coilyco-gaming/eco-app
Watch
2
0
Code Issues 33 Pull requests Projects Releases Packages 1 Wiki Activity Actions

The managed hook block is pinned to the retired v0.193.0 train, and bumping it opens 73 pre-existing violations #316

New issue
Closed
opened 2026-08-20 07:22:50 +00:00 by coilyco-ops · 1 comment
coilyco-ops commented 2026-08-20 07:22:50 +00:00
Member
Copy link

.pre-commit-config.yaml pins the managed agentic-os block at rev: v0.193.0. That tag is from the retired aos-v* scheme, not the aos-precommit-v* train that apply-agentic-os-hooks.py tracks. The current default is aos-precommit-v0.34.0.

Why it matters today: the secret scan is broken here

At v0.193.0 the offline scan passes its exclude-paths regex through a process substitution:

trufflehog git file://. --since-commit HEAD \
  --exclude-paths <(cat <<'EOF'

Native Windows trufflehog cannot open the resulting descriptor, so on a native Windows host every run fails:

error trufflehog unable to open filter file
{"file": "/dev/fd/63", "error": "open /dev/fd/63: The system cannot find the path specified."}

The current scripts/trufflehog-scan.sh writes a real temp file with mktemp and converts it with cygpath for the native binary, so the bump fixes the scan rather than muting it. Verified by diffing the script at both tags.

Coverage is degraded, not absent. This repo also defines a repo: local trufflehog hook with an inline entry and no --exclude-paths, and that one passes. So one of the two scans runs. Those two hooks share a display name, which is why the output shows one pass and one fail and reads confusingly.

Why it is not a one-line fix

Running apply-agentic-os-hooks.py --repo eco-app produces a working bump, and both trufflehog hooks then pass. But v0.193.0 is old enough that the refresh also activates a baseline this repo has never met. pre-commit run --all-files then reports 115 FAIL lines, roughly 73 distinct violations, across six hooks. The commit aborts on the installed hook, correctly, and --no-verify is not an option.

Breakdown, easiest first.

Size caps, 42 violations. Mostly a config-key migration.

pyproject.toml already declares exactly the right paths:

[tool.agentic-os.documentation-layout]
excludes = ["investigation/", "docs/", "mods/"]

with a sound comment about investigation/ being a preserved post-mortem and docs/ holding long-form FEATURES docs migrated from the four source repos. That reasoning still holds. What changed is that agentic-os#1108 made excludes placement-only, and size exemption moved to a separate vendored key. So these paths are declared and simply not reaching the caps any more. eco-mods hit this exact wall and resolved it by bumping the rev so vendored becomes effective.

actionlint. One missing config file.

Fails only on unknown runner labels docker and deploy, which are self-hosted labels. It needs a .github/actionlint.yaml declaring them, which sibling repos already carry. No workflow changes.

check json. One file.

mods/telemetry/Configs/EcoTelemetry.example.json does not parse: Expecting property name enclosed in double quotes: line 8 column 3. Likely an annotated example config. Either make it valid JSON or exclude it as a template.

source doc references, 22 violations. Mechanical.

Dead refs to docs/internals.md from the telemetry mod, and to docs/dto.md and docs/currency-holdings.md from the stores mod. The stores docs do exist at mods/stores/docs/, so these are relative-path mismatches after the four-repo merge rather than missing documents.

Actions run steps stay one line, 9 violations. The only real restructuring.

build-publish.yml, modio-publish.yml, and mods-diagnostic.yml inline multi-line bodies through YAML block scalars and python3 -c. The rule wants each body moved into a tracked script invoked from a single-line run.

Suggested order

  1. Bump the rev and add vendored to pyproject.toml. That should clear 42 at once.
  2. Add .github/actionlint.yaml with the self-hosted labels.
  3. Fix or exclude the telemetry example JSON.
  4. Repoint the 22 source doc references.
  5. Move the nine inline workflow bodies into tracked scripts.

