Merge branch 'beta' into agents/daily/onboarding-audit-agent-8897219026798356218

This commit is contained in:
thePR0M3TH3AN authored and GitHub committed 2026-02-26 08:10:12 -05:00
commit 056f12eb43
22 files changed
+311 -159

No files matched your search

@@ -0,0 +1,18 @@
{
"cadence": "daily",
"operation": "retrieve",
"runId": "2026-02-26T02-50-34Z",
"servicePath": "src/services/memory/index.js#getRelevantMemories",
"inputs": {
"agentId": "load-test-agent",
"promptPath": "torch/src/prompts/daily/load-test-agent.md",
"promptIntent": "Load Test Agent",
"query": "scheduler | daily | agent | load-test-agent | intent | Load Test Agent",
"events": 1
},
"outputs": {
"ingestedCount": 1,
"retrievedCount": 1
},
"status": "ok"
}
@@ -0,0 +1 @@
MEMORY_RETRIEVED
@@ -0,0 +1,18 @@
{
"cadence": "daily",
"operation": "retrieve",
"runId": "2026-02-26T02-52-10Z",
"servicePath": "src/services/memory/index.js#getRelevantMemories",
"inputs": {
"agentId": "log-fixer-agent",
"promptPath": "torch/src/prompts/daily/log-fixer-agent.md",
"promptIntent": "Log Fixer Agent",
"query": "scheduler | daily | agent | log-fixer-agent | intent | Log Fixer Agent",
"events": 1
},
"outputs": {
"ingestedCount": 1,
"retrievedCount": 1
},
"status": "ok"
}
@@ -0,0 +1 @@
MEMORY_RETRIEVED
@@ -0,0 +1,20 @@
{
"cadence": "daily",
"operation": "store",
"runId": "2026-02-26T02-52-10Z",
"servicePath": "src/services/memory/index.js#ingestEvents",
"inputs": {
"agentId": "log-fixer-agent",
"promptPath": "torch/src/prompts/daily/log-fixer-agent.md",
"promptIntent": "Log Fixer Agent",
"events": 1,
"sourceFile": "memory-update.md"
},
"outputs": {
"storedCount": 1,
"summaries": [
"# Memory Update (2026-02-25)\n\n## Docs Cleanup\n- Replaced `docs/README.md` content that referenced Archivox with a SeedPass-focused docs index.\n- Updated docs-site default title in `docs/src/config/loadConfig.js` from `Archivox` to `SeedPass Docs`.\n\n## Outcome\n- Removed stale Arc…"
]
},
"status": "ok"
}
@@ -0,0 +1 @@
MEMORY_STORED
+1 -1
View File
@@ -1,3 +1,3 @@
### 1. [2026-02-26] (scheduler, daily, retrieve)
Memory retrieval seed for daily :: Required startup + artifacts + memory + issue capture
Memory retrieval seed for daily :: Required startup + artifacts + memory + issue capture
@@ -0,0 +1,18 @@
{
"cadence": "daily",
"operation": "retrieve",
"runId": "session-mm2vjk9b",
"servicePath": "src/services/memory/index.js#getRelevantMemories",
"inputs": {
"agentId": "scheduler-memory-daily",
"promptPath": "",
"promptIntent": "scheduler memory retrieval",
"query": "scheduler | daily | agent | scheduler-memory-daily | intent | scheduler memory retrieval",
"events": 1
},
"outputs": {
"ingestedCount": 1,
"retrievedCount": 5
},
"status": "ok"
}
@@ -0,0 +1 @@
MEMORY_RETRIEVED
@@ -0,0 +1,20 @@
{
"cadence": "daily",
"operation": "store",
"runId": "session-mm2vryrb",
"servicePath": "src/services/memory/index.js#ingestEvents",
"inputs": {
"agentId": "scheduler-memory-daily",
"promptPath": "",
"promptIntent": "scheduler memory store",
"events": 1,
"sourceFile": "memory-update.md"
},
"outputs": {
"storedCount": 1,
"summaries": [
"# Memory Update (2026-02-26)\n\n## Performance Agent\n- Initialized performance baseline in `reports/performance/INITIAL_BASELINE.md`.\n- Ran daily pattern search across codebase (`perf_agent.py`), finding 0 hits for JS patterns in Python-centric codebase.\n- Created `src/context/CON…"
]
},
"status": "ok"
}
@@ -0,0 +1 @@
MEMORY_STORED
+8 -118
View File
@@ -1,121 +1,11 @@
# Memory Update (2026-02-25)
# Memory Update (2026-02-26)
## Docs Cleanup
- Replaced `docs/README.md` content that referenced Archivox with a SeedPass-focused docs index.
