Sync with live vault: 28 new files, 7 imports, 16 updates

2026-09-01 13:33:50 -07:00
parent dac3008e20
commit 8b26efd3b7
43 changed files with 1557 additions and 166 deletions
@@ -0,0 +1,24 @@
+# Daily — 2026-08-29
+
+> Consolidated session → durable memory rundown.
+
+## Learned / Decided
+- **Telegram picker audit (2026-08-29)**: found an auth gap — the `/model` inline-keyboard
+  callback handler (`_handle_model_picker_callback`, telegram adapter.py ~6824) does **not** call
+  `_is_callback_user_authorized`, unlike the choice picker, approval buttons, slash-confirm, and
+  clarify. Any reachable user in a shared group can switch the session's model. Medium-severity
+  security inconsistency. Full write-up: `04_projects/hermes-telegram-picker/status.md`.
+- **Model switching permanence fixed**: default model set to OpenRouter DeepSeek `deepseek-v4-flash-0731`; fallback chain reordered; proactive compression at 8K. `/model` is session-scoped; use `hermes config set model.default` to persist.
+- **Cron model field pitfall**: do NOT put the provider prefix in a cron's `model` field — use bare model + separate `provider:` (OpenRouter returns "not a valid model ID" otherwise).
+- **Cron context size**: full default toolset ≈ 17K tokens of system prompt; overflowed freetoken's 8,448-token budget. Give cron jobs a minimal toolset.
+- **base64 corruption**: files seen as base64 text on disk were real corruption; verify files are plain markdown.
+- `hermes fallback add|remove` are interactive pickers; set `fallback_providers` via `config set`.
+
+## Projects
+- **hermes-local-pc-setup**: Vault RAG now live (ChromaDB + LM Studio :1234, 114 chunks / 23 files), `vault-consolidation` cron (daily 6am) created. Status updated.
+
+## New user-memory candidates
+- None this cycle (existing proposals unchanged).
+
+## RAG reindex
+- **OK** — 118 chunks from 24 files into ChromaDB (vault-knowledge).