Worth deciding separately whether the repo: local trufflehog hook should stay once the managed one works, since it duplicates the scan without the exclude-paths protection. It does carry stages: [pre-commit, pre-push], which may be the reason it exists.

Note on scope

Nothing here was introduced by a recent change. All of it predates the pin and only becomes visible when the pin moves. Sibling eco-ops carries the same v0.193.0 pin and will hit its own version of this.

`.pre-commit-config.yaml` pins the managed agentic-os block at `rev: v0.193.0`. That tag is from the retired `aos-v*` scheme, not the `aos-precommit-v*` train that `apply-agentic-os-hooks.py` tracks. The current default is `aos-precommit-v0.34.0`. ## Why it matters today: the secret scan is broken here At `v0.193.0` the offline scan passes its exclude-paths regex through a process substitution: ```sh trufflehog git file://. --since-commit HEAD \ --exclude-paths <(cat <<'EOF' ``` Native Windows trufflehog cannot open the resulting descriptor, so on a native Windows host every run fails: ``` error trufflehog unable to open filter file {"file": "/dev/fd/63", "error": "open /dev/fd/63: The system cannot find the path specified."} ``` The current `scripts/trufflehog-scan.sh` writes a real temp file with `mktemp` and converts it with `cygpath` for the native binary, so the bump fixes the scan rather than muting it. Verified by diffing the script at both tags. Coverage is degraded, not absent. This repo also defines a `repo: local` trufflehog hook with an inline entry and no `--exclude-paths`, and that one passes. So one of the two scans runs. Those two hooks share a display name, which is why the output shows one pass and one fail and reads confusingly. ## Why it is not a one-line fix Running `apply-agentic-os-hooks.py --repo eco-app` produces a working bump, and both trufflehog hooks then pass. But `v0.193.0` is old enough that the refresh also activates a baseline this repo has never met. `pre-commit run --all-files` then reports 115 FAIL lines, roughly 73 distinct violations, across six hooks. The commit aborts on the installed hook, correctly, and `--no-verify` is not an option. Breakdown, easiest first. **Size caps, 42 violations. Mostly a config-key migration.** `pyproject.toml` already declares exactly the right paths: ```toml [tool.agentic-os.documentation-layout] excludes = ["investigation/", "docs/", "mods/"] ``` with a sound comment about `investigation/` being a preserved post-mortem and `docs/` holding long-form FEATURES docs migrated from the four source repos. That reasoning still holds. What changed is that agentic-os#1108 made `excludes` placement-only, and size exemption moved to a separate `vendored` key. So these paths are declared and simply not reaching the caps any more. eco-mods hit this exact wall and resolved it by bumping the rev so `vendored` becomes effective. **actionlint. One missing config file.** Fails only on unknown runner labels `docker` and `deploy`, which are self-hosted labels. It needs a `.github/actionlint.yaml` declaring them, which sibling repos already carry. No workflow changes. **check json. One file.** `mods/telemetry/Configs/EcoTelemetry.example.json` does not parse: `Expecting property name enclosed in double quotes: line 8 column 3`. Likely an annotated example config. Either make it valid JSON or exclude it as a template. **source doc references, 22 violations. Mechanical.** Dead refs to `docs/internals.md` from the telemetry mod, and to `docs/dto.md` and `docs/currency-holdings.md` from the stores mod. The stores docs do exist at `mods/stores/docs/`, so these are relative-path mismatches after the four-repo merge rather than missing documents. **Actions run steps stay one line, 9 violations. The only real restructuring.** `build-publish.yml`, `modio-publish.yml`, and `mods-diagnostic.yml` inline multi-line bodies through YAML block scalars and `python3 -c`. The rule wants each body moved into a tracked script invoked from a single-line `run`. ## Suggested order 1. Bump the rev and add `vendored` to `pyproject.toml`. That should clear 42 at once. 2. Add `.github/actionlint.yaml` with the self-hosted labels. 3. Fix or exclude the telemetry example JSON. 4. Repoint the 22 source doc references. 5. Move the nine inline workflow bodies into tracked scripts. Worth deciding separately whether the `repo: local` trufflehog hook should stay once the managed one works, since it duplicates the scan without the exclude-paths protection. It does carry `stages: [pre-commit, pre-push]`, which may be the reason it exists. ## Note on scope Nothing here was introduced by a recent change. All of it predates the pin and only becomes visible when the pin moves. Sibling `eco-ops` carries the same `v0.193.0` pin and will hit its own version of this.
coilyco-ops commented 2026-08-20 08:19:06 +00:00
Author
Member
Copy link

