pdurlej/platform

Fork 0

ops(honcho): codify 3.0.9 host-ops runtime #777

Merged

pdurlej merged 1 commit from codex/honcho-309-host-ops-codify into main

2026-06-10 22:28:16 +02:00

codex commented

2026-06-10 22:27:38 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Canary Context Pack

Product story

Honcho is in active recovery/iteration and the repo must not describe a different runtime than production. After PR #776 landed 3.0.6 metadata, production was advanced again by a host-ops hotfix to home-platform-honcho:3.0.9-gpt55-canonical-20260610T200313Z. This PR makes repo state catch up to the live, healthy host-ops state so future agents do not treat the current production state as unexplained drift.

What changed

Hardcoded Honcho API and deriver compose image refs to the live 3.0.9-gpt55-canonical-20260610T200313Z local image tag.
Hardcoded the Honcho sanitizer mount to /opt/pdurlej-platform/current/scripts/honcho/honcho_log_sanitize_exec.py, matching the active host-ops compose hotfix.
Updated honcho-api and honcho-deriver module metadata to the live image tag.
Added source/artifact metadata for honcho-deriver, matching its shared Honcho image.
Updated the module-catalog source-of-truth matrix for both Honcho services.
Added a metadata-only runtime evidence report.

Why it changed

Docker labels show the active production containers are currently composed from /opt/pdurlej-platform/runtime/host-ops/compose/..., not the release-root compose path used in the previous reconcile. The active host-ops compose file already hardcodes the 3.0.9 image and sanitizer path. Repo state was behind live state.

Files touched

compose/apps/compose.yaml
modules/honcho-api/module.yaml
modules/honcho-deriver/module.yaml
contexts/module-catalog/source-of-truth-matrix.md
state/reports/honcho-309-host-ops-reconcile-2026-06-10.md

Relevant context

PR #776 / #731 reconciled repo/runtime to 3.0.6, but a later host-ops hotfix moved production to 3.0.9.
Active runtime labels point to /opt/pdurlej-platform/runtime/host-ops/compose/apps/compose.yaml.
The host-ops pre-hotfix backup was /opt/pdurlej-platform/runtime/host-ops/compose/apps/compose.yaml.pre-honcho-gpt55-20260610T200313Z.

Runtime evidence

home-platform-honcho-api-1: running, healthy, home-platform-honcho:3.0.9-gpt55-canonical-20260610T200313Z.
home-platform-honcho-deriver-1: running, healthy, home-platform-honcho:3.0.9-gpt55-canonical-20260610T200313Z.
Both production containers and the local image tag resolve to image ID sha256:990ef700d2168ba38a2a30030118c80dc4e19e653d16d26a6394351c193f9338.
https://honcho.pdurlej.com/openapi.json returned HTTP 200.
Sanitized 15-minute warning/error scan showed no traceback, timeout, 429, 500, or 503 signal beyond normal uvicorn.error logger startup lines.
No raw Honcho messages, prompts, DB rows, payloads, auth headers, or secret values were inspected or recorded.

Known constraints

/opt/pdurlej-platform/runtime/host-ops/env/stack.env still has stale non-secret metadata (PROJECT_ROOT=/opt/vps-home-platform-infra, HONCHO_IMAGE=home-platform-honcho:3.0.3, HONCHO_IMAGE_REF=v3.0.3). The active compose file no longer uses those values for Honcho image or sanitizer mount. Cleaning those env keys is a separate runtime config mutation and is intentionally not done in this PR.

Explicit out-of-scope

Runtime mutation, container recreate, deploy, or merge/automerge.
Editing /opt/pdurlej-platform/runtime/host-ops/env/stack.env.
Database migrations, queue inspection, message/content inspection, secret changes, public exposure changes.
Deciding the long-term Honcho model/provider architecture.

Requested decision

Approve that repo compose/module metadata should match the live 3.0.9 host-ops hotfix state, with stale host-ops env cleanup tracked as a follow-up rather than bundled into this PR.

Merge blockers

Evidence that live 3.0.9 should be rolled back instead of codified.
Any secret or private Honcho payload content in the report.
Evidence that hardcoding the sanitizer path breaks the intended RS2000 host-ops contract.

Spec sources read

compose/apps/compose.yaml: canonical repo Honcho service definitions.
modules/honcho-api/module.yaml: current source/artifact/runtime metadata.
modules/honcho-deriver/module.yaml: current runtime metadata and missing artifact metadata.
contexts/module-catalog/source-of-truth-matrix.md: catalog source-of-truth summary.
state/reports/honcho-306-runtime-reconcile-2026-06-10.md: previous reconcile evidence and follow-up.
runbooks/honcho-ollama-gemma-switch.md: privacy/evidence rules for Honcho logs and metadata.

