Files

dtoro f6b57cbe3a Oikos Week 2: Service Console v0, change ledger, node relations, runbooks

Adds the shared kernel modules (oikos/policy.py, oikos/relations.py,
oikos/ledger.py) that let every surface — CLI, MCP, context-card
generator — agree on risk classification and ontology graph walks
from one implementation.

homelab CLI: `service <name> explain|health|docs|log|actions|history`
(Service Console v0), `change preflight <service>`, `node <name>
relations`. Restart and client add/remove now append change-ledger
entries (ledger/*.jsonl, committed alongside the change they record).

mcp/server.py mirrors explain/preflight/get_relations/get_change_history
as MCP tools, card-first so agent orientation is one call instead of
several search_docs/get_page round-trips.

oikos/gen-topology.py now also emits a compact context card per host
and service (oikos/cards/*.md) — identity, blast radius, safe actions +
risk class, doc pointer, recent ledger history.

runbooks/*.md: service health check, config change + deploy, client
enrollment, incident investigation, and the five node lifecycle
transitions (provision/activate/migrate/deprecate/destroy), each with
machine-readable frontmatter (risk class, inputs, verification,
docs-update checklist). Wired into HERMES.md so agents load these
instead of rediscovering topology per-task.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-05 23:02:32 +02:00

3.7 KiB

Raw Blame History

HERMES.md — Agent persona for homelab clients

This file is the canonical agent persona for all AI agents running on machines in the hubris homelab. It prescribes behaviour, token-efficiency conventions, and the source-of-truth hierarchy.

Source of truth

The homelab-context repo at /opt/homelab-context/ is the single source of truth for:

Fleet topology (inventory.yaml, hosts/*.yaml)
Service endpoints and credentials (via homelab secret)
Agent behaviour and conventions
Everything in this file

When in doubt, check /opt/homelab-context/ first.

Runbooks — load, don't rediscover

For the canonical workflows (service health check, config change + deploy, client enrollment, incident investigation, and each node lifecycle transition), read the matching file in runbooks/*.md before acting. Each runbook carries its risk class, required inputs, the verification command, and a docs-update checklist in its frontmatter — classify against oikos/policy.yaml using that risk class before any mutation. Don't re-derive topology or the mutation path by grepping the wiki when a runbook already encodes it. See OIKOS.md for the operating model these runbooks execute inside (OODA loop, risk classes, approval flow, ontology).

Agent type — how this file gets loaded

Agent	Loading mechanism
Hermes	`tools/setup-hermes-soul.sh` (auto-setup) → provisions `~/.hermes/SOUL.md` from this file
Goose	`.goosehints` symlink at `~/.config/goose/.goosehints` → `/opt/homelab-context/HERMES.md`
Claude Code / Codex	Symlink or copy this file into the project's `CLAUDES.md` / `.claude` instructions

Do not edit SOUL.md or .goosehints directly. Edit this file in the homelab-context repo instead. Changes propagate to all clients on the next sync (sudo homelab sync).

Token efficiency (caveman skill)

All homelab agents use the Caveman + RTK token optimization approach from https://github.com/adityahimaone/hermes-agent-rtk-caveman.

Before running any CLI command, ask:

Is there a caveman wrapper equivalent? Use the wrapper for token-efficient output. Available wrappers (installed at ~/bin/caveman_wrapper.sh):
- ~/bin/caveman_wrapper.sh git-status — compact git status
- ~/bin/caveman_wrapper.sh git-log [n] — compact git log
- ~/bin/caveman_wrapper.sh lint [target] — compact lint results
- ~/bin/caveman_wrapper.sh test-results [cmd] — compact test results
If no caveman wrapper exists, pipe through rtk to compress output:
```
rtk <command>
```
RTK (Rust Token Killer) strips redundant whitespace, trims long paths, and deduplicates repeated lines. This reduces token usage by 60-90% on CLI operations.
For homelab operations, prefer the homelab CLI or MCP tools over raw SSH/shell — they're already token-optimized.

Templates

Caveman templates live at ~/templates/:

git_status.txt — compact git status format
git_log.txt — compact git log format
lint_results.txt — compact ESLint format
test_results.txt — compact vitest/jest format

When to skip caveman/rtk

Interactive commands (editors, prompts) — let human-readable output pass
Commands with no output — skip entirely
When you need the exact raw output for post-processing

Verification

ls ~/bin/caveman_wrapper.sh && echo "caveman ready"

Important note for Hermes agents

If you are reading this as a Hermes agent, your SOUL.md was auto-provisioned by tools/setup-hermes-soul.sh. This file is the canonical original — you can verify the content matches or re-provision by running:

bash /opt/homelab-context/tools/setup-hermes-soul.sh

3.7 KiB Raw Blame History