4de98b29fd
Some checks are pending
CI / lint-and-test (push) Waiting to run
* feat(kb): apply-worker to auto-land approved proposals (stage 2 automation) Event-driven worker that turns a HUMAN-approved kb_stage proposal into canonical state, so an approval in Telegram surfaces in Leo's identity without Leo applying its own work. - Fires only on status='approved' (never pending_review) -> proposer != applier holds; the human approval stays the trigger. No auto-approve anywhere. - Reuses scripts/apply_proposal.py verbatim as the sole apply path (same txn, rowcount=1 guard, FK stamp). Connects as the narrow kb_apply role, never superuser, never inside the hermes harness. - Render hook (--render-cmd / KB_APPLY_RENDER_CMD) is inert until the SOUL renderer (PR2) is deployed; applying still works, rendered SOUL just lags. - Ships INERT: report-only unless --enable / KB_APPLY_WORKER_ENABLED=1. systemd oneshot service + 5min timer, both shipped disabled. - 10 unit tests; candidate query validated read-only vs prod (0 applyable today). * fix(kb): apply-worker --max-per-tick cap + poison-pill retry ceiling Fixer draft-exit items: - --max-per-tick=1 (default): an enabled worker lands applies one-at-a-time and observably instead of draining the whole approved queue in one tick. - --max-attempts=3 ceiling with a persisted failure-count state file: a deterministically-failing approved proposal is treated as a poison pill and skipped after N consecutive failures, instead of retrying every tick forever. State persists on disk because the worker runs oneshot per timer tick. Both are inert until the worker is enabled; it still ships disabled.
23 lines
910 B
Desktop File
23 lines
910 B
Desktop File
[Unit]
|
|
Description=Teleo KB apply worker — lands human-approved proposals into canonical
|
|
After=network.target docker.service
|
|
Wants=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=teleo
|
|
Group=teleo
|
|
# Runs from the git-backed deploy-infra worktree (scripts/ is NOT rsynced into the
|
|
# live pipeline tree; the reviewed copy is invoked in place). Operator tool, not a
|
|
# hermes runtime component.
|
|
ExecStart=/opt/teleo-eval/pipeline/.venv/bin/python3 \
|
|
/opt/teleo-eval/workspaces/deploy-infra/scripts/apply_worker.py
|
|
# Ships INERT: no --enable here, so each tick is report-only until an operator opts
|
|
# in. Flip on (after the first manual apply is proven) by dropping an EnvironmentFile
|
|
# with KB_APPLY_WORKER_ENABLED=1 and KB_APPLY_RENDER_CMD=... — no unit edit needed.
|
|
EnvironmentFile=-/opt/teleo-eval/secrets/kb-apply-worker.env
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|