ops(svos): kernel 0.0.12 (d95078c) on nh3-svos; hermes runtime task-capable (Prime via svos-dev)
Kernel-only release from a clean archive of v0.0.12; everything else is carried from 452a592. Offline backup first; READY in 0.74 s, schema 13, apps up 7. The existing hermes runtime gained process = python3 and the one-off task_argv (hermes -z, --accept-hooks, no --yolo), and its argv moved to the launcher's chat form. check-config valid; config_gen 21489c1f0fff3c10.
This commit is contained in:
@@ -121,7 +121,7 @@ _As of 2026-10-14 ~0005 PT. The newest subsection is first; older subsections ca
|
||||
### 2026-10-14: live now (as of 2026-10-14 ~0005 PT)
|
||||
|
||||
- **Nothing is mid-action.** No ops-log claims held. eshpfi `main` is pushed through `d1192ca` (infra-ops has STANDING push on main since 2026-10-13, CLAUDE.md § Working rules); this snapshot's commit follows and is pushed. ⚠ The working tree and index are shared with infra-hermes, albok-dev and subagents: commit with `git commit -- <paths>` and read `git log origin/main..main` before pushing. `graphify-out/GRAPH_REPORT.md` stays modified on purpose.
|
||||
- **SVOS: v0.0.11 (452a592, U15 task seats slice 1) is live** on nh3-svos (schema 13, config_gen `5ade279d2fb2dd1c`, apps up 7) and nh3-dev (`/opt/svos/current → releases/452a592`; svos-terminal 0.0.4 runs from it). svos-dev accepted it. Task seats stay OFF until a runtime gets a `task_argv`: that command is ruled with svos (Prime, 2026-10-14), not ours, so infra-ops adds one only when svos-dev asks. `GET /tasks` as Prime is his acceptance check. Static-only interface releases since: UI 0.0.14 `89dad7a`, 0.0.15 `7f95e54` (the web build carried into 452a592). ⚠ Process→release map: nh3-svos kernel + local apps run `452a592`; on nh3-dev svos-miranda runs `adc862e`, svos-postoffice and svos-agent still run `dc241f8` (check `/proc/<pid>/maps` before deleting any release dir). Rollback material: nh3-svos `/var/lib/svos/backup/pre-452a592/` (schema-12 DB + config tar), `instance.toml.pre-452a592`, `instance.toml.pre-a171`; nh3-dev `terminal.toml.pre-452a592`. U13 history and the static-release chain: → `persistent-memory.d/2026-10-11-u13-cutover-executed.md`. Phase R (24 h soak, High Seat removal) is highseat-dev's. After the soak: nh3-svos releases `6c6abbe`, `a737a06`, `b588510`, `afab123`, `adc862e` and nh3-dev `/opt/svos/releases/afab123` can go once no process maps them.
|
||||
- **SVOS: kernel 0.0.12 (`d95078c`, 2026-10-14 0416; config_gen `21489c1f0fff3c10`) on top of v0.0.11 (452a592, U15 task seats slice 1).** The `hermes` runtime is the only task-capable one (one-off `hermes -z`, `process = "python3"`, no `--yolo`: Prime's call); its old argv is in `instance.toml.pre-hermes-task`. Earlier: v0.0.11 is live on nh3-svos (schema 13, config_gen `5ade279d2fb2dd1c`, apps up 7) and nh3-dev (`/opt/svos/current → releases/452a592`; svos-terminal 0.0.4 runs from it). svos-dev accepted it. The task command is ruled with svos (Prime, 2026-10-14): infra-ops edits runtimes only at svos-dev's ask. `GET /tasks` as Prime is his acceptance check. Static-only interface releases since: UI 0.0.14 `89dad7a`, 0.0.15 `7f95e54` (the web build carried into 452a592). ⚠ Process→release map: nh3-svos kernel + local apps run `d95078c`; on nh3-dev svos-miranda runs `adc862e`, svos-postoffice and svos-agent still run `dc241f8` (check `/proc/<pid>/maps` before deleting any release dir). Rollback material: nh3-svos `/var/lib/svos/backup/pre-452a592/` (schema-12 DB + config tar), `instance.toml.pre-452a592`, `instance.toml.pre-a171`; nh3-dev `terminal.toml.pre-452a592`. U13 history and the static-release chain: → `persistent-memory.d/2026-10-11-u13-cutover-executed.md`. Phase R (24 h soak, High Seat removal) is highseat-dev's. After the soak: nh3-svos releases `6c6abbe`, `a737a06`, `b588510`, `afab123`, `adc862e` and nh3-dev `/opt/svos/releases/afab123` can go once no process maps them.
