selfheal-lab/selfheal-lab-gitops
2
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ai-env): wire the TypeSafe key and enable Jev shadow gates

Browse Source 
AI VM の apply.sh が Secret Manager の selfheal-typesafe-api-key を取得し、
agent コンテナに JEV_KEY_FILE として渡す。ai.env で JEV_MODE=shadow、
JEV_MODEL=jev-1.13.0 を設定し、鍵が未登録でも agent は通常どおり動く
（ゲートは鍵未登録を記録するだけ）。
This commit is contained in:
seon committed 2026-10-08 15:10:25 +09:00
1 parent 73ac63f989
commit d050c6d54b
3 files changed
+7 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

vm/ai-env/ai.env
+4
View File
@@ -14,3 +14,7 @@ HARNESS_URL=http://10.20.0.11:8080
MIMIR_URL=http://10.20.0.10:9009/prometheus MIMIR_URL=http://10.20.0.10:9009/prometheus
LOKI_URL=http://10.20.0.10:3100 LOKI_URL=http://10.20.0.10:3100
K8S_API=https://10.10.0.10:6443 K8S_API=https://10.10.0.10:6443
# Jev shadow gates (2026-10-08): off | shadow. shadow records TypeSafe System One answers (triage before the LLM, review after it)
# next to each diagnosis in ai.jev_shadow and in the harness diagnosis event; it never changes the disposition.
JEV_MODE=shadow
JEV_MODEL=jev-1.13.0
vm/ai-env/apply.sh
+2 -1
View File
@@ -20,11 +20,12 @@ SEC=/opt/selfheal/ai/secrets
mkdir -p "$SEC"; chmod 700 /opt/selfheal/ai "$SEC" mkdir -p "$SEC"; chmod 700 /opt/selfheal/ai "$SEC"
umask 077 umask 077
secret selfheal-openai-api-key > "$SEC/openai-api-key" secret selfheal-openai-api-key > "$SEC/openai-api-key"
secret selfheal-typesafe-api-key > "$SEC/typesafe-api-key"
secret selfheal-discord-bot-token > "$SEC/discord-bot-token" secret selfheal-discord-bot-token > "$SEC/discord-bot-token"
secret selfheal-k8s-ai-token > "$SEC/k8s-token" secret selfheal-k8s-ai-token > "$SEC/k8s-token"
secret selfheal-k8s-ca-cert > "$SEC/k8s-ca.crt" secret selfheal-k8s-ca-cert > "$SEC/k8s-ca.crt"
unset TOKEN unset TOKEN
for f in openai-api-key discord-bot-token; do [ -s "$SEC/$f" ] || echo "note: secret $f is empty (not registered yet); service runs degraded" >&2; done for f in openai-api-key discord-bot-token typesafe-api-key; do [ -s "$SEC/$f" ] || echo "note: secret $f is empty (not registered yet); service runs degraded" >&2; done
for f in k8s-token k8s-ca.crt; do [ -s "$SEC/$f" ] || echo "note: $f is empty (run make token on the operator host)" >&2; done for f in k8s-token k8s-ca.crt; do [ -s "$SEC/$f" ] || echo "note: $f is empty (run make token on the operator host)" >&2; done
chown -R 10002:10002 "$SEC"; chmod 600 "$SEC"/* # agent/hitl run as uid 10002 chown -R 10002:10002 "$SEC"; chmod 600 "$SEC"/* # agent/hitl run as uid 10002
vm/ai-env/compose.yaml
+1
View File
@@ -10,6 +10,7 @@ services:
RAG_DSN: "postgres://ai:${RAG_DB_PASSWORD}@rag-db:5432/ai?sslmode=disable" RAG_DSN: "postgres://ai:${RAG_DB_PASSWORD}@rag-db:5432/ai?sslmode=disable"
HITL_URL: http://hitl:8081 HITL_URL: http://hitl:8081
OPENAI_KEY_FILE: /run/secrets/openai-api-key OPENAI_KEY_FILE: /run/secrets/openai-api-key
JEV_KEY_FILE: /run/secrets/typesafe-api-key
K8S_TOKEN_FILE: /run/secrets/k8s-token K8S_TOKEN_FILE: /run/secrets/k8s-token
K8S_CA_FILE: /run/secrets/k8s-ca.crt K8S_CA_FILE: /run/secrets/k8s-ca.crt
PROMPT_DIR: /etc/ai/prompts PROMPT_DIR: /etc/ai/prompts