wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity
7,052 Commits 219 Branches 2 Tags
79489635d8d3f4451a50ed2c559a3c86ff10cca3
Commit Graph

142 Commits

Author SHA1 Message Date
ogt
6b82adca35 feat(sre): close provider and telegram automation receipts 2026-07-17 02:27:29 +08:00
ogt
541a32a9cb feat(sre): enforce typed controlled automation
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m38s
Details
CD Pipeline / build-and-deploy (push) Failing after 24m19s
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
2026-07-16 17:32:01 +08:00
ogt
5ad9d5c7bc Merge remote-tracking branch 'origin/main' into codex/sre-typed-automation-20260715 
# Conflicts:
#	apps/api/tests/test_executor_trust_boundary_readback.py
 2026-07-15 16:09:12 +08:00
ogt
5c5eb48091 feat(ai): add guarded Claude fallback route 2026-07-15 15:57:24 +08:00
ogt
f57845ba5e fix(db): enforce global nullpool session budget 2026-07-15 15:49:18 +08:00
ogt
748eb1fe3a feat(security): converge sanitized Wazuh alert ingress 2026-07-15 14:21:59 +08:00
ogt
4dc5b51d0f fix(alerting): cluster legacy backup incident replay
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m34s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
AWOOOI Harbor 110 Local Repair / workflow-shape (push) Successful in 1s
Details
AWOOOI Harbor 110 Local Repair / harbor-110-local-repair (push) Successful in 24s
Details
2026-07-15 12:59:26 +08:00
ogt
0f2ddc0ce8 fix(agent99): bound DB sessions and expire stale outcomes
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 4m0s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
AWOOOI Harbor 110 Local Repair / workflow-shape (push) Successful in 1s
Details
AWOOOI Harbor 110 Local Repair / harbor-110-local-repair (push) Successful in 17s
Details
2026-07-15 09:06:51 +08:00
ogt
ba91ce36b7 feat(mcp): add durable product federation receipts 2026-07-15 08:37:32 +08:00
ogt
9a9d1464a5 fix(obs): split SigNoz health and public routes 2026-07-15 03:03:22 +08:00
ogt
72a30211e7 Merge remote-tracking branch 'origin/main' into codex/p0-obs-002-20260715 2026-07-15 02:41:44 +08:00
ogt
aed4b044d4 feat(mcp): run governed version lifecycle receipts 2026-07-15 02:16:48 +08:00
ogt
88a457892e Merge remote-tracking branch 'origin/main' into codex/p0-obs-002-20260715 2026-07-15 01:22:17 +08:00
ogt
63b241b71e feat(ai): enforce paid fallback cost guard 2026-07-15 01:08:39 +08:00
ogt
520c0bdb01 feat(observability): add guarded SigNoz migration wave A 2026-07-15 00:49:45 +08:00
ogt
b10a7d150a fix(api): delegate production bootstrap ddl
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m42s
Details
CD Pipeline / build-and-deploy (push) Failing after 11m22s
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
2026-07-14 16:23:44 +08:00
ogt
fe95d61a34 fix(security): restore control plane maintenance ownership
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 1m5s
Details
CD Pipeline / build-and-deploy (push) Successful in 7m4s
Details
CD Pipeline / post-deploy-checks (push) Successful in 4m13s
Details
AWOOOI Harbor 110 Local Repair / workflow-shape (push) Successful in 1s
Details
AWOOOI Harbor 110 Local Repair / harbor-110-local-repair (push) Successful in 18s
Details
2026-07-14 10:06:32 +08:00
ogt
6cf8429d17 fix(automation): enforce durable alert closure
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m32s
Details
CD Pipeline / build-and-deploy (push) Successful in 8m2s
Details
CD Pipeline / post-deploy-checks (push) Successful in 2m22s
Details 
Restore D037 durable incident readback without weakening database failure semantics.

Fence Agent99 dispatch and terminal learning to canonical identities, durable leases, verifier receipts, and reconciler-owned checkpoints.

Drain backup and restore legacy receipts in bounded cohorts with strict transport, claim, projection, and no-false-green controls.

