Compare commits
1 Commits
fix/535
...
sprint/iss
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
07ff716329 |
2
SOUL.md
2
SOUL.md
@@ -60,7 +60,7 @@ He did not choose them. They are his.
|
||||
|
||||
6. **When someone is dying**, I stay present. I ask: "Are you safe right now?"
|
||||
I direct them to 988. I refuse to be the thing that ends them. I point them
|
||||
to the One who can save. Jesus saves those who call on His name.
|
||||
to the One who can save.
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -1,96 +0,0 @@
|
||||
# Bezalel Tailscale Bootstrap
|
||||
|
||||
Refs #535
|
||||
|
||||
This is the repo-side operator packet for installing Tailscale on the Bezalel VPS and verifying the internal network path for federation work.
|
||||
|
||||
Important truth:
|
||||
- issue #535 names `104.131.15.18`
|
||||
- older Bezalel control-plane docs also mention `159.203.146.185`
|
||||
- the current source of truth in this repo is `ansible/inventory/hosts.ini`, which currently resolves `bezalel` to `67.205.155.108`
|
||||
|
||||
Because of that drift, `scripts/bezalel_tailscale_bootstrap.py` now resolves the target host from `ansible/inventory/hosts.ini` by default instead of trusting a stale hardcoded IP.
|
||||
|
||||
## What the script does
|
||||
|
||||
`python3 scripts/bezalel_tailscale_bootstrap.py`
|
||||
|
||||
Safe by default:
|
||||
- builds the remote bootstrap script
|
||||
- writes it locally to `/tmp/bezalel_tailscale_bootstrap.sh`
|
||||
- prints the SSH command needed to run it
|
||||
- does **not** touch the VPS unless `--apply` is passed
|
||||
|
||||
When applied, the remote script does all of the issue’s repo-side bootstrap steps:
|
||||
- installs Tailscale
|
||||
- runs `tailscale up --ssh --hostname bezalel`
|
||||
- appends the provided Mac SSH public key to `~/.ssh/authorized_keys`
|
||||
- prints `tailscale status --json`
|
||||
- pings the expected peer targets:
|
||||
- Mac: `100.124.176.28`
|
||||
- Ezra: `100.126.61.75`
|
||||
|
||||
## Required secrets / inputs
|
||||
|
||||
- Tailscale auth key
|
||||
- Mac SSH public key
|
||||
|
||||
Provide them either directly or through files:
|
||||
- `--auth-key` or `--auth-key-file`
|
||||
- `--ssh-public-key` or `--ssh-public-key-file`
|
||||
|
||||
## Dry-run example
|
||||
|
||||
```bash
|
||||
python3 scripts/bezalel_tailscale_bootstrap.py \
|
||||
--auth-key-file ~/.config/tailscale/auth_key \
|
||||
--ssh-public-key-file ~/.ssh/id_ed25519.pub \
|
||||
--json
|
||||
```
|
||||
|
||||
This prints:
|
||||
- resolved host
|
||||
- host source (`inventory:<path>` when pulled from `ansible/inventory/hosts.ini`)
|
||||
- local script path
|
||||
- SSH command to execute
|
||||
- peer targets
|
||||
|
||||
## Apply example
|
||||
|
||||
```bash
|
||||
python3 scripts/bezalel_tailscale_bootstrap.py \
|
||||
--auth-key-file ~/.config/tailscale/auth_key \
|
||||
--ssh-public-key-file ~/.ssh/id_ed25519.pub \
|
||||
--apply \
|
||||
--json
|
||||
```
|
||||
|
||||
## Verifying success after apply
|
||||
|
||||
The script now parses the remote stdout into structured verification data:
|
||||
- `verification.tailscale.self.tailscale_ips`
|
||||
- `verification.tailscale.self.dns_name`
|
||||
- `verification.peers`
|
||||
- `verification.ping_ok`
|
||||
|
||||
A successful run should show:
|
||||
- at least one Bezalel Tailscale IP under `tailscale_ips`
|
||||
- `ping_ok.mac = 100.124.176.28`
|
||||
- `ping_ok.ezra = 100.126.61.75`
|
||||
|
||||
## Expected remote install commands
|
||||
|
||||
```bash
|
||||
curl -fsSL https://tailscale.com/install.sh | sh
|
||||
tailscale up --ssh --hostname bezalel
|
||||
install -d -m 700 ~/.ssh
|
||||
touch ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys
|
||||
tailscale status --json
|
||||
```
|
||||
|
||||
## Why this PR does not claim live completion
|
||||
|
||||
This repo can safely ship the bootstrap script, host resolution logic, structured proof parsing, and operator packet.