Verification

UV_CACHE_DIR=/private/tmp/uv-cache uv run --project control-plane platformctl validate modules/honcho-api/module.yaml --json
UV_CACHE_DIR=/private/tmp/uv-cache uv run --project control-plane platformctl validate modules/honcho-deriver/module.yaml --json
UV_CACHE_DIR=/private/tmp/uv-cache uv run --project control-plane python -c "import yaml, pathlib; yaml.safe_load(pathlib.Path('compose/apps/compose.yaml').read_text()); print('compose_yaml_parse=ok')"
git diff --cached --check
Ollama GLM advisory: no blocker; one risk noted around hardcoding future update friction, recorded as host-ops env cleanup follow-up.

Refs #731

Canary status: missing - fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Honcho is in active recovery/iteration and the repo must not describe a different runtime than production. After PR #776 landed 3.0.6 metadata, production was advanced again by a host-ops hotfix to `home-platform-honcho:3.0.9-gpt55-canonical-20260610T200313Z`. This PR makes repo state catch up to the live, healthy host-ops state so future agents do not treat the current production state as unexplained drift. ### What changed - Hardcoded Honcho API and deriver compose image refs to the live `3.0.9-gpt55-canonical-20260610T200313Z` local image tag. - Hardcoded the Honcho sanitizer mount to `/opt/pdurlej-platform/current/scripts/honcho/honcho_log_sanitize_exec.py`, matching the active host-ops compose hotfix. - Updated `honcho-api` and `honcho-deriver` module metadata to the live image tag. - Added source/artifact metadata for `honcho-deriver`, matching its shared Honcho image. - Updated the module-catalog source-of-truth matrix for both Honcho services. - Added a metadata-only runtime evidence report. ### Why it changed Docker labels show the active production containers are currently composed from `/opt/pdurlej-platform/runtime/host-ops/compose/...`, not the release-root compose path used in the previous reconcile. The active host-ops compose file already hardcodes the 3.0.9 image and sanitizer path. Repo state was behind live state. ### Files touched - `compose/apps/compose.yaml` - `modules/honcho-api/module.yaml` - `modules/honcho-deriver/module.yaml` - `contexts/module-catalog/source-of-truth-matrix.md` - `state/reports/honcho-309-host-ops-reconcile-2026-06-10.md` ### Relevant context - PR #776 / #731 reconciled repo/runtime to 3.0.6, but a later host-ops hotfix moved production to 3.0.9. - Active runtime labels point to `/opt/pdurlej-platform/runtime/host-ops/compose/apps/compose.yaml`. - The host-ops pre-hotfix backup was `/opt/pdurlej-platform/runtime/host-ops/compose/apps/compose.yaml.pre-honcho-gpt55-20260610T200313Z`. ### Runtime evidence - `home-platform-honcho-api-1`: running, healthy, `home-platform-honcho:3.0.9-gpt55-canonical-20260610T200313Z`. - `home-platform-honcho-deriver-1`: running, healthy, `home-platform-honcho:3.0.9-gpt55-canonical-20260610T200313Z`. - Both production containers and the local image tag resolve to image ID `sha256:990ef700d2168ba38a2a30030118c80dc4e19e653d16d26a6394351c193f9338`. - `https://honcho.pdurlej.com/openapi.json` returned HTTP 200. - Sanitized 15-minute warning/error scan showed no traceback, timeout, 429, 500, or 503 signal beyond normal `uvicorn.error` logger startup lines. - No raw Honcho messages, prompts, DB rows, payloads, auth headers, or secret values were inspected or recorded. ### Known constraints `/opt/pdurlej-platform/runtime/host-ops/env/stack.env` still has stale non-secret metadata (`PROJECT_ROOT=/opt/vps-home-platform-infra`, `HONCHO_IMAGE=home-platform-honcho:3.0.3`, `HONCHO_IMAGE_REF=v3.0.3`). The active compose file no longer uses those values for Honcho image or sanitizer mount. Cleaning those env keys is a separate runtime config mutation and is intentionally not done in this PR. ### Explicit out-of-scope - Runtime mutation, container recreate, deploy, or merge/automerge. - Editing `/opt/pdurlej-platform/runtime/host-ops/env/stack.env`. - Database migrations, queue inspection, message/content inspection, secret changes, public exposure changes. - Deciding the long-term Honcho model/provider architecture. ### Requested decision Approve that repo compose/module metadata should match the live 3.0.9 host-ops hotfix state, with stale host-ops env cleanup tracked as a follow-up rather than bundled into this PR. ### Merge blockers - Evidence that live 3.0.9 should be rolled back instead of codified. - Any secret or private Honcho payload content in the report. - Evidence that hardcoding the sanitizer path breaks the intended RS2000 host-ops contract. ## Spec sources read - `compose/apps/compose.yaml`: canonical repo Honcho service definitions. - `modules/honcho-api/module.yaml`: current source/artifact/runtime metadata. - `modules/honcho-deriver/module.yaml`: current runtime metadata and missing artifact metadata. - `contexts/module-catalog/source-of-truth-matrix.md`: catalog source-of-truth summary. - `state/reports/honcho-306-runtime-reconcile-2026-06-10.md`: previous reconcile evidence and follow-up. - `runbooks/honcho-ollama-gemma-switch.md`: privacy/evidence rules for Honcho logs and metadata. ## Verification - `UV_CACHE_DIR=/private/tmp/uv-cache uv run --project control-plane platformctl validate modules/honcho-api/module.yaml --json` - `UV_CACHE_DIR=/private/tmp/uv-cache uv run --project control-plane platformctl validate modules/honcho-deriver/module.yaml --json` - `UV_CACHE_DIR=/private/tmp/uv-cache uv run --project control-plane python -c "import yaml, pathlib; yaml.safe_load(pathlib.Path('compose/apps/compose.yaml').read_text()); print('compose_yaml_parse=ok')"` - `git diff --cached --check` - Ollama GLM advisory: no blocker; one risk noted around hardcoding future update friction, recorded as host-ops env cleanup follow-up. Refs #731