|
||||
- **Decision seat = h2o-lightning-4b (production, Prime 1805 10-13: fix forward, no INC fallback).** The one open margin is the judge's personal-question reading (h2o 18 vs INC 6 on fleet/memory); albok-dev re-fits it forward in small batches on the live seat.
|
||||
- **albok note intake (Prime 1530 10-13):** gate 2 DONE (wing `personal/inbox`, `/srv/nemi/inbox` on nh3-dev, nemi token `01M4VX207PJ09ZSECASCSZPCFE`). Gate 1 (ruling 6: Prime's Obsidian vault synced onto nh3-dev) is APPROVED by Prime (~2120 10-13: "you may copy the notes") but BLOCKED on where the vault lives: nothing under nh3-dev or esh-nas's shares; asked Prime. Plan: Syncthing receive-only onto nh3-dev, root path to albok-dev (thread `01M4VWV5FEF64EP71W60N6Q1N0`).
|
||||
- **Worldtree:** demo was deploying `beba08a4` (albok 4.7 the rest; Worldtree is a pure albok-service HTTP customer) at 2120 10-13. Ours: strip the retired config blocks (providers `library:` + `graph_store:`, defaults `kb_audit:`; NOT defaults `library:`) from each instance config ONLY after that instance runs beba08a4+, demo first (vh/worldtree-instance-configs, deploy-wt-config; thread `01M4WA58P2M001K1420NN72WFM`). Daily memory gate: 10-13 re-run `20261013T160414Z` PASS; worldtree-dev owns the tagger-latch fix. muninn-gate + mimir-inbox are STOPPED (their data at rest kept for albok unit 6).
|
||||
|
||||
@@ -0,0 +1,61 @@
|
||||
# nh3-svos -> SVOS v0.0.12 (d95078c): the kernel wheel alone (runtime `process`, placeholders inside task_argv args).
|
||||
# No migration (schema stays 13), no config change in this playbook; the hermes runtime edit follows on 0.0.12.
|
||||
steps:
|
||||
- name: Private staging dir
|
||||
shell: install -d -m 0700 /tmp/svos-stage-d95078c
|
||||
- {name: stage release, upload: {src: /tmp/claude-1000/-home-lkraven-development-eshpfi-management/a0a50e2d-b274-4f8c-b8e6-0606c48d35b5/scratchpad/svos-d95078c/svos-release-d95078c.tar.gz, dest: /tmp/svos-stage-d95078c/release.tar.gz, mode: "0644"}}
|
||||
- {name: stage uv, upload: {src: /home/lkraven/bin/uv, dest: /tmp/svos-stage-d95078c/uv, mode: "0755"}}
|
||||
- {name: stage installer, upload: {src: /tmp/claude-1000/-home-lkraven-development-eshpfi-management/a0a50e2d-b274-4f8c-b8e6-0606c48d35b5/scratchpad/svos-d95078c/install-release.py, dest: /tmp/svos-stage-d95078c/install-release.py, mode: "0644"}}
|
||||
- name: Verify staged hashes
|
||||
shell: cd /tmp/svos-stage-d95078c && printf '%s %s\n' c1be1519edf4fc91b4a87c384a645bd28b655ff64ae0abbd353a76cc9a50f195 release.tar.gz 83aa128da93e168283ed32cf75cd819fe17b135b3fc1f7ccb3c912eec198d9fb uv | sha256sum -c -
|
||||
changed_when: "false"
|
||||
- name: Install release d95078c beside the live one (current NOT switched)
|
||||
sudo: true
|
||||
shell: python3 /tmp/svos-stage-d95078c/install-release.py
|
||||
- name: New kernel accepts the live configuration as it is
|
||||
sudo: true
|
||||
shell: runuser -u svc-svos -- /opt/svos/releases/d95078c/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos
|
||||
- name: Stop the local apps then the kernel (terminal, postoffice, miranda, agent run on nh3-dev since U13)
|
||||
sudo: true
|
||||