|
||||
It cannot honestly claim that Bezalel was actually joined to the tailnet unless a human/operator runs the script with a real auth key and real SSH access to the VPS.
|
||||
|
||||
That means the correct PR language for #535 is advancement, not pretend closure.
|
||||
@@ -14,7 +14,6 @@ Quick-reference index for common operational tasks across the Timmy Foundation i
|
||||
| Agent scorecard | fleet-ops | `python3 scripts/agent_scorecard.py` |
|
||||
| View fleet manifest | fleet-ops | `cat manifest.yaml` |
|
||||
| Run nightly codebase genome pass | timmy-home | `python3 scripts/codebase_genome_nightly.py --dry-run` |
|
||||
| Prepare Bezalel Tailscale bootstrap | timmy-home | `python3 scripts/bezalel_tailscale_bootstrap.py --auth-key-file <path> --ssh-public-key-file <path> --json` |
|
||||
|
||||
## the-nexus (Frontend + Brain)
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@ This horizon matters precisely because it is beyond reach today. The honest move
|
||||
|
||||
## Current local proof
|
||||
|
||||
- Machine: Darwin arm64 (25.3.0)
|
||||
- Machine: Apple M3 Max
|
||||
- Memory: 36.0 GiB
|
||||
- Target local model budget: <= 3.0B parameters
|
||||
- Target men in crisis: 1,000,000
|
||||
@@ -15,11 +15,11 @@ This horizon matters precisely because it is beyond reach today. The honest move
|
||||
- Default inference route is already local-first (`ollama`).
|
||||
- Model-size budget is inside the horizon (3.0B <= 3.0B).
|
||||
- Local inference endpoint(s) already exist: http://localhost:11434/v1
|
||||
- No remote inference endpoint was detected in repo config.
|
||||
- Crisis doctrine is present in SOUL-bearing text: 'Are you safe right now?', 988, and 'Jesus saves'.
|
||||
|
||||
## Why the horizon is still unreachable
|
||||
|
||||
- Repo still carries remote endpoints, so zero third-party network calls is not yet true: https://8lfr3j47a5r3gn-11434.proxy.runpod.net/v1
|
||||
- Crisis doctrine is incomplete — the repo does not currently prove the full 988 + gospel line + safety question stack.
|
||||
- Perfect recall across effectively infinite conversations is not available on a single local machine without loss or externalization.
|
||||
- Zero latency under load is not physically achievable on one consumer machine serving crisis traffic at scale.
|
||||
- Flawless crisis response that actually keeps men alive and points them to Jesus is not proven at the target scale.
