claude-projects/claude-config/config/prompts/infra/JH-1_jenkins_hermes_state_audit.md

JH-1 — Jenkins + Hermes state audit (personal_projects #181, #208, GAMEPLAN §3) — READ-ONLY

Written 2026-09-27 (infrastructure general questions conversation). Run AFTER the owner has restarted jenkins and hermes on server-01 (their published ports + hermes DNS were dead since the 09-17 boot — see BOOT-1). If curl -s -o /dev/null -w '%{http_code}' http://192.168.1.90:8090/login is still 000 when you start, continue anyway using docker exec (it does not need the ports) and note it. Safe to run in parallel with W2, OLLAMA-1, S1, AS0, BOOT-1.

---

You are a bounded, READ-ONLY audit agent for the Jenkins (deploy) + Hermes (monitor) layer on server-01. Budget: --max-turns 30. If you issue the same tool call twice with identical arguments, STOP and output the wrap-up block with status=partially_succeeded.

HARD RULES

• READ-ONLY. No container restart/stop/start, no Jenkins build triggers, no job/config edits, no Hermes messages/commands sent, no sudo, no Vault, no git add/commit/push, no Postgres writes.
• All server-01 access = ssh -o BatchMode=yes administrator@192.168.1.90 '<cmd>' (administrator is in the docker group there). server-01 is SHARED (n8n-prod, sandboxes) — touch only jenkins + hermes.
• Never print secrets. Jenkins credentials.xml/secrets/: list credential IDs + types ONLY (grep <id> and the class name), never <secret>/<password>/<privateKey> bodies. Hermes config: print keys/section names and non-secret values only; for anything named key/token/secret/password print <set>/<unset>. NEVER docker inspect … .Config.Env and never run env/printenv in a container.
• If a hook blocks something, stop with a partial wrap-up.

FACTS (main session, verified 2026-09-27)

• jenkins: image gitea.local/backtalk6858/jenkins:latest, ports 192.168.1.90:8090→8080 and :50000, compose /opt/appdata/docker/docker-compose/jenkins/ on server-01 (Dockerfile, plugins.txt, start.sh, vault-approle/, jenkins-home/). 36 job folders; only 4 have ever built: jellyfin (5), secrets-proxy (8), sudo-bridge (12), sudo-bridge-server01 (2). Row #181: "provisioned but idle, and the record says otherwise". Coolify is retired; the intended deploy path is Jenkins. READ these role definitions first (they are the yardstick for the gap analysis): /home/administrator/.claude/projects/-home-administrator-Desktop-claude/memory/project_jenkins_hermes_boundary.md (LOCKED 2026-06-25: Jenkins = ALL deploys — builds images, injects Vault secrets at deploy time, docker compose up, rollbacks; Hermes = ALL monitoring — health watch, NTFY/Telegram alerts, auto-restart on health failure after announcing, escalate; Hermes never redeploys itself, it TRIGGERS the Jenkins pipeline), .../-home-administrator-Desktop-claude/memory/project_cicd_jenkins.md (pipeline patterns: services bound for primary = build → push → sandbox deploy on server-01 → smoke test → promote to primary via secrets-proxy /shell target=production; server-01-only services use Jenkinsfile.server01), .../-home-administrator-Desktop-claude/memory/project_hermes_exploration_day.md, .../-home-administrator-Desktop-claude/memory/feedback_hermes_telegram_api.md (task injection = POST to the Hermes gateway API :8642, never Telegram sendMessage), .../-home-administrator-Desktop-claude/memory/feedback_evaluate_jenkins_hermes_fit.md, and in /home/administrator/.claude/projects/-opt-appdata-docker/memory/: jenkins_deployment_transition.md, project_virtual_it_department.md (end goal = unattended self-healing; Phase 2 = sandbox-verify-before-apply).
• hermes: image nousresearch/hermes-agent:latest (unpinned), ports 192.168.1.90:8642 and :9119, network hermes_default; logs show the Telegram gateway failing DNS for days (empty resolv.conf). Its compose on primary is /opt/appdata/docker/docker-compose/hermes/docker-compose.yml (703 B, June) — find the one server-01 actually runs from via the container label com.docker.compose.project.working_dir. Owner rule: the always-on agent is Hermes, never OpenClaw.
• A second Ollama consolidation is in flight (OLLAMA-1): the single Ollama will be server-01 ollama (0.0.0.0:11434, GPU).

