wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity
1,679 Commits 203 Branches 2 Tags
757a58cc60ca056ccf0107970507ec44783b2bca
Commit Graph

256 Commits

Author SHA1 Message Date
AWOOOI CD
757a58cc60 chore(cd): deploy 1625e7b [skip ci] 2026-04-21 18:10:42 +00:00
AWOOOI CD
ca8361e0bc chore(cd): deploy 6d5f070 [skip ci] 2026-04-21 17:56:34 +00:00
Your Name
d0591c54b0 fix(security): 體健修復 — 7項 Critical/Major 安全問題全修
Some checks failed
CD Pipeline / build-and-deploy (push) Failing after 35s
Details 
## Critical 修復 (C1-C5)
- C1: git rm --cached 03-secrets.yaml（CHANGE_ME 模板不再追蹤）
- C2: git rm --cached awoooi.db + .gitignore 加 *.db（SQLite HARD_RULES 違規）
- C3: sentry-tunnel SENTRY_HOST 改為 process.env fallback
- C4: config.py DATABASE_URL 移除 changeme default，改為必填
- C5: run_migration.py 改為 os.environ["DATABASE_URL"]

## Major 修復 (M1-M4)
- M1: auto_repair /execute 加 CSRF 保護 + AutoRepairPanel.tsx 同步
- M2: drift /rollback /adopt 加 CSRF 保護（/internal/scan 保持無 CSRF）
- M3: terminal /intent 加 CSRF 保護 + terminal.store.ts 同步
- M4: live-dashboard HOST_IPS + host-grid VIP 改為 env var

## 其他
- 新增 apps/web/.env.example（6 個 env var 說明）
- K8s deployment-web 補入 3 個新 env var
- 整合測試：新增 aider_event_repository + ai_router_feedback 真實 DB 測試
- test_terminal.py CSRF dependency override 修復

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-22 01:27:39 +08:00
AWOOOI CD
49e465954c chore(cd): deploy 4fc1f49 [skip ci] 2026-04-21 14:35:32 +00:00
AWOOOI CD
0a72ae21e4 chore(cd): deploy 8fd31ec [skip ci] 2026-04-21 13:38:44 +00:00
AWOOOI CD
4bc183742f chore(cd): deploy bd73548 [skip ci] 2026-04-21 13:26:51 +00:00
AWOOOI CD
a2777aee04 chore(cd): deploy 685f5c6 [skip ci] 2026-04-21 13:05:41 +00:00
AWOOOI CD
4bc52a9bdc chore(cd): deploy acab1cd [skip ci] 2026-04-21 07:29:25 +00:00
AWOOOI CD
3c266190cf chore(cd): deploy 3323a90 [skip ci] 2026-04-20 17:13:47 +00:00
AWOOOI CD
e60c064bdc chore(cd): deploy 9a44516 [skip ci] 2026-04-20 12:29:49 +00:00
AWOOOI CD
f9ff23f007 chore(cd): deploy 156a52f [skip ci] 2026-04-20 12:09:31 +00:00
AWOOOI CD
72aea671b3 chore(cd): deploy ce918ee [skip ci] 2026-04-20 11:48:59 +00:00
AWOOOI CD
770e869f7e chore(cd): deploy 803b389 [skip ci] 2026-04-19 20:31:09 +00:00
AWOOOI CD
525102d87e chore(cd): deploy 4188df6 [skip ci] 2026-04-19 20:22:13 +00:00
AWOOOI CD
a837172fd5 chore(cd): deploy f572561 [skip ci] 2026-04-19 15:10:19 +00:00
AWOOOI CD
b9068d495f chore(cd): deploy fa643eb [skip ci] 2026-04-19 14:47:23 +00:00
AWOOOI CD
2af623032a chore(cd): deploy 37b6c9b [skip ci] 2026-04-19 14:31:48 +00:00
AWOOOI CD
b9c4896c7f chore(cd): deploy 2f5cab2 [skip ci] 2026-04-19 14:10:25 +00:00
AWOOOI CD
32959db83d chore(cd): deploy 0004554 [skip ci] 2026-04-19 13:29:28 +00:00
AWOOOI CD
f1b13d7b26 chore(cd): deploy 7db8845 [skip ci] 2026-04-19 12:36:04 +00:00
AWOOOI CD
638053346b chore(cd): deploy ceb61c3 [skip ci] 2026-04-19 12:15:43 +00:00
AWOOOI CD
576f9dad18 chore(cd): deploy ba18ad2 [skip ci] 2026-04-19 11:46:35 +00:00
AWOOOI CD
e84338e615 chore(cd): deploy 6ab0ce9 [skip ci] 2026-04-19 10:18:43 +00:00
AWOOOI CD
691bdc6cc1 chore(cd): deploy e677773 [skip ci] 2026-04-19 09:35:27 +00:00
AWOOOI CD
46677a3392 chore(cd): deploy df71c9a [skip ci] 2026-04-19 09:12:54 +00:00
AWOOOI CD
0d2455ae9a chore(cd): deploy fdf8b73 [skip ci] 2026-04-19 09:01:49 +00:00
AWOOOI CD
c77ce63a32 chore(cd): deploy 0226344 [skip ci] 2026-04-19 08:39:23 +00:00
AWOOOI CD
2dd02bec3f chore(cd): deploy 5b9b36f [skip ci] 2026-04-19 08:18:49 +00:00
OG T
7e4d83e66e chore(cd): manual deploy e7ba8cb (CI B5 network bug bypass) [skip ci] 
CI B5 Integration Tests 因 docker network 隔離無法連 pg-test-b5,
連續 2 次 fail (run 984 + 985)。
905 unit test + 26 verifier test 全 pass,確認 e7ba8cb 程式碼正確。
手動 build linux/amd64 image 推 Harbor,改 kustomization.yaml 觸發 ArgoCD sync。

