Repository navigation
chore(agents): un-suspend mctl-agents-shepherd cron - #617
Merged
Merged
Conversation
Spend cap reset at 2026-07-24T03:00:00Z has held: dry-run + a real single-slug shepherd probe both completed Succeeded on the primary OAuth token with no fallback and no workflow_failed incident.
Member
Author
|
@claude review |
|
Claude finished @mashkovd's task in 40s —— View job PR Review: chore(agents): un-suspend mctl-agents-shepherd cronStatus: ✅ APPROVED (trivial config change) AnalysisThis PR makes two changes to
Classification: Trivial (config value + documentation update) Verification provided in PR body:
Correctness checks:
Verdict: No P1/P2 findings. Ready to merge. |
|
Claude finished @mashkovd's task in 37s —— View job PR Review: chore(agents): un-suspend mctl-agents-shepherd cronStatus: ✅ Approved Changes Reviewed
Review Findings
Verdict: Trivial config-only change per CLAUDE.md conventions. Safe to merge. --- | Branch |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
mashkovd
added a commit
that referenced
this pull request
Sep 12, 2026
… Slice 1 Turns on MCP_HEADER_PROBE for the Phase 3 correlation measurement (mctlhq/mctl-telegram#617 Slice 1, mctlhq/.github#35). The probe logs one sanitized line per request to MCP_PATH -- the complete set of arriving header names plus sanitized values -- so the measurement can state which request identifiers actually reach the tg.mctl.ai ingress from the Cloudflare Portal, and whether they are stable across calls. Phase 2 established that Gateway supplies no tool-level evidence, so this has to be measured mctl-side rather than assumed from Cf-Ray. Secrets collapse to [redacted len=N fp=hmac], client addresses are masked per hop, and the request body is never read. Requires 0.65.0; earlier images ignore the key. The fingerprint key is per process, so fingerprints compare only within one pod. replicaCount is 1 and the strategy is Recreate, so the window already lands on a single process -- the comment says not to scale up while the flag is true. This key is removed again in the same pass that deletes the middleware, once the header table is posted on #617. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01986LBvdeTxnByHZtuzGAeK
mashkovd
added a commit
that referenced
this pull request
Sep 12, 2026
… Slice 1 Turns on MCP_HEADER_PROBE for the Phase 3 correlation measurement (mctlhq/mctl-telegram#617 Slice 1, mctlhq/.github#35). The probe logs one sanitized line per request to MCP_PATH -- the complete set of arriving header names plus sanitized values -- so the measurement can state which request identifiers actually reach the tg.mctl.ai ingress from the Cloudflare Portal, and whether they are stable across calls. Phase 2 established that Gateway supplies no tool-level evidence, so this is measured mctl-side rather than assumed from Cf-Ray. Secrets collapse to [redacted len=N fp=hmac], client addresses are masked per hop, and the request body is never read. Requires 0.65.0; earlier images ignore the key. The fingerprint key is per process, so fingerprints compare only within one pod. replicaCount is 1 and the strategy is Recreate, so the window already lands on a single process -- the comment says not to scale up while the flag is true. This key is removed again in the same pass that deletes the middleware, once the header table is posted on #617. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01986LBvdeTxnByHZtuzGAeK
mashkovd
added a commit
that referenced
this pull request
Sep 12, 2026
…probe feat(mctl-telegram): enable the temporary inbound-header probe for #617 Slice 1
mashkovd
added a commit
that referenced
this pull request
Sep 18, 2026
mashkovd
added a commit
that referenced
this pull request
Sep 18, 2026
mashkovd
added a commit
that referenced
this pull request
Sep 18, 2026
mashkovd
added a commit
that referenced
this pull request
Sep 18, 2026
fix(proposal): align #617 with shipped correlation baseline
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
suspend: true→falseon themctl-agents-shepherdCronWorkflow.Why
mctl-gitops#611suspendedimplement/incidents/issue-poll/shepherdon 2026-07-20 after the org-wide Claude spend cap escalated to a 7-day rate-limit window, resetting 2026-07-24T03:00:00Z. This PR re-enablesshepherdonly, per operator request, after confirming the reset held.Verification
Two manual
mctl_trigger_shepherdprobes today (2026-07-25):mctl-gitops/incident-17841222— completed Succeeded on the primary OAuth token,shepherd-fallbackstep Skipped (never needed), noworkflow_failedincident raised.No RateLimitEvent/429 observed in either run.
implement/incidents/issue-pollremain suspended — out of scope for this PR.