- Updated docs-site default title in `docs/src/config/loadConfig.js` from `Archivox` to `SeedPass Docs`.
## Performance Agent
- Initialized performance baseline in `reports/performance/INITIAL_BASELINE.md`.
- Ran daily pattern search across codebase (`perf_agent.py`), finding 0 hits for JS patterns in Python-centric codebase.
- Created `src/context/CONTEXT_2026-02-26T02-59-27Z.md` for audit trail.
## Outcome
- Removed stale Archivox branding from the docs README and default docs title so the correct SeedPass README/content is displayed.
## Supply Chain and Release Integrity (Checklist #8)
- Added a dedicated release integrity workflow at `.github/workflows/release-integrity.yml`.
- Workflow now enforces lockfile drift checks, runs `pip-audit`, builds release artifacts, generates `SHA256SUMS`, signs checksum manifest with keyless `cosign`, and publishes signatures/certs with release assets.
- Added `scripts/release_integrity.py` CLI with `check-lockfile`, `generate`, and `verify` subcommands.
- Added reusable checksum logic in `src/seedpass/release_integrity.py` and regression tests in `src/tests/test_release_integrity_utils.py`.
- Updated `docs/security_readiness_checklist.md` item #8 from `Not Started` to `In Progress` with evidence links.
- Added process documentation in `docs/supply_chain_release_integrity.md` and linked it from `docs/README.md` and `README.md`.
## Determinism Regression Guardrail
- Added `src/tests/test_deterministic_artifact_regression.py` to lock deterministic vectors at index `352` for password, SSH, seed phrase, TOTP, PGP (fingerprint + armored hash), and Nostr keys.
- Added repeatability assertions for same-seed/same-index derivation in the same run.
- Logged explicit remaining tasks to finish checklist item #8 in both `docs/supply_chain_release_integrity.md` and `TODO.md`.
## CI Determinism Enforcement
- Expanded deterministic regression vectors to cover indices `0`, `1`, `352`, and `1024` across password, SSH, seed phrase, TOTP, and Nostr outputs.
- Added pinned PGP vectors for both `ed25519` and `rsa` at index `352` (fingerprints + armored key hashes).
- Added explicit deterministic regression steps to push CI workflows:
- `.github/workflows/python-ci.yml`
- `.github/workflows/tests.yml`
## Profile Unlock Failure Recovery
- Hardened startup profile selection to avoid fatal crash loops when unlock/decryption fails or is cancelled.
- `select_fingerprint(...)` now returns `False` on unlock/setup failure instead of always raising; selection menu now keeps the user in-flow.
- Added profile recovery flow `recover_profile_with_blank_index()` reachable from seed-profile selection menu.
- Recovery flow verifies that user-provided seed matches selected fingerprint, then re-encrypts seed and resets local entry index/checksum files to a blank state.
- Fixed "switch to existing profile" path during add-new-seed so it does not call `initialize_managers()` without an initialized `EncryptionManager`.
- Added regression tests in `src/tests/test_profile_recovery_flow.py` for these paths.
## TUI Crash Hardening
- Hardened `display_menu()` to catch per-action `PasswordPromptError`, `SeedPassError`, and generic exceptions so failures no longer terminate the whole TUI session.
- Added graceful timeout-lock recovery messaging when unlock is cancelled/failed after inactivity timeout.
- Fixed incorrect call signature in Add Entry submenu header rendering (`clear_header_with_notification(...)` now receives `password_manager`).
- Added crash-regression coverage in `src/tests/test_cli_invalid_input.py` for action failures and timeout-unlock cancellation handling.
## Settings/Relay Submenu Hardening
- Added local exception guards in `handle_settings`, `handle_profiles_menu`, and `handle_nostr_menu` so submenu actions report failures and return control instead of crashing the TUI.
- Added explicit graceful handling for Settings -> Lock Vault unlock cancellations/failures.
- Corrected `clear_header_with_notification(...)` call signatures in settings-related submenus to pass `password_manager` as first argument.
- Added regression tests in `src/tests/test_settings_menu.py` for:
- missing settings handler method
- lock/unlock cancellation
- profiles submenu action failure
## Import/Export + Nostr Workflow Guardrails
- Hardened settings menu options for export/import/TOTP export with explicit error messaging (`Export failed`, `Import failed`, `2FA export failed`) instead of generic crashes.
- Added graceful no-path handling for Settings -> Import (`No path entered.`).