下一輪需修 CI: cd.yaml B5 step 加 --network 讓 pg-test-b5 與 ci-runner 同 network。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 12:46:36 +08:00
AWOOOI CD
da7956187e chore(cd): deploy 2abc91e [skip ci] 2026-04-19 03:38:47 +00:00
OG T
eab3f527cd feat(monitoring): Phase 7 盲區治理 — L2 配額 + 自監控告警 (ADR-090)
Some checks failed
Deploy Alert Rules / Deploy Prometheus Alert Rules (push) Successful in 1m21s
Details
CD Pipeline / build-and-deploy (push) Failing after 9m24s
Details 
戰場：110 load=17 持續 13 天 + 188 cadvisor 321% CPU 重啟無效
統帥鐵律：不要只降低，要長期解決 → 結構性治理而非補丁

本 commit 涵蓋：
1. k8s/monitoring/docker-compose-110.yml
   - cadvisor 加 mem_limit 512M + cpus 1.0（L2 防爆網）
   - 備註 110 live 與本檔 drift（下一 session 納入 CD）

2. ops/monitoring/alerts-unified.yml 新增 infra_self_monitoring 群組：
   - CadvisorDown / MemoryPressure / CPUThrottled
   - NodeExporterDown / CPUThrottled
   - SentryClickHouseMemoryPressure / CPUThrottled
   - GiteaMemoryPressure / CPUThrottled
   - PrometheusDown（監控自監控元層）
   → 全部用 (memory usage / spec_memory_limit) 動態判斷，
     不寫死 80% 或 MB 數，配額改閾值自動跟著變

其他配套（非本 repo，已 SSH patch 到 110/188）：
- /home/ollama/wooo-aiops/docker-compose.yml：188 cadvisor 加 --disable_metrics / --docker_only / --housekeeping_interval + 1g/1.5c
- /home/wooo/monitoring/docker-compose.yml：110 cadvisor + node-exporter 納管 + 降維 flags + 配額
- /opt/sentry/docker-compose.override.yml：Sentry L2 配額（clickhouse 8g/4c, kafka 3g/2c 等）
- /home/wooo/gitea/docker-compose.yml：Gitea 3g/3c
- /home/wooo/act-runner/docker-compose.yml：Actions Runner 2g/2c