Landed on main as ed4e5f7. pre-commit run --all-files is green, 844 tests pass, lint and smoke pass.

What shipped, against the suggested order

1. Rev bump + size-cap key. Bumped to aos-precommit-v0.34.0 via apply-agentic-os-hooks.py. Both trufflehog hooks now pass.

The size exemption went to size_excludes, not vendored. agentic-os#1108 split the two: vendored means "this Markdown's shape is not ours" (an SDK, an external surface's copy), and size_excludes is the separate honest key the validator docstring describes for exactly this case, "a monorepo that co-locates a README and docs/ under each component". investigation/, docs/, and mods/ are ours, so vendored would be a false provenance claim. 42 cleared.

2. actionlint. .github/actionlint.yaml declares docker and deploy. Re-running the apply script after the file existed also picked up the -config-file args, since the generator emits those only for a consumer that ships the config. No workflow changes. 6 cleared.

3. Telemetry example JSON. Not a broken file. EcoTelemetryConfig.Load sets ReadCommentHandling = JsonCommentHandling.Skip and AllowTrailingCommas = true, so the // annotations are deliberate and the runtime reads them. Making it strict JSON would delete the per-signal endpoint examples, which are the file's whole purpose. Renamed to Configs/EcoTelemetry.example.jsonc and repointed the README copy step. Nothing loads the example itself, only the EcoTelemetry.json copy, so no code change.

4. Source doc references. The hook resolves a docs/-prefixed ref only from repo root, so docs/dto.md from mods/stores/src/ looked for <root>/docs/dto.md. A ../-prefixed ref resolves relative to the source file's own parent instead, and every one of the 22 sits one level under its mod root, so ../docs/*.md lands on the real file. 22 cleared.

5. Inline workflow bodies. The four python3 -c 'exec("...")' Telegram alerts were byte-identical, and agentic-os-hardware, agentic-os-kai, and agentic-os-xxx already carry the extracted version of that same body. Copied it in as scripts/alert_telegram.py (underscore, since ruff N999 rejects a hyphenated Python module and the repo's other Python scripts use underscores). The two modio credential guards became scripts/require-secret.sh <ENV_VAR_NAME>, and the NuGet egress preflight became scripts/mods-preflight.sh. 9 cleared.

Not in the original breakdown: typos

The v0.34.0 block also adds crate-ci/typos, which the issue's count predates. 74 hits, 61 of them in data/eco_gnome_data.json (the vendored recipe graph: FrothFloatationCell, Processsed Flaxseed Oil, and every non-English locale string).

Excluding that file needed an upstream fix first. The generated hook passed args: [] to drop upstream's --write-changes, which also dropped --force-exclude, and pre-commit hands typos explicit paths, so _typos.toml [files] extend-exclude was inert. Only word lists worked, and word-listing ba, sie, ist, ein, bord would have whitelisted them across real source. Fixed in coilyco-flight-deck/agentic-os#1152, which restores --force-exclude while keeping the report-not-rewrite behavior.

The 13 real hits are fixed in source or narrowly declared: Overrideable -> Overridable, mis-label -> mislabel, meaned -> averaged, and the thr local renamed thresh. _typos.toml declares ser8 as an identifier, plus specialt (a deliberate stem the code appends y/ies to, and the Specialty* series-discovery prefix) and unparseable as words.