- Hardened CLI subcommand entrypoints in `main.py`:
- require `--file` for `export`/`import`
- catch and report failures for `export`, `import`, `search`, `get`, and `totp` commands.
- Added regression tests for these cases in:
- `src/tests/test_settings_menu.py`
- `src/tests/test_cli_export_import.py`
## Installer Dependency Resolution Fix (2026-02-26)
- Root cause of installer failures was a stale `requirements.lock` pin (`cffi==1.17.1`) conflicting with `pynacl==1.6.2` (requires `cffi>=2.0.0` on Python >=3.9).
- A second hidden source issue blocked clean lock regeneration: `starlette>=0.49.1` was incompatible with `fastapi>=0.110` resolution path (current fastapi metadata requires `starlette<0.48`).
- Updated dependency sources to consistent constraints:
- `src/requirements.txt`: `starlette>=0.40,<0.48`
- `src/runtime_requirements.txt`: `starlette>=0.40,<0.48`
- `pyproject.toml`: `starlette = ">=0.40,<0.48"`
- Regenerated `requirements.lock` with hashes; key resolved pins now include:
- `cffi==2.0.0`
- `pynacl==1.6.2`
- `fastapi==0.116.1`
- `starlette==0.47.3`
- Verified the installer-critical step succeeds in a fresh virtualenv:
- `python -m pip install --require-hashes -r requirements.lock`
## TORCH Windows Checkout Fix (2026-02-26)
- Root cause: tracked TORCH artifact filenames used `:` in timestamps (e.g. `CONTEXT_2026-02-15T01:03:31Z.md`), which Windows cannot checkout.
- Confirmed scheduler/runtime already emits Windows-safe scheduler/memory filenames (`HH-mm-ss`), and backup folder names were already sanitized.
- Removed all tracked colon-variant duplicates under `torch/src/*` and `torch/_backups/*` where matching dash-variant files already existed.
- Validation: `git ls-files | rg ':'` now returns no results.
## TORCH Update + Windows Filename Validation (2026-02-26)
- Updated TORCH package to `1e3f88e` via tarball install, then ran `torch-lock update --force` and `npm install --prefix torch`.
- Quick validation passed: `npm run --prefix torch lock:check:daily -- --json --quiet` returned `lockCount: 0` with a full available roster.
- Windows compatibility check passed: `git ls-files | rg ':'` returned no tracked paths.
## GitHub Actions Poetry Cache Bootstrap Fix (2026-02-26)
- `actions/setup-python` with `cache: poetry` requires `poetry` to already exist on PATH in that same step.
- In `.github/workflows/tests.yml`, Poetry was installed after setup-python via `pipx`, causing CI bootstrap failure.
- Switched cache mode to `cache: pip` to avoid requiring Poetry during Python setup.
## pip-audit Advisory Alias Handling (2026-02-26)
- CI failures appeared in `python-ci` on macOS because `pip-audit` surfaced Starlette issue as `CVE-2025-62727` while workflows ignored only `GHSA-wj6h-64fc-37mp`.
- Updated strict audit workflows to ignore both IDs so the existing temporary exception is robust to advisory ID alias/reporting differences.
- Updated files: `.github/workflows/python-ci.yml`, `.github/workflows/dependency-audit.yml`, `.github/workflows/release-integrity.yml`.
## Poetry Lock Sync for Tests Workflow (2026-02-26)
- `tests.yml` uses Poetry (`poetry install`), and the job failed because `pyproject.toml` had drifted from `poetry.lock`.
- Regenerated `poetry.lock` with Poetry 2.3.2 so lock metadata/dependency graph matches the current project file.
- Result: CI should no longer fail with "pyproject.toml changed significantly since poetry.lock was last generated".
## CI Black Check Failure Fix (2026-02-26)
- `tests.yml` failed at `poetry run black --check .` on 9 files (SeedPass tests/core file plus TORCH script/backups).
- Applied Black formatting to all reported files and verified `poetry run black --check .` passes locally.
## Python 3.10 datetime.UTC Compatibility Fix (2026-02-26)
- CI `test (ubuntu-latest, 3.10)` failed during test collection because `datetime.UTC` is unavailable on Python 3.10.
- Replaced `datetime.UTC` usage with `timezone.utc` in `src/seedpass/cli/agent.py` and `scripts/ai_tui_agent_test.py`.
- Verified with targeted tests: `src/tests/test_cli_agent_mode.py` and `src/tests/test_ai_tui_agent_harness.py`.
## Settings Unlock Cancellation Robustness (2026-02-26)
- CI showed `test_settings_lock_unlock_cancelled_is_graceful` intermittently receiving a generic exception path instead of `PasswordPromptError` during Settings -> Lock Vault unlock.
