Skip to content

Making Of

A living journal of how this repo's place in the house AI stack came to be. Odysseus itself has its own long history (see git log, CONTRIBUTING.md, ROADMAP.md) - this journal only covers the house-pipeline integration work, starting with this audit.

Chapter 1 - House pipeline re-audit (2026-07-08)

Odysseus was already a mature, actively developed, security-conscious open-source project (public repo, dev/main branch split, its own SECURITY.md, THREAT_MODEL.md, docs/security-ci.md, and eight GitHub Actions workflows covering syntax, secret scanning via gitleaks, workflow security via actionlint+zizmor, container scanning via hadolint+Trivy, and dependency review) before this audit touched it. This was not a build-from- scratch pass - it was a gap-fix audit against the house tool-pipeline's standard checklist.

What the audit found and did:

  • Secret pre-scan (24 flagged hits). Ran the house pipeline's hard-gate regex (council_...|Bearer ...|AKIA...|sk-...|gh[pousr]_...|xox...|BEGIN PRIVATE KEY) - zero matches. A broader heuristic scan (any key/secret/password/token = "literal" assignment) surfaced ~40 matches, all inside tests/ as short, clearly-fake fixture values ("sk-secret", "fake-key", "old-password", one deliberately-named "GREPSECRET_TOKEN_ZZZ" canary) used to exercise auth/owner-scope/masking logic, or inside src/integrations.py as the variable name api_key/dict key, never a literal secret value. .env (present on disk, gitignored, not tracked by git) contains only local Ollama host/port config, no credentials. No real secret was found. Full classification table is in the audit report.
  • Codex security review. Run via codex exec against the repo root, focused additionally on src/integrations.py and the test fixture shapes. See the audit report for the verdict.
  • Docs-set gap-fill. Added the house pipeline's required doc set that didn't already exist under different names: root TESTING.md (pointing at the existing, more detailed tests/README.md and tests/TESTING_STANDARD.md), docs/technical/ARCHITECTURE.md (component + sequence Mermaid diagrams), docs/plain/README.md, this file, and docs/BOARD.md. Existing SECURITY.md/THREAT_MODEL.md/ docs/security-ci.md were left as the canonical security docs rather than duplicated.
  • Test state. Installed requirements.txt fresh and ran pytest -q --cov=. --cov-report=term-missing --cov-report=xml locally on Windows/Python 3.13: 115 failed, 4353 passed, 20 skipped, 21 errors, 65% total coverage in 12m52s. The failures are dominated by Windows-environment issues (70 of 115 are *_js.py Node-harness tests all dying on ERR_UNSUPPORTED_ESM_URL_SCHEME; all 21 errors are Windows path/FileNotFoundError issues) - consistent with python-tests in CI being continue-on-error and the ROADMAP's "fresh install smoke tests" item. Full breakdown in TESTING.md.
  • CI state. The existing CI already exceeded the house pipeline's minimum template in most respects (pinned+checksummed gitleaks/actionlint/zizmor binaries vs. the template's mutable-tag concerns), and - discovered only by reading docs/security-ci.md, since it isn't a checked-in workflow file - GitHub's default CodeQL setup already runs as an advisory SAST scan over the app's own code. The house pipeline's brief still names semgrep-docker as a required component specifically because it's Docker-reproducible by any contributor without GitHub's infrastructure, so it was added alongside CodeQL rather than instead of it, plus a churn/flake-detection job (which directly surfaces the flakiness python-tests already discloses). Added .github/workflows/semgrep.yml (Docker-based semgrep scan --config auto --error) and .github/workflows/churn.yml (fast-lane pytest x5, fail on disagreement, with a timeout-minutes and per-test --timeout safety net since no test is marked slow yet, so today's "fast lane" is the full suite). Both kept on ubuntu-latest to match this repo's existing convention rather than the house template's [self-hosted, home-ci, windows] labels, since this repo has no self-hosted runner registered against its org.
  • Remote/org note. origin is https://github.com/pewdiepie-archdaemon/ odysseus, not under andrewjonesdev. Flagged for the pending org migration pass rather than moved as part of this audit.