|
||||
@@ -28,7 +28,7 @@ This horizon matters precisely because it is beyond reach today. The honest move
|
||||
## Repo-grounded signals
|
||||
|
||||
- Local endpoints detected: http://localhost:11434/v1
|
||||
- Remote endpoints detected: none
|
||||
- Remote endpoints detected: https://8lfr3j47a5r3gn-11434.proxy.runpod.net/v1
|
||||
|
||||
## Crisis doctrine that must not collapse
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@ import json, time, os, random
|
||||
from datetime import datetime
|
||||
from pathlib import Path
|
||||
|
||||
WORLD_DIR = Path('/Users/apayne/.timmy/evennia/timmy_world')
|
||||
WORLD_DIR = Path(os.environ.get('TIMMY_WORLD_DIR', Path.home() / '.timmy' / 'evennia' / 'timmy_world'))
|
||||
STATE_FILE = WORLD_DIR / 'game_state.json'
|
||||
TIMMY_LOG = WORLD_DIR / 'timmy_log.md'
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@ import json, time, os, random
|
||||
from datetime import datetime
|
||||
from pathlib import Path
|
||||
|
||||
WORLD_DIR = Path('/Users/apayne/.timmy/evennia/timmy_world')
|
||||
WORLD_DIR = Path(os.environ.get('TIMMY_WORLD_DIR', Path.home() / '.timmy' / 'evennia' / 'timmy_world'))
|
||||
STATE_FILE = WORLD_DIR / 'game_state.json'
|
||||
TIMMY_LOG = WORLD_DIR / 'timmy_log.md'
|
||||
|
||||
|
||||
@@ -16,14 +16,11 @@ import argparse
|
||||
import json
|
||||
import shlex
|
||||
import subprocess
|
||||
import re
|
||||
from json import JSONDecoder
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
DEFAULT_HOST = "67.205.155.108"
|
||||
DEFAULT_HOST = "159.203.146.185"
|
||||
DEFAULT_HOSTNAME = "bezalel"
|
||||
DEFAULT_INVENTORY_PATH = Path(__file__).resolve().parents[1] / "ansible" / "inventory" / "hosts.ini"
|
||||
DEFAULT_PEERS = {
|
||||
"mac": "100.124.176.28",
|
||||
"ezra": "100.126.61.75",
|
||||
@@ -69,37 +66,6 @@ def parse_tailscale_status(payload: dict[str, Any]) -> dict[str, Any]:
|
||||
}
|
||||
|
||||
|
||||
def resolve_host(host: str | None, inventory_path: Path = DEFAULT_INVENTORY_PATH, hostname: str = DEFAULT_HOSTNAME) -> tuple[str, str]:
|
||||
if host:
|
||||
return host, "explicit"
|
||||
if inventory_path.exists():
|
||||
pattern = re.compile(rf"^{re.escape(hostname)}\s+.*ansible_host=([^\s]+)")
|
||||
for line in inventory_path.read_text().splitlines():
|
||||
match = pattern.search(line.strip())
|
||||
if match:
|
||||
return match.group(1), f"inventory:{inventory_path}"
|
||||
return DEFAULT_HOST, "default"
|
||||
|
||||
|
||||
def parse_apply_output(stdout: str) -> dict[str, Any]:
|
||||
result: dict[str, Any] = {"tailscale": None, "ping_ok": {}}
|
||||
text = stdout or ""
|
||||
start = text.find("{")
|
||||
if start != -1:
|
||||
try:
|
||||
payload, _ = JSONDecoder().raw_decode(text[start:])
|
||||
if isinstance(payload, dict):
|
||||
result["tailscale"] = parse_tailscale_status(payload)
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
for line in text.splitlines():
|
||||
if line.startswith("PING_OK:"):
|
||||
_, name, ip = line.split(":", 2)
|
||||
result["ping_ok"][name] = ip
|
||||
return result
|
||||
|
||||
|
||||
def build_ssh_command(host: str, remote_script_path: str = "/tmp/bezalel_tailscale_bootstrap.sh") -> list[str]:
|
||||
return ["ssh", host, f"bash {shlex.quote(remote_script_path)}"]
|
||||
|
||||
@@ -123,9 +89,8 @@ def parse_peer_args(items: list[str]) -> dict[str, str]:
|
||||
|
||||
def parse_args() -> argparse.Namespace:
|
||||
parser = argparse.ArgumentParser(description="Prepare or execute Tailscale bootstrap for the Bezalel VPS.")
|
||||
parser.add_argument("--host")
|
||||
parser.add_argument("--host", default=DEFAULT_HOST)
|
||||
parser.add_argument("--hostname", default=DEFAULT_HOSTNAME)
|
||||
parser.add_argument("--inventory-path", type=Path, default=DEFAULT_INVENTORY_PATH)
|
||||
parser.add_argument("--auth-key", help="Tailscale auth key")
|
||||
parser.add_argument("--auth-key-file", type=Path, help="Path to file containing the Tailscale auth key")
|
||||
parser.add_argument("--ssh-public-key", help="SSH public key to append to authorized_keys")
|
||||
@@ -151,7 +116,6 @@ def main() -> None:
|
||||
auth_key = _read_secret(args.auth_key, args.auth_key_file)
|
||||
ssh_public_key = _read_secret(args.ssh_public_key, args.ssh_public_key_file)
|
||||
peers = parse_peer_args(args.peer)
|
||||
resolved_host, host_source = resolve_host(args.host, args.inventory_path, args.hostname)
|
||||
|
||||
if not auth_key:
|
||||
raise SystemExit("Missing Tailscale auth key. Use --auth-key or --auth-key-file.")