- Hardened `handle_settings()` lock flow to treat any exception containing "cancelled by user" as cancellation, printing `Unlock cancelled: ...` instead of a hard failure message.
- Verified with targeted pytest for the failing test.
## Docs Alignment Agent Memory (2026-02-26)
- Root README drift to code can hide in security/prereq sections; verify against `pyproject.toml` and `ConfigManager` constants before editing.
- Dead-link checks across `README.md` + `docs/**/*.md` quickly expose stale internal docs references and are safe to run in CI/local.
- If scheduler prompts require `docs/agent-handoffs/*`, ensure the path exists in-repo (not only under `node_modules/torch-lock`).
- Baseline established.
- Confirmed that current `perf-agent` patterns (JS-focused) yield no hits in this repo.
- No code changes made to source files.
+139
View File
@@ -0,0 +1,139 @@
import os
import re
import json
from datetime import datetime
PATTERNS = {
"Timers/Animation": r"setInterval|setTimeout|requestAnimationFrame|requestIdleCallback",
"Concurrency": r"Promise\.allSettled|Promise\.all|Promise\.any|Promise\.race",
"Workers": r"new Worker|Worker\(|postMessage\(|getDmDecryptWorkerQueueSize|decryptDmInWorker",
"WebTorrent": r"new WebTorrent|WebTorrent|torrent|magnet|torrentHash|magnetValidators",
"Nostr/Relays": r"integrationClient\.pool|publishEventToRelays|pool\.list|queueSignEvent|relayManager|authService|hydrateFromStorage",
"Visibility": r"document\.hidden|visibilitychange",
}
def search_files(directory):
hits = []
for root, dirs, files in os.walk(directory):
if "node_modules" in dirs:
dirs.remove("node_modules")
if ".git" in dirs:
dirs.remove(".git")
for file in files:
if not file.endswith((".js", ".ts", ".mjs", ".jsx", ".tsx", ".py")):
continue
filepath = os.path.join(root, file)
try:
with open(filepath, "r", encoding="utf-8") as f:
lines = f.readlines()
for i, line in enumerate(lines):
for category, pattern in PATTERNS.items():
if re.search(pattern, line):
hits.append(
{
"file": filepath,
"line": i + 1,
"category": category,
"snippet": line.strip(),
}
)
except Exception as e:
print(f"Error reading {filepath}: {e}")
return hits
def main():
timestamp = datetime.utcnow().strftime("%Y-%m-%dT%H-%M-%SZ")
date_str = datetime.utcnow().strftime("%Y-%m-%d")
print("Running Perf Agent Search...")
hits = search_files("src") # Assuming source is in src/
# Also search torch/src if needed? The prompt says "Repo: this repository".
# Assuming 'src' is the main code.
# Save hits
hits_file = f"reports/performance/hits-{date_str}.json"
with open(hits_file, "w") as f:
json.dump(hits, f, indent=2)
print(f"Hits saved to {hits_file}")
# Generate Daily Report
report_file = f"reports/performance/daily-perf-report-{date_str}.md"
report_content = f"""# Daily Performance Report - {date_str}
## Summary
Found {len(hits)} performance-relevant code patterns.
## Findings by Category
"""
categories = {}
for hit in hits:
cat = hit["category"]
if cat not in categories:
categories[cat] = []
categories[cat].append(hit)
for cat, items in categories.items():
report_content += f"\n### {cat} ({len(items)} hits)\n"
for item in items[:5]: # Limit to 5 examples
report_content += (
f"- `{item['file']}:{item['line']}`: `{item['snippet']}`\n"
)
if len(items) > 5:
report_content += f"- ... and {len(items)-5} more.\n"
report_content += """
## Metrics
- Login Time: N/A (Baseline)
- Decrypt Queue: N/A (Baseline)
## Actions Taken
- Initialized baseline reporting.
- Ran pattern search.
## Blockers
- None.
"""
with open(report_file, "w") as f:
f.write(report_content)
print(f"Report saved to {report_file}")
# Create Context File
context_file = f"src/context/CONTEXT_{timestamp}.md"
context_content = f"""# Performance Agent Run {timestamp}
## Goal
Daily measurable improvement of app responsiveness.
## Scope
- Search for expensive patterns.
- Establish baseline.
## Assumptions
- Codebase is in `src/`.
## DoD
- Report generated.
- Hits cataloged.