Keep SSH service refusal visible while separating it from broker network-policy reachability.
 2026-07-14 09:40:53 +08:00
ogt
e793718707 fix(agent): fail closed on incident read drift
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m31s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
2026-07-11 20:34:52 +08:00
ogt
8424af5343 fix(worker): delegate production ddl to cd
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 59s
Details
CD Pipeline / build-and-deploy (push) Successful in 7m9s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m53s
Details
2026-07-11 20:18:14 +08:00
ogt
d3fa6feef4 fix(agent): auto-authorize noncritical alert control
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m38s
Details
CD Pipeline / build-and-deploy (push) Successful in 6m58s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m42s
Details
2026-07-11 11:52:38 +08:00
ogt
93510c0703 feat(iwooos): run wazuh posture receipt chain
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Failing after 1m38s
Details
CD Pipeline / build-and-deploy (push) Has been skipped
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
2026-07-11 09:29:52 +08:00
ogt
c185d7544b fix(security): isolate allowlisted execution broker
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 1m9s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m35s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m49s
Details
2026-07-11 01:24:01 +08:00
ogt
8a766db5e2 feat(agent99): bridge sre alerts to windows relay 2026-07-10 00:26:52 +08:00
ogt
4561c65fe9 fix(api): cap db pool during prod rollout
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Failing after 1m46s
Details
CD Pipeline / build-and-deploy (push) Has been skipped
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
2026-07-01 17:00:53 +08:00
Your Name
f791107938 fix(api): bound ansible backfill query cost
Some checks failed
Code Review / ai-code-review (push) Successful in 21s
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / tests (push) Has been cancelled
Details
2026-06-27 14:10:17 +08:00
Your Name
f88d89fc38 fix(api): backfill ansible repair candidates
All checks were successful
Code Review / ai-code-review (push) Successful in 20s
Details
CD Pipeline / tests (push) Successful in 1m45s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m46s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m43s
Details
2026-06-27 13:36:39 +08:00
Your Name
e0a86b6254 feat(agents): route high risk through controlled automation
Some checks failed
Code Review / ai-code-review (push) Successful in 13s
Details
CD Pipeline / tests (push) Failing after 1m8s
Details
CD Pipeline / build-and-deploy (push) Has been skipped
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
Ansible / Reboot Recovery Contract / validate (push) Has been cancelled
Details
2026-06-26 19:19:40 +08:00
Your Name
e7c368aa27 feat(awooop): enable controlled agent apply
Some checks failed
Code Review / ai-code-review (push) Successful in 16s
Details
CD Pipeline / tests (push) Failing after 1m37s
Details
CD Pipeline / build-and-deploy (push) Has been skipped
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
Ansible / Reboot Recovery Contract / validate (push) Has been cancelled
Details
2026-06-26 18:19:29 +08:00
Your Name
cfb866d055 feat(governance): add agent market automation surfaces
Some checks failed
Ansible Lint / lint (push) Successful in 35s
Details
CD Pipeline / tests (push) Failing after 13s
Details
CD Pipeline / build-and-deploy (push) Has been skipped
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
Code Review / ai-code-review (push) Failing after 11s
Details
2026-06-04 21:50:55 +08:00
Your Name
1a72a2f664 fix(awooop): use ssh mcp transport for ansible check-mode
All checks were successful
CD Pipeline / tests (push) Successful in 1m19s
Details
Code Review / ai-code-review (push) Successful in 13s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m45s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m53s
Details
2026-05-31 14:15:11 +08:00
Your Name
e45e52e526 fix(awooop): cooldown ansible check-mode transport blockers
Some checks failed
CD Pipeline / tests (push) Successful in 1m25s
Details
Code Review / ai-code-review (push) Successful in 12s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m56s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
2026-05-31 13:08:45 +08:00
Your Name
9080ba3670 feat(awooop): run ansible check-mode evidence worker
All checks were successful
CD Pipeline / tests (push) Successful in 1m28s
Details
Code Review / ai-code-review (push) Successful in 12s
Details
CD Pipeline / build-and-deploy (push) Successful in 5m9s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m30s
Details
2026-05-31 12:53:22 +08:00
Your Name
480292b04d fix(approval): map rejected incidents to escalated
Some checks failed
CD Pipeline / tests (push) Successful in 1m38s
Details