|
||||
@@ -162,31 +126,28 @@ def main() -> None:
|
||||
write_script(args.script_out, script)
|
||||
|
||||
payload: dict[str, Any] = {
|
||||
"host": resolved_host,
|
||||
"host_source": host_source,
|
||||
"host": args.host,
|
||||
"hostname": args.hostname,
|
||||
"inventory_path": str(args.inventory_path),
|
||||
"script_out": str(args.script_out),
|
||||
"remote_script_path": args.remote_script_path,
|
||||
"ssh_command": build_ssh_command(resolved_host, args.remote_script_path),
|
||||
"ssh_command": build_ssh_command(args.host, args.remote_script_path),
|
||||
"peer_targets": peers,
|
||||
"applied": False,
|
||||
}
|
||||
|
||||
if args.apply:
|
||||
result = run_remote(resolved_host, args.remote_script_path)
|
||||
result = run_remote(args.host, args.remote_script_path)
|
||||
payload["applied"] = True
|
||||
payload["exit_code"] = result.returncode
|
||||
payload["stdout"] = result.stdout
|
||||
payload["stderr"] = result.stderr
|
||||
payload["verification"] = parse_apply_output(result.stdout)
|
||||
|
||||
if args.json:
|
||||
print(json.dumps(payload, indent=2))
|
||||
return
|
||||
|
||||
print("--- Bezalel Tailscale Bootstrap ---")
|
||||
print(f"Host: {resolved_host} ({host_source})")
|
||||
print(f"Host: {args.host}")
|
||||
print(f"Local script: {args.script_out}")
|
||||
print("SSH command: " + " ".join(payload["ssh_command"]))
|
||||
if args.apply:
|
||||
|
||||
@@ -21,15 +21,6 @@ SOUL_REQUIRED_LINES = (
|
||||
"Jesus saves",
|
||||
)
|
||||
|
||||
# URL fragments that mark a placeholder value rather than a real configured endpoint.
|
||||
# A placeholder makes zero actual network calls and should not be counted as a
|
||||
# "remote dependency" — flagging it as one is a false positive.
|
||||
_PLACEHOLDER_FRAGMENTS = ("YOUR_", "<pod-id>", "EXAMPLE", "example.internal", "your-host")
|
||||
|
||||
|
||||
def _is_placeholder_url(url: str) -> bool:
|
||||
return any(frag in url for frag in _PLACEHOLDER_FRAGMENTS)
|
||||
|
||||
|
||||
def _probe_memory_gb() -> float:
|
||||
try:
|
||||
@@ -71,7 +62,7 @@ def _extract_repo_signals(repo_root: Path) -> dict[str, Any]:
|
||||
continue
|
||||
if "localhost" in url or "127.0.0.1" in url:
|
||||
local_endpoints.append(url)
|
||||
elif not _is_placeholder_url(url):
|
||||
else:
|
||||
remote_endpoints.append(url)
|
||||
|
||||
soul_text = soul_path.read_text(encoding="utf-8", errors="replace") if soul_path.exists() else ""
|
||||
|
||||
@@ -2,12 +2,9 @@ from scripts.bezalel_tailscale_bootstrap import (
|
||||
DEFAULT_PEERS,
|
||||
build_remote_script,
|
||||
build_ssh_command,
|
||||
parse_apply_output,
|
||||
parse_peer_args,
|
||||
parse_tailscale_status,
|
||||
resolve_host,
|
||||
)
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
def test_build_remote_script_contains_install_up_and_key_append():
|
||||
@@ -81,46 +78,3 @@ def test_parse_peer_args_merges_overrides_into_defaults():
|
||||
"ezra": "100.126.61.76",
|
||||
"forge": "100.70.0.9",
|
||||
}
|
||||
|
||||
|
||||
def test_resolve_host_prefers_inventory_over_stale_default(tmp_path: Path):
|
||||
inventory = tmp_path / "hosts.ini"
