6 Commits

Author SHA1 Message Date
myron 7f6397b514 perf: route Guardian and Vision text analysis to Groq instead of Claude
Guardian anomaly alerts and SITREP are pure text reasoning — Groq's
llama-3.3-70b-versatile handles them at near-zero cost with lower
latency. Vision Protocol image analysis stays on Claude (claude-opus-
4-8) because Groq has no vision models. Text-only sysinfo snapshots
(no image captured) also move to Groq.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-17 17:06:15 +00:00
myron 6b906da406 deploy: auto-sync reactor.py to /opt/jarvis-arc on deploy
When deploy/reactor.py changes in a push, the deploy runner now copies it
to the runtime location and restarts jarvis-arc.service automatically.
Eliminates the two-copy drift problem — repo is now canonical.
2026-06-11 21:35:24 +00:00
myron 6abff8dd56 Add reactor.py to deploy/ + gitignore WireGuard .conf files in public_html
Arc Reactor was running from /opt/jarvis-arc with no version tracking.
Added to deploy/ so all fixes (metrics_json→metric_data, flat JSON parsing,
disk mount key fix) are captured. WG configs are runtime-generated secrets
and must not be committed.
2026-06-11 20:47:23 +00:00
myron ecbc2e09a5 Fix 8 code-review findings: security + reliability
1. agent.py: shell allow-check reads cfg, not server payload (RCE fix)
2. webhook.php: move WEBHOOK_SECRET to gitignored config.php; rotate secret
3. agent.py: replace recursive main() with while loop (RecursionError fix)
4. jarvis-deploy.sh: push force-revert to GitHub on syntax fail (loop fix)
5. agent.py: self_update() verifies SHA-256 before exec (integrity fix)
6. agent.php: remove JARVIS_IP from browser-action bypass (auth fix)
7. jarvis-watchdog.sh: escape SQL vars in alert() to prevent injection
8. jarvis-deploy.sh: atomic mv instead of cat+truncate (TOCTOU fix)

Also: distribute jarvis-agent.py.sha256 alongside agent for integrity checks
2026-05-25 14:27:27 +00:00
myron 45fef11785 Autonomous systems: watchdog, smart deploy, site health, auto-heal, agent installer
- deploy/jarvis-watchdog.sh: self-healing watchdog (every 5 min)
  * monitors lsws/mysql/redis, restarts on failure
  * JARVIS HTTP self-check, restarts OLS on 5xx
  * disk/memory alerts inserted to DB
  * offline Proxmox VM agents restarted via qm guest exec
  * log rotation (1000 line cap)
- deploy/jarvis-deploy.sh: smart deploy with PHP validation
  * php8.3 syntax check on every changed .php file
  * auto-reverts git commit + inserts critical alert on syntax error
  * reloads OLS after JARVIS deploys
- api/endpoints/facts_collector.php: site health monitoring
  * curls all 7 managed sites every 3 min
  * stores up/down status in kb_facts
- api/endpoints/alerts.php: auto-heal + site alerts
  * dispatches restart_service commands when services down on agents
  * generates alerts from kb_facts site health data
- public_html/install-agent.sh: one-liner Linux agent installer
  * installs deps, downloads agent, registers with JARVIS, sets up systemd
- public_html/webhook.php: fixed infra deploy path to /opt/infra
2026-05-25 14:08:07 +00:00
myron d3156b98b3 Add DB schema, agent script, vhost config, deploy cron
- db/schema.sql: full jarvis_db schema (15 tables)
- agent/jarvis-agent.py: production agent script
- config/vhost/: OpenLiteSpeed vhost configuration
- deploy/jarvis-agent.service: systemd unit
- deploy/cron-jarvis.txt: JARVIS cron entries
- .gitignore: exclude system dirs and logs
2026-05-25 13:51:12 +00:00