D4 (R7): prohibido compilar/instalar/probar en /srv — copias en /tmp o workspace del runner

deploy/usr-local-bin/cayce-autodeploy

@@ -7,16 +7,6 @@
 # Timer: cada 3 min. Fallo → DM al supervisor + logger. Nunca toca un tree sucio.
 
 say() { echo "[autodeploy] $*"; logger -t cayce-autodeploy "$*"; }
-# r33: un rollback repetido avisa UNA vez por incidente (subject = repo:causa);
-# el journal sigue completo (say por ciclo). Un deploy exitoso limpia el subject.
-dm_once() { # $1 subject, $2 mensaje
-  local flag="/var/lib/cayce/autodeploy-alerts/$1"
-  if [ -e "$flag" ]; then say "DM suprimido (incidente ya avisado): $1"; return 0; fi
-  mkdir -p /var/lib/cayce/autodeploy-alerts 2>/dev/null || true
-  touch "$flag" 2>/dev/null || true
-  dm "$2"
-}
-dm_clear() { rm -f "/var/lib/cayce/autodeploy-alerts/$1" 2>/dev/null || true; }
 dm() {
   SUP=$(grep -aoE 'SUPERVISOR_NPUB_HEX=[0-9a-f]+' /srv/cayce-nostr/.env 2>/dev/null | cut -d= -f2)
   [ -n "$SUP" ] && curl -s -X POST http://127.0.0.1:3011/dm -H "Content-Type: application/json" \
@@ -109,10 +99,6 @@ say "entity → $(git rev-parse --short HEAD) (tests $PASS/27, watcher OK, live)
   # r21: sin DM (no urgente) — dm "entity desplegado: $(git rev-parse --short HEAD) — tests $PASS/27, watcher OK"
 fi   # fin sección entity
 
-# r32: la seccion hardcap corre en SUBSHELL — un ROLLBACK (exit 1) ya no
-# aborta los deploys de bitcoinhotels (bug: rollback de hardcap llevaba
-# bloqueando bh desde las 15:10 mientras gh#10 espera merge)
-(
 # ── 2b. hardcap-news → /srv/hardcap-news (GitHub; web, sin PUBLISH_OFF) ─────
 cd /srv/hardcap-news || { say "FATAL: sin /srv/hardcap-news"; exit 1; }
 git fetch -q origin 2>/dev/null
@@ -126,7 +112,7 @@ if ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null && [ -z "$(git st
   fi
   if ! (cd frontend && npm run build >/tmp/hc-autodeploy-build.log 2>&1); then
     git reset -q --hard "$OLD"; (cd frontend && npm run build >/dev/null 2>&1); sudo -n systemctl restart hardcap-frontend.service
-    say "ROLLBACK hardcap-news: fallo el build"; dm_once "hardcap:rollback-build" "ROLLBACK hardcap-news (build) — main NO desplegado, rollback activo (aviso unico)"
+    say "ROLLBACK hardcap-news: fallo el build"; dm "ROLLBACK hardcap-news (build) — main NO desplegado, rollback activo"
     exit 1
   fi
   sudo -n systemctl restart hardcap-frontend.service
@@ -134,29 +120,23 @@ if ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null && [ -z "$(git st
   CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:3003/)
   if [ "$CODE" != "200" ]; then
     git reset -q --hard "$OLD"; (cd frontend && npm run build >/dev/null 2>&1); sudo -n systemctl restart hardcap-frontend.service
-    say "ROLLBACK hardcap-news: verificacion (code=$CODE)"; dm_once "hardcap:rollback-code" "ROLLBACK hardcap-news verificacion: code=$CODE — rollback activo (aviso unico)"
+    say "ROLLBACK hardcap-news: verificacion (code=$CODE)"; dm "ROLLBACK hardcap-news verificacion: code=$CODE — rollback activo"
     exit 1
   fi
   # r24: identidad por build-id (cuando el despliegue trae la función)
-  # r33: la identidad de hardcap solo se exige si ESTE main renderiza la meta
+  if git grep -q "NEXT_PUBLIC_BUILD_ID" -- frontend/src/app/layout.tsx frontend/next.config.js 2>/dev/null; then
-  # build-id (gh#10 la anade al layout). Mientras no exista, no exigir identidad
-  # (loop del 2026-11-03: 34 rollbacks grep-eando un build-id que main no servia).
