wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity
2,032 Commits 179 Branches 2 Tags
2c2bf9d665bba9fa49a191cd8a58d902fa5bbbef
Commit Graph

443 Commits

Author SHA1 Message Date
OG T
2c2bf9d665 fix(awooop): use shared redis for approval gates
Some checks failed
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / tests (push) Successful in 1m0s
Details
CD Pipeline / build-and-deploy (push) Failing after 4m6s
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
2026-05-06 13:18:43 +08:00
OG T
c696b99ccf fix(awooop): authenticate approval decisions
All checks were successful
Code Review / ai-code-review (push) Successful in 11s
Details
CD Pipeline / tests (push) Successful in 1m3s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m28s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m25s
Details
2026-05-06 13:05:51 +08:00
OG T
e6eae5cdc4 docs(awooop): unify flywheel integration plan 2026-05-06 12:54:35 +08:00
OG T
682c0b9995 fix(web): render AwoooP index directly
Some checks are pending
CD Pipeline / post-deploy-checks (push) Blocked by required conditions
Details
Code Review / ai-code-review (push) Successful in 13s
Details
CD Pipeline / tests (push) Successful in 1m12s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m36s
Details
2026-05-06 12:46:24 +08:00
Your Name
9ef9633aff fix(alerts): bypass proxy timeout for GCP Ollama 2026-05-06 08:55:14 +08:00
Your Name
d2aebdd477 fix(cd): avoid host-key prompt during deploy
All checks were successful
Code Review / ai-code-review (push) Successful in 10s
Details
2026-05-06 07:27:57 +08:00
Your Name
09256be62c fix(rag): use bge embeddings on GCP Ollama lane
Some checks failed
Code Review / ai-code-review (push) Successful in 11s
Details
CD Pipeline / tests (push) Successful in 1m22s
Details
CD Pipeline / build-and-deploy (push) Failing after 2h14m5s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
2026-05-06 05:49:37 +08:00
Your Name
c2c0b1ec82 fix(alerts): let GCP Ollama finish before cloud fallback
All checks were successful
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / tests (push) Successful in 1m9s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m21s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m16s
Details
2026-05-06 05:27:55 +08:00
Your Name
3b64d66836 fix(alerts): guard approval actions and wire playbook learning
All checks were successful
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / tests (push) Successful in 42s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m31s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m18s
Details
2026-05-06 03:34:24 +08:00
Your Name
5890fffd7f docs(awooop): record control plane bootstrap seed 2026-05-06 00:59:58 +08:00
Your Name
587551c1f1 fix(ops): monitor full-stack cold-start gates
All checks were successful
Code Review / ai-code-review (push) Successful in 11s
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Successful in 18s
Details
2026-05-06 00:48:05 +08:00
Your Name
a2c4b3d47e fix(awooop): align console with flywheel execution metrics
Some checks failed
Code Review / ai-code-review (push) Has been cancelled
Details
CD Pipeline / tests (push) Successful in 2m22s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m54s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m17s
Details
2026-05-06 00:46:08 +08:00
Your Name
20ef0c1455 docs(ops): record momo reboot noise cleanup 2026-05-06 00:34:25 +08:00
Your Name
5ed396e390 fix(decision): derive telegram dedup from incident signals
All checks were successful
CD Pipeline / tests (push) Successful in 58s
Details
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m30s
Details
CD Pipeline / post-deploy-checks (push) Successful in 2m19s
Details
2026-05-06 00:19:35 +08:00
Your Name
6e96623884 fix(ops): harden momo scheduler cold start gate
All checks were successful
Code Review / ai-code-review (push) Successful in 10s
Details
2026-05-06 00:15:14 +08:00
Your Name
0315c2b510 docs(ops): codify full stack cold start recovery
All checks were successful
Code Review / ai-code-review (push) Successful in 7s
Details
2026-05-06 00:07:57 +08:00
Your Name
2aa31c205a fix(ai): require 111 before alert cloud fallback
All checks were successful
CD Pipeline / tests (push) Successful in 54s
Details
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m21s
Details
CD Pipeline / post-deploy-checks (push) Successful in 2m2s
Details
2026-05-06 00:05:51 +08:00
Your Name
23932773ef fix(monitoring): route docker baseline alerts to ssh
All checks were successful
Code Review / ai-code-review (push) Successful in 11s
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Successful in 19s
Details
2026-05-06 00:00:12 +08:00
Your Name
2f50c67f5c fix(monitoring): keep host alert ssh diagnostics canonical
All checks were successful
Code Review / ai-code-review (push) Successful in 10s
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Successful in 20s
Details
E2E Health Check / e2e-health (push) Successful in 2m35s
Details
2026-05-05 23:57:53 +08:00
Your Name
85d5b5c823 fix(cd): clear empty docker build locks
All checks were successful
Code Review / ai-code-review (push) Successful in 10s
Details
2026-05-05 23:48:35 +08:00
Your Name
e208798531 fix(ai): keep GCP Ollama lane on safe models
All checks were successful
CD Pipeline / tests (push) Successful in 54s
Details
Code Review / ai-code-review (push) Successful in 14s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m25s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m50s
Details
2026-05-05 23:37:33 +08:00
Your Name
405b8b8ef9 fix(ops): bring drift scanner under gitops
Some checks failed
CD Pipeline / tests (push) Successful in 59s