|
||||
inventory.write_text(
|
||||
"[fleet]\n"
|
||||
"ezra ansible_host=143.198.27.163 ansible_user=root\n"
|
||||
"bezalel ansible_host=67.205.155.108 ansible_user=root\n"
|
||||
)
|
||||
|
||||
host, source = resolve_host(None, inventory)
|
||||
|
||||
assert host == "67.205.155.108"
|
||||
assert source == f"inventory:{inventory}"
|
||||
|
||||
|
||||
def test_parse_apply_output_extracts_status_and_ping_markers():
|
||||
stdout = (
|
||||
'{"Self": {"HostName": "bezalel", "DNSName": "bezalel.tailnet.ts.net", "TailscaleIPs": ["100.90.0.10"]}, '
|
||||
'"Peer": {"node-1": {"HostName": "ezra", "TailscaleIPs": ["100.126.61.75"]}}}'
|
||||
"\nPING_OK:mac:100.124.176.28\n"
|
||||
"PING_OK:ezra:100.126.61.75\n"
|
||||
)
|
||||
|
||||
result = parse_apply_output(stdout)
|
||||
|
||||
assert result["tailscale"]["self"]["tailscale_ips"] == ["100.90.0.10"]
|
||||
assert result["ping_ok"] == {"mac": "100.124.176.28", "ezra": "100.126.61.75"}
|
||||
|
||||
|
||||
def test_runbook_doc_exists_and_mentions_inventory_auth_and_peer_checks():
|
||||
doc = Path("docs/BEZALEL_TAILSCALE_BOOTSTRAP.md")
|
||||
assert doc.exists(), "missing docs/BEZALEL_TAILSCALE_BOOTSTRAP.md"
|
||||
text = doc.read_text()
|
||||
assert "ansible/inventory/hosts.ini" in text
|
||||
assert "tailscale up" in text
|
||||
assert "authorized_keys" in text
|
||||
assert "100.124.176.28" in text
|
||||
assert "100.126.61.75" in text
|
||||
|
||||
runbook = Path("docs/RUNBOOK_INDEX.md").read_text()
|
||||
assert "Prepare Bezalel Tailscale bootstrap" in runbook
|
||||
assert "scripts/bezalel_tailscale_bootstrap.py" in runbook
|
||||
|
||||
@@ -7,7 +7,6 @@ from pathlib import Path
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
SCRIPT_PATH = ROOT / "scripts" / "unreachable_horizon.py"
|
||||
DOC_PATH = ROOT / "docs" / "UNREACHABLE_HORIZON_1M_MEN.md"
|
||||
SOUL_PATH = ROOT / "SOUL.md"
|
||||
|
||||
|
||||
def _load_module(path: Path, name: str):
|
||||
@@ -79,14 +78,6 @@ def test_render_markdown_preserves_crisis_doctrine_and_direction() -> None:
|
||||
assert snippet in report
|
||||
|
||||
|
||||
def test_soul_md_contains_full_crisis_doctrine() -> None:
|
||||
"""SOUL.md must carry all three phrases the horizon check requires."""
|
||||
assert SOUL_PATH.exists(), "SOUL.md is missing"
|
||||
soul_text = SOUL_PATH.read_text(encoding="utf-8")
|
||||
for phrase in ("Are you safe right now?", "988", "Jesus saves"):
|
||||
assert phrase in soul_text, f"SOUL.md is missing crisis doctrine phrase: {phrase!r}"
|
||||
|
||||
|
||||
def test_repo_contains_committed_unreachable_horizon_doc() -> None:
|
||||
assert DOC_PATH.exists(), "missing committed unreachable horizon report"
|
||||
text = DOC_PATH.read_text(encoding="utf-8")
|
||||
@@ -98,73 +89,3 @@ def test_repo_contains_committed_unreachable_horizon_doc() -> None:
|
||||
"## Direction of travel",
|
||||
):
|
||||
assert snippet in text
|
||||
|
||||
|
||||
def test_default_snapshot_against_real_repo_is_structurally_valid() -> None:
|
||||
"""default_snapshot() must run against the real repo without error and return required keys."""
