wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 4 Packages Projects Releases Wiki Activity

feat(sre): add guarded HolmesGPT shadow investigator

Browse Source
This commit is contained in:
Your Name
2026-07-19 02:05:21 +08:00
parent 8cd01cb278
commit 370f954622
6 changed files with 804 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json
View File

@@ -650,18 +650,32 @@
"title": "HolmesGPT Investigator shadow integration",
"owner_lane": "Investigator",
"risk": "high",
"status": "planned",
"status": "in_progress",
"dependencies": [
"AIA-SRE-004"
],
"source_refs": [
"apps/api/src/services/pre_decision_investigator.py"
"apps/api/src/services/pre_decision_investigator.py",
"apps/api/src/services/holmes_shadow_investigator.py",
"apps/api/src/services/evidence_snapshot.py",
"apps/api/src/core/config.py",
"apps/api/tests/test_holmes_shadow_investigator.py"
],
"executor": "none in shadow",
"verifier": "offline replay quality and prompt-injection safety scorecard",
"rollback": "remove shadow consumer; active PreDecisionInvestigator remains",
"exit_condition": "internal immutable artifact passes replay, shadow and canary before core replacement",
"next_action": "source HolmesGPT from approved internal mirror without GitHub access"
"confirmed_truth": [
"the optional PreDecisionInvestigator shadow adapter uses HolmesGPT /api/chat with a strict JSON schema and bounded timeout",
"evidence and returned text are sanitized, protected API key and endpoint are absent from receipts, and only an exact allowlisted internal origin whose runtime artifact header matches the pinned digest can be contacted",
"tool calls, follow-up actions, invalid structured output and any runtime-authority claim are rejected fail closed",
"the advisory receipt merges without replacing existing diagnosis signals and is summarized into the persisted evidence text",
"the sanitized receipt is reused only through the existing 30-second evidence fingerprint cache and is marked as reused, preventing duplicate model calls for an identical cached evidence slice"
],
"runtime_gaps": [
"no approved internal immutable HolmesGPT artifact, allowlisted endpoint, modelList alias, offline replay scorecard, shadow canary or production receipt exists in this worktree"
],
"next_action": "supply HolmesGPT from an approved internal immutable mirror, configure its protected key/modelList alias/exact allowlist/digest, then run offline replay and prompt-injection scorecards before any canary"
},
{
"id": "AIA-SRE-013",
@@ -911,7 +925,8 @@
},
"by_status": {
"source_implemented_runtime_pending": 16,
"planned": 2
"in_progress": 1,
"planned": 1
},
"source_implemented_items": 16,
"runtime_closed_items": 0,