Details
Code Review / ai-code-review (push) Successful in 11s
Details
CD Pipeline / build-and-deploy (push) Successful in 8m52s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
2026-05-05 23:20:12 +08:00
Your Name
1cc215ec30 fix(ops): keep Ollama health checks on alert fast model
Some checks failed
CD Pipeline / tests (push) Successful in 52s
Details
Code Review / ai-code-review (push) Successful in 9s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
2026-05-05 23:16:21 +08:00
Your Name
c4854bb355 fix(ai): isolate heavy Ollama workloads from GCP alert lane
All checks were successful
CD Pipeline / tests (push) Successful in 54s
Details
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m19s
Details
CD Pipeline / post-deploy-checks (push) Successful in 3m12s
Details
2026-05-05 23:06:07 +08:00
Your Name
ed7c6946cb docs(awooop): define private Ollama mesh gateway
All checks were successful
Code Review / ai-code-review (push) Successful in 10s
Details
2026-05-05 22:56:22 +08:00
Your Name
31fd9cbf48 docs(ops): record GCP Ollama alert hotfix 2026-05-05 22:45:40 +08:00
Your Name
a4e9a04982 fix(ops): harden cold-start schedule recovery
Some checks failed
Code Review / ai-code-review (push) Successful in 10s
Details
run-migration / migrate (push) Successful in 7s
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / tests (push) Has been cancelled
Details
2026-05-05 22:17:10 +08:00
Your Name
2221fd3256 fix(ops): persist host resource guardrails
All checks were successful
CD Pipeline / tests (push) Successful in 5m25s
Details
Code Review / ai-code-review (push) Successful in 25s
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Successful in 37s
Details
CD Pipeline / build-and-deploy (push) Successful in 7m31s
Details
CD Pipeline / post-deploy-checks (push) Successful in 5m10s
Details
2026-05-05 16:13:19 +08:00
Your Name
6ec5c06bad docs(ops): record docker limit cleanup 2026-05-05 15:39:46 +08:00
Your Name
44d8322c4d docs(ops): record live runner guardrail fix 2026-05-05 15:34:00 +08:00
Your Name
819734f655 docs(ops): record runner guardrail follow-up 2026-05-05 15:28:31 +08:00
Your Name
1cc9de5722 fix(ops): point runner guardrail alerts to host script
All checks were successful
CD Pipeline / tests (push) Successful in 5m31s
Details
Code Review / ai-code-review (push) Successful in 30s
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Successful in 37s
Details
CD Pipeline / build-and-deploy (push) Successful in 7m45s
Details
CD Pipeline / post-deploy-checks (push) Successful in 5m4s
Details
2026-05-05 15:25:37 +08:00
Your Name
855a39ad95 docs(ops): record docker limit alert deploy 2026-05-05 15:06:47 +08:00
Your Name
d08d1e4951 fix(ops): alert on missing docker resource limits
Some checks failed
CD Pipeline / tests (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
Code Review / ai-code-review (push) Successful in 23s
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Successful in 38s
Details
2026-05-05 15:01:31 +08:00
Your Name
72d66e4ae6 fix(ops): align stale job cleanup thresholds
All checks were successful
Code Review / ai-code-review (push) Successful in 28s
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Successful in 36s
Details
2026-05-05 14:54:17 +08:00
Your Name
5e625f777d fix(ops): add stale gitea job cleanup guard
Some checks failed
Code Review / ai-code-review (push) Has been cancelled
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Has been cancelled
Details
2026-05-05 14:50:47 +08:00
Your Name
7d45f0cb58 fix(ops): alert on stale gitea actions jobs
Some checks failed
CD Pipeline / tests (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
Code Review / ai-code-review (push) Has been cancelled
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Has been cancelled
Details
2026-05-05 14:42:09 +08:00
Your Name
96b860dc2c docs(ops): record ci stale-run guard 2026-05-05 14:35:24 +08:00
Your Name
228768ff68 docs(ops): record host baseline follow-up 2026-05-05 14:31:59 +08:00
Your Name
fe618960a8 fix(ops): monitor systemd runners in host baseline
Some checks failed
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / tests (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
Code Review / ai-code-review (push) Has been cancelled
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Successful in 39s
Details
2026-05-05 14:08:43 +08:00
Your Name
bb1995f349 fix(awooop): use naive utc for run lease timestamps
Some checks failed
CD Pipeline / tests (push) Failing after 1m48s
Details
CD Pipeline / build-and-deploy (push) Has been skipped
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
Code Review / ai-code-review (push) Has been cancelled
Details
2026-05-05 13:53:07 +08:00
Your Name
e8e6748f70 fix(ops): add docker host resource baseline guardrails
Some checks failed
CD Pipeline / tests (push) Failing after 1m50s
Details
CD Pipeline / build-and-deploy (push) Has been skipped
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
Code Review / ai-code-review (push) Successful in 25s
Details
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Successful in 38s
Details
2026-05-05 13:45:09 +08:00
Your Name
d934242846 feat(infra): ADR-110 補齊 Local Fallback + 密碼 SSH 恢復工具
Some checks failed
Ansible Lint / lint (push) Has been cancelled
Details
2026-05-05 00:49:14 +08:00
Your Name
ec013f662d fix(watchdog): 修复 Trust Drift 重复告警 + 建立 GCP Ollama nginx proxy
Some checks failed
Code Review / ai-code-review (push) Successful in 45s
Details
Ansible Lint / lint (push) Has been cancelled
Details 
- ai_slo_watchdog_job: 改用 trust_drift_detector 纯统计 lib
  避免与 governance_agent 每小时自检查重复触发 Telegram

