wiki: sync 2026-08-26 03:05 UTC — 10 file(s) updated

brain.md

@@ -1,18 +1,18 @@
 # 🧠 Knowledge Wiki — Brain Summary
 
-_Last updated: 2026-08-20 03:06 UTC_
+_Last updated: 2026-08-26 03:03 UTC_
 
 ## Workstreams & Status
 
 | # | Workstream | Open Items | Priority |
 |---|-----------|-----------|----------|
-| 🔵 | VSSA — DPVP | 21 active, 1 opportunity, 1 waiting | Apptio AWS connection, Phase 2 opportunity, access governance/monitoring, Jira-targeted role grants/revocations, project-level backups, Architecture Decision process |
+| 🔵 | VSSA — DPVP | 19 active, 1 opportunity | Phase 2 opportunity, AWS tagging, Azure-cost onboarding documentation, access governance/monitoring, Jira-targeted role grants/revocations, project-level backups, Architecture Decision process |
 | 🟡 | VSSA — Enterprise Architect | 4 active | Scope decision, Gytis outreach, Atea & IBM institution engagement, Government Developer Portal |
-| 🟢 | Cognitive Architect | 7 active (1 ASAP) | IBMid cert update; Oleg follow-up; ArchiMate investigation; Texture/Jenny integration follow-up; cogarch backlog |
+| 🟢 | Cognitive Architect | 8 active (1 ASAP) | IBMid cert update; Oleg follow-up; Aurimas Nogis/Hermes security follow-up; ArchiMate investigation; Texture/Jenny integration follow-up; cogarch backlog |
 | 🟣 | SAP Delivery Powered By AI | 1 active | Michael Martine material review |
 | 🏅 | Distinguished Engineer | 3 active | Elizabeth docs + summary; FutureNow/Baltic AI/client-relations upskilling with Jurgis |
 
-**Total open:** 38 items | **Completed:** 5 (env vars deployed; CA-01, CA-03, CA-04, and CA-B01 completed)
+**Total open:** 36 items | **Completed:** 7 (env vars deployed; Apptio AWS-connection investigation and Azure-cost onboarding completed; CA-01, CA-03, CA-04, and CA-B01 completed)
 
 ## Atea Cooperation
 
@@ -20,7 +20,7 @@ _Last updated: 2026-08-20 03:06 UTC_
 - Current tracked workstreams: VSSA AWS contract; VSSA DPVP contract and Phase 2 opportunity; Valstybės duomenų agentūra AWS portal audit; Lietuvos Geležinkeliai RFP; and two early Atea & IBM items (the user-provided title “Let's go to institutions” and a Government Developer Portal). Details for the two Atea & IBM items are not yet specified.
 - DPVP Phase 2 discussion scope covers the portal, backend execution migration, VSSA on-premises onboarding, complex hybrid services, and organization scanning across AWS, Azure, and GCP. Ownership, prioritisation, estimates, dependencies, dates, scan baselines, and commercial route remain unconfirmed.
 - VSSA AWS: an AWS Well-Architected Framework review has been proposed, not approved; workload/account scope, authorization, access, schedule, and remediation ownership remain open.
-- DPVP follow-up: check with Atea about role assumption for the TFE OIDC setup; the intended role/account and implementation details are not yet recorded.
+- DPVP backlog changes confirmed 2026-08-25: the Apptio AWS-connection investigation and Azure-cost onboarding are completed; the follow-up with Atea about TFE OIDC role assumption and July cost-estimation review were dropped. Open refinements include figuring out AWS tagging issues, documenting the Azure-cost onboarding approach, and having Julius locate documentation for the nightly AWS cost-allocation-tag enablement job.
 - The portal audit is an opportunity only; active testing requires explicit written authorization and agreed scope.
 - A consolidated executive summary was requested on 2026-07-29 and is maintained in `wiki/channels/1531661088209371198.md`.
 
@@ -64,6 +64,7 @@ _Last updated: 2026-08-20 03:06 UTC_
 - **Gitea recovery (confirmed 2026-08-11):** Gitea `1.27.0` crashed all SSH/Smart-HTTP Git-serving processes despite healthy web/API; upgrade to `1.27.1` restored API and both Git transports. The queued VSSA commit `6fc42ab` was pushed and remotely verified.
 - **Gitea Pages pattern (verified 2026-08-11):** Actions runners build repositories and publish to `/gondor-v1-gitea-pages/<organization>/<repository>/`, exposed at `https://pages.apps.lego-cloud.eu/<organization>/<repository>/`. The Pages dataset must be allowed by `container.valid_volumes` and mounted into job containers. `skic-v1-playground/documentation` run 2326 and the live site were verified.
 - **Actions Docker (verified 2026-08-11):** use the runner-mounted `/var/run/docker.sock` directly (client `29.6.2-1`, Engine `29.0.4`). DinD is unnecessary and privileged DinD is not currently supported by this runner.
+- **CogArch GitHub attribution (required 2026-08-25):** `cogarch-github` commits/PRs must disclose that Hermes acted using Oleg Lukasonok's PAT without implying Oleg performed or approved the action. When evidence permits, also name the Discord user who guided/originated the work; never invent uncertain attribution.
 - **Gondor v1 (2026-08-02):** Hermes SSH access as `lego` is verified to Osgiliath 000 and both Minas Tirith workers; use the `gondor-v1-nodes` skill. Open ingress incident: Argo CD's hostPort 80/443 `ingress-nginx` conflicts with Osgiliath's system Nginx; repair through `home-v1/gondor-v1.git`, not a transient live patch.
 - **Hermes outage (2026-08-04–11):** confirmed Codex quota exhaustion first blocked model responses while Discord/cron remained alive; a separate likely host/container-runtime failure then stopped all gateway, scheduler, log, and health progress after 2026-08-04 14:00:42 UTC. Physical restart at 2026-08-11 00:11:40 restored service without Hermes repair. Exact host-level trigger remains **UNKNOWN** because previous-boot TrueNAS/kernel/ZFS/runtime/hardware telemetry is unavailable inside the container.
 - **world-v1/network-v1:** ✅ global Internet address book; IP-level mapping now separates registry holder, route origin, operator, and service. Initial records: `0.0.0.0` and `1.1.1.1`; wiki page at `wiki/infrastructure/network-v1.md`