[boxp]

概要

boxp/arch の Hermes ledger join (runner ai_ops_ledger.bb の mirror) を有効にする env を codex-workspace の task-board container に追加する。

• CODEX_TASK_BOARD_AI_OPS_HERMES_LEDGER_COMMAND: kubectl exec -n hermes-agent deploy/hermes-agent -c hermes-agent -- sh -c 'cat /opt/data/ai-ops/ledger/events-*.jsonl'
• 権限は hermes-agent namespace の既存 Role codex-workspace-debug (pods/exec) をそのまま使う。新しい RBAC / secret / NetworkPolicy 変更なし。
• 影響: codex-workspace pod の再作成 1 回。hermes-agent の変更・再起動なし。
• runner 側は上限付き (30 秒 / 8 MiB) で、失敗時は前回 snapshot + stale 表示に落ち、runner は止まらない。

対応 PR: boxp/arch (BOXP-360 Hermes ledger join)

🤖 Generated with Claude Code

[github-actions]

ArgoCD Diff Result

Auth path: tailscale

アプリケーション: codex-workspace の差分

パス: argoproj/codex-workspace

===== apps/Deployment codex-workspace/codex-workspace ======
1346a1347,1349
>         - name: CODEX_TASK_BOARD_AI_OPS_HERMES_LEDGER_COMMAND
>           value: kubectl exec -n hermes-agent deploy/hermes-agent -c hermes-agent
>             -- sh -c 'cat /opt/data/ai-ops/ledger/events-*.jsonl'
ℹ️ 上記の差分が見つかりました

[github-actions]

Chainsaw Manifest Validation

✅ 全テスト通過

テスト対象コンポーネント: ["codex-workspace"]

📦 codex-workspace

✅ PASSED

テスト出力を展開

Version: 0.2.15
Loading default configuration...
- Using test file: chainsaw-test
- TestDirs [./tests/chainsaw/codex-workspace]
- Quiet false
- SkipDelete false
- FailFast false
- Namespace ''
- FastNamespaceDeletion false
- FullName false
- IncludeTestRegex ''
- ExcludeTestRegex ''
- ApplyTimeout 5s
- AssertTimeout 30s
- CleanupTimeout 30s
- DeleteTimeout 15s
- ErrorTimeout 30s
- ExecTimeout 5s
- DeletionPropagationPolicy Background
- Template true
- NoCluster false
- PauseOnFailure false
Loading tests...
- codex-workspace-metrics (./tests/chainsaw/codex-workspace)
Loading values...
Running tests...
=== RUN   chainsaw
=== PAUSE chainsaw
=== CONT  chainsaw
=== RUN   chainsaw/codex-workspace-metrics
=== PAUSE chainsaw/codex-workspace-metrics
=== CONT  chainsaw/codex-workspace-metrics
    sink.go:61: ������������| 11:54:14 | �[32;1mcodex-workspace-metrics�[0;22m | �[32;1m@chainsaw            �[0;22m | �[32;1mCREATE�[0;22m    | �[32;1mOK�[0;22m    | v1/Namespace @ chainsaw-assured-wasp
    sink.go:61: ������������| 11:54:14 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mrequire-isolated-kind�[0;22m | �[36;1mTRY�[0;22m       | �[36;1mBEGIN�[0;22m |
    sink.go:61: ������������| 11:54:14 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mrequire-isolated-kind�[0;22m | �[36;1mCMD�[0;22m       | �[36;1mRUN�[0;22m   |
        === COMMAND
        /usr/bin/sh -c set -eu
        case "${CHAINSAW_KIND_CONTEXT:-}" in
          kind-*) ;;
          *) echo "An explicit isolated kind context is required; this suite is not read-only." >&2; exit 1 ;;
        esac
        : "${CHAINSAW_KIND_KUBECONFIG:?An isolated kubeconfig is required}"
        test -r "$CHAINSAW_KIND_KUBECONFIG"
        test "$(kubectl --kubeconfig "$CHAINSAW_KIND_KUBECONFIG" config current-context)" = "$CHAINSAW_KIND_CONTEXT"
        expected_server="$(kubectl --kubeconfig "$CHAINSAW_KIND_KUBECONFIG" config view --minify -o jsonpath='{.clusters[0].cluster.server}')"
        actual_server="$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')"
        test -n "$expected_server"
        test "$actual_server" = "$expected_server"
    sink.go:61: ������������| 11:54:14 | �[32;1mcodex-workspace-metrics�[0;22m | �[32;1mrequire-isolated-kind�[0;22m | �[32;1mSCRIPT�[0;22m    | �[32;1mDONE�[0;22m  |
    sink.go:61: ������������| 11:54:14 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mrequire-isolated-kind�[0;22m | �[36;1mTRY�[0;22m       | �[36;1mEND�[0;22m   |
    sink.go:61: ������������| 11:54:14 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mapply-and-check      �[0;22m | �[36;1mTRY�[0;22m       | �[36;1mBEGIN�[0;22m |
    sink.go:61: ������������| 11:54:14 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mapply-and-check      �[0;22m | �[36;1mCMD�[0;22m       | �[36;1mRUN�[0;22m   |
        === COMMAND
        /usr/bin/sh -c set -eu
        manifest="$(mktemp)"
        trap 'rm -f "$manifest"' EXIT
        "${REPO_ROOT}/tests/chainsaw/codex-workspace/render-minimal.sh" > "$manifest"
        kubectl apply --server-side -f "$manifest"
        if ! kubectl wait --for=condition=Available deployment/codex-workspace -n codex-workspace --timeout=180s; then
          kubectl describe pods -n codex-workspace || true
          kubectl get events -n codex-workspace --sort-by=.lastTimestamp || true
          exit 1
        fi
        kubectl exec -n codex-workspace deployment/codex-workspace -c ai-ops-metrics -- python -c 'import urllib.request as u; assert u.urlopen("http://127.0.0.1:9464/healthz").read().strip() == b"ok"; m=u.urlopen("http://127.0.0.1:9464/metrics").read(); assert b"ai_ops_stub_metric 1" in m and b"ai_ops_metrics_file_present 1" in m'
    sink.go:61: ������������| 11:54:56 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mapply-and-check      �[0;22m | �[36;1mSCRIPT�[0;22m    | �[36;1mLOG�[0;22m   |
        === STDOUT
        namespace/codex-workspace serverside-applied
        configmap/codex-workspace-ai-ops-metrics-4c4t7dc569 serverside-applied
        deployment.apps/codex-workspace serverside-applied
        deployment.apps/codex-workspace condition met
    sink.go:61: ������������| 11:54:56 | �[32;1mcodex-workspace-metrics�[0;22m | �[32;1mapply-and-check      �[0;22m | �[32;1mSCRIPT�[0;22m    | �[32;1mDONE�[0;22m  |
    sink.go:61: ������������| 11:54:56 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mapply-and-check      �[0;22m | �[36;1mTRY�[0;22m       | �[36;1mEND�[0;22m   |
    sink.go:61: ������������| 11:54:56 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mapply-and-check      �[0;22m | �[36;1mFINALLY�[0;22m   | �[36;1mBEGIN�[0;22m |
    sink.go:61: ������������| 11:54:56 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mapply-and-check      �[0;22m | �[36;1mCMD�[0;22m       | �[36;1mRUN�[0;22m   |
        === COMMAND
        /usr/bin/sh -c # kind は job ごとに破棄するので削除完了は待たない (python の PID 1 は SIGTERM で
        # 止まらず、待つと terminationGracePeriodSeconds の 30s がそのまま critical path に乗る)。
        kubectl delete namespace codex-workspace --ignore-not-found --wait=false
    sink.go:61: ������������| 11:54:56 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mapply-and-check      �[0;22m | �[36;1mSCRIPT�[0;22m    | �[36;1mLOG�[0;22m   |
        === STDOUT
        namespace "codex-workspace" deleted
    sink.go:61: ������������| 11:54:56 | �[32;1mcodex-workspace-metrics�[0;22m | �[32;1mapply-and-check      �[0;22m | �[32;1mSCRIPT�[0;22m    | �[32;1mDONE�[0;22m  |
    sink.go:61: ������������| 11:54:56 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1mapply-and-check      �[0;22m | �[36;1mFINALLY�[0;22m   | �[36;1mEND�[0;22m   |
    sink.go:61: ������������| 11:54:56 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1m@chainsaw            �[0;22m | �[36;1mCLEANUP�[0;22m   | �[36;1mBEGIN�[0;22m |
    sink.go:61: ������������| 11:54:56 | �[32;1mcodex-workspace-metrics�[0;22m | �[32;1m@chainsaw            �[0;22m | �[32;1mDELETE�[0;22m    | �[32;1mOK�[0;22m    | v1/Namespace @ chainsaw-assured-wasp
    sink.go:61: ������������| 11:55:02 | �[36;1mcodex-workspace-metrics�[0;22m | �[36;1m@chainsaw            �[0;22m | �[36;1mCLEANUP�[0;22m   | �[36;1mEND�[0;22m   |
--- PASS: chainsaw (0.00s)
    --- PASS: chainsaw/codex-workspace-metrics (47.80s)
PASS
Tests Summary...
- Passed  tests 1
- Failed  tests 0
- Skipped tests 0
Done.