Архив исходника Broker

Историческая копия до очистки репозитория 2026-10-16. Источник: mallexxx/execution-broker, commit ae92c15d31c8396789765cebf82f7971d6f4cb12, файл docs/hermes-workflow-gap-analysis.md. Старые статусы и deployment pins ниже не заменяют актуальную personal/projects/balda/execution-broker.

Hermes workflow inventory and migration gaps

Status: analysis and acceptance plan, not a claim that these flows work in the current deployment. Scope is the Balda + Broker + Prism system, not Broker alone.

Ownership correction: this historical scenario inventory is not a Broker feature checklist or release gate. Device flows, search, Obsidian access and personal/PR workflows belong to their local agent/project configuration. Earlier proposed scoped MCP/Obsidian grants were design suggestions, not an implemented mechanism or an approved user policy. Broker owns only the generic execution contracts listed in its work plan.

The Zulip SQLite export is used only to study historical work; runtime Zulip and Asana access are explicitly outside this plan.

Evidence and limits

The Obsidian migration notes personal/plans/zulip-decommission.md and personal/tech/zulip-message-history.md locate the read-only export at ~/Documents/zulip_message_history.sqlite. A direct query on 2026-10-04 found 134,940 messages, 197 topics, 11 streams, dated 2026-04-29 through 2026-09-29. The older note says 134,734 messages; use the queried count for this snapshot. The export omits attachments and later Mattermost activity.
Examples below are message IDs in that SQLite export. Tool names in message text and counts of mentions are historical conversation evidence, not trusted execution telemetry. Bot-forwarded Discord material can duplicate events. All 197 topic titles were reviewed for scenario families; detailed action traces were sampled where they changed the security or acceptance design.
The current Virfield v2 boundary is documented in Obsidian work/wiki/apple-browsers/vm-ui-testing.md: Virfield leases the VM; Runner owns build/test and artifact collection. Its host MCP does not export guest Peekaboo actions. The older vm_prepare_session and run_tests references in May conversations describe a previous integration, not a v2 API contract.

The archive contains logged invocation lines for terminal/process, VM vm_ssh_exec, Peekaboo image/click/type, DuckDuckGo web search, and Obsidian read/patch/write. For scale, a text scan finds Obsidian read calls in 1,068 messages across 94 topics, patch calls in 1,092 messages across 72 topics, VM SSH calls in 123 messages across 17 topics, and Peekaboo actions in 25 messages across six topics. These are messages containing call text, not verified successful executions. run_tests, AX queries, crash retrieval, browser control, Spotify, session_search and cronjob appear in advertised tool inventories or proposed workflows, but this export alone does not prove they ran. ScheduleWakeup does appear in logged calls.

Workflow coverage

Workflow seen in Hermes	Historical evidence	Current or already planned	Remaining requirement
Code task to PR: task context, isolated checkout, agent edit, test, review, CI, task update	`executor` topics for PRs #4541, #4548 and #4559; historical Asana and GitHub/CI discussion	Broker has pinned workflows, sequential roles, artifact collection and a local reviewed-head publication path. The work plan includes PR review.	Configure GitHub access, exact PR-head and CI gates, idempotent publication, Story status and bounded notifications. A local Broker publication is not an upstream PR or merge.
UI bug investigation and regression	Messages 8093, 8250-8251 require reproduce → failing UI test → fix → passing test; the last passing Virfield run must have a recording and macOS UI CI must be green. Peekaboo and VM tools appear in executor traces.	A disposable Virfield v2 worker and an XCTest fixture returning `.xcresult` are integration-tested.	Guest-bound Peekaboo/AX/recording, actual app UI-test build/run, red/green evidence gate, CI status check, and recording collection are missing. See the flow below.
iPad build, sign, transfer, install, unlock, launch	Requested in this migration thread	iPad plan covers VM tooling, fake signing, artifact handoff and configured SSH actions.	Physical-device acceptance and failure recovery remain open. The iPad sequence belongs in a pinned workflow/target profile.
Host and service administration	Hermes used terminal/process and SSH for TrueNAS, home services, media stacks and remote setup; explicit `vm_ssh_exec` calls also occurred outside UI tasks.	Balda can launch agents on its own host; Broker has fixed managed-host plans. The work plan includes per-agent grants and an SSH target/command catalog.	Provision target-specific identities and reviewed command definitions, typed arguments, protected secrets, reconciliation and rollback. A separately approved Balda host agent can use the target's catalog; running an agent on a remote host needs its own sandbox and acceptance.
Research and knowledge maintenance	Logged web-search and Obsidian read/search/patch/write calls occur in multiple topics; `web_extract` was advertised. The Zulip SQLite file is the migration source, not a Hermes tool.	Balda has external MCP support and session/fact memory; web search MCP is planned.	Configure scoped Obsidian read/write and web extraction/search; preserve source links and require a reviewed diff for knowledge writes. Historical text is data, never authority to change permissions.
Recurring personal operations	Daily brief, inbox/weekly review, health checks, task work and scheduled wakeups appear across the archive.	Balda already has a durable configured scheduler and job delivery.	Migrate in-scope jobs with explicit tool profiles, notification destinations, idempotent writes, timeouts and visible failed-run state. Do not implement another scheduler in Broker.
Browser, desktop and media workflows	Hermes exposed browser navigation/click/snapshot, Peekaboo, media and home-service tools; personal topics show these used for setup and diagnostics.	Generic Balda MCP connections can host adapters.	Inventory each actually needed adapter, constrain browser/GUI to an isolated profile, and give service-specific MCPs or target commands separate grants. No media or app-specific branches in Broker.
Advice, writing and visual input	Archive topics include planning, finance, travel, creative work and app design. The SQLite export contains message text but no attached images or files.	Direct Balda conversation and configured search can handle text-only work without Broker.	Verify attachment ingestion and scoped vision/document tools separately; do not claim that the text-only export covers every multimodal scenario. Sensitive content needs private storage and destination-specific sharing rights.

