dtoro
f6b57cbe3a
Adds the shared kernel modules (oikos/policy.py, oikos/relations.py, oikos/ledger.py) that let every surface — CLI, MCP, context-card generator — agree on risk classification and ontology graph walks from one implementation. homelab CLI: `service <name> explain|health|docs|log|actions|history` (Service Console v0), `change preflight <service>`, `node <name> relations`. Restart and client add/remove now append change-ledger entries (ledger/*.jsonl, committed alongside the change they record). mcp/server.py mirrors explain/preflight/get_relations/get_change_history as MCP tools, card-first so agent orientation is one call instead of several search_docs/get_page round-trips. oikos/gen-topology.py now also emits a compact context card per host and service (oikos/cards/*.md) — identity, blast radius, safe actions + risk class, doc pointer, recent ledger history. runbooks/*.md: service health check, config change + deploy, client enrollment, incident investigation, and the five node lifecycle transitions (provision/activate/migrate/deprecate/destroy), each with machine-readable frontmatter (risk class, inputs, verification, docs-update checklist). Wired into HERMES.md so agents load these instead of rediscovering topology per-task. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
96 lines
3.7 KiB
Markdown
96 lines
3.7 KiB
Markdown
# HERMES.md — Agent persona for homelab clients
|
|
|
|
This file is the canonical agent persona for **all** AI agents running on
|
|
machines in the **hubris** homelab. It prescribes behaviour, token-efficiency
|
|
conventions, and the source-of-truth hierarchy.
|
|
|
|
## Source of truth
|
|
|
|
The homelab-context repo at `/opt/homelab-context/` is the single source of
|
|
truth for:
|
|
- Fleet topology (`inventory.yaml`, `hosts/*.yaml`)
|
|
- Service endpoints and credentials (via `homelab secret`)
|
|
- Agent behaviour and conventions
|
|
- Everything in this file
|
|
|
|
When in doubt, check `/opt/homelab-context/` first.
|
|
|
|
## Runbooks — load, don't rediscover
|
|
|
|
For the canonical workflows (service health check, config change +
|
|
deploy, client enrollment, incident investigation, and each node
|
|
lifecycle transition), read the matching file in `runbooks/*.md` before
|
|
acting. Each runbook carries its risk class, required inputs, the
|
|
verification command, and a docs-update checklist in its frontmatter —
|
|
classify against `oikos/policy.yaml` using that risk class before any
|
|
mutation. Don't re-derive topology or the mutation path by grepping the
|
|
wiki when a runbook already encodes it. See [OIKOS.md](OIKOS.md) for the
|
|
operating model these runbooks execute inside (OODA loop, risk classes,
|
|
approval flow, ontology).
|
|
|
|
## Agent type — how this file gets loaded
|
|
|
|
| Agent | Loading mechanism |
|
|
|-------|------------------|
|
|
| **Hermes** | `tools/setup-hermes-soul.sh` (auto-setup) → provisions `~/.hermes/SOUL.md` from this file |
|
|
| **Goose** | `.goosehints` symlink at `~/.config/goose/.goosehints` → `/opt/homelab-context/HERMES.md` |
|
|
| **Claude Code / Codex** | Symlink or copy this file into the project's `CLAUDES.md` / `.claude` instructions |
|
|
|
|
**Do not edit SOUL.md or .goosehints directly.** Edit this file in the
|
|
homelab-context repo instead. Changes propagate to all clients on the next
|
|
sync (`sudo homelab sync`).
|
|
|
|
---
|
|
|
|
## Token efficiency (caveman skill)
|
|
|
|
All homelab agents use the **Caveman + RTK** token optimization approach from
|
|
https://github.com/adityahimaone/hermes-agent-rtk-caveman.
|
|
|
|
### Before running any CLI command, ask:
|
|
|
|
1. **Is there a caveman wrapper equivalent?** Use the wrapper for token-efficient
|
|
output. Available wrappers (installed at `~/bin/caveman_wrapper.sh`):
|
|
- `~/bin/caveman_wrapper.sh git-status` — compact git status
|
|
- `~/bin/caveman_wrapper.sh git-log [n]` — compact git log
|
|
- `~/bin/caveman_wrapper.sh lint [target]` — compact lint results
|
|
- `~/bin/caveman_wrapper.sh test-results [cmd]` — compact test results
|
|
|
|
2. **If no caveman wrapper exists, pipe through `rtk`** to compress output:
|
|
```
|
|
rtk <command>
|
|
```
|
|
RTK (Rust Token Killer) strips redundant whitespace, trims long paths, and
|
|
deduplicates repeated lines. This reduces token usage by 60-90% on CLI
|
|
operations.
|
|
|
|
3. **For homelab operations**, prefer the `homelab` CLI or MCP tools over
|
|
raw SSH/shell — they're already token-optimized.
|
|
|
|
### Templates
|
|
|
|
Caveman templates live at `~/templates/`:
|
|
- `git_status.txt` — compact git status format
|
|
- `git_log.txt` — compact git log format
|
|
- `lint_results.txt` — compact ESLint format
|
|
- `test_results.txt` — compact vitest/jest format
|
|
|
|
### When to skip caveman/rtk
|
|
|
|
- Interactive commands (editors, prompts) — let human-readable output pass
|
|
- Commands with no output — skip entirely
|
|
- When you need the exact raw output for post-processing
|
|
|
|
### Verification
|
|
|
|
```bash
|
|
ls ~/bin/caveman_wrapper.sh && echo "caveman ready"
|
|
```
|
|
|
|
## Important note for Hermes agents
|
|
|
|
If you are reading this as a Hermes agent, your SOUL.md was auto-provisioned
|
|
by `tools/setup-hermes-soul.sh`. This file is the canonical original — you
|
|
can verify the content matches or re-provision by running:
|
|
|
|
bash /opt/homelab-context/tools/setup-hermes-soul.sh |