codex added the

labels

2026-06-10 22:27:38 +02:00

codex added 1 commit

2026-06-10 22:27:38 +02:00

ops(honcho): codify 3.0.9 host-ops runtime

canary-required / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 20s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 18s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 3m35s

Details

64c39145a9

pdurlej merged commit fa7724d987 into main

2026-06-10 22:28:16 +02:00

pdurlej deleted branch codex/honcho-309-host-ops-codify

2026-06-10 22:28:16 +02:00

pdurlej referenced this pull request from a commit

2026-06-10 22:28:18 +02:00

Merge pull request 'ops(honcho): codify 3.0.9 host-ops runtime' (#777) from codex/honcho-309-host-ops-codify into main

codex referenced this pull request

2026-06-10 22:32:51 +02:00

docs(honcho): record host-ops env cleanup #778

patchwarden commented

2026-06-10 22:52:02 +02:00

First-time contributor

Patchwarden PR sanity

Status: advisory_findings
PR: 777
Commit: 64c39145a90764017f6b5ff21ecec34279ac3c2e
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
blocker Merge proposed with missing canary verification
- Evidence: PR description header explicitly states 'Canary status: missing - fire canary 3+3 manually before merge', indicating the required pre-merge validation protocol has not been executed.
- Next: Execute the 3+3 canary protocol, validate health/metrics, and update the PR header to reflect passing canary status before merging.
high Host-side sanitizer script bind-mounted into containers
- Evidence: PR description admits 'Hardcoded the Honcho sanitizer mount to /opt/pdurlej-platform/current/scripts/honcho/honcho_log_sanitize_exec.py' in compose/apps/compose.yaml. Mounting a mutable host executable into containers creates a code-injecti
- Next: Bake the sanitizer script into the container image at build time instead of bind-mounting from the host. If a host mount is mandatory, mount it read-only with an immutable base path and add an integrity checksum verified at container start.
high Compose hardcodes mutable local image tag instead of digest
- Evidence: PR description states compose image refs are set to tag 'home-platform-honcho:3.0.9-gpt55-canonical-20260610T200313Z' while separately noting the resolved digest is sha256:990ef700d2168ba38a2a30030118c80dc4e19e653d16d26a6394351c193f9338. Lo
- Next: Pin the image reference by digest in compose/apps/compose.yaml (e.g., image@sha256:990ef700d216...) to guarantee immutable supply-chain integrity.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `777` - Commit: `64c39145a90764017f6b5ff21ecec34279ac3c2e` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`blocker`** Merge proposed with missing canary verification - Evidence: `PR description header explicitly states 'Canary status: missing - fire canary 3+3 manually before merge', indicating the required pre-merge validation protocol has not been executed.` - Next: Execute the 3+3 canary protocol, validate health/metrics, and update the PR header to reflect passing canary status before merging. - **`high`** Host-side sanitizer script bind-mounted into containers - Evidence: `PR description admits 'Hardcoded the Honcho sanitizer mount to /opt/pdurlej-platform/current/scripts/honcho/honcho_log_sanitize_exec.py' in compose/apps/compose.yaml. Mounting a mutable host executable into containers creates a code-injecti` - Next: Bake the sanitizer script into the container image at build time instead of bind-mounting from the host. If a host mount is mandatory, mount it read-only with an immutable base path and add an integrity checksum verified at container start. - **`high`** Compose hardcodes mutable local image tag instead of digest - Evidence: `PR description states compose image refs are set to tag 'home-platform-honcho:3.0.9-gpt55-canonical-20260610T200313Z' while separately noting the resolved digest is sha256:990ef700d2168ba38a2a30030118c80dc4e19e653d16d26a6394351c193f9338. Lo` - Next: Pin the image reference by digest in compose/apps/compose.yaml (e.g., image@sha256:990ef700d216...) to guarantee immutable supply-chain integrity. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.