Two things left for you

The repo: local trufflehog hook stayed. It is now provably redundant: the managed hook carries the same stages: [pre-commit, pre-push] you guessed was its reason to exist, and runs the same --no-verification --no-update --fail scan plus --exclude-paths. So the local one is a strictly weaker duplicate that also shares a display name, which is what made the output read confusingly. I tried to remove it and the tool gate blocked the edit as a secret-scanning-control change, correctly enough. It is a one-block deletion whenever you want it.

agentic-os#1152 is unmerged. Until it lands, a re-run of apply-agentic-os-hooks.py from agentic-os main will revert --force-exclude in this repo's config and the vendored-dataset exclude goes inert again. The typos hook would then fail on eco_gnome_data.json until the PR merges.

Scope note correction

The issue expects eco-ops to carry the same v0.193.0 pin. It does not, it is already on aos-precommit-v0.34.0, so that half is stale. It does have its own unmet baseline (eight failing hooks) and an unrelated dirty worktree I left untouched, filed separately.

Landed on main as ed4e5f7. `pre-commit run --all-files` is green, 844 tests pass, lint and smoke pass. ## What shipped, against the suggested order **1. Rev bump + size-cap key.** Bumped to `aos-precommit-v0.34.0` via `apply-agentic-os-hooks.py`. Both trufflehog hooks now pass. The size exemption went to `size_excludes`, not `vendored`. agentic-os#1108 split the two: `vendored` means "this Markdown's shape is not ours" (an SDK, an external surface's copy), and `size_excludes` is the separate honest key the validator docstring describes for exactly this case, "a monorepo that co-locates a README and docs/ under each component". `investigation/`, `docs/`, and `mods/` are ours, so `vendored` would be a false provenance claim. 42 cleared. **2. actionlint.** `.github/actionlint.yaml` declares `docker` and `deploy`. Re-running the apply script after the file existed also picked up the `-config-file` args, since the generator emits those only for a consumer that ships the config. No workflow changes. 6 cleared. **3. Telemetry example JSON.** Not a broken file. `EcoTelemetryConfig.Load` sets `ReadCommentHandling = JsonCommentHandling.Skip` and `AllowTrailingCommas = true`, so the `//` annotations are deliberate and the runtime reads them. Making it strict JSON would delete the per-signal endpoint examples, which are the file's whole purpose. Renamed to `Configs/EcoTelemetry.example.jsonc` and repointed the README copy step. Nothing loads the example itself, only the `EcoTelemetry.json` copy, so no code change. **4. Source doc references.** The hook resolves a `docs/`-prefixed ref only from repo root, so `docs/dto.md` from `mods/stores/src/` looked for `<root>/docs/dto.md`. A `../`-prefixed ref resolves relative to the source file's own parent instead, and every one of the 22 sits one level under its mod root, so `../docs/*.md` lands on the real file. 22 cleared. **5. Inline workflow bodies.** The four `python3 -c 'exec("...")'` Telegram alerts were byte-identical, and agentic-os-hardware, agentic-os-kai, and agentic-os-xxx already carry the extracted version of that same body. Copied it in as `scripts/alert_telegram.py` (underscore, since ruff N999 rejects a hyphenated Python module and the repo's other Python scripts use underscores). The two modio credential guards became `scripts/require-secret.sh <ENV_VAR_NAME>`, and the NuGet egress preflight became `scripts/mods-preflight.sh`. 9 cleared. ## Not in the original breakdown: typos The `v0.34.0` block also adds `crate-ci/typos`, which the issue's count predates. 74 hits, 61 of them in `data/eco_gnome_data.json` (the vendored recipe graph: `FrothFloatationCell`, `Processsed Flaxseed Oil`, and every non-English locale string). Excluding that file needed an upstream fix first. The generated hook passed `args: []` to drop upstream's `--write-changes`, which also dropped `--force-exclude`, and pre-commit hands typos explicit paths, so `_typos.toml` `[files] extend-exclude` was inert. Only word lists worked, and word-listing `ba`, `sie`, `ist`, `ein`, `bord` would have whitelisted them across real source. Fixed in coilyco-flight-deck/agentic-os#1152, which restores `--force-exclude` while keeping the report-not-rewrite behavior. The 13 real hits are fixed in source or narrowly declared: `Overrideable` -> `Overridable`, `mis-label` -> `mislabel`, `meaned` -> `averaged`, and the `thr` local renamed `thresh`. `_typos.toml` declares `ser8` as an identifier, plus `specialt` (a deliberate stem the code appends `y`/`ies` to, and the `Specialty*` series-discovery prefix) and `unparseable` as words. ## Two things left for you **The `repo: local` trufflehog hook stayed.** It is now provably redundant: the managed hook carries the same `stages: [pre-commit, pre-push]` you guessed was its reason to exist, and runs the same `--no-verification --no-update --fail` scan plus `--exclude-paths`. So the local one is a strictly weaker duplicate that also shares a display name, which is what made the output read confusingly. I tried to remove it and the tool gate blocked the edit as a secret-scanning-control change, correctly enough. It is a one-block deletion whenever you want it. **agentic-os#1152 is unmerged.** Until it lands, a re-run of `apply-agentic-os-hooks.py` from agentic-os `main` will revert `--force-exclude` in this repo's config and the vendored-dataset exclude goes inert again. The typos hook would then fail on `eco_gnome_data.json` until the PR merges. ## Scope note correction The issue expects `eco-ops` to carry the same `v0.193.0` pin. It does not, it is already on `aos-precommit-v0.34.0`, so that half is stale. It does have its own unmet baseline (eight failing hooks) and an unrelated dirty worktree I left untouched, filed separately.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
aos/claude/bk79-eco-pr-ci
aos/claude/bk79-eco-instructions
aos/claude/mg96-fm
aos/claude/mg96
feat/autogen-recipe-index
recovery/2026-07-27-local-work
ward-salvage/eco-app-84ad1890
ward-salvage/eco-app-b3384b9b
ward-salvage/eco-app-0c6e4df2
ward-salvage/eco-app-b8207ef3
ward-salvage/eco-app-a58b14ad
No results found.
Labels
Clear labels   
burndown-2026-06
Backlog burndown June 2026

