Your Name
|
c4854bb355
|
fix(ai): isolate heavy Ollama workloads from GCP alert lane
CD Pipeline / tests (push) Successful in 54s
Code Review / ai-code-review (push) Successful in 10s
CD Pipeline / build-and-deploy (push) Successful in 3m19s
CD Pipeline / post-deploy-checks (push) Successful in 3m12s
|
2026-05-05 23:06:07 +08:00 |
|
Your Name
|
8629ac709b
|
feat(awooop): Phase 1-8 完整實作 — AwoooP Agent Platform 六平面架構
run-migration / migrate (push) Failing after 59s
Code Review / ai-code-review (push) Successful in 1m8s
Type Sync Check / check-type-sync (push) Successful in 2m27s
## Phase 1-3: Control Plane + Contract System
- awooop_phase1_control_plane_2026-05-04.sql: 12 張核心表 + RLS
- awooop_phase1_batch1_rls_2026-05-04.sql: 全部 FORCE RLS + GRANT
- packages/awooop-contracts/: 六合約 JSON Schema + golden fixtures
- src/models/awooop_contracts.py: Pydantic v2 contract models（extra=forbid）
- src/repositories/contract_repository.py: contract lifecycle（draft→published→active）
- src/services/contract_service.py: HMAC publish sig + Redis multi-sig activate
- src/services/schema_validator.py: LLM output validator（retry×3, E-SCHEMA-001）
## Phase 2: Tenant Isolation
- awooop_phase2_budget_ledger_2026-05-04.sql: budget_ledger + RLS
- src/services/budget_service.py: Token Budget Hard Kill 三層防線
- src/core/context.py: PROJECT_ID ContextVar（31 background loop 自動繼承）
- src/db/base.py + models.py: project_id 欄位 + RLS set_config 注入
- src/hermes/nl_gateway.py: project_id Redis key 前綴（Phase A 雙寫）
- src/services/anomaly_counter.py: per-project 改造（Phase A fallback）
## Phase 4: Platform Shell in Shadow Mode
- awooop_phase4_run_state_2026-05-04.sql: run_state + step_journal + idempotency
- src/services/run_state_machine.py: 8-state FSM + SKIP LOCKED + stale reaper
- src/services/platform_runtime.py: UUID v7 + W3C trace_id + shadow_execute
- src/services/audit_sink.py: PII/secret redaction 9 patterns
- src/api/v1/platform/runs.py: POST/GET /v1/platform/runs（Router→Service 架構）
- src/workers/platform_worker.py: SKIP LOCKED worker + heartbeat + reaper loop
- src/main.py: platform router + lifespan worker start/stop
## Phase 5: MCP Gateway 五閘門
- awooop_phase5_mcp_gateway_2026-05-04.sql: 4 表 + RLS
- src/plugins/mcp/gateway.py: McpGateway（Gate 1~5, E-MCP-GATE-001~009）
- src/plugins/mcp/redaction_middleware.py: 雙層 redaction + 16K 截斷
- src/plugins/mcp/registry.py: __provider name mangling（ADR-116）
- src/plugins/mcp/credential_resolver.py: k8s secret ref 解析
- tests/test_mcp_credential_isolation.py: 10 個迴歸測試（secret leak 防再現）
## Phase 6-8: EwoooC + Channel Hub + Approval Token
- awooop_phase6_ewoooc_onboarding_2026-05-04.sql: ewoooc tenant + 4 read-only MCP tools
- awooop_phase7_channel_hub_2026-05-04.sql: conversation_event + outbound_message
- src/services/provider_proxy.py: ProviderProxy + PlatformEnvelope（ADR-115）
- src/services/channel_hub.py: Telegram inbound mirror + Progressive Feedback（30s）
- src/services/awooop_approval_token.py: HS256 + jti NX replay 防護 + suggest mode
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-04 19:31:53 +08:00 |
|
Your Name
|
13e51802fe
|
feat(awooop): Phase 0 全 ADR + Phase 1 control plane schema（含 critic 四項修正）
## Phase 0（文件層，全部 Accepted）
- ADR-106/107：AwoooP 平台架構 + 儲存策略
- ADR-111~118：Bootstrap → RLS 七項核心 ADR
- ADR-119~124：SAGA → Singleton Decomposition 六項 ADR
- ADR-UI-01~04：Operator Console 四個 UI ADR
## Phase 1（DB schema + migration）
- awooop_phase1_control_plane_2026-05-04.sql：7 張新表 + trigger + RLS
- Step 1：三角色（platform_admin/migration BYPASSRLS，awooop_app 受 RLS）