對映：
- feedback_monitor_self_monitoring.md 🔴🔴🔴 監控工具必須被監控
- feedback_ai_autonomous_direction.md 動態閾值 ≠ 寫死規則
- ADR-090 Layer 2 資源配額強制

驗收（48h）：
- 188 cadvisor CPU 從 321% → <50%（配額強制）
- 110 load5 從 18 → <10（Sentry/Gitea 釋壓後）
- 自監控告警無誤報

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 01:50:41 +08:00
AWOOOI CD
be76100112 chore(cd): deploy 4b8be32 [skip ci] 2026-04-18 17:26:35 +00:00
AWOOOI CD
41e6b503e2 chore(cd): deploy 98aef55 [skip ci] 2026-04-18 16:11:01 +00:00
AWOOOI CD
805230436d chore(cd): deploy 898145d [skip ci] 2026-04-18 15:38:17 +00:00
AWOOOI CD
87d0859a98 chore(cd): deploy 6ad73b4 [skip ci] 2026-04-18 12:22:38 +00:00
OG T
6ad73b4834 fix(flywheel): 三修 L5/L6 斷鏈 — RBAC 擴權 + 失敗原因入庫 + verifier 失敗時也跑
All checks were successful
CD Pipeline / build-and-deploy (push) Successful in 11m6s
Details 
2026-04-18 晚（台北時區） — ogt + Claude Opus 4.7 (1M)

全景飛輪診斷暴露 3 個真斷鏈:
  - L5 執行 30d: EXECUTION_FAILED 216 / EXECUTION_SUCCESS 2 (失敗率 99%)
  - L6 驗證 7d: verification_result 全 NULL (988 筆 evidence 都沒驗)
  - 所有 rejection_reason / error_message 欄位全空(無法診斷)

根因: awoooi-executor ServiceAccount RBAC 不足,executor.py 每次
kubectl get nodes/HPA 都 Forbidden,連 evidence 都抓不到,後面 repair
全炸,verifier 因為 execution 沒 success 永遠不 trigger,evidence
驗證結果永遠 NULL。修一個 RBAC 解 3 個節點。

## P0.1 RBAC 擴權 (k8s/awoooi-prod/07-rbac.yaml)

新增 cluster-scope 讀權(僅 list/get/watch,零寫入):
  - nodes + nodes/status (evidence gathering 必需)
  - horizontalpodautoscalers (HPA 狀態)
  - metrics.k8s.io: nodes + pods (resource metrics)
  - statefulsets + daemonsets (完整 workload 視圖)

已 kubectl apply + 煙霧測試: kubectl get nodes 可跑。

## P0.2 失敗時必寫 rejection_reason (approval_db.py)

update_execution_status() 新增 error_message 參數,失敗時寫入
rejection_reason (截 2000 字) → 之後診斷有依據。

approval_execution.py 呼叫端同步更新,result.error 一路傳進 DB。

## P0.3 Verifier 失敗時也跑 (approval_execution.py)

原邏輯: verifier 只在 result.success=True 時呼叫 → 99% 失敗下
永遠不跑。

新邏輯: 失敗 path 也 create_task 跑 verifier,action_taken 後綴
加 ":FAILED" 標記。verifier 抓 post_state 寫
verification_result='failed' 回 incident_evidence。

L7 learning 從此有失敗樣本可學,playbook trust 負向 2x 衰減才
真正生效。

預期效果:
  - EXECUTION_FAILED 率 30d 內應從 99% 降到 <30%
  - incident_evidence.verification_result NULL 率應從 100% 降到 <10%
  - approval_records.rejection_reason 補齊率從 0% 到 100%