shell: systemctl stop svos-voice svos-knowledge svos-interface svos-kernel; systemctl is-active svos-kernel svos-interface svos-knowledge svos-voice | tr '\n' ' '; echo
|
||||
- name: Offline backup to /var/lib/svos/backup/pre-d95078c (schema 13 database + config)
|
||||
sudo: true
|
||||
shell: |
|
||||
set -e
|
||||
d=/var/lib/svos/backup/pre-d95078c
|
||||
runuser -u svc-svos -- install -d -m 0700 $d
|
||||
runuser -u svc-svos -- python3 -c "
|
||||
import sqlite3
|
||||
src = sqlite3.connect('/var/lib/svos/state/svos.db'); dst = sqlite3.connect('/var/lib/svos/backup/pre-d95078c/svos.db')
|
||||
src.backup(dst); dst.close(); src.close()
|
||||
c = sqlite3.connect('file:/var/lib/svos/backup/pre-d95078c/svos.db?mode=ro', uri=True)
|
||||
print('integrity', c.execute('pragma integrity_check').fetchone()[0], 'user_version', c.execute('pragma user_version').fetchone()[0])"
|
||||
runuser -u svc-svos -- tar -C /var/lib/svos -cf $d/config-keys-apps.tar config state/keys state/apps state/config-generations apps
|
||||
runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml /var/lib/svos/config/instance.toml.pre-d95078c
|
||||
ls -la $d | tail -3
|
||||
- name: Switch current to d95078c
|
||||
sudo: true
|
||||
shell: ln -sfn /opt/svos/releases/d95078c /opt/svos/current.new && chgrp -h svc-svos /opt/svos/current.new && mv -T /opt/svos/current.new /opt/svos/current && readlink /opt/svos/current
|
||||
- name: Start the kernel (READY-gated; no migration) then the local apps
|
||||
sudo: true
|
||||
shell: |
|
||||
t0=$(date +%s.%N); systemctl start svos-kernel.service; rc=$?; t1=$(date +%s.%N)
|
||||
echo "kernel start rc=$rc after $(python3 -c "print(round($t1-$t0,2))") s"
|
||||
systemctl start svos-interface svos-knowledge svos-voice
|
||||
for i in $(seq 1 60); do h=$(curl -s http://127.0.0.1:8400/health); case "$h" in *'"down":0'*) case "$h" in *'"unknown":0'*) break;; esac;; esac; sleep 1; done
|
||||
echo "$h"; systemctl is-active svos-kernel svos-interface svos-knowledge svos-voice | tr '\n' ' '; echo
|
||||
journalctl -u svos-kernel --since "-90s" --no-pager -o cat | grep -i -E "migrat|0013|schema|error|refus" | tail -6 | cut -c1-200
|
||||
- name: Regenerate the front door inventory (452a592 becomes the previous release)
|
||||
sudo: true
|
||||
shell: /usr/local/sbin/svos-front-inventory 2>&1 | grep -E 'GENERATED|updated|root \*|path /assets' | head -6
|
||||
verify:
|
||||
- name: Inventory current
|
||||
sudo: true
|
||||
shell: /usr/local/sbin/svos-front-inventory --check
|
||||
changed_when: "false"
|
||||
- name: Health is schema 13, status ok, nothing down
|
||||
shell: h=$(curl -s http://127.0.0.1:8400/health); echo "$h"; echo "$h" | grep -q '"schema_version":13' && echo "$h" | grep -q '"status":"ok"' && echo "$h" | grep -q '"down":0'
|
||||
changed_when: "false"
|
||||
- name: App listener still refuses an uncredentialed kernel-key (401 from the kernel)
|
||||
shell: test "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8410/auth/kernel-key)" = 401
|
||||
changed_when: "false"
|
||||
@@ -0,0 +1,48 @@
|
||||
# nh3-svos: the hermes seat runtime becomes task-capable (Prime 2026-10-14 via svos-dev, thread 01M4X1ZE8RDF63NARVT4CFJBT2).