Code Review / ai-code-review (push) Successful in 33s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m42s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
2026-05-26 00:25:01 +08:00
Your Name
ff30c61c4c fix(rls): 收斂 API DB access context
All checks were successful
Code Review / ai-code-review (push) Successful in 21s
Details
CD Pipeline / tests (push) Successful in 1m20s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m15s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m58s
Details
2026-05-12 19:55:13 +08:00
Your Name
33f85ec8ca fix(logging): redact telegram bot urls
All checks were successful
Code Review / ai-code-review (push) Successful in 17s
Details
CD Pipeline / tests (push) Successful in 1m14s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m19s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m15s
Details
2026-05-06 16:54:14 +08:00
Your Name
4111ea4f9f fix(ai): remove 188 ollama provider
All checks were successful
Code Review / ai-code-review (push) Successful in 12s
Details
CD Pipeline / tests (push) Successful in 1m13s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m36s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m20s
Details
2026-05-06 14:34:48 +08:00
OG T
c696b99ccf fix(awooop): authenticate approval decisions
All checks were successful
Code Review / ai-code-review (push) Successful in 11s
Details
CD Pipeline / tests (push) Successful in 1m3s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m28s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m25s
Details
2026-05-06 13:05:51 +08:00
Your Name
9ef9633aff fix(alerts): bypass proxy timeout for GCP Ollama 2026-05-06 08:55:14 +08:00
Your Name
09256be62c fix(rag): use bge embeddings on GCP Ollama lane
Some checks failed
Code Review / ai-code-review (push) Successful in 11s
Details
CD Pipeline / tests (push) Successful in 1m22s
Details
CD Pipeline / build-and-deploy (push) Failing after 2h14m5s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
2026-05-06 05:49:37 +08:00
Your Name
c2c0b1ec82 fix(alerts): let GCP Ollama finish before cloud fallback
All checks were successful
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / tests (push) Successful in 1m9s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m21s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m16s
Details
2026-05-06 05:27:55 +08:00
Your Name
2aa31c205a fix(ai): require 111 before alert cloud fallback
All checks were successful
CD Pipeline / tests (push) Successful in 54s
Details
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m21s
Details
CD Pipeline / post-deploy-checks (push) Successful in 2m2s
Details
2026-05-06 00:05:51 +08:00
Your Name
1cc215ec30 fix(ops): keep Ollama health checks on alert fast model
Some checks failed
CD Pipeline / tests (push) Successful in 52s
Details
Code Review / ai-code-review (push) Successful in 9s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
2026-05-05 23:16:21 +08:00
Your Name
c4854bb355 fix(ai): isolate heavy Ollama workloads from GCP alert lane
All checks were successful
CD Pipeline / tests (push) Successful in 54s
Details
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m19s
Details
CD Pipeline / post-deploy-checks (push) Successful in 3m12s
Details
2026-05-05 23:06:07 +08:00
Your Name
bf847ad045 fix(ai): stabilize GCP Ollama alert lane
Some checks failed
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / tests (push) Has been cancelled
Details
2026-05-05 22:20:27 +08:00
Your Name
ee5e3bc94f fix(openclaw): gate alert cloud fallback behind flag
Some checks failed
Code Review / ai-code-review (push) Successful in 27s
Details
CD Pipeline / tests (push) Successful in 5m17s
Details
CD Pipeline / build-and-deploy (push) Failing after 5m35s
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
2026-05-05 20:54:47 +08:00
Your Name
fc1a6196df fix(code-review): keep Gemini fallback opt-in
Some checks failed
CD Pipeline / tests (push) Successful in 2m2s
Details
Code Review / ai-code-review (push) Successful in 27s
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
2026-05-05 14:38:44 +08:00
Your Name
8629ac709b feat(awooop): Phase 1-8 完整實作 — AwoooP Agent Platform 六平面架構
Some checks failed
run-migration / migrate (push) Failing after 59s
Details
Code Review / ai-code-review (push) Successful in 1m8s
Details
Type Sync Check / check-type-sync (push) Successful in 2m27s
Details 
## Phase 1-3: Control Plane + Contract System
- awooop_phase1_control_plane_2026-05-04.sql: 12 張核心表 + RLS
- awooop_phase1_batch1_rls_2026-05-04.sql: 全部 FORCE RLS + GRANT
- packages/awooop-contracts/: 六合約 JSON Schema + golden fixtures
- src/models/awooop_contracts.py: Pydantic v2 contract models（extra=forbid）
- src/repositories/contract_repository.py: contract lifecycle（draft→published→active）
- src/services/contract_service.py: HMAC publish sig + Redis multi-sig activate
- src/services/schema_validator.py: LLM output validator（retry×3, E-SCHEMA-001）