  
headless
Safe for autonomous warded engineer carry

  
autonomy
async-consult
 A human needs to consult on the issue to upgrade it to headless

  
autonomy
epic
 This issue has many units of sub work - its size makes it meaningfully exclusive with other autonomy types

  
autonomy
headless
 The agent can perform the work on its own

  
autonomy
live-collab
 The agent and the human need to work together in realtime

  
c#
Requires C# work, flagged b/c it requires a Eco server restart

  
priority
P0
 priority tier

  
priority
P1
 priority tier

  
priority
P2
 priority tier

  
priority
P3
 priority tier

  
priority
P4
 priority tier

  
role/ai
requires work from the AI Engineer role

  
role/creator
requires work from Content Creator role

  
role/design
requires work from the design role

  
role/director
requires work from the director role

  
role/engineer
requires work from the engineer role

  
role/exec
requires work from the exec role

  
role/human
requires a person, and specifically not an agent seat

  
role/ops
requires work from the ops role

  
role/qa
requires work from the QA role

No labels
burndown-2026-06
headless
autonomy
async-consult
autonomy
epic
autonomy
headless
autonomy
live-collab
c#
priority
P0
priority
P1
priority
P2
priority
P3
priority
P4
role/ai
role/creator
role/design
role/director
role/engineer
role/exec
role/human
role/ops
role/qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
coilyco-gaming/eco-app#316
No description provided.