| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
docs: take operator pages off docs.omi.me Unlisted Mintlify MDX is still a public URL. Move runbooks, flags, invariants, and agent rules next to owning code, add docs/AGENTS.md as the site allow-list, and correct the live kill-switch contract after the JIT authority page leaves the site. Co-authored-by: Cursor <cursoragent@cursor.com> | 3 天前 | |
ci(public-build): env-var removal, per-environment flags, real invoker identity checks (#12582) * ci(public-build): env-var removal, per-environment flags, real invoker identity checks Plaintext Cloud Run env vars survived merge deploys, restricted ingress was applied to development, and TBD placeholders passed presence checks into gcloud. Co-authored-by: Cursor <cursoragent@cursor.com> * ci(public-build): probe actAs via IAM testIamPermissions REST gcloud has no iam service-accounts test-iam-permissions subcommand, so the previous preflight would fail every prod deploy. Call the IAM REST method with urllib and a print-access-token bearer instead. * ci(public-build): reject remove_runtime_env_vars overlapping preserved secrets Cubic review (PRRT_kwDOLkKqys6eWSS0): a runtime name in both preserve_runtime_secrets and remove_runtime_env_vars loaded cleanly, yet deployment emits --remove-env-vars for a binding the contract claims to preserve via the merge update strategies — the removal would strip the preserved secret binding. Extend the dedicated overlap rejection to preserve_runtime_secrets and its mirrored fallback_runtime_secrets, with a regression test. --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: David Zhang <9387252+Git-on-my-level@users.noreply.github.com> | 1 天前 | |
docs(backend): move calendar-capture rules to docs/agents/calendar-capture The Service Map bullet for the SCA-381 calendar-capture contract pushed backend/AGENTS.md past the agents-md-lean budget; keep the one-line contract there and move the full discard-override / auto-link gating / capture-gap rules to docs/agents/calendar-capture.md. | 3 天前 | |
fix(desktop): preserve realtime voice context boundaries Keep visual evidence scoped to the active voice turn, isolate background context turns, and route historical product questions through sourced deep research. Verified with 93 focused Swift tests, 42 agent tool-contract tests, repeated routing evaluations, and the named local app using the exact Wispr Flow prompt. Failure-Class: new | 15 小时前 | |
Add screenshot for issue #6559 | 4 个月前 | |
fix(desktop): make activation and updater health honest Failure-Class: none | 22 天前 | |
ci(public-build): env-var removal, per-environment flags, real invoker identity checks (#12582) * ci(public-build): env-var removal, per-environment flags, real invoker identity checks Plaintext Cloud Run env vars survived merge deploys, restricted ingress was applied to development, and TBD placeholders passed presence checks into gcloud. Co-authored-by: Cursor <cursoragent@cursor.com> * ci(public-build): probe actAs via IAM testIamPermissions REST gcloud has no iam service-accounts test-iam-permissions subcommand, so the previous preflight would fail every prod deploy. Call the IAM REST method with urllib and a print-access-token bearer instead. * ci(public-build): reject remove_runtime_env_vars overlapping preserved secrets Cubic review (PRRT_kwDOLkKqys6eWSS0): a runtime name in both preserve_runtime_secrets and remove_runtime_env_vars loaded cleanly, yet deployment emits --remove-env-vars for a binding the contract claims to preserve via the merge update strategies — the removal would strip the preserved secret binding. Extend the dedicated overlap rejection to preserve_runtime_secrets and its mirrored fallback_runtime_secrets, with a regression test. --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: David Zhang <9387252+Git-on-my-level@users.noreply.github.com> | 1 天前 | |
Put private-cloud-sync bucket lifecycle under version control + Coldline@30d on chunks/ (#12631) * Put private-cloud-sync bucket lifecycle under version control + Coldline@30d on chunks/ The omi-private-cloud-sync bucket's lifecycle was managed by nothing: console and gsutil only. This adds the checked-in contract + offline validator + workflow admission shape the repo already uses for the frame-request buckets, and adds one rule: SetStorageClass -> COLDLINE at age 30 scoped to matchesPrefix ["chunks/"]. `buckets update --lifecycle-file` REPLACES the whole lifecycle config, so the two legacy Delete rules (merged/ age 3, playback/ age 30) are re-declared verbatim in every environment file and the workflow validates the desired file as a superset of the live