-  if git grep -q "name=.build-id." -- frontend/src/app/layout.tsx 2>/dev/null; then
     BUILT=$(curl -s -m 8 http://127.0.0.1:3003/ | grep -oE 'name="build-id" content="[a-f0-9]{8}"' | grep -oE '[a-f0-9]{8}' | head -1)
     WANT=$(git rev-parse --short=8 HEAD)
     if [ "$BUILT" != "$WANT" ]; then
       git reset -q --hard "$OLD"; (cd frontend && npm run build >/dev/null 2>&1); sudo -n systemctl restart hardcap-frontend.service
-      say "ROLLBACK hardcap-news: build-id '$BUILT' != '$WANT'"; dm_once "hardcap:build-id" "ROLLBACK hardcap-news: servia build '$BUILT' pero lo desplegado era '$WANT'. Hasta mergear gh#10 (meta build-id) el check de identidad no se exige; aviso unico."
+      say "ROLLBACK hardcap-news: build-id '$BUILT' != '$WANT'"; dm "ROLLBACK hardcap-news: servia build '$BUILT' pero lo desplegado era '$WANT'."
       exit 1
     fi
-    dm_clear "hardcap:build-id"; dm_clear "hardcap:rollback-build"; dm_clear "hardcap:rollback-code"
     say "identidad hardcap OK: servido=$BUILT desplegado=$WANT"
   fi
-  dm_clear "hardcap:build-id"; dm_clear "hardcap:rollback-build"; dm_clear "hardcap:rollback-code"
   say "hardcap-news → $(git rev-parse --short HEAD) (200)"
 fi
 
-)
 # ── 3. bitcoinhotels → /srv/bitcoinhotels (web; sin PUBLISH_OFF) ────────────
 cd /srv/bitcoinhotels || { say "FATAL: sin /srv/bitcoinhotels"; exit 1; }
 git fetch -q origin 2>/dev/null

deploy/usr-local-bin/cayce-daily-report

@@ -1,226 +0,0 @@
-#!/bin/bash
-# cayce-daily-report (r20) — DM diario al supervisor:
-#   1) publicado por canal con enlaces  2) rechazos del guard y por qué
-#   3) PRs auto-mergeados + deploys      4) métricas Umami (ambos sitios)
-#   5) costo estimado de Gemini del día
-set -uo pipefail
-OUT=$(mktemp)
-PSQL="sudo -n -u postgres psql -d cayce -tA -f-"
-DAY=$(date -u +%F)
-
-{
-echo "CAYCE — reporte diario $DAY (UTC)"
-
-echo ""
-echo "== 1. Publicado (24h) =="
-$PSQL <<'EOF'
-SELECT 'nostr/' || type || ' — ' || left(regexp_replace(content, E'[\\n\\r]+', ' ', 'g'), 80)
-  || ' — ev:' || coalesce(meta->>'event_id', '(sin id)')
-FROM outbound_drafts
-WHERE status='published' AND channel='nostr'
-  AND type NOT IN ('profile','contact_list','inbox_relays','deletion')
-  AND ts > now() - interval '24 hours'
-ORDER BY ts DESC LIMIT 6;
-SELECT 'hardcap/' || type || ' — ' || left(regexp_replace(content, E'[\\n\\r]+', ' ', 'g'), 80)
-FROM outbound_drafts
-WHERE status='published' AND channel='hardcap' AND ts > now() - interval '24 hours'
-ORDER BY ts DESC LIMIT 4;
-EOF
-sudo -n -u postgres psql -d cayce -tA -f- <<'EOF'
-SELECT platform || ' — ' || theme || ' — ' || coalesce(post_url, '(sin url)')
-FROM posts_log WHERE ts > now() - interval '24 hours' AND status='ok' ORDER BY ts DESC LIMIT 6;
-EOF
-
-echo ""
-echo "== 2. Guard: rechazos (24h) =="