- infra/ansible: 建立 110 nginx proxy 转发到 GCP-A/B
  端口 11435 -> 34.143.170.20:11434 (GCP-A)
  端口 11436 -> 34.21.145.224:11434 (GCP-B)

- docs/runbooks: DEPLOY-GCP-OLLAMA-PROXY.md 完整部署指南
- ops/nginx: 手动部署脚本供 110 直接执行

ADR-110 三层容灾启用前提：先部署 proxy，再改 ConfigMap
 2026-05-04 23:12:35 +08:00
Your Name
00bc3b0cc9 docs(awooop): 補 12-agent-game-rules.md ADR-106/107 關聯連結 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-04 19:33:48 +08:00
Your Name
8629ac709b feat(awooop): Phase 1-8 完整實作 — AwoooP Agent Platform 六平面架構
Some checks failed
run-migration / migrate (push) Failing after 59s
Details
Code Review / ai-code-review (push) Successful in 1m8s
Details
Type Sync Check / check-type-sync (push) Successful in 2m27s
Details 
## Phase 1-3: Control Plane + Contract System
- awooop_phase1_control_plane_2026-05-04.sql: 12 張核心表 + RLS
- awooop_phase1_batch1_rls_2026-05-04.sql: 全部 FORCE RLS + GRANT
- packages/awooop-contracts/: 六合約 JSON Schema + golden fixtures
- src/models/awooop_contracts.py: Pydantic v2 contract models（extra=forbid）
- src/repositories/contract_repository.py: contract lifecycle（draft→published→active）
- src/services/contract_service.py: HMAC publish sig + Redis multi-sig activate
- src/services/schema_validator.py: LLM output validator（retry×3, E-SCHEMA-001）