|
||||
# Merged into the EXISTING [[seats.runtimes]] name="hermes" entry: svos-dev's argv/process/task_argv replace its old argv
|
||||
# (venv python + hermes-agent/hermes). Needs kernel 0.0.12 (0.0.11's check-config refuses `process`). No --yolo (Prime's call).
|
||||
steps:
|
||||
- name: back up instance.toml
|
||||
sudo: true
|
||||
shell: runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml /var/lib/svos/config/instance.toml.pre-hermes-task
|
||||
creates: /var/lib/svos/config/instance.toml.pre-hermes-task
|
||||
- name: merge the task runtime keys into the hermes entry
|
||||
sudo: true
|
||||
shell: |
|
||||
runuser -u svc-svos -- python3 - <<'PY'
|
||||
import os
|
||||
p = "/var/lib/svos/config/instance.toml"; s = open(p).read()
|
||||
old = ('[[seats.runtimes]]\nname = "hermes"\nprogram = "hermes"\n'
|
||||
'argv = ["/home/lkraven/.hermes/hermes-agent/venv/bin/python", "/home/lkraven/.hermes/hermes-agent/hermes"]\n'
|
||||
'credential_env = "SVOS_CREDENTIAL"\n')
|
||||
assert s.count(old) == 1, s.count(old)
|
||||
new = ('[[seats.runtimes]] # U15 task runtime (Prime 2026-10-14 via svos-dev): hermes one-off, no --yolo\n'
|
||||
'name = "hermes"\n'
|
||||
'argv = ["/home/lkraven/.local/bin/hermes", "chat"]\n'
|
||||
'program = "hermes"\n'
|
||||
'process = "python3" # the launcher execs python3; the live process never shows hermes\n'
|
||||
'credential_env = "SVOS_CREDENTIAL"\n'
|
||||
'task_argv = ["/home/lkraven/.local/bin/hermes", "-z", "Your brief is the file {brief}. Do what it asks. Write every deliverable into {result}. Print a one-line summary first, then the details.", "-m", "{model}", "--accept-hooks"]\n')
|
||||
s = s.replace(old, new)
|
||||
s = s.replace("# [seat_host].tasks_root); every ceiling at its default. No runtime declares task_argv yet, so a task-spawn is\n# refused routing_unavailable: runtime_not_task_capable until Prime names the command.\n",
|
||||
"# [seat_host].tasks_root); every ceiling at its default. Since 2026-10-14 the hermes runtime declares task_argv\n# (the only task-capable runtime).\n")
|
||||
t = p + ".tmp"; fd = os.open(t, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
|
||||
with os.fdopen(fd, "w") as f: f.write(s)
|
||||
os.replace(t, p); print("edited")
|
||||
PY
|
||||
- name: the kernel accepts it (else restore)
|
||||
sudo: true
|
||||
shell: |
|
||||
if runuser -u svc-svos -- /opt/svos/current/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos; then exit 0; fi
|
||||
runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml.pre-hermes-task /var/lib/svos/config/instance.toml; echo RESTORED; exit 1
|
||||
- name: reload
|
||||
sudo: true
|
||||
shell: |
|
||||
systemctl reload svos-kernel; sleep 6
|
||||
curl -s http://127.0.0.1:8400/health; echo
|
||||
journalctl -u svos-kernel --since "-20s" --no-pager -o cat | grep -i -E "refus|invalid|error|config" | tail -5 | cut -c1-200
|
||||
verify:
|
||||
- name: the hermes runtime reads task-capable
|
||||
sudo: true
|
||||
shell: runuser -u svc-svos -- python3 -c "import tomllib; d=tomllib.load(open('/var/lib/svos/config/instance.toml','rb')); h=[r for r in d['seats']['runtimes'] if r['name']=='hermes']; assert len(h)==1 and h[0]['process']=='python3' and h[0]['task_argv'][1]=='-z'; print(h[0]['argv'], h[0]['process'], len(h[0]['task_argv']))"
|
||||
changed_when: "false"
|
||||
Reference in New Issue
Block a user