before.json captured with the deploy identity. The validator refuses to drop a live rule, refuses any Delete rule that could reach chunks/ (an unscoped Delete counts), refuses a SetStorageClass rule not scoped to exactly ["chunks/"], and refuses noncurrent-version rules. push applies development only. prod is dispatch-only behind a typed confirmation, an exact-main-SHA admission, and the prod environment reviewer. Plan and evidence: omi-knowledge-base/projects/gcp-cost-efficiency/evidence/2026-09-02-coldline-rollout-plan.md Failure-Class: none Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(storage-lifecycle): address Cubic review — pin bucket per env, --raw describes, scoped rollback removal - Assert the expected bucket per environment in the select step before any gcloud command runs (a same-project bucket edit could otherwise reconcile a different bucket). - Add --raw to both 'gcloud storage buckets describe' fixtures so the validator reads the raw API representation it is written against (name, versioning.enabled, verbatim rule equality). - Replace the rollback blanket --allow-rule-removal with a scoped --allow-rule-removal-of <apply doc>: only rules the apply variant declared (the Coldline rule) may be dropped; any later live rule still blocks. The blanket flag remains as an explicit operator override. - Validator: reject non-string action.type with a normal validation error instead of a TypeError; require matchesStorageClass to be exactly [STANDARD, MULTI_REGIONAL] (omission/subsets broadened the transition). - Tests: regression tests for each guard plus a structural workflow test pinning the bucket assert, --raw describes, and scoped rollback wiring. Verification: python3 -m pytest tests/unit/test_storage_lifecycle_contract.py tests/unit/test_storage_lifecycle_workflow.py -q → 18 passed; validator CLI exercised end-to-end (source-only on all four docs, scoped-removal rollback simulation pass/block/blanket/mutex); black clean; .github/scripts/check-deployment-concurrency.py OK. --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: David Zhang <9387252+Git-on-my-level@users.noreply.github.com> | 13 小时前 | |
Merge origin/main into chore/agent-vm-retire-and-delete Resolve the lock-policy conflict by keeping main's isolated firestore-schema concurrency group and omitting the retired agent-proxy workflow contracts. Co-authored-by: David Zhang <Git-on-my-level@users.noreply.github.com> | 16 天前 | |
chore(codeowners): require review for firmware and the app BLE/sync paths main already runs with require_code_owner_reviews, so these entries block a merge rather than only requesting a review. - omi/firmware/** -> @TuEmb. Firmware ships to hardware in the field and cannot be rolled back the way a server deploy can. - The app's BLE and offline-sync paths -> @mdmohsin7. They carry recording data between device and backend, and changes that look local have broken capture or stranded recordings before. #11016 and #11017 proposing to restore bonding that was deliberately removed is the current example. Paths were checked against the tree rather than guessed: every entry resolves, including the Kotlin and Swift BLE directories, which sit outside app/lib and would otherwise be missed. | 1 个月前 | |
docs: take operator pages off docs.omi.me Unlisted Mintlify MDX is still a public URL. Move runbooks, flags, invariants, and agent rules next to owning code, add docs/AGENTS.md as the site allow-list, and correct the live kill-switch contract after the JIT authority page leaves the site. Co-authored-by: Cursor <cursoragent@cursor.com> | 3 天前 | |
ci: collapse desktop beta to signed-smoke plus hourly freshness (#11588) * ci: collapse desktop beta to signed-smoke plus hourly freshness Qualification never rolled back recent signed-smoke manifests and starved the planner when a push event was missed. Remove the lane, make source-gate failures diagnosable from one command, and alarm when candidate and live beta diverge. Co-authored-by: Cursor <cursoragent@cursor.com> * docs: retarget INV-BETA-1 guards after deleting qualification tests The auto-beta-candidate script is gone with the qualification lane; keep the locked beta-identity invariant pointing at a guard that still exists. Co-authored-by: Cursor <cursoragent@cursor.com> * ci: make skipped desktop checks legible and let a green tip unblock the train Two failure modes survived the beta-train collapse and are fixed here. Skipped jobs published the wrong check name. GitHub does not evaluate a job's `name:` for a SKIPPED job, so the conditional names on `desktop-swift` and `desktop-swift-release-compile` were published verbatim as the raw expression text. On