nisse

200 Commits 2 Branches 1 Tag

2 Commits

Include renames

Author	SHA1	Message	Date
dongarandClaude Opus 5.5	761ebdb857	Run every command on the build VM over SSH (M1.3) CI / checks (push) Skipped CI / checks (pull_request) Failing after 55s Details execution.SSHHost.execute is now the only way the agent runs anything (L13). Commands travel as a script on SSH's stdin, so the secrets handed to a call are never on a command line, and every value handed out is redacted from the output. Timeouts kill the remote process group, and an unreachable host is reported as such, not as a failed command. Workspace and GitRepo run on the build VM. The clone uses the repository's SSH URL, so no credential is stored in it (#89); fetches and pushes get the push key over stdin, in a short-lived ssh-agent, and PRs are still opened from the agent's host with its API token. The bench runs on the build host too. Tests reach "the build VM" through a throwaway local sshd (nisse_dev .testing); CI installs openssh-server. The live push test now pushes with the sandbox's deploy key (NISSE_PUSH_KEY). Fixes #89. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE	2026-10-02 21:39:46 +00:00
dongarandClaude Opus 5.5	a18321b4b0	Add a bring-up script and a transcript dump; let nisse-dev install on its own VM (M0.2) CI / checks (push) Skipped CI / checks (pull_request) Successful in 1m16s Details Development Plan M0.2. - scripts/bringup.sh: start [REF] sets the previous run aside under /root/nisse-e2e/runs/, exports the ref under test and starts the agent as the transient systemd unit nisse-bringup, so it outlives the shell that started it; stop (SIGTERM, clean shutdown), status, logs, and collect (the journal log and a readable transcript). - nisse_dev.dump (python -m nisse_dev.dump STATE_DB [--full]): a readable dump of a state store's state, pending intents and canonical log. Opens the store read-only, so it is safe against a live agent. - The agent runs as root on this development VM, as it will on its own VM. Architecture D3/D6/D7 corrected to match the operator's intent: installing packages and toolchains on its own VM is class 2, recorded so the environment can be rebuilt (it was class 3 with provisioning an open question); egress names OS package mirrors. The plan's M0.2, M4.1, M4.2 and bring-up guards follow. Acceptance: a smoke run started, answered status in the test room, stopped cleanly, and collect produced the log and transcript. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE	2026-10-01 16:16:32 +00:00

Author

SHA1

Message

Date

dongarandClaude Opus 5.5

761ebdb857

Run every command on the build VM over SSH (M1.3)

CI / checks (push) Skipped

CI / checks (pull_request) Failing after 55s

Details

execution.SSHHost.execute is now the only way the agent runs anything
(L13). Commands travel as a script on SSH's stdin, so the secrets handed
to a call are never on a command line, and every value handed out is
redacted from the output. Timeouts kill the remote process group, and
an unreachable host is reported as such, not as a failed command.

Workspace and GitRepo run on the build VM. The clone uses the
repository's SSH URL, so no credential is stored in it (#89); fetches
and pushes get the push key over stdin, in a short-lived ssh-agent,
and PRs are still opened from the agent's host with its API token.
The bench runs on the build host too.

Tests reach "the build VM" through a throwaway local sshd (nisse_dev
.testing); CI installs openssh-server. The live push test now pushes
with the sandbox's deploy key (NISSE_PUSH_KEY).

Fixes #89.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

2026-10-02 21:39:46 +00:00

dongarandClaude Opus 5.5

a18321b4b0

Add a bring-up script and a transcript dump; let nisse-dev install on its own VM (M0.2)

CI / checks (push) Skipped

CI / checks (pull_request) Successful in 1m16s

Details

Development Plan M0.2.

- scripts/bringup.sh: start [REF] sets the previous run aside under
  /root/nisse-e2e/runs/, exports the ref under test and starts the agent
  as the transient systemd unit nisse-bringup, so it outlives the shell
  that started it; stop (SIGTERM, clean shutdown), status, logs, and
  collect (the journal log and a readable transcript).
- nisse_dev.dump (python -m nisse_dev.dump STATE_DB [--full]): a readable
  dump of a state store's state, pending intents and canonical log. Opens
  the store read-only, so it is safe against a live agent.
- The agent runs as root on this development VM, as it will on its own
  VM. Architecture D3/D6/D7 corrected to match the operator's intent:
  installing packages and toolchains on its own VM is class 2, recorded
  so the environment can be rebuilt (it was class 3 with provisioning an
  open question); egress names OS package mirrors. The plan's M0.2, M4.1,
  M4.2 and bring-up guards follow.

Acceptance: a smoke run started, answered status in the test room,
stopped cleanly, and collect produced the log and transcript.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

2026-10-01 16:16:32 +00:00