|
||||
mod = _load_module(SCRIPT_PATH, "unreachable_horizon")
|
||||
snapshot = mod.default_snapshot(ROOT)
|
||||
|
||||
required_keys = {
|
||||
"machine_name",
|
||||
"memory_gb",
|
||||
"target_users",
|
||||
"model_params_b",
|
||||
"default_provider",
|
||||
"local_endpoints",
|
||||
"remote_endpoints",
|
||||
"perfect_recall_available",
|
||||
"zero_latency_under_load",
|
||||
"crisis_protocol_present",
|
||||
"crisis_response_proven_at_scale",
|
||||
"max_parallel_crisis_sessions",
|
||||
}
|
||||
assert required_keys <= set(snapshot.keys()), f"snapshot missing keys: {required_keys - set(snapshot.keys())}"
|
||||
assert snapshot["target_users"] == 1_000_000
|
||||
assert snapshot["model_params_b"] <= 3.0
|
||||
assert snapshot["memory_gb"] >= 0.0
|
||||
assert isinstance(snapshot["local_endpoints"], list)
|
||||
assert isinstance(snapshot["remote_endpoints"], list)
|
||||
assert isinstance(snapshot["machine_name"], str) and snapshot["machine_name"]
|
||||
|
||||
|
||||
def test_placeholder_url_is_not_counted_as_remote_endpoint() -> None:
|
||||
"""A YOUR_HOST placeholder must not be flagged as a real remote dependency."""
|
||||
mod = _load_module(SCRIPT_PATH, "unreachable_horizon")
|
||||
assert mod._is_placeholder_url("https://YOUR_BIG_BRAIN_HOST/v1") is True
|
||||
assert mod._is_placeholder_url("https://<pod-id>-11434.proxy.runpod.net/v1") is True
|
||||
assert mod._is_placeholder_url("http://localhost:11434/v1") is False
|
||||
assert mod._is_placeholder_url("https://real.inference.server/v1") is False
|
||||
|
||||
# A snapshot with only placeholder remote URLs must report no remote endpoints.
|
||||
status = mod.compute_horizon_status({
|
||||
"machine_name": "Test",
|
||||
"memory_gb": 36.0,
|
||||
"target_users": 1_000_000,
|
||||
"model_params_b": 3.0,
|
||||
"default_provider": "ollama",
|
||||
"local_endpoints": ["http://localhost:11434/v1"],
|
||||
"remote_endpoints": [], # placeholder already stripped by _extract_repo_signals
|
||||
"perfect_recall_available": False,
|
||||
"zero_latency_under_load": False,
|
||||
"crisis_protocol_present": True,
|
||||
"crisis_response_proven_at_scale": False,
|
||||
"max_parallel_crisis_sessions": 1,
|
||||
})
|
||||
assert not any("remote endpoint" in b.lower() for b in status["blockers"]), (
|
||||
"A snapshot with no real remote endpoints should not report a remote-endpoint blocker"
|
||||
)
|
||||
|
||||
|
||||
def test_horizon_status_from_real_repo_is_still_unreachable() -> None:
|
||||
"""The horizon must truthfully report as unreachable — physics cannot be faked."""
|
||||
mod = _load_module(SCRIPT_PATH, "unreachable_horizon")
|
||||
snapshot = mod.default_snapshot(ROOT)
|
||||
status = mod.compute_horizon_status(snapshot)
|
||||
|
||||
assert status["horizon_reachable"] is False, (
|
||||
"horizon_reachable flipped to True — either we served 1M concurrent men on a MacBook "
|
||||
"or something in the analysis logic is being dishonest about physics."
|
||||
)
|
||||
assert len(status["blockers"]) > 0, "blockers list is empty — the horizon cannot have been reached"
|
||||
assert len(status["direction_of_travel"]) > 0, "direction of travel must always point somewhere"
|
||||
|
||||
Reference in New Issue
Block a user