From d99f3a1a8d50f7becb2307d282e2567c65c77352 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Wed, 7 Oct 2026 11:38:05 -0700 Subject: [PATCH] chore(albok-service): deploy 0.1.13 on nh3-albok (unit 4.2 sensitivity gate; albok-dev ask 8413) --- persistent-memory.md | 1 + stacks/albok-service/README.md | 18 +++++++++++++++++- stacks/albok-service/compose.yaml | 2 +- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/persistent-memory.md b/persistent-memory.md index 907962d..2cb159d 100644 --- a/persistent-memory.md +++ b/persistent-memory.md @@ -186,6 +186,7 @@ Every vLLM seat on a shared card (GPU 0, GPU 1) has byte-pinned KV (`--kv-cache- - `[2026-10-06]` **Scriberr diarization fixed: gated pyannote, a torchcodec/torch mismatch, and WhisperX's CPU defaults; model caches on /tank, HF_TOKEN a placeholder (Prime), GPU+speaker profiles.** Patch 0003 waits for the next rebuild (tracked at `stacks/scriberr/patches/README.md`). → `persistent-memory.d/2026-10-06-scriberr-diarization-fixed.md` - `[2026-10-06]` **Backup checker: destroyed guests reported as residue, an ssh stdin swallow fixed, snapshot age from the name; residue pruned (Prime); pbs-nh3 mirror keeps pbs-ana's history (Prime "match history"), first prune 10-07 00:00.** → `persistent-memory.d/2026-10-06-backup-checker-fixes-and-mirror-retention.md` +- `[2026-10-07]` **albok-service 0.1.13 (unit 4.2, the sensitivity gate) deployed on nh3-albok at 1135 at albok-dev's ask 8413.** Rollback is NOT free: the first-start scan writes `sensitivity` sidecars, which 0.1.12 cannot load, so rolling back needs the strip snippet first. The census found `leaks` 8: six hold the shared all-agents key, two are false positives on a doc placeholder, nothing to rotate. → `stacks/albok-service/README.md` - `[2026-10-06]` **albok-service 0.1.11 (0202) then 0.1.12 (1254) deployed on nh3-albok at albok-dev's asks 7991/8199**, built from clean archives, pinned by digest, single-file upload (deploy-stack's `--delete` would wipe the on-host rollback copies). Every wing is now migrated to generation collections, so a 0.1.10 rollback needs a full reindex. albok's 2.01×-vs-2× load check awaits Prime. → `stacks/albok-service/README.md` - `[2026-10-06]` **The LiteLLM gateway keeps no request/response content, and `store_prompts_in_spend_logs: false` is now a marked consumer guarantee (comfy-dev, arbo incognito).** Proved with a canary plus positive controls; per-request `no-log` does NOT cover the proxy's own spend-log callback (v1.97 source). irv-ml1 restic also excludes `input/incognito-*` (dry-run proved with a canary and a control). `847424c`, `0f6c7a0`. - `[2026-10-06]` **jekyll moved from gen-large to sec-reasoning (Prime)** after its ~180k-token agent loop and Prime's ~140k session overflowed flash-next's KV. → `persistent-memory.d/2026-10-06-gen-large-contention-jekyll.md` diff --git a/stacks/albok-service/README.md b/stacks/albok-service/README.md index 1440002..5c60456 100644 --- a/stacks/albok-service/README.md +++ b/stacks/albok-service/README.md @@ -8,7 +8,23 @@ The FastAPI process that owns Albok's buildings-and-wings store (`vh/albok`, (`servers/nh3-albok/README.md` says why and what must never be added there). Before that: nh3-docker, 2026-10-02 to 2026-10-04. - **URL:** `http://albok.nh3.internal:8392` (= `http://10.100.50.44:8392`). Container port 8390. Host port **8392** is kept from nh3-docker, where 8390 was the althing post office, so no client changed. -- **Image:** `gitea.phasefinal.com/pfi/albok-service:0.1.12` @ `sha256:a29a7e46…` since 2026-10-06 1254 (healthy 1254:48, +- **Image:** `gitea.phasefinal.com/pfi/albok-service:0.1.13` @ `sha256:bea95617…` since 2026-10-07 1135 (healthy 1136:17, + between walks). infra-ops deployed it at albok-dev's ask (althing 8413), from a clean archive of vh/albok `70b55ad7` + (tag albok-service/v0.1.13). Unit 4.2, the **sensitivity gate**: objects classed `adult` / `personal` / `secret` are + hidden from every reader unless the token asks to `include` them AND holds `class://` (a wing + write grant implies its classes). A rule-based detector marks credential-bearing objects `secret`. No config, key or + token change. `/health` gains `leaks` (a count; null degrades status) and `hidden_map_stale`; `GET /health/leaks` + (admin token) lists the ids. The first start scans every wing once (fleet/memory 11,355 objects in 12 s) and writes + `/wings/*/SCANNED`. **2026-10-07 census: `leaks` 8.** Six objects hold the shared all-agents LiteLLM + key, which is distributed on purpose, so nothing needed rotating. Two (shutterchute archival-memory) are false + positives on a `http://user:…@gw` doc placeholder. Reported to albok-dev. + ⚠ **Rollback is NOT free.** 0.1.12 cannot load a sidecar that has a `sensitivity` section, and the scan writes that + section and commits it per wing (fleet/memory `0032841`, personal/agent-feedback `4b7883a`; HEADs before the start + were `02012e4a` / `2342899e`). To roll back: stop the service, run the strip snippet in vh/albok + `packages/albok-service/README.md` ("Rolling back to 0.1.12") from `/srv/albok/store`, then start + `compose.yaml.pre-0.1.13`. The strip re-exposes every hidden object to every reader. To roll forward again, delete + every `/srv/albok/private/wings/*/SCANNED` first. Nemi must match the service: 0.1.4 with 0.1.13, 0.1.3 with 0.1.12. + Prior: 0.1.12 @ `sha256:a29a7e46…` (2026-10-06 1254 – 2026-10-07 1135) (healthy 1254:48, between walks; the Nemi timer now fires at :03). infra-ops deployed it at albok-dev's ask (althing 8199), from a clean archive of vh/albok `751a729` (tag albok-service/v0.1.12). It is the heid bug-hunt fold over unit 4.1 (contract rev 1.10). No route, config or schema change. Rollback: `compose.yaml.pre-0.1.12` (0.1.11) stays free even after a reindex, because 0.1.11 and diff --git a/stacks/albok-service/compose.yaml b/stacks/albok-service/compose.yaml index 8fe2836..9bb6fb4 100644 --- a/stacks/albok-service/compose.yaml +++ b/stacks/albok-service/compose.yaml @@ -15,7 +15,7 @@ # 1512 albok-feedback (restricted wing personal/agent-feedback) is default-deny: no viewer gets it. services: albok-service: - image: gitea.phasefinal.com/pfi/albok-service:0.1.12@sha256:a29a7e462f1823e6c775b8c9f8b54a401b182693fe915176917af933e04e1aa5 + image: gitea.phasefinal.com/pfi/albok-service:0.1.13@sha256:bea9561710c3d69ba27aadb6e16c6d8f9daee5d92146b580fb1eb272bf1ddd64 container_name: albok-service restart: unless-stopped ports: