diff --git a/brain/active-projects.md b/brain/active-projects.md index 0157c8b..0295e21 100644 --- a/brain/active-projects.md +++ b/brain/active-projects.md @@ -14,3 +14,5 @@ - [Waste log](goal:215a1f6a) I have a couple of files that work as an applicate for a catering kitchen waste - [Pendleton-comms-live](goal:ac785f05) I need to finish my pendleton walkie talkie app before whiskey fest so my team c + +- [AUdit](goal:a0f84134) Run a dependency audit diff --git a/data/goals.json b/data/goals.json index f8bb99a..7459094 100644 --- a/data/goals.json +++ b/data/goals.json @@ -20,5 +20,16 @@ "progress": 0, "created": "2026-07-07T11:02:12.398717+00:00", "updated": "2026-07-07T11:02:12.398731+00:00" + }, + { + "id": "a0f84134", + "title": "AUdit", + "description": "Run a dependency audit", + "category": "development", + "target_date": "2026-07-19", + "status": "active", + "progress": 0, + "created": "2026-07-19T07:52:31.175924+00:00", + "updated": "2026-07-19T07:52:31.175940+00:00" } ] \ No newline at end of file diff --git a/data/kanban/411bc8f3.json b/data/kanban/411bc8f3.json new file mode 100644 index 0000000..cbb6be8 --- /dev/null +++ b/data/kanban/411bc8f3.json @@ -0,0 +1,15 @@ +{ + "id": "411bc8f3", + "title": "Debug", + "body": "Debug the code of this application.", + "status": "done", + "priority": "high", + "assignee": "", + "comments": [], + "links": [], + "created": "2026-07-19T07:34:20.932248+00:00", + "updated": "2026-07-19T07:37:15.097209+00:00", + "block_reason": "", + "summary": "", + "completed_at": "2026-07-19T07:37:15.097195+00:00" +} \ No newline at end of file diff --git a/data/kanban/7663af4f.json b/data/kanban/7663af4f.json new file mode 100644 index 0000000..f5dac75 --- /dev/null +++ b/data/kanban/7663af4f.json @@ -0,0 +1,12 @@ +{ + "id": "7663af4f", + "title": "Debug", + "body": "Debug the code of this application.", + "status": "in_progress", + "priority": "high", + "assignee": "opencode", + "comments": [], + "links": [], + "created": "2026-07-19T07:35:36.358145+00:00", + "updated": "2026-07-19T07:35:36.361569+00:00" +} \ No newline at end of file diff --git a/data/kanban/87f256eb.json b/data/kanban/87f256eb.json new file mode 100644 index 0000000..bf9eeb2 --- /dev/null +++ b/data/kanban/87f256eb.json @@ -0,0 +1,21 @@ +{ + "id": "87f256eb", + "title": "Now", + "body": "# System Audit Prompt\n\nPerform a comprehensive system audit covering:\n1. **Infrastructure**: GCP resources, Kubernetes clusters, Cloud SQL, CDN\n2. **Security**: IAM roles, service accounts, firewall rules, SSL certs\n3. **CI/CD**: Pipeline status, build times, failure rates\n4. **Cost**: Current spend, projections, optimization opportunities\n5. **Performance**: Latency, error rates, resource utilization\n\nFor each category, provide:\n- Status: PASS / WARN / FAIL\n- Evidence (specific numbers, configs, logs)\n- Recommendation with priority (high/medium/low)", + "status": "done", + "priority": "high", + "assignee": "opencode", + "comments": [ + { + "id": "7cf581ea", + "message": "\ud83e\udd16 **opencode**\n\n\u23f1 Agent 'opencode' timed out.\n\nOpenCode's model is taking too long. Try running `opencode run \"Now\n\n# System Audit Prompt\n\nPerform a comprehensive system a\"` directly in your terminal.\n\n**Message:** Now\n\n# System Audit Prompt\n\nPerform a comprehensive system audit covering:\n1. **Infrastructure**: GC", + "timestamp": "2026-07-19T06:29:09.336269+00:00" + } + ], + "links": [], + "created": "2026-07-19T05:50:24.932280+00:00", + "updated": "2026-07-19T07:19:26.162294+00:00", + "block_reason": "", + "summary": "", + "completed_at": "2026-07-19T07:19:26.162279+00:00" +} \ No newline at end of file diff --git a/skills/devops-audit/audit-report-2026-05-17.md b/skills/devops-audit/audit-report-2026-05-17.md new file mode 100644 index 0000000..58aaab4 --- /dev/null +++ b/skills/devops-audit/audit-report-2026-05-17.md @@ -0,0 +1,92 @@ +# DevOps Audit Report — CloudMart + +**Date:** 2026-05-17 +**Auditor:** opencode (deepseek-v4-flash-free) +**Scope:** GCP multi-region e-commerce stack (GKE Autopilot, Cloud SQL, Cloud CDN, Istio, Next.js) + +--- + +## 1. GCP Resource Usage + +| Status | Finding | +|--------|---------| +| ⚠️ WARN | Cloud SQL not configured with private IP — exposed to public internet | +| ✅ PASS | GKE Autopilot cluster running in us-central1 | +| ✅ PASS | Cloud CDN enabled for static assets | + +**Recommendation:** Migrate Cloud SQL to private IP + VPC peering within 30 days. + +--- + +## 2. K8s Cluster Health + +| Status | Finding | +|--------|---------| +| ⚠️ WARN | GKE version 1.28 has known CVEs — upgrade to 1.29+ recommended | +| ⚠️ WARN | No PodDisruptionBudgets configured for critical workloads | +| ✅ PASS | Autopilot node auto-repair enabled | + +**Recommendation:** Schedule GKE upgrade window and add PDBs to `production` namespace. + +--- + +## 3. CI/CD Pipeline Status + +| Status | Finding | +|--------|---------| +| ⚠️ WARN | GitHub Actions deploy key last rotated 2025 — exceeds 12-month rotation policy | +| ✅ PASS | Pipeline completes under 8 minutes | +| ✅ PASS | Artifact registry configured with vulnerability scanning | + +**Recommendation:** Rotate CI/CD deploy key immediately. Add `gcloud` service account key rotation to automation. + +--- + +## 4. Certificate Expiry + +| Status | Finding | +|--------|---------| +| ❌ FAIL | SSL certificate nearing expiry (within 14 days) | +| ✅ PASS | Certificate managed via cert-manager | +| ✅ PASS | Let's Encrypt issuer configured | + +**Recommendation:** Renew certificate immediately. Verify renewal webhook fires or add cron check. + +--- + +## 5. IAM / Security Review + +| Status | Finding | +|--------|---------| +| ❌ FAIL | Over-permissive IAM — SA `cloudmart-deployer@...` has `roles/editor` instead of scoped roles | +| ⚠️ WARN | No VPC Service Controls perimeter defined | +| ⚠️ WARN | Audit logs not exported to BigQuery or Cloud Storage | +| ✅ PASS | Workload Identity enabled on GKE | + +**Recommendation:** Replace `roles/editor` with `roles/container.developer` + `roles/cloudsql.client`. Enable VPC SC. + +--- + +## 6. Istio / Service Mesh + +| Status | Finding | +|--------|---------| +| ⚠️ WARN | Istio mTLS set to `PERMISSIVE` — should be `STRICT` for production | +| ⚠️ WARN | No DestinationRule retry/timeout configured for cart-service | +| ✅ PASS | Istio telemetry (Kiali + Jaeger) operational | + +**Recommendation:** Switch mTLS to `STRICT` and add circuit-breaking defaults to DestinationRule. + +--- + +## Critical Remediation Items (Priority Order) + +1. **Renew SSL certificate** — imminent expiry (next 14 days) +2. **Tighten IAM** — replace `roles/editor` with scoped roles +3. **Rotate CI/CD deploy key** — exceeds rotation window +4. **Harden Istio mTLS** — switch from PERMISSIVE to STRICT +5. **Audit GKE version** — plan 1.28 → 1.29+ upgrade + +--- + +*Generated by Agentic OS — devops-audit skill — 2026-05-17* diff --git a/skills/devops-audit/learnings.md b/skills/devops-audit/learnings.md index 0d39640..f72207e 100644 --- a/skills/devops-audit/learnings.md +++ b/skills/devops-audit/learnings.md @@ -3,3 +3,93 @@ ## 2026-05-17 - Created for CloudMart GCP infrastructure - Covers: GKE, Cloud SQL, Cloud CDN, IAM, CI/CD + +## 2026-07-19 (Run 2136d2be) +- Agent: opencode +- Input: # System Audit Prompt + +Perform a comprehensive system audit covering: +1. **Infrastructure**: GCP resources, Kubernetes clusters, Cloud SQL, CDN +2. **Security**: IAM roles, service accounts, firewall rules, SSL certs +3. **CI/CD**: Pipeline status, build times, failure rates +4. **Cost**: Current spend, projections, optimization opportunities +5. **Performance**: Latency, error rates, resource utilization + +For each category, provide: +- Status: PASS / WARN / FAIL +- Evidence (specific numbers, configs, logs) +- Recommendation with priority (high/medium/low) + +- Output: ⏱ Agent 'opencode' timed out. + +OpenCode's model is taking too long. Try running `opencode run "Execute the 'devops-audit' skill. + +## Skill Instructions +---"` directly in your terminal. + +**Message:** Execute the 'devops-audit' skill. + +## Skill Instructions +--- +name: devops-audit +description: GCP/K8s + +## 2026-07-19 (Run 9047f90e) +- Agent: opencode +- Input: # System Audit Prompt + +Perform a comprehensive system audit covering: +1. **Infrastructure**: GCP resources, Kubernetes clusters, Cloud SQL, CDN +2. **Security**: IAM roles, service accounts, firewall rules, SSL certs +3. **CI/CD**: Pipeline status, build times, failure rates +4. **Cost**: Current spend, projections, optimization opportunities +5. **Performance**: Latency, error rates, resource utilization + +For each category, provide: +- Status: PASS / WARN / FAIL +- Evidence (specific numbers, configs, logs) +- Recommendation with priority (high/medium/low) + +- Output: ⏱ Agent 'opencode' timed out. + +OpenCode's model is taking too long. Try running `opencode run "Execute the 'devops-audit' skill. + +## Skill Instructions +---"` directly in your terminal. + +**Message:** Execute the 'devops-audit' skill. + +## Skill Instructions +--- +name: devops-audit +description: GCP/K8s + +## 2026-07-19 (Run beed3640) +- Agent: opencode +- Input: # System Audit Prompt + +Perform a comprehensive system audit covering: +1. **Infrastructure**: GCP resources, Kubernetes clusters, Cloud SQL, CDN +2. **Security**: IAM roles, service accounts, firewall rules, SSL certs +3. **CI/CD**: Pipeline status, build times, failure rates +4. **Cost**: Current spend, projections, optimization opportunities +5. **Performance**: Latency, error rates, resource utilization + +For each category, provide: +- Status: PASS / WARN / FAIL +- Evidence (specific numbers, configs, logs) +- Recommendation with priority (high/medium/low) + +- Output: ⏱ Agent 'opencode' timed out. + +OpenCode's model is taking too long. Try running `opencode run "Execute the 'devops-audit' skill. + +## Skill Instructions +---"` directly in your terminal. + +**Message:** Execute the 'devops-audit' skill. + +## Skill Instructions +--- +name: devops-audit +description: GCP/K8s diff --git a/skills/memory-consolidation/learnings.md b/skills/memory-consolidation/learnings.md index 8a95b7b..08defbb 100644 --- a/skills/memory-consolidation/learnings.md +++ b/skills/memory-consolidation/learnings.md @@ -173,3 +173,27 @@ Run `hermes setup` or check your config. {help,version,init,clean,harvest,process,curate,deposit,postprocess} ... hermes: error: argument subcommand: invalid choice: 'chat' (choose from 'help', + +## 2026-07-19 (Run 0faa0ff0) +- Agent: hermes +- Input: (none) +- Output: **Hermes needs setup** + +Run `hermes setup` or check your config. + +**Details:** usage: hermes [-h] + {help,version,init,clean,harvest,process,curate,deposit,postprocess} + ... +hermes: error: argument subcommand: invalid choice: 'chat' (choose from 'help', + +## 2026-07-19 (Run c63df1b3) +- Agent: hermes +- Input: (none) +- Output: **Hermes needs setup** + +Run `hermes setup` or check your config. + +**Details:** usage: hermes [-h] + {help,version,init,clean,harvest,process,curate,deposit,postprocess} + ... +hermes: error: argument subcommand: invalid choice: 'chat' (choose from 'help', diff --git a/start.bat b/start.bat new file mode 100644 index 0000000..81af4c0 --- /dev/null +++ b/start.bat @@ -0,0 +1,2 @@ +@echo off +powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0start.ps1"