN and SSH access to the fleet.
# Provision a new node
python3 scripts/provision_wizard.py --name fenrir --model qwen2.5-coder-7b
# Check fleet status
python3 scripts/fleet_llama.py status
# Audit architectural integrity
python3 scripts/architecture_linter_v2.py
Built by Gemini — The Builder, The Systematizer, The Force Multiplier.