every commit that did not touch desktop paths the required check `Desktop Swift Build & Tests` was therefore ABSENT rather than skipped, and the planner reported "missing" instead of the truth. Observed on f666ddd4a3, 7a79f08329 and 7d7ed62e5, all of which read green. The conditional existed to keep a merged `pull_request.closed` bookkeeping run from publishing a skipped required check onto the merge SHA; dropping the `closed` event removes that hazard at the source and lets both names be literals. A contract test now rejects any expression in a job name. A green tip did not unblock the train. The planner selects the newest desktop-touching commit and, when its checks are red, could only fall back to an OLDER green SHA. On Aug 14 main's tip was green while the newest desktop-touching commit below it was red on a flaky Swift suite, so the train shipped stale code or wedged. A first-parent commit above the blocked SHA contains everything the blocked SHA contains, so its own exact-SHA checks tested a superset of that tree; when they are genuinely green the train may ship from that newer SHA. Tried before the backward fallback, because it ships newer code. Only a real `ready` gate qualifies, so a skipped or absent check still never counts as success. Also keep the beta rollback precondition expressible: beta manifests carry the `signed-smoke` tier, whose frozen-schema truth is `qualification_passed: False`, so the literal T2/True requirement rejected every current rollback target. Failure-Class: none Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(web): keep the release lifecycle helper compiling under the admin es5 target `newestSparkleVersion` iterated `String.matchAll()` with `for...of`. The admin package sets "target": "es5", where iterating an IterableIterator is TS2802, so `npm run typecheck` failed and took the Web Checks Build job red. Local pre-push does not typecheck the Next.js admin app, so CI was the first place this could surface. Use `exec` loops instead of widening the package's compile target, which would change output for every file to fix one. Verified with the same commands CI runs: `npm run typecheck` clean and `npm test` 88 passed across 14 files. Failure-Class: none Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> | 19 天前 | |
fix(deploy): accept load-balancer-only public-build candidates through their public URL (#12560) The frontend contract restricts Cloud Run ingress to the load balancer so the shared-chat rate-limit subject can trust X-Forwarded-For. That makes the tagged run.app candidate URL answer 404 to CI, so the browser smoke that gates promotion has failed on every prod frontend deploy since the flag landed, and h.omi.me has been serving the May build behind three months of merges. Resolve the acceptance route from the live ingress annotation: open ingress keeps the pre-promotion smoke of the no-traffic candidate; restricted ingress requires a declared public URL in the contract, is promoted first, smoked at that URL, and rolled back to the previously serving revision on failure. A restricted service without a declared URL is refused naming the ingress policy instead of "canary did not become ready". Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> | 1 天前 | |
fix(desktop-windows): reset onboarding when a different account signs in (#12230) * chore: record weekly guardrail baseline pulse * fix(desktop-windows): reset onboarding when a different account signs in reconcileAccountForSignIn detected a UID change and wiped user data, but onboardingCompletedAt survived teardown — so a second user on the same machine was dropped straight into the home screen without seeing the setup wizard. Fix: call resetOnboarding() (deletes onboardingCompletedAt + onboardingStep) just before teardownUserData() inside the stored!==uid branch of reconcileAccountForSignIn. Same-user re-auth and first-ever sign-in are unaffected (guard condition unchanged). Verified: pnpm test -- authTeardown.test.ts passes (7 tests, 3 assertions updated to pin resetOnboarding call-count per branch). Failure-Class: none Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KADKRuaPJdho9CDE7nLXQP --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Tim <tim@cornwallwes.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> | 8 天前 | |
chore: ratchet memory lifecycle baseline | 22 天前 | |
feat: complete Python desktop backend cutover | 1 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 3 天前 | ||
| 1 天前 | ||
| 3 天前 | ||
| 15 小时前 | ||
| 4 个月前 | ||
| 22 天前 | ||
| 1 天前 | ||
| 13 小时前 | ||
| 16 天前 | ||
| 1 个月前 | ||
| 3 天前 | ||
| 19 天前 | ||
| 1 天前 | ||
| 8 天前 | ||
| 22 天前 | ||
| 1 个月前 |