claude-botandClaude Fable 5
90aeaf1ef8
Both wrong assessments (#249 openbao 'sealed', #250 three untested hypotheses while one 'kubectl logs' showed the 401) share one root cause: the agents diagnose blind, so they narrate plausible fiction. Labeling unverified claims (previous commit) treats the symptom; this gives them the means to verify: - kubernetes/apps/monitoring/ci-diagnostics-rbac.yaml: ServiceAccount ci-diagnostics with a read-only ClusterRole (workloads, events, pods/log, Flux/ESO/cert-manager/monitoring/ceph CRDs — NO secrets) plus a namespaced services/proxy Role for the Prometheus and Alertmanager HTTP APIs. - scripts/ci/make-diag-kubeconfig.sh: mints a 1h token per run from the admin kubeconfig (no new long-lived secret), builds .ci-diag/kubeconfig, copies the static kubectl binary for the jq-only ci-claude image, smoke-tests with the restricted identity, and degrades to snapshot-only mode when the SA isn't reconciled. - alert-monitor.yml / issue-fix.yml: agents get exactly one extra tool, Bash(./.ci-diag/kubectl:*) — prefix match forbids pipes and any other binary; RBAC forbids mutation and secret reads. - prompts: verification is now mandatory, not aspirational — 'a hypothesis you could have settled with one read-only command but didn't is a defect in your output'; fix agent must test the issue's claims before building on them; minimal-quote rule against dumping logs into public issues. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV7bZzZLeoFUEdAeCSLEei
31 lines
672 B
Plaintext
31 lines
672 B
Plaintext
.envrc
|
|
shell.nix
|
|
.vault_pass
|
|
.direnv/
|
|
*.log
|
|
/immich
|
|
*.tfplan
|
|
|
|
# Talos secrets (generated, never commit)
|
|
kubernetes/talos/controlplane.yaml
|
|
kubernetes/talos/worker.yaml
|
|
kubernetes/talos/talosconfig
|
|
kubernetes/talos/secrets.yaml
|
|
kubernetes/access-staging/
|
|
|
|
# Claude Code project-local runtime state
|
|
.claude/
|
|
|
|
# Trivy scan outputs (generated in CI workspace, never commit)
|
|
trivy-iac.json
|
|
trivy-image-*.json
|
|
|
|
# Alert-monitor pipeline workspace (generated in CI, never commit)
|
|
.ci-alert-monitor/
|
|
|
|
# CI diagnostic kubeconfig + kubectl for the agent steps (generated, never commit)
|
|
.ci-diag/
|
|
|
|
# Plaintext secret templates awaiting SOPS encryption (never commit)
|
|
*.plaintext.yaml
|