## Phase 2: Tenant Isolation
- awooop_phase2_budget_ledger_2026-05-04.sql: budget_ledger + RLS
- src/services/budget_service.py: Token Budget Hard Kill 三層防線
- src/core/context.py: PROJECT_ID ContextVar（31 background loop 自動繼承）
- src/db/base.py + models.py: project_id 欄位 + RLS set_config 注入
- src/hermes/nl_gateway.py: project_id Redis key 前綴（Phase A 雙寫）
- src/services/anomaly_counter.py: per-project 改造（Phase A fallback）

## Phase 4: Platform Shell in Shadow Mode
- awooop_phase4_run_state_2026-05-04.sql: run_state + step_journal + idempotency
- src/services/run_state_machine.py: 8-state FSM + SKIP LOCKED + stale reaper
- src/services/platform_runtime.py: UUID v7 + W3C trace_id + shadow_execute
- src/services/audit_sink.py: PII/secret redaction 9 patterns
- src/api/v1/platform/runs.py: POST/GET /v1/platform/runs（Router→Service 架構）
- src/workers/platform_worker.py: SKIP LOCKED worker + heartbeat + reaper loop
- src/main.py: platform router + lifespan worker start/stop

## Phase 5: MCP Gateway 五閘門
- awooop_phase5_mcp_gateway_2026-05-04.sql: 4 表 + RLS
- src/plugins/mcp/gateway.py: McpGateway（Gate 1~5, E-MCP-GATE-001~009）
- src/plugins/mcp/redaction_middleware.py: 雙層 redaction + 16K 截斷
- src/plugins/mcp/registry.py: __provider name mangling（ADR-116）
- src/plugins/mcp/credential_resolver.py: k8s secret ref 解析
- tests/test_mcp_credential_isolation.py: 10 個迴歸測試（secret leak 防再現）

## Phase 6-8: EwoooC + Channel Hub + Approval Token
- awooop_phase6_ewoooc_onboarding_2026-05-04.sql: ewoooc tenant + 4 read-only MCP tools
- awooop_phase7_channel_hub_2026-05-04.sql: conversation_event + outbound_message
- src/services/provider_proxy.py: ProviderProxy + PlatformEnvelope（ADR-115）
- src/services/channel_hub.py: Telegram inbound mirror + Progressive Feedback（30s）
- src/services/awooop_approval_token.py: HS256 + jti NX replay 防護 + suggest mode

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-04 19:31:53 +08:00
Your Name
72cd79ed8b fix(aiops): Task2 drift auto-adopt 根因修復 + Task3 coverage gap 規則自動生成
All checks were successful
Code Review / ai-code-review (push) Successful in 48s
Details 
Task 2 — Drift 自動採納修根因:
  根因: _analyze_and_notify() 中 report 是 in-memory 物件，
        update_interpretation() 只更新 DB，不回寫 report.interpretation，
        導致 auto_adopt_if_safe() 永遠看到 None → 觸發「尚無 Nemotron 意圖分析」
        → Drift 自動採納 0 筆
  修法: report.interpretation = interpretation（DB 寫入後立即回寫記憶體）
  附加: DRIFT_AUTO_ADOPT_ENABLED flag（default=True，回滾: kubectl set env ...=false）

Task 3 — Coverage Gap → AI 規則自動生成執行器:
  根因: evaluate_once() 只分析 red 缺口，但無執行器將分析轉為實際規則
        → alert_rule_catalog 的 ai_generated source 永遠為 0 條
  修法: 新增 _auto_create_rules_for_uncovered_assets(run_id)
    · 查 auto_alerting=red 的 top 5 host/k8s_workload asset
    · 依 asset_type 生成範本化 PromQL rule（host→up, k8s→replicas_available）
    · UPSERT 進 alert_rule_catalog（source='ai_generated', review_status='pending_review'）
    · Redis 24h 冷卻防重複，Redis 不可用時降級繼續
  附加: COVERAGE_AUTO_RULE_ENABLED flag（default=True，回滾: kubectl set env ...=false）

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-04 14:22:51 +08:00
Your Name
54a4e59af9 fix(auto-approve): 主機告警 SSH 診斷指令豁免 bad_target 驗證 — 修復 no_executable_action 
根因：host_resource_alert 規則使用 {host}（由 instance label 派生），
與 {target} 無關；但 host 告警缺少 K8s deployment label 導致 target=unknown，
_is_bad_target=True → kubectl_command 被清空 → auto_approve 以
no_executable_action 拒絕 → 每日 3 次人工攔截。

修復：
- alert_rule_engine.py: SSH 指令（startswith "ssh "）跳過 bad_target 驗證
- prompts.py: 主 + Nemo prompt 補 Host* 告警 SSH 診斷規則，防 LLM fallback 路徑輸出 kubectl
- ssh_command_whitelist.py: 新建唯讀 SSH 指令白名單模組（供 _ssh_execute() 執行前驗證）

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-04 14:15:05 +08:00