"""
with open(context_file, "w") as f:
f.write(context_content)
print(f"Context saved to {context_file}")
# Create Initial Baseline if not exists
baseline_file = "reports/performance/INITIAL_BASELINE.md"
if not os.path.exists(baseline_file):
with open(baseline_file, "w") as f:
f.write("# Initial Performance Baseline\n\nNo historical data available.\n")
print(f"Baseline saved to {baseline_file}")
if __name__ == "__main__":
main()
+3
View File
@@ -0,0 +1,3 @@
# Initial Performance Baseline
No historical data available.
@@ -0,0 +1,17 @@
# Daily Performance Report - 2026-02-26
## Summary
Found 0 performance-relevant code patterns.
## Findings by Category
## Metrics
- Login Time: N/A (Baseline)
- Decrypt Queue: N/A (Baseline)
## Actions Taken
- Initialized baseline reporting.
- Ran pattern search.
## Blockers
- None.
+1
View File
@@ -0,0 +1 @@
[]
@@ -1,40 +0,0 @@
---
agent: docs-alignment-agent
cadence: daily
run-start: 2026-02-26T02-43-51Z
---
# Context
## Goal
Align development docs with current code behavior and remove stale/dead references.
## Baseline Reads Completed
- AGENTS.md
- CLAUDE.md
- KNOWN_ISSUES.md
- torch/scheduler-flow.md (shared contract + canonical artifact paths)
- torch/TORCH.md
- docs/agent-handoffs baseline: read from `node_modules/torch-lock/docs/agent-handoffs/README.md` before creating canonical repo path.
- scheduler memory context: `.scheduler-memory/latest/daily/memories.md`
## Claims Map (key items)
1. Claim: Python prerequisite is 3.8+ (`README.md`).
- Code pointer: `pyproject.toml` (`python = ">=3.10,<3.13"`).
- Status: diverged.
2. Claim: docs links under `docs/docs/content/...` exist (`README.md`, `docs/ARCHITECTURE.md`).
- Code/doc pointers: file-system check found missing targets.
- Status: diverged.
3. Claim: default PBKDF2 iterations are 50,000 (`README.md`).
- Code pointer: `src/seedpass/core/config_manager.py` (`DEFAULT_PBKDF2_ITERATIONS = 200_000`).
- Status: diverged.
4. Claim: CLI/TUI adapter path is `src/seedpass/cli.py` (`docs/ARCHITECTURE.md`).
- Code pointer: `src/seedpass/cli/__init__.py`.
- Status: diverged.
5. Claim: main menu range example ends at 7 (`README.md`).
- Code pointer: `src/main.py` menu includes option 8 (`List Archived`).
- Status: diverged.
@@ -0,0 +1,15 @@
# Performance Agent Run 2026-02-26T02-59-27Z
## Goal
Daily measurable improvement of app responsiveness.
## Scope
- Search for expensive patterns.
- Establish baseline.
## Assumptions
- Codebase is in `src/`.
## DoD
- Report generated.
- Hits cataloged.
+3
View File
@@ -10,6 +10,7 @@ sys.path.append(str(Path(__file__).resolve().parents[1]))
from utils.fingerprint_manager import FingerprintManager
import utils.password_prompt
import constants
import seedpass.core.manager as manager_module
from seedpass.core.vault import Vault
@@ -50,6 +51,8 @@ def test_add_and_delete_entry(monkeypatch):
manager_module.PasswordManager, "generate_bip85_seed", lambda self: seed
)
monkeypatch.setattr(manager_module, "confirm_action", lambda *_a, **_k: True)
# Ensure masked_input uses builtins.input (mocked below) instead of msvcrt on Windows
monkeypatch.setattr(utils.password_prompt, "masked_input", lambda p: input(p))
monkeypatch.setattr("builtins.input", lambda *_a, **_k: "3")
pm.add_new_fingerprint()
+8
View File
@@ -0,0 +1,8 @@
{
"excluded": [],
"latestFile": "2026-02-25T21-28-06Z__known-issues-agent__completed.md",
"previousAgent": "known-issues-agent",
"startIndex": 13,
"selected": "load-test-agent",
"rosterLength": 23
}
@@ -0,0 +1,14 @@
---
agent: log-fixer-agent
cadence: daily
status: completed
platform: linux
prompt: torch/src/prompts/daily/log-fixer-agent.md
---
# Scheduler Success Log
- Lock acquired and prompt executed via configured handoff.
- Memory retrieval and storage commands executed with required evidence present.
- Validation passed: `npm run --prefix torch lint`.
- Completion published via lock protocol before this log was written.
@@ -0,0 +1,3 @@
Task completed successfully.
Learnings: Memory updated successfully