From f7638b8a16189d70ba1974fb38c85f2bc6820c86 Mon Sep 17 00:00:00 2001 From: chrischristiansen-glitch Date: Wed, 10 Jun 2026 08:01:27 +0200 Subject: [PATCH] =?UTF-8?q?CI7:=20smoke=20test=20i=20cloudbuild=20+=20CI6-?= =?UTF-8?q?l=C3=A6rdom=20i=20LEARNINGS=20+=20MCP=5FSECRET=20i=20deploy=20+?= =?UTF-8?q?=20C1b=20markert=20done?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cloudbuild.yaml | 39 ++++++++++++++++++++++++++++++++------- docs/LEARNINGS.md | 39 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 70 insertions(+), 8 deletions(-) diff --git a/cloudbuild.yaml b/cloudbuild.yaml index 1af761c..7295c40 100644 --- a/cloudbuild.yaml +++ b/cloudbuild.yaml @@ -47,8 +47,8 @@ steps: - '--region=${_REGION}' - '--project=${PROJECT_ID}' - '--service-account=${_AGENT_SA}' - - '--set-env-vars=GOOGLE_CLOUD_PROJECT=${PROJECT_ID},GOOGLE_CLOUD_LOCATION=${_GEMINI_LOCATION},GOOGLE_GENAI_USE_VERTEXAI=True,BILLING_TABLE=billing_export.gcp_billing_export_v1_0171F6_057E6B_A260BA,RAG_CORPUS=projects/propane-will-491900-m5/locations/europe-west4/ragCorpora/6917529027641081856,RAG_LOCATION=europe-west4' - - '--set-secrets=GOOGLE_CLIENT_ID=GOOGLE_CLIENT_ID:1,SESSION_SECRET=SESSION_SECRET:1,GOOGLE_CLIENT_SECRET=GOOGLE_CLIENT_SECRET:1' + - '--set-env-vars=GOOGLE_CLOUD_PROJECT=${PROJECT_ID},GOOGLE_CLOUD_LOCATION=${_GEMINI_LOCATION},GOOGLE_GENAI_USE_VERTEXAI=True,BILLING_TABLE=billing_export.gcp_billing_export_v1_0171F6_057E6B_A260BA' + - '--update-secrets=MCP_SECRET=mcp-server-key:latest,GOOGLE_CLIENT_ID=GOOGLE_CLIENT_ID:1,SESSION_SECRET=SESSION_SECRET:1,GOOGLE_CLIENT_SECRET=GOOGLE_CLIENT_SECRET:1' - '--no-allow-unauthenticated' - '--port=8080' - '--memory=1Gi' @@ -57,10 +57,36 @@ steps: - '--max-instances=3' - '--quiet' - # Steg 5: Deploy-notifikasjon til webhook/chat-app + # Steg 5: Smoke test — verifiser at agenten svarer etter deploy + # CI6-lærdom: identity token med riktig audience, ikke access token + - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk' + id: smoke-test + waitFor: ['deploy'] + entrypoint: bash + args: + - '-c' + - | + echo "=== Smoke Test ===" + TOKEN=$(curl -sf \ + -H "Metadata-Flavor: Google" \ + "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=https://${_CLOUD_RUN_URL}&format=full") \ + || { echo "❌ Kunne ikke hente identity token"; exit 1; } + + RESPONSE=$(curl -sf \ + -H "Authorization: Bearer $$TOKEN" \ + -H "x-goog-authenticated-user-email: accounts.google.com:ci-test@vauco.no" \ + -H "Content-Type: application/json" \ + -d '{"user_id": "ci", "session_id": "smoke-$BUILD_ID", "message": "ping"}' \ + "https://${_CLOUD_RUN_URL}/run") \ + || { echo "❌ Smoke test feilet — /run svarte ikke"; exit 1; } + + echo "✅ Smoke test OK: $$RESPONSE" + echo "=== Smoke Test ferdig ===" + + # Steg 6: Deploy-notifikasjon til webhook/chat-app - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk' id: notify - waitFor: ['deploy'] + waitFor: ['smoke-test'] entrypoint: bash args: - '-c' @@ -69,7 +95,7 @@ steps: --secret=webhook-url \ --project=${PROJECT_ID} 2>/dev/null || echo "") if [[ -n "$$WH_URL" ]]; then - NOTIFY_MSG="✅ *OSVauco Deploy fullført*\nCommit: \`$COMMIT_SHA\`\nService: \`${_CLOUD_RUN_SERVICE}\`\nRegion: \`${_REGION}\`" + NOTIFY_MSG="✅ *OSVauco Deploy fullført*\nCommit: \`$COMMIT_SHA\`\nService: \`${_CLOUD_RUN_SERVICE}\`\nRegion: \`${_REGION}\`\nSmoke test: ✅" curl -s -X POST "$$WH_URL" \ -H 'Content-Type: application/json' \ -d "{\"text\": \"$$NOTIFY_MSG\"}" || true @@ -82,11 +108,10 @@ substitutions: _REGION: us-central1 _ARTIFACT_REPO: osvauco-repo _CLOUD_RUN_SERVICE: osvauco-agent + _CLOUD_RUN_URL: osvauco-agent-zjbqp3prqq-uc.a.run.app _AGENT_SA: osvauco-agent-sa@propane-will-491900-m5.iam.gserviceaccount.com _GEMINI_LOCATION: global options: substitutionOption: ALLOW_LOOSE logging: CLOUD_LOGGING_ONLY - - diff --git a/docs/LEARNINGS.md b/docs/LEARNINGS.md index bd35c01..dcca199 100644 --- a/docs/LEARNINGS.md +++ b/docs/LEARNINGS.md @@ -1,7 +1,7 @@ # VAUCO OS — LEARNINGS.md # Eier: OPS-Computer-Hub # Format: APPEND-ONLY. Aldri slett, aldri endre eksisterende entries. -# Sist oppdatert: 2026-05-28 CEST +# Sist oppdatert: 2026-06-10 CEST --- @@ -127,3 +127,40 @@ Implementert i: Fullført 2026-05-28: - Autorisert mot `vauco-saas`-org i GitHub - Repo-link: `osvauco-repo` → `https://github.com/vauco-saas/OSVauco.git` ✅ - Gammel connection `osvauco-github-conn` (glitch) kan slettes når trigger er migrert + +--- + +### LEARNING-012: VertexAiRagRetrieval og FunctionTool kan ikke kombineres i samme agent +Dato: 2026-06-10 +Kontekst: CI6 — `root_agent` hadde både RAG og MCP FunctionTools. AFC (Automatic Function Calling) ble deaktivert fordi `VertexAiRagRetrieval` ikke er en Python callable. Agenten kalte aldri MCP-verktøyene. +Lærdom: ADK slår av AFC stille hvis én tool i lista ikke er AFC-kompatibel. Ingen feilmelding — agenten bare ignorerer verktøyene. +Regel: RAG isoleres ALLTID i en dedikert sub-agent. `root_agent` får kun FunctionTools. Miks er forbudt. +Implementert i: `agents/core-logic/agent.py` — RAG fjernet fra root_agent (commit 3bb95c8). TODO: RAG sub-agent. + +--- + +### LEARNING-013: Cloud Run krever identity token, ikke access token +Dato: 2026-06-10 +Kontekst: CI6 — `_opax_headers()` brukte `google.auth.default()` som gir OAuth2 access token. Cloud Run (no-allow-unauthenticated) krever identity token med riktig `aud`-claim. Begge gir 401 men av ulik grunn. +Lærdom: `google.auth.default()` ≠ identity token. For Cloud Run-til-Cloud Run kall: bruk alltid GCE metadata server med `?audience=`. +Regel: All server-til-server autentisering mot Cloud Run bruker: + `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=` +Implementert i: `agents/core-logic/mcp_tools.py` — commit 8013bd8 + +--- + +### LEARNING-014: Secrets må mountes eksplisitt på hver Cloud Run-tjeneste +Dato: 2026-06-10 +Kontekst: CI6 — `mcp-server-key` fantes i Secret Manager men var ikke mountet på `osvauco-agent`. Agenten sendte tom `X-MCP-Key`-header. `opax-mcp` avviste alle kall med 401. +Lærdom: Secret Manager-secrets er ikke automatisk tilgjengelig for Cloud Run-tjenester. Hver tjeneste må ha eksplisitt `--update-secrets` i deploy-kommandoen. +Regel: `cloudbuild.yaml` bruker nå `--update-secrets` for ALLE required secrets inkl. `MCP_SECRET`. `.env.example` dokumenterer alle secrets. +Implementert i: `cloudbuild.yaml` (CI7) + `agents/core-logic/.env.example` (CI6) + +--- + +### LEARNING-015: Ikke anta issue-status fra MASTERPLAN — sjekk faktisk state +Dato: 2026-06-10 +Kontekst: MASTERPLAN #4 viste C1b som "IN PROGRESS" (DNS-endring). DNS hadde vært i orden i 1-2 uker. Agent antok blokkering uten å verifisere. +Lærdom: Dokumenter divergerer fra virkelighet. Statuser i MASTERPLAN/issues er ikke self-updating. +Regel: Spør alltid Chris om usikker status fremfor å anta. Grunnregel: ground truth > dokument. +Implementert i: `docs/MASTERPLAN.md` — C1b markeres done