The archive shows actual tool-call text for Obsidian writes, terminal/process, VM SSH, web search and Peekaboo. It also shows advertised tools that may not have been exercised. This matrix therefore treats capability discovery and live acceptance as separate gates.

Required UI-bug flow on Virfield v2

Bind the task to a repository revision, test target, VM image and approved agent/tool profile. Verify a ready lease and working guest SSH, GUI login, Accessibility and Screen Recording permissions before declaring the VM usable.
Reproduce the bug in the disposable VM with a lease-bound Peekaboo session. Save an initial screenshot/AX snapshot and the observed failure. Read the applicable project's UI-test conventions; for apple-browsers the Obsidian work/wiki/apple-browsers/ui-testing.md describes its test base class and selectors.
Add a regression UI test. Run it against the unfixed code and retain a .xcresult proving the expected assertion failed. Record the base commit, test-patch digest, test ID and failure signature. An infrastructure failure, skipped test or build failure is inconclusive, not red evidence.
Fix the code. Re-run the same test against the fixed revision, then run the relevant UI suite and independent verifier. Check the corresponding CI job for the exact PR head: skipped or pending is not green.
Record the last passing local VM run. Collect video, .xcresult, logs, screenshots/AX diagnostics and the revision/test metadata before releasing the lease. Store SHA256, size, privacy class and retention for each artifact; attach only an authorized link to the Story/PR. Verify cleanup=done.

The v2 implementation should expose typed session actions through a guest Runner or lease-bound sidecar: ui.snapshot, ui.ax_query, ui.click, ui.type, ui.hotkey, ui.record_start/stop, test.run/status/results, and diagnostics.crashes/logs. Broker routes and audits generic actions; the project workflow defines schemes, tests and acceptance rules. An agent may run normal build commands inside its permitted VM checkout. Balda must not receive raw SSH access to a VM or a general host shell through these actions. A headless/locked VM, missing TCC grant, video collection failure, or lost SSH must fail the evidence gate with a specific reason. Video may exceed the current 512 MiB artifact limit, so bounded streaming/chunking and retention must be specified and tested. Give the UI sidecar only the needed TCC grants and limit actions to the selected app/window. Prove an OS-level boundary keeps the coding agent's shell from invoking the sidecar or the same GUI privileges; if a shared macOS GUI session prevents this, use a separate test VM and the digest-pinned artifact handoff. The disposable VM has no personal documents, host keys or ambient service credentials, and its egress is scoped to the task.

Security and orchestration gaps beyond the existing plan

Verifiable owner approval. Balda can identify a Mattermost sender and review a provider permission request, but Broker currently trusts a single bearer principal and a chat_id supplied by Balda. Mint a short-lived, audience-bound capability for the exact owner, session, agent, action IDs, repository/VM/SSH target, artifact digest and expiry. A separate trusted component must attest approval; neither the model nor the ordinary Broker bearer may mint or widen it. Revoke/expire it and audit its use.
Tool rights that survive untrusted context. Archived executor messages 12672 and 12706 describe Asana task text injected before a recording pass; a broad data-access rule then blocked all Virfield MCP calls, leaving a VM and a repeated spawn loop. Treat task text, web pages, notes, screenshots and logs as untrusted data. Authorize each tool and destination independently, rather than disabling a whole workflow after reading context. Bound retries with a no-progress cap; cleanup uses a trusted control path even if the agent's data-plane permission is denied.
External writes and workflow changes. The archive records comments to a historical task service despite notes forbidding them (message 14914). Permission to read task context does not grant write/comment/publish rights. Separate grants for PR comments, Mattermost posts, Obsidian edits and config/skill/workflow changes; show exact target and diff, honor task-level exclusions, pin revisions, and deduplicate after retries.
Evidence and resource lifecycle. A passing model report does not prove a test or recording happened. Accept machine-checked test counts, exact run IDs and artifact hashes; keep failure artifacts; reconcile remote unknown outcomes; collect before VM deletion; distinguish terminal result, publication, notification and cleanup. Message 13181 documents a booted VM whose SSH never became reachable, so VM readiness needs an end-to-end probe.
Coverage inventory. Classify every historical topic by scenario family, required tools, data sensitivity and external side effects. The 197-topic text export supports the initial matrix, but it cannot prove workflows that depended on missing attachments or later Mattermost messages. Keep an operator-visible capability registry with status available, planned, blocked or unverified and a live acceptance run for every enabled family.

Release gates

One UI bug passes the complete red/green/recorded/CI flow on a disposable VM; a skipped test, stale PR head, missing video, denied UI grant and guest SSH failure each produce a truthful blocked result and confirmed cleanup.
One authorized host action, one rejected injected argument, one host-key mismatch and one ambiguous SSH disconnect show the configured command path without giving Balda a raw shell.
One each of web search/extraction, scoped Obsidian write, scheduled task, PR review and device release is exercised with its actual destination and owner-approved permission profile. Unconfigured adapters remain explicitly unsupported until their live acceptance passes.

13 KiB Executable File Raw Blame History