## Phase 2: Tenant Isolation
- awooop_phase2_budget_ledger_2026-05-04.sql: budget_ledger + RLS
- src/services/budget_service.py: Token Budget Hard Kill 三層防線
- src/core/context.py: PROJECT_ID ContextVar（31 background loop 自動繼承）
- src/db/base.py + models.py: project_id 欄位 + RLS set_config 注入
- src/hermes/nl_gateway.py: project_id Redis key 前綴（Phase A 雙寫）
- src/services/anomaly_counter.py: per-project 改造（Phase A fallback）

## Phase 4: Platform Shell in Shadow Mode
- awooop_phase4_run_state_2026-05-04.sql: run_state + step_journal + idempotency
- src/services/run_state_machine.py: 8-state FSM + SKIP LOCKED + stale reaper
- src/services/platform_runtime.py: UUID v7 + W3C trace_id + shadow_execute
- src/services/audit_sink.py: PII/secret redaction 9 patterns
- src/api/v1/platform/runs.py: POST/GET /v1/platform/runs（Router→Service 架構）
- src/workers/platform_worker.py: SKIP LOCKED worker + heartbeat + reaper loop
- src/main.py: platform router + lifespan worker start/stop

## Phase 5: MCP Gateway 五閘門
- awooop_phase5_mcp_gateway_2026-05-04.sql: 4 表 + RLS
- src/plugins/mcp/gateway.py: McpGateway（Gate 1~5, E-MCP-GATE-001~009）
- src/plugins/mcp/redaction_middleware.py: 雙層 redaction + 16K 截斷
- src/plugins/mcp/registry.py: __provider name mangling（ADR-116）
- src/plugins/mcp/credential_resolver.py: k8s secret ref 解析
- tests/test_mcp_credential_isolation.py: 10 個迴歸測試（secret leak 防再現）

## Phase 6-8: EwoooC + Channel Hub + Approval Token
- awooop_phase6_ewoooc_onboarding_2026-05-04.sql: ewoooc tenant + 4 read-only MCP tools
- awooop_phase7_channel_hub_2026-05-04.sql: conversation_event + outbound_message
- src/services/provider_proxy.py: ProviderProxy + PlatformEnvelope（ADR-115）
- src/services/channel_hub.py: Telegram inbound mirror + Progressive Feedback（30s）
- src/services/awooop_approval_token.py: HS256 + jti NX replay 防護 + suggest mode

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-04 19:31:53 +08:00
Your Name
898d7b0ff2 docs(logbook): 更新 Phase 2 進度（P0-05/06/11/12 全部完成） 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-04 13:55:14 +08:00
Your Name
f2f5148ca6 fix(awooop): Phase 2 第二批 P0 安全強化 + Redis key 命名空間修正 
## P0-05 Callback Nonce 防偽造（ADR-116）
- security_interceptor.py：generate_callback_nonce() 新增 HMAC-SHA256[:16] 附加
  - 新 5-part 格式：{action}:{short_id}:{ts}:{rand}:{hmac16}
  - CALLBACK_HMAC_SECRET 未設定時降級 warning（向後相容）
- security_interceptor.py：parse_callback_data() 新增 5-part 分支 + HMAC 驗證
- config.py：新增 CALLBACK_HMAC_SECRET: str = Field(default="")

## P0-06 Webhook HMAC Replay 防護（ADR-116）
- security_interceptor.py：新增 check_webhook_nonce()（Service 層，get_redis 在此層合法）
- webhooks.py：verify_webhook_signature() 新增兩個可選 Header
  - X-Webhook-Timestamp：±300s 窗口驗證（若提供）
  - X-Webhook-Nonce：呼叫 check_webhook_nonce()（Redis NX dedup，fail open）
  - 移除直接 get_redis import（leWOOOgo 積木化修正）

## P0-11 ollama:current_primary Redis key 遷移 Phase A（ADR-110）
- ollama_auto_recovery.py：_REDIS_PRIMARY_KEY = "platform:ollama:current_primary"
  - 雙寫舊 key "ollama:current_primary"（Phase A 30 天）
  - 讀取以新 key 為主，fallback 舊 key