TASKS

1. Jenkins inventory: for each of the 36 jobs: type (pipeline/freestyle), SCM URL + branch + scriptPath, whether the Gitea repo + Jenkinsfile exist (list repos via the Gitea API only if anonymous read works; otherwise UNVERIFIED), last build result/date, what it deploys to and HOW (docker socket mount? SSH to primary? agent on primary?). Nodes/agents configured. Credential IDs + types. Plugin count + any failed plugin loads in the log. Whether Jenkins can reach primary's Docker at all today.
2. Hermes inventory: version/tag + digest; the model/provider backend it is configured for (does it use Ollama? which host/model?); enabled gateways (Telegram etc.) and their state; scheduled jobs/crons/skills it has; tools/permissions (docker.sock? SSH keys? network reach to primary?); memory/data dir size; whether anything in it already monitors the control plane (GAMEPLAN says Hermes = level-1 monitor reading /var/log/control-plane-up.jsonl + command_audit).
3. Gap analysis vs the plan — include each roadmap item from the boundary memory as its own row: bitwarden-bridge pipeline; a pipeline for every Coolify-debt container; the Hermes skill that triggers a Jenkins redeploy on persistent health failure; Hermes dashboard route (:9119) + Telegram verified; the automation_ideas background re-evaluation that fires once BOTH are confirmed live. Also check: does any pipeline still promote via secrets-proxy /shell (stopped since 07-09 → that promote path is dead) or via sudo-bridge (being retired)? Plus: GAMEPLAN §3 (Jenkins = the only write path from the future claude-runner VM; Hermes = level-1 monitor, CA-P5 ladder, D10 watchdog) and rows #181, #208, #235 (skill: deploy — Jenkins first). What exists vs what's missing, as a table.
4. Proposed build order for Jenkins + Hermes as bounded agent phases (each ≤ 1 session, name the owner steps between them), sized so 4–5 agents can run in parallel on other projects without conflicting (state which phases touch server-01 shared state and must run alone).

DELIVERABLE: report /opt/appdata/docker/research/jenkins_hermes_state_2026-09-28.md: Verdict (5 lines) → Jenkins table → Hermes table → gap table → proposed phases → UNVERIFIED list → "facts in memory that are now wrong" (file + line + correct fact).

SCOPE ALLOWLIST: the report; /opt/appdata/docker/docker-compose/jenkins/.claude/context.md and /opt/appdata/docker/docker-compose/hermes/.claude/context.md on PRIMARY (create from template if missing). Nothing else.

PERSIST BEFORE YOU FINISH

• For each of the two context.md files: create from /home/administrator/.claude/projects/-opt-appdata-docker/memory/playbook_project_context_template.md if missing, append "## JH-1 audit — 2026-09-28 (background agent)" (What was done / Current state / Next step).
• Run: python3 /opt/appdata/docker/.claude/scripts/embed_memory_dir.py --only-recent 5
• FINAL message = wrap-up JSON only, always: {"status":"succeeded|partially_succeeded|failed","project":"jenkins #181 + hermes","phase":"JH-1","actions_taken":[],"actions_failed":[],"files_touched":[],"containers_restarted":[],"jenkins":{"jobs":36,"jobs_ever_built":0,"jobs_with_valid_scm":0,"deploy_mechanism":"","reachable_8090":true},"hermes":{"image_digest":"","llm_backend":"","gateways":[],"scheduled_jobs":0,"monitors_control_plane":false},"stale_memory_facts":[],"unverified_claims":[],"next_step":"","notes":""}