kyle/sift

T

kyle 7be4ed1d43 p2.5: redact reason/err for permit_restricted logs

Guard messages embed the hostname (resolve <host>, no addresses for
<host>). Restricted callers now log a coarse reason class and err=-.
Test dumps slog records and forbids the hostname anywhere in them.

docs: P3 review — fail-closed search, cache class, public dialer

2026-09-23 11:47:37 -07:00

cmd/sift

p2.5: log host=- for permit_restricted callers

2026-09-23 11:40:45 -07:00

dist

p2.4: restricted workspace for permitted callers

2026-09-23 08:33:58 -07:00

docs

p2.5: redact reason/err for permit_restricted logs

2026-09-23 11:47:37 -07:00

internal

p2.5: redact reason/err for permit_restricted logs

2026-09-23 11:47:37 -07:00

nix

p1.1: dynamic self-IP deny (DDNS/trace, keep previous, atomic swap)

2026-09-22 22:59:08 -07:00

skill

docs: skill matches shipped P2 (no search, recover, fallback cap)

2026-09-23 06:00:50 -07:00

tests/contract

p1: cap jq output, log refusals, fail contract without SDK

2026-09-22 22:02:38 -07:00

vendor

p2: digest with in-sift FIFO, SQLite caches, Honcho context, recover

2026-09-22 23:54:49 -07:00

.gitignore

p0: skeleton, dialer-Control URL guard, flake, Makefile

2026-09-22 21:26:13 -07:00

flake.lock

p0: skeleton, dialer-Control URL guard, flake, Makefile

2026-09-22 21:26:13 -07:00

flake.nix

p1: vendorHash = null when vendor/ is committed

2026-09-22 22:27:24 -07:00

go.mod

p2: digest with in-sift FIFO, SQLite caches, Honcho context, recover

2026-09-22 23:54:49 -07:00

go.sum

p2: digest with in-sift FIFO, SQLite caches, Honcho context, recover

2026-09-22 23:54:49 -07:00

Makefile

p1: cap jq output, log refusals, fail contract without SDK

2026-09-22 22:02:38 -07:00

README.md

p1: /v2/scrape, /v1/fetch, auth, CLI, contract tests

2026-09-22 21:54:01 -07:00

README.md

sift

LLM-oriented fetch and search for the Hermes fleet: fetch a resource and get it back cleaned, compact, and with useful context attached — using local models (Dixie), SearXNG and Brave on orion, and Honcho for retrieval.

Status: P1 clean fetch (/v2/scrape, /v1/fetch, CLI, auth). See docs/PLAN.md and docs/P1.md.

Build

Makefile is the source of truth for flags (CGO_ENABLED=0, -trimpath, -s -w -X main.version=).

make build          # bin/sift
make test           # go test -race ./...
make lint           # go vet, and staticcheck if installed
make install        # PREFIX=/usr/local; example config in /etc/sift/
nix build           # packages.sift, same ldflags
nix flake check     # make test lint

The service does not assume Nix store paths. Non-Nix hosts: make install plus dist/sift.service.