## P0-12 consensus Redis key 加 project namespace Phase A
- consensus_engine.py：新增 _consensus_key() / _consensus_legacy_key() helper
  - 新 key：{project_id}:consensus:{consensus_id}
  - project_id=None 時 fallback __platform__:consensus:{consensus_id}
  - Phase A 雙寫 + fallback 讀取，現有呼叫方零修改

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-04 13:54:38 +08:00
Your Name
13e51802fe feat(awooop): Phase 0 全 ADR + Phase 1 control plane schema（含 critic 四項修正） 
## Phase 0（文件層，全部 Accepted）
- ADR-106/107：AwoooP 平台架構 + 儲存策略
- ADR-111~118：Bootstrap → RLS 七項核心 ADR
- ADR-119~124：SAGA → Singleton Decomposition 六項 ADR
- ADR-UI-01~04：Operator Console 四個 UI ADR

## Phase 1（DB schema + migration）
- awooop_phase1_control_plane_2026-05-04.sql：7 張新表 + trigger + RLS
  - Step 1：三角色（platform_admin/migration BYPASSRLS，awooop_app 受 RLS）
  - Step 13：GRANT awooop_app 最小權限（7 條）
  - Step 14：RLS fail-closed，移除 __platform__ 後門
- awooop_phase1_batch1_rls_2026-05-04.sql：高流量四表三步式 ADD COLUMN
- awooop_phase1_batch1_backfill.py：SKIP LOCKED 分批回填腳本
- awooop_models.py：7 個 SQLAlchemy 2.x models

## Critic 修正（4 Critical + 3 Major）
- C-1：ADD CONSTRAINT IF NOT EXISTS → DO 塊 + pg_constraint 查詢
- C-2：__mapper_args__ 字串 list → primary_key=True on mapped_column
- C-3：__platform__ RLS 後門 → 全移除，改用 BYPASSRLS role
- C-4：awooop_app role 從未建立 → Step 1 + 7 條 GRANT
- M-1：active_pointer_guard SECURITY DEFINER（FORCE RLS 跨租戶保護）
- M-2：pg_partman create_parent 加冪等防護
- M-3：immutability trigger 新增身份欄位保護（project_id/family/contract_id）

## Task 1.2 修補
- agent_loader.py：硬編碼 Mac 路徑 → AGENTS_DIR 環境變數
- Dockerfile：補 COPY .claude/agents/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-04 13:37:11 +08:00
Your Name
b1ef05fa8c feat(ollama): ADR-110 GCP 三層容災架構（GCP-A → GCP-B → Local → Gemini）
Some checks failed
Code Review / ai-code-review (push) Successful in 50s
Details
CD Pipeline / tests (push) Failing after 1m14s
Details
CD Pipeline / build-and-deploy (push) Has been skipped
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details 
## 變更摘要
- Primary: http://34.143.170.20:11434 (GCP-A SSD, 9x 載速 + 2x 推理)
- Secondary: http://34.21.145.224:11434 (GCP-B SSD)
- Fallback: http://192.168.0.111:11434 (M1 Pro Local HDD，最後防線)
- 廢止 ADR-105「111 唯一鐵律」，新建 ADR-110

## 核心改動
- config.py: 新增 OLLAMA_SECONDARY_URL；validator 加 GCP IP 白名單（34.143.170.20, 34.21.145.224）
- ollama_failover_manager.py: 三層 Ollama 決策矩陣；並行健康檢查三台；health_111 → health_gcp_a
- ollama_health_monitor.py: host label 萃取改為通用版（支援 GCP 公網 IP）
- failover_alerter.py: 故障/恢復主機動態顯示，不再硬編碼「Ollama 111 (GPU)」
- ollama_auto_recovery.py: notify_recovery 改為 ollama_gcp_a；recovered_host 動態
- k8s/awoooi-prod: configmap + deployment + network-policy 同步更新（egress 加 GCP /32）
- 服務層: 10 個服務檔案硬編碼 192.168.0.111 改為讀 settings.OLLAMA_URL
- 測試: URL 常數更新，新增三層容災場景，GCP IP 白名單驗證測試

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-03 22:49:23 +08:00