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-18 20:12:57 +08:00
AWOOOI CD
1dac23fd56 chore(cd): deploy b0d560d [skip ci] 2026-04-18 10:21:41 +00:00
AWOOOI CD
c40f3506e3 chore(cd): deploy b63aed7 [skip ci] 2026-04-18 09:20:51 +00:00
AWOOOI CD
584831bace chore(cd): deploy f3960f3 [skip ci] 2026-04-18 08:39:13 +00:00
AWOOOI CD
e7bd37a5ac chore(cd): deploy a156566 [skip ci] 2026-04-18 08:14:08 +00:00
AWOOOI CD
4f70da027e chore(cd): deploy fb88512 [skip ci] 2026-04-18 08:03:46 +00:00
AWOOOI CD
7d342e3f3e chore(cd): deploy 7542e6e [skip ci] 2026-04-18 07:36:38 +00:00
AWOOOI CD
6768a375bd chore(cd): deploy 2d43751 [skip ci] 2026-04-18 05:34:11 +00:00
OG T
2d43751729 feat(ops): ADR-090-B 零信任收尾範本 — wrapper / sudoers / migrator / CI
Some checks failed
CD Pipeline / build-and-deploy (push) Successful in 12m17s
Details
run-migration / migrate (push) Failing after 14s
Details 
2026-04-18 台北時區 —— ogt + Claude Opus 4.7 (1M)

本 commit 響應本 Session 兩次憑證外洩事故
(feedback_secrets_leak_incidents_2026-04-18.md),
交付統帥可直接部署的零信任基礎設施範本.

檔案清單:

1. scripts/host-ops/awoooi-hosts-add.sh
   - 110 主機 /etc/hosts 白名單 wrapper
   - 只允許預定義主機名,idempotent,帶 IP 格式驗證
   - 安裝: /usr/local/bin/awoooi-hosts-add (root:root 0755)

2. scripts/host-ops/awoooi-wrapper.sudoers
   - 配套 sudoers 規則 (NOPASSWD for wrapper + SIGHUP only)
   - 安裝: /etc/sudoers.d/awoooi-wrapper (root:root 0440)
   - 禁 tee / bash / sh 這類 generic shell access

3. apps/api/migrations/adr090b_awoooi_migrator_role.sql
   - PG 限權角色 awoooi_migrator
   - 只能 DDL (CREATE/ALTER/DROP/INDEX/COMMENT)
   - 明確 REVOKE 所有 DML + default privileges 鎖死
   - 本檔由統帥執行 (需 superuser),不由 Claude 執行

4. k8s/awoooi-prod/awoooi-migrator-secret.template.yaml
   - K8s Secret patch 範本
   - 新增 MIGRATION_DATABASE_URL key (awoooi_migrator 連線串)
   - 與應用 DATABASE_URL 拆開

5. .gitea/workflows/run-migration.yml
   - CI 自動套用新 migration (單 transaction + ON_ERROR_STOP)
   - 用 Gitea secret MIGRATION_DATABASE_URL,不走明碼
   - 每次成功寫一筆 asset_discovery_run (audit trail)

零信任三層防線 (對應 feedback_secrets_leak_incidents):
  L1 對話無密碼 -> wrapper 內建白名單
  L2 操作經 wrapper -> sudoers + awoooi_migrator
  L3 顯示強制遮蔽 -> CI 走 secret,不走 env

本 Session 發現的 3 次憑證外洩全部在 feedback_secrets_leak
memory 登記,並有對應 P0 輪替計畫.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-18 13:23:39 +08:00
AWOOOI CD
d23343ac69 chore(cd): deploy 1ff3405 [skip ci] 2026-04-17 17:17:58 +00:00
AWOOOI CD
1de72fffe5 chore(cd): deploy 4f2e122 [skip ci] 2026-04-17 17:03:41 +00:00
AWOOOI CD
0bde389323 chore(cd): deploy cf50a5c [skip ci] 2026-04-17 15:17:51 +00:00
AWOOOI CD
bf835e51ac chore(cd): deploy cbb719b [skip ci] 2026-04-17 14:54:34 +00:00
AWOOOI CD
3c56f02954 chore(cd): deploy af2adb5 [skip ci] 2026-04-17 14:36:03 +00:00
AWOOOI CD
f7edae78fb chore(cd): deploy 604d8ee [skip ci] 2026-04-17 14:21:29 +00:00