- Step 13：GRANT awooop_app 最小權限（7 條）
- Step 14：RLS fail-closed，移除 __platform__ 後門
- awooop_phase1_batch1_rls_2026-05-04.sql：高流量四表三步式 ADD COLUMN
- awooop_phase1_batch1_backfill.py：SKIP LOCKED 分批回填腳本
- awooop_models.py：7 個 SQLAlchemy 2.x models
## Critic 修正（4 Critical + 3 Major）
- C-1：ADD CONSTRAINT IF NOT EXISTS → DO 塊 + pg_constraint 查詢
- C-2：__mapper_args__ 字串 list → primary_key=True on mapped_column
- C-3：__platform__ RLS 後門 → 全移除，改用 BYPASSRLS role
- C-4：awooop_app role 從未建立 → Step 1 + 7 條 GRANT
- M-1：active_pointer_guard SECURITY DEFINER（FORCE RLS 跨租戶保護）
- M-2：pg_partman create_parent 加冪等防護
- M-3：immutability trigger 新增身份欄位保護（project_id/family/contract_id）
## Task 1.2 修補
- agent_loader.py：硬編碼 Mac 路徑 → AGENTS_DIR 環境變數
- Dockerfile：補 COPY .claude/agents/
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-04 13:37:11 +08:00 |
|
Your Name
|
b1ef05fa8c
|
feat(ollama): ADR-110 GCP 三層容災架構（GCP-A → GCP-B → Local → Gemini）
Code Review / ai-code-review (push) Successful in 50s
CD Pipeline / tests (push) Failing after 1m14s
CD Pipeline / build-and-deploy (push) Has been skipped
CD Pipeline / post-deploy-checks (push) Has been skipped
## 變更摘要
- Primary: http://34.143.170.20:11434 (GCP-A SSD, 9x 載速 + 2x 推理)
- Secondary: http://34.21.145.224:11434 (GCP-B SSD)
- Fallback: http://192.168.0.111:11434 (M1 Pro Local HDD，最後防線)
- 廢止 ADR-105「111 唯一鐵律」，新建 ADR-110
## 核心改動
- config.py: 新增 OLLAMA_SECONDARY_URL；validator 加 GCP IP 白名單（34.143.170.20, 34.21.145.224）
- ollama_failover_manager.py: 三層 Ollama 決策矩陣；並行健康檢查三台；health_111 → health_gcp_a
- ollama_health_monitor.py: host label 萃取改為通用版（支援 GCP 公網 IP）
- failover_alerter.py: 故障/恢復主機動態顯示，不再硬編碼「Ollama 111 (GPU)」
- ollama_auto_recovery.py: notify_recovery 改為 ollama_gcp_a；recovered_host 動態
- k8s/awoooi-prod: configmap + deployment + network-policy 同步更新（egress 加 GCP /32）
- 服務層: 10 個服務檔案硬編碼 192.168.0.111 改為讀 settings.OLLAMA_URL
- 測試: URL 常數更新，新增三層容災場景，GCP IP 白名單驗證測試
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
2026-05-03 22:49:23 +08:00 |
|
Your Name
|
7b6df17dee
|
feat(hermes): 升級 Ollama 模型路由 — qwen3:8b 取代雙模型
CD Pipeline / build-and-deploy (push) Has started running
- qwen2.5-coder:7b + qwen2.5:7b-instruct → qwen3:8b (Hybrid Thinking)
- qwen3:8b 同時勝任程式碼與通用指令，單一模型涵蓋 9 個 agent
- deepseek-r1:14b 保留 debugger / vuln-verifier 推理任務
- gemma4 尚未在 Ollama registry 釋出，暫保留 gemma3:4b
- 已在 111 主機 pull qwen3:8b (4.9GB)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-04-25 03:24:16 +08:00 |
|
Your Name
|
250eca99c6
|
fix(hermes): 改用 Ollama 本地模型（111），零費用，按 agent 類型選模型
CD Pipeline / build-and-deploy (push) Has been cancelled
模型路由：
debugger / vuln-verifier → deepseek-r1:14b (強推理，找根因/安全分析)
critic / db-expert / coder 群 → qwen2.5-coder:7b (程式碼專用)
planner / onboarder / web → qwen2.5:7b-instruct (通用指令)
default → deepseek-r1:14b
- _strip_think_tags(): 去除 deepseek-r1 <think> 推理塊，只留最終回答
- timeout=90s (deepseek-r1 推理較慢)
- log 加 model 欄位供 latency 監控
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-04-25 03:13:59 +08:00 |
|
Your Name
|
d467cac709
|
fix(hermes): 改用 anthropic Python SDK 直呼，棄用需要 claude CLI 的 claude-agent-sdk
CD Pipeline / build-and-deploy (push) Has been cancelled
根因：claude-agent-sdk 需要 spawn claude CLI，prod pod 沒有 CLI 所以 SDK 回空。
修法：改用 anthropic.AsyncAnthropic().messages.create() 直呼 API。
model: claude-haiku-4-5-20251001（快速低成本，適合 Telegram QA）
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-04-25 03:08:51 +08:00 |
|
Your Name
|
7d1c85eb86
|
fix(hermes): ANTHROPIC_API_KEY 注入 + solver 信心度修法 A + 12-Agent 治理文件
CD Pipeline / build-and-deploy (push) Has been cancelled
- nl_gateway.py: ClaudeAgentOptions 透過 env= 注入 ANTHROPIC_API_KEY（CLAUDE_API_KEY alias），
修復 SDK 找不到 API key 的問題（SDK 讀 ANTHROPIC_API_KEY，K8s secret 名稱是 CLAUDE_API_KEY）
- solver_agent.py: 修法 A — kubectl_command 欄位優先路徑，OpenClaw Nemo 回傳完整指令時
不再被語意合成壓縮 confidence（0.9 → min(0.5) 的 bug），9 tests pass
- AGENTS.md: Codex CLI 對應版 CLAUDE.md（Codex Session 啟動用）
- docs/12-agent-game-rules.md: 12-Agent 任務判型 + 主責/協作派工 + 9 skills 對照（v1.0）
- .agents/skills/06-awoooi-monorepo-master.md: v1.6，新增 12-agent 協作治理章節
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-04-25 02:33:43 +08:00 |
|
Your Name
|
86ee013cdf
|
feat(hermes-complete): Hermes NL 三項補強 + ConsensusEngine + ADR 收尾
CD Pipeline / build-and-deploy (push) Successful in 9m32s
## Hermes NL 補強（nl_gateway.py）
- T1 hermes_dispatch_log DB 寫入（asyncio.create_task 非阻擋）
- T2 Redis 速率限制：per-chat_id 20 req/min，fail-open
- T3 Multi-turn session：hermes:session:{chat_id}:{user_id} TTL=300s，最近 3 輪
## ConsensusEngine（ADR-095 宣告式設計）
- consensus_engine.py: CONSENSUS_WEIGHTS class 屬性
security=0.4 鎖定，9 個 Claude Code agent 分配 0.6
- config.py: ENABLE_12AGENT_CONSENSUS=False feature flag
## ADR 狀態
- ADR-093/094/095: Proposed → 🟡 批准實作中
- 各 ADR 加 v1.1 變更紀錄
## K8s ConfigMap
- prod 04-configmap.yaml: 加 3 個 feature flags（均 false）
- dev 02-configmap.yaml: 同步加入
## LOGBOOK
- 記錄 WS0–WS6 + 補強完成，feature flags 啟用指引
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-04-25 02:22:40 +08:00 |
|
Your Name
|
00443370ba
|
feat(ws6): Hermes observability — latency logging + dispatch audit table
run-migration / migrate (push) Failing after 16s
CD Pipeline / build-and-deploy (push) Has been cancelled
- nl_gateway.py: time.monotonic() 測量 SDK call 耗時
hermes_nl_dispatch log 加 latency_ms + success 欄位
- migrations/adr094_hermes_dispatch_log.sql
hermes_dispatch_log（bigserial + chat_id/user_id/agent/latency_ms/success）
已部署至 prod awoooi_prod
ADR-094 P95 latency 監控 + 幻覺追蹤用
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-04-25 02:10:06 +08:00 |
|
Your Name
|
834a65c833
|
feat(ws5): ADR-093 Approvers 白名單 chat_member 同步
- hermes/approvers.py: Redis Set hermes:approvers:{group_id}
sync_member_joined / sync_member_left / get_approvers / is_approved_member
空集合 → 降級不阻擋，由 config whitelist 把關
- telegram_webhook.py: chat_member / my_chat_member 事件處理
member/administrator/creator → sadd; left/kicked → srem
get_redis() 同步取 async client，再 await approvers 函數
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-04-25 02:10:06 +08:00 |
|
Your Name
|
2572ec46d2
|
feat(ws4): Hermes NL 自然語言介面 — 12-Agent Claude SDK 接入（ADR-094/095）
## hermes/ 套件（5 個新模組）
### display_names.py
- 12 agent 視覺識別表（emoji + hashtag + handle + short_name）
- format_response_header() 產生 Telegram 前綴
### agent_loader.py
- 解析 .claude/agents/*.md frontmatter → system prompt
- lru_cache 避免重複讀檔
### safety_hooks.py
- 移植 awoooi-guard.js 20 條 HARD BLOCK 規則（DENY_PATTERNS）
- 5 條 MUTATE_PATTERNS → 須走審批流
### nl_gateway.py
- Layer 1: 關鍵字正則路由（12 條規則，<10ms）
- Layer 3: DEFAULT_AGENT = "debugger"
- Claude Agent SDK query() 非同步串流，取 ResultMessage.result
- 安全降級：SDK error → 友好錯誤訊息
### telegram_webhook.py
- WS4 Hermes NL 接入（@tsenyangbot mention 或私訊觸發）
- HERMES_NL_ENABLED=False（feature flag 保護，預設關閉）
## telegram_gateway.py
- send_hermes_reply(text, chat_id, reply_to_message_id)
無 500 字截斷，支援 Agent 長回覆
## config.py
- HERMES_NL_ENABLED: bool = False
- TELEGRAM_BOT_USERNAME: str = "tsenyangbot"
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-04-25 02:10:06 +08:00 |
|