Chapter 05 - Platform engineering
An agentic ops bot for repository work, Cloud Build triage, and rollback planning whose self-audit turned safety advice into enforcement layers, not instructions.
latest repository verification snapshot in task status
security, action, and completion audit suites
live credentials, PR flow proof, and rotation stay visible
Thesis
Hermes already provides Telegram transport, memory, model orchestration, and MCP execution. This repository adds the operator-owned layer: repo allowlists, proposal storage, approval commands, action history, GCP observability, and repository audits that fail when safety becomes only prose.
Security honesty
These rows come from the 2026-06-10 audit material and the source repositories' `origin/main` history. The table only marks an item fixed when a commit, source file, or test file exists.
| Finding | Found | Fixed evidence | Status |
|---|---|---|---|
| Direct GitHub write tools made safety advisory | The 2026-06-10 decisions log removed direct GitHub write tools from the exposed MCP surface. | Security audit code now fails if create_or_update_file, create_branch, or create_pull_request are directly included; proposal approval is the supported write path.Source: Merge 40fafb5 / commit dd2fe3f; scripts/audit_security.py and tests/test_security_audit.py. | Fixed |
| Sensitive paths and secret-like content needed executable guards | Path and content safety could not depend only on SOUL.md instructions when the bot can plan writes. | Safety guards reject `.env*`, `.github`, Dockerfile, cloudbuild, deploy paths, secret-adjacent names, and obvious secret assignments before a proposal is rendered.Source: src/telegram_development/safety.py; tests/test_proposals.py; tests/test_security_audit.py. | Fixed |
| Untrusted repo and Cloud Run output could become prompt instructions | Repository content and log output are operational data, but an agent loop can accidentally treat them as instructions. | Router and observability paths wrap untrusted output in BEGIN_UNTRUSTED_TOOL_OUTPUT / END_UNTRUSTED_TOOL_OUTPUT and the audit checks for those delimiters.Source: Merge 40fafb5; plugins/deepseek_router, plugins/gcp_observability, tests/test_security_audit.py. | Fixed |
| Completion and action history were not machine-enforced | A repository implementation needed gates that distinguish repository completion from live setup and record proposal actions. | Completion audit, action audit, history command, and task-status checks now pin repository_ok, command evidence, and proposal events.Source: Commits a7796bd and c5508ac; tests/test_completion_audit.py and tests/test_action_audit.py. | Fixed |
Open item
The task-status document keeps the real approved PR flow against a non-production test repo as a remaining external validation step.
Source: telegram-development/docs/task-status.mdOpen item
Repository-only completion can pass while full live readiness waits for `.env`, `config/repos.yaml`, tools, and deployed services.
Source: telegram-development/docs/runbooks/completion-audit.mdOpen item
The repository does not rotate live credentials; the task-status doc records rotation as an operator step after deployment stability.
Source: telegram-development/docs/task-status.mdOpen item
The model-tier router can select and hint tiers, but Hermes hooks cannot fully switch the tool-loop model per turn today.
Source: telegram-development/config/decisions-log.mdFeature evidence
The repository covers `/start`, `/repo`, `/model`, `/history`, `/repo-status`, `/status`, `/approve`, `/reject`, and `/cancel` through command code, manifests, tests, and task-status evidence.
Source: telegram-development/docs/task-status.mdA change proposal stores a JSON record, renders a diff, waits for approval, then returns ordered GitHub MCP commands instead of executing direct writes by default.
Source: telegram-development/docs/runbooks/pr-workflow.mdThe bot can reason about Cloud Build, Cloud Run, logs, rollback planning, and repository/deployment context while keeping production promotion explicit.
Source: telegram-development/OPERATIONS.mdEvidence trail