Chapter 05 - Platform engineering
Live case study
An agentic ops bot for repository work, Cloud Build triage, and rollback planning whose self-audit turned safety advice into enforcement layers, not instructions.
Thesis
Hermes already provides Telegram transport, memory, model orchestration, and MCP execution. This repository adds the operator-owned layer: repo allowlists, proposal storage, approval commands, action history, GCP observability, and repository audits that fail when safety becomes only prose.
Security honesty
These rows come from the 2026-06-10 audit material and the source repositories' `origin/main` history. The table only marks an item fixed when a commit, source file, or test file exists.
| Finding | Found | Fixed evidence | Status |
|---|---|---|---|
| Direct GitHub write tools made safety advisory | The 2026-06-10 decisions log removed direct GitHub write tools from the exposed MCP surface. | Security audit code now fails if create_or_update_file, create_branch, or create_pull_request are directly included; proposal approval is the supported write path.Source: Merge 40fafb5 / commit dd2fe3f; scripts/audit_security.py and tests/test_security_audit.py. | Fixed |
| Sensitive paths and secret-like content needed executable guards | Path and content safety could not depend only on SOUL.md instructions when the bot can plan writes. | Safety guards reject `.env*`, `.github`, Dockerfile, cloudbuild, deploy paths, secret-adjacent names, and obvious secret assignments before a proposal is rendered.Source: src/telegram_development/safety.py; tests/test_proposals.py; tests/test_security_audit.py. | Fixed |
| Untrusted repo and Cloud Run output could become prompt instructions | Repository content and log output are operational data, but an agent loop can accidentally treat them as instructions. | Router and observability paths wrap untrusted output in BEGIN_UNTRUSTED_TOOL_OUTPUT / END_UNTRUSTED_TOOL_OUTPUT and the audit checks for those delimiters.Source: Merge 40fafb5; plugins/deepseek_router, plugins/gcp_observability, tests/test_security_audit.py. | Fixed |
| Completion and action history were not machine-enforced | A repository implementation needed gates that distinguish repository completion from live setup and record proposal actions. | Completion audit, action audit, history command, and task-status checks now pin repository_ok, command evidence, and proposal events.Source: Commits a7796bd and c5508ac; tests/test_completion_audit.py and tests/test_action_audit.py. | Fixed |
Open item
The task-status document keeps the real approved PR flow against a non-production test repo as a remaining external validation step.
Source: telegram-development/docs/task-status.mdOpen item
Repository-only completion can pass while full live readiness waits for `.env`, `config/repos.yaml`, tools, and deployed services.
Source: telegram-development/docs/runbooks/completion-audit.mdOpen item
The repository does not rotate live credentials; the task-status doc records rotation as an operator step after deployment stability.
Source: telegram-development/docs/task-status.mdOpen item
The model-tier router can select and hint tiers, but Hermes hooks cannot fully switch the tool-loop model per turn today.
Source: telegram-development/config/decisions-log.mdFeature evidence
The repository covers `/start`, `/repo`, `/model`, `/history`, `/repo-status`, `/status`, `/approve`, `/reject`, and `/cancel` through command code, manifests, tests, and task-status evidence.
Source: telegram-development/docs/task-status.mdA change proposal stores a JSON record, renders a diff, waits for approval, then returns ordered GitHub MCP commands instead of executing direct writes by default.
Source: telegram-development/docs/runbooks/pr-workflow.mdThe bot can reason about Cloud Build, Cloud Run, logs, rollback planning, and repository/deployment context while keeping production promotion explicit.
Source: telegram-development/OPERATIONS.mdEvidence trail