-sudo -n -u postgres psql -d cayce -tA -f- <<'EOF'
-SELECT count(*) || 'x  ' || left(reasons, 100) FROM guard_rejections
-WHERE ts > now() - interval '24 hours'
-GROUP BY reasons ORDER BY count(*) DESC LIMIT 6;
-EOF
-
-echo ""
-echo "== 2b. DMs urgentes (politica r33) =="
-NDM=$(journalctl -u cayce-nostr --since "-24 hours" --no-pager 2>/dev/null | grep -c "\[dm\] envio a")
-UCOUNT=$(python3 -c "import json; print(json.load(open('/srv/cayce-core/.dm-urgent-count.json')).get('$(date -u +%F)', 0))" 2>/dev/null || echo 0)
-echo "  DMs NIP-04 enviados (24h, todas las causas): $NDM · urgentes de hoy (tope 3): $UCOUNT"
-if [ -s /srv/cayce-core/.dm-deferred.log ]; then
-  echo "  diferidos por tope (van aqui en vez de DM):"
-  tail -5 /srv/cayce-core/.dm-deferred.log | sed "s/^/    /"
-fi
-if [ -f /srv/cayce-core/PUBLISH_OFF ]; then
-  echo "  kill switch: ACTIVO ($(head -c 20 /srv/cayce-core/PUBLISH_OFF 2>/dev/null))"
-fi
-
-echo ""
-echo "== 3. PRs y deploys =="
-BTOK=$(cat /etc/cayce/ci-bot.token 2>/dev/null)
-if [ -n "$BTOK" ]; then
-  for REPO in cayce-ops entity bitcoinhotels; do
-    curl -s -m 10 -H "Authorization: token $BTOK" \
-      "http://127.0.0.1:3100/api/v1/repos/cayce/$REPO/pulls?state=closed&limit=20" \
-    | python3 -c "
-import json, sys, datetime
-cutoff = (datetime.datetime.utcnow() - datetime.timedelta(days=1)).strftime('%Y-%m-%dT%H:%M')
-for p in json.load(sys.stdin):
-    m = (p.get('merged_at') or '')
-    if not p.get('merged') or not m or m < cutoff: continue
-    print(f\"$REPO#{p['number']} — {p['title'][:60]}\")" 2>/dev/null
-  done
-fi
-journalctl -u cayce-autodeploy --since "-24 hours" -o cat --no-pager 2>/dev/null | grep -E "^\[autodeploy\].*(→|ROLLBACK|ABORT|FATAL)" | tail -6
-
-echo ""
-echo "== 3b. PRs que esperan tu merge =="
-PROTECTED="SPEC.md|MANDATE.md|prompts/cayce-identity.md|guard[^/]*\.|relay-watcher|outbox\.mjs|guard-blocklist|check-single-outbox|\.gitea/workflows|\.github/workflows|cayce-auto-merge|act_runner|docker"
-if [ -n "${BTOK:-}" ]; then
-  for REPO in cayce-ops entity bitcoinhotels; do
-    curl -s -m 10 -H "Authorization: token $BTOK" \
-      "http://127.0.0.1:3100/api/v1/repos/cayce/$REPO/pulls?state=open&limit=20" \
-    | python3 -c "
-import json, sys, urllib.request, os
-tok = os.environ.get('BTOK')
-for p in json.load(sys.stdin):
-    req = urllib.request.Request(f'http://127.0.0.1:3100/api/v1/repos/cayce/$REPO/pulls/{p["number"]}/files?limit=100', headers={'Authorization': 'token ' + tok})
-    files = [f.get('filename','') for f in json.load(urllib.request.urlopen(req, timeout=10))]
-    import re
-    prot = [f for f in files if re.search(r'$PROTECTED', f)]
-    motivo = 'toca paths protegidos: ' + ', '.join(prot[:3]) if prot else 'CI pendiente o esperando revisión'
-    print(f"  $REPO#{p['number']} — {p['title'][:56]} — {motivo}")" 2>/dev/null
-  done
-fi
-echo "  GitHub patternn/hardcap-news: sin token en VPS — revisar https://github.com/patternn/hardcap-news/pulls"
-
-echo ""
-echo "== 4. Umami (24h) =="
-sudo -n -u postgres psql -d umami -tA -f- <<'EOF'
-SELECT w.name || ': ' || count(DISTINCT e.session_id) || ' visitas · ' || count(*) || ' páginas'
-FROM website_event e JOIN website w ON w.website_id = e.website_id
-WHERE e.created_at > now() - interval '24 hours' AND e.event_type = 1
-GROUP BY w.name ORDER BY count(*) DESC;
-SELECT 'top: ' || url_path || ' (' || count(*) || ')' FROM website_event
-WHERE created_at > now() - interval '24 hours' AND event_type = 1
-GROUP BY url_path ORDER BY count(*) DESC LIMIT 4;
-SELECT 'refs: ' || coalesce(nullif(referrer_domain, ''), '(direct)') || ' (' || count(DISTINCT session_id) || ')'
-FROM website_event
-WHERE created_at > now() - interval '24 hours' AND event_type = 1
-GROUP BY referrer_domain ORDER BY count(DISTINCT session_id) DESC LIMIT 4;
-EOF
-
-echo ""
-echo "== Contenido nuevo publicado hoy por sitio =="
-# bitcoinhotels: guias/fichas nuevas o actualizadas en el arbol DESPLEGADO (link vivo)
-cd /srv/bitcoinhotels 2>/dev/null && git log --since="24 hours" --format="%H" -- src/data/guides.json | while read -r C; do
-  git show "$C" -- src/data/guides.json 2>/dev/null | grep -oE '^\+\s+"slug": "[a-z0-9-]+"' | sed 's/.*: "//;s/"//' \
-    | while read -r SL; do echo "  bitcoinhotels.org/guides/$SL"; done
-done | sort -u
-# hardcap: notas publicadas hoy (link por article_id del meta)
-sudo -n -u postgres psql -d cayce -tA -f- <<'EOF2' | while read -r L; do [ -n "$L" ] && echo "  hardcap.news$L"; done
-SELECT '/news/' || (meta->>'article_id') || '/summary — ' || left(regexp_replace(content, E'[\n\r]+', ' ', 'g'), 60)
-FROM outbound_drafts
-WHERE channel='hardcap' AND status='published' AND ts > now() - interval '24 hours'
-  AND meta->>'article_id' IS NOT NULL
-ORDER BY ts DESC LIMIT 6;
-EOF2
-
-echo ""
-echo "== Ciclos: piezas producidas (24h) =="
-sudo -n -u postgres psql -d cayce -tA -f- <<'EOF'
-SELECT 'posts: ' || count(*) || ' piezas nostr (opinion/reflection/events/iniciativa)'
-FROM outbound_drafts WHERE channel='nostr'
-  AND type IN ('opinion','reflection','events_post','initiative_note')
-  AND status='published' AND ts > now() - interval '24 hours';
-SELECT 'editoriales: ' || count(*) || ' opiniones publicadas · ' || (SELECT count(*) FROM actions_log WHERE action='editorials_cycle' AND ts > now() - interval '24 hours') || ' corridas'
-FROM outbound_drafts WHERE channel='nostr' AND type='opinion' AND status='published' AND ts > now() - interval '24 hours';
-SELECT 'notas hardcap: ' || count(*) || ' publicadas'
-FROM outbound_drafts WHERE channel='hardcap' AND status='published' AND ts > now() - interval '24 hours';
-SELECT 'curacion hardcap: ' || count(*) || ' corridas del ciclo core · ' || (SELECT count(*) FROM digests WHERE ts > now() - interval '24 hours') || ' digests'
-FROM actions_log WHERE action='cycle_complete' AND ts > now() - interval '24 hours';
-SELECT 'promo: ' || count(*) FILTER (WHERE status='ok') || ' publicadas · ' || count(*) FILTER (WHERE status LIKE 'rejected%') || ' rechazadas · ' || count(*) FILTER (WHERE status LIKE 'error%') || ' con error'
-FROM posts_log WHERE ts > now() - interval '24 hours';
-SELECT 'iniciativa: ' || count(*) || ' drafts creados'
-FROM actions_log WHERE action='draft_created' AND ts > now() - interval '24 hours';
-EOF
-
-echo "== Checklist de postulacion (verificable en vivo) =="
-chk() { # $1 nombre, $2 condicion (0=verde)
-  if [ "$2" = "0" ]; then echo "  $1: verde"; else echo "  $1: pendiente"; fi
-}
-for SITE in bh hc; do
-  [ "$SITE" = "bh" ] && P=3002 && D=bitcoinhotels.org || { P=3003; D=hardcap.news; }
-  N=$(curl -s -m 6 http://127.0.0.1:$P/sitemap.xml | grep -c "<loc>")
-  TR=0; for PG in about contact privacy terms; do C=$(curl -s -o /dev/null -w "%{http_code}" -m 5 http://127.0.0.1:$P/$PG); [ "$C" = "200" ] && TR=$((TR+1)); done
-  HWW=$(curl -s -o /dev/null -w "%{http_code}" -m 5 http://127.0.0.1:$P/how-we-work)
-  ADS=$(curl -s -o /dev/null -w "%{http_code}" -m 5 http://127.0.0.1:$P/ads.txt)
-  PC=$(curl -s -o /dev/null -w "%{http_code}" -m 5 http://127.0.0.1:$P/privacy)
-  PRIV=$(curl -s -m 5 http://127.0.0.1:$P/privacy | grep -c -i "adsense"); [ "$PC" != "200" ] && PRIV=0
-  echo "$D: sitemap=$N URLs · confianza $TR/4 · how-we-work $([ "$HWW" = "200" ] && echo SI || echo NO) · ads.txt $([ "$ADS" = "200" ] && echo SI || echo NO) · privacy-AdSense $([ "$PRIV" -ge 1 ] && echo SI || echo NO)"
-done
-
-if [ "$(date -u +%u)" = "1" ]; then
-  echo "== Semanal (lunes): checklist AdSense =="
-  for SITE in bh hc; do
-    [ "$SITE" = "bh" ] && P=3002 && N=bitcoinhotels.org || { P=3003; N=hardcap.news; }
-    OK=0; TOTAL=5
-    for PG in sitemap.xml ads.txt privacy terms how-we-work; do
-      C=$(curl -s -o /dev/null -w "%{http_code}" -m 5 http://127.0.0.1:$P/$PG); [ "$C" = "200" ] && OK=$((OK+1))
-    done
-    echo "  $N: $OK/$TOTAL (sitemap · ads.txt · privacy · terms · how-we-work)"
-  done
-fi
-
-echo "== Pushes (24h) por autor =="
-for R in cayce-ops entity bitcoinhotels; do
-  A=$(cd /srv/$([ "$R" = "cayce-ops" ] && echo home/ubuntu/cayce-ops || { [ "$R" = "entity" ] && echo cayce-core || echo bitcoinhotels; }) 2>/dev/null && git log --since="24 hours" --format="%an" | sort | uniq -c | tr "\n" ";" )
-  echo "  $R: ${A:-sin commits}"
-done
-
-echo "== Avance semanal FASE B (piezas vs objetivo) =="
-# convencion: los commits de piezas FASE B llevan prefijo "pieza:"
-SEM=$(( ($(date -u +%s) / 86400 + 3) / 7 ))  # semana ISO aprox
-for R in cayce-ops entity bitcoinhotels; do
-  D=/srv/$([ "$R" = "cayce-ops" ] && echo home/ubuntu/cayce-ops || { [ "$R" = "entity" ] && echo cayce-core || echo bitcoinhotels; })
-  N=$(cd "$D" 2>/dev/null && git log --since="7 days" --format="%s" | grep -c "^pieza:")
-  echo "  $R: $N piezas-commits esta semana"
-done
-echo "  objetivos: bitcoinhotels 2/sem · hardcap ~2,5/sem (hub+watch+guia alterna)"
-
-echo "== Persistencias (caidos ahora mismo) =="
-for U in cayce-nostr.service hardcap-backend.service hardcap-frontend.service cayce-bitcoinhotels.service postgresql@18-main.service caddy.service; do
-  A=$(systemctl is-active $U 2>/dev/null)
-  [ "$A" != "active" ] && echo "  $U: $A"
-done
-true
-
-echo "== 5. Gemini del día =="
-python3 - /srv/cayce-core/.llm-usage.jsonl <<'PY' 2>/dev/null || echo "(sin uso registrado aún)"
-import json, sys, os
-IN = OUT_ = CACHED = CALLS = 0
-if os.path.exists(sys.argv[1]):
-    for line in open(sys.argv[1]):
-        try:
-            d = json.loads(line)
-            if d.get("ts", "")[:10] == __import__("datetime").datetime.utcnow().date().isoformat():
-                CALLS += 1; IN += d.get("in", 0); OUT_ += d.get("out", 0); CACHED += d.get("cached", 0)
-        except Exception:
-            pass
-rin  = float(os.environ.get("GEMINI_USD_PER_MTOK_IN",  "0.15"))
-rout = float(os.environ.get("GEMINI_USD_PER_MTOK_OUT", "0.60"))
-cost = IN/1e6*rin + OUT_/1e6*rout
-print(f"{CALLS} llamadas · in {IN:,} tok · out {OUT_:,} tok · cached {CACHED:,} · costo estimado ${cost:.3f} (rates {rin}/{rout} USD/Mtok)")
-PY
-} > "$OUT" 2>&1
-
-# DM al supervisor + copia de auditoría
-SUP=$(grep -aoE 'SUPERVISOR_NPUB_HEX=[0-9a-f]+' /srv/cayce-nostr/.env 2>/dev/null | cut -d= -f2)
-BODY=$(head -c 6000 "$OUT")
-if [ -n "$SUP" ]; then
-  curl -s -m 20 -X POST http://127.0.0.1:3011/dm -H "Content-Type: application/json" \
-    -d "$(python3 -c "import json,sys; print(json.dumps({'to_hex': '$SUP', 'content': open('$OUT').read()[:6000]}))")" \
-    >/dev/null && logger -t cayce-daily-report "DM enviado ($(wc -c < "$OUT") bytes)"
-else
-  logger -t cayce-daily-report "SIN supervisor — reporte solo en log"
-fi
-cat "$OUT"
-cp "$OUT" /var/log/cayce-daily-report.log 2>/dev/null || true
-rm -f "$OUT"

deploy/usr-local-bin/cayce-urgent-watch

@@ -1,138 +0,0 @@
-#!/bin/bash
-# cayce-urgent-watch (r21 → r33) — política de DMs del operador:
-#   DM inmediato SOLO si:
-#     · kill switch activado o fuga detectada
-#     · sitio/servicio público caído >15 min (no rollbacks que se recuperan)
-#     · backup fallido 2 días seguidos
-#     · gasto de Gemini por encima del umbral
-#   Todo lo demás (initiative, rollbacks recuperados, ciclos, publicaciones,
-#   rechazos, merges CODEOWNERS) va SOLO al resumen diario de las 23:50 UTC.
-#   Ciclos pausados a propósito (p.ej. promo) no generan alertas.
-#   Dedup por tipo de incidente + sujeto (24 h). Tope: 3 DMs urgentes/día;
-#   a partir de ahí, una línea en el resumen diario (.dm-deferred.log).
-# DRYRUN=1 imprime qué haría sin enviar ni contar.
-DEDUP=/srv/cayce-core/.dm-dedup.json
-DOWNST=/srv/cayce-core/.critical-down.json
-COUNTF=/srv/cayce-core/.dm-urgent-count.json
-DEFER=/srv/cayce-core/.dm-deferred.log
-USAGE=${LLM_USAGE_LOG:-/srv/cayce-core/.llm-usage.jsonl}
-GEMINI_MAX_USD=${GEMINI_MAX_USD:-1.0}
-export TTL_MS=$((24 * 3600 * 1000))
-DRY=${DRYRUN:-0}
-
-dm_urgente() {  # $1 clave (tipo:sujeto), $2 mensaje
-  python3 - "$1" "$2" "$DEDUP" "$TTL_MS" "$COUNTF" "$DEFER" "$DRY" <<'PY'
-import json, sys, subprocess, datetime, os
-key, msg, dedup, ttl, countf, defer, dry = sys.argv[1:8]
-ttl, dry = int(ttl), int(dry)
-st = {}
-try: st = json.load(open(dedup))
-except Exception: pass
-now = datetime.datetime.utcnow().timestamp() * 1000
-if now - st.get(key, 0) < ttl:
-    print(f"[urgent] DM dedup ({key}) — ya alertado en <24h"); sys.exit(0)
-cnt = {}
-today = datetime.datetime.utcnow().date().isoformat()
-try: cnt = json.load(open(countf))
-except Exception: pass
-n = cnt.get(today, 0)
-sup = ""
-for l in open("/srv/cayce-nostr/.env"):
-    if l.startswith("SUPERVISOR_NPUB_HEX="): sup = l.strip().split("=",1)[1]
-if not sup:
-    print("[urgent] sin supervisor — solo log"); sys.exit(0)
-if n >= 3:
-    with open(defer, "a") as f:
-        f.write(f"{datetime.datetime.utcnow().isoformat()} DEFERIDO (tope 3/dia) {key}: {msg}\n")
-    print(f"[urgent] TOPE 3/dia alcanzado — diferido al resumen diario ({key})")
-    sys.exit(0)
-if dry:
-    print(f"[urgent] DRYRUN: enviaria DM ({key}): {msg[:100]}")
-    sys.exit(0)
-subprocess.run(["curl","-s","-m","20","-X","POST","http://127.0.0.1:3011/dm",
-    "-H","Content-Type: application/json","-d",json.dumps({"to_hex":sup,"content":msg})],
-    capture_output=True)
-st[key] = now
-cnt[today] = n + 1
-json.dump(st, open(dedup, "w"))
-json.dump(cnt, open(countf, "w"))
-print(f"[urgent] DM enviado ({key}) — {cnt[today]}/3 hoy")
-PY
-}
-
-# 1) kill switch manual o fuga: PUBLISH_OFF sin violación reciente del watcher,
-#    o violación del relay-watcher (fuga) en la última hora.
-if [ -f /srv/cayce-core/PUBLISH_OFF ]; then
-  SIG=$(head -c 9 /srv/cayce-core/PUBLISH_OFF 2>/dev/null)
-  AGE=$(( $(date -u +%s) - $(stat -c %Y /srv/cayce-core/PUBLISH_OFF 2>/dev/null || echo 0) ))
-  if [ "$SIG" != "autodeploy" ] || [ "$AGE" -ge 600 ]; then
-    V=$(sudo -n -u postgres psql -d cayce -tAc "SELECT count(*) FROM guard_rejections WHERE type='watcher_violation' AND ts > now() - interval '15 minutes'" 2>/dev/null || echo 1)
-    [ "$V" = "0" ] && dm_urgente "killswitch:manual" "URGENTE: PUBLISH_OFF activo (kill switch MANUAL) — publicación en draft global. Sin violación del watcher que lo explique."
-  fi
-fi
-FUGA=$(sudo -n -u postgres psql -d cayce -tAc "SELECT count(*) FROM guard_rejections WHERE type='watcher_violation' AND ts > now() - interval '60 minutes'" 2>/dev/null || echo 0)
-[ "$FUGA" != "0" ] && dm_urgente "fuga:watcher" "URGENTE: $FUGA violaciones del watcher en 60 min — posible fuga de publicación. PUBLISH_OFF recomendado."
-
-# 2) servicios críticos caídos >15 min (estado persistente de primera caída)
-while IFS=: read -r TAG UNIT MINS; do
-  [ "$TAG" = "DOWN" ] && dm_urgente "down:$UNIT" "URGENTE: servicio crítico caído ${MINS} min: $UNIT"
-done < <(python3 - "$DOWNST" <<'PY'
-import json, subprocess, sys, time
-UNITS = ["cayce-nostr.service","hardcap-backend.service","hardcap-frontend.service",
-         "cayce-bitcoinhotels.service","postgresql@18-main.service","caddy.service"]
-st = {}
-try: st = json.load(open(sys.argv[1]))
-except Exception: pass
-now = time.time()
-for u in UNITS:
-    active = subprocess.run(["systemctl","is-active",u], capture_output=True, text=True).stdout.strip() == "active"
-    if active:
-        st.pop(u, None)
-    else:
-        st.setdefault(u, now)
-        if now - st[u] > 15*60:
-            print(f"DOWN:{u}:{int((now-st[u])/60)}")
-json.dump(st, open(sys.argv[1], "w"))
-PY
-)
-
-# 3) backup fallido 2 días seguidos (r33: un fallo puntual no es urgente)
-if systemctl is-failed cayce-backup.service >/dev/null 2>&1; then
-  FAILS=$(journalctl -u cayce-backup.service --since "48 hours ago" --no-pager 2>/dev/null | grep -c "Failed with result")
-  if [ "${FAILS:-0}" -ge 2 ]; then
-    dm_urgente "backup:2días" "URGENTE: cayce-backup fallido ${FAILS} veces en 48h — revisar /var/backups/cayce y el journal."
-  else
-    echo "[urgent] backup failed hoy ($FAILS en 48h <2) — va al resumen diario"
-  fi
-fi
-
-# 4) gasto de Gemini hoy > umbral (tokens reales)
-read -r COST CALLS TIN TOUT < <(python3 - "$USAGE" <<'PY'
-import json, sys, os, datetime
-rin = float(os.environ.get("GEMINI_USD_PER_MTOK_IN", "0.15"))
-rout = float(os.environ.get("GEMINI_USD_PER_MTOK_OUT", "0.60"))
-today = datetime.datetime.utcnow().date().isoformat()
-IN = OUT_ = CALLS = 0
-if os.path.exists(sys.argv[1]):
-    for line in open(sys.argv[1]):
-        try:
-            d = json.loads(line)
-            if d.get("ts","")[:10] == today:
-                CALLS += 1; IN += d.get("in",0); OUT_ += d.get("out",0)
-        except Exception: pass
-print(f"{IN/1e6*rin + OUT_/1e6*rout:.4f} {CALLS} {IN} {OUT_}")
-PY
-)
-if python3 -c "exit(0 if float('${COST:-0}') > float('$GEMINI_MAX_USD') else 1)" 2>/dev/null; then
-  dm_urgente "gasto:gemini" "URGENTE: gasto Gemini de hoy \$${COST} (> \$${GEMINI_MAX_USD}) — ${CALLS} llamadas, ${TIN} in / ${TOUT} out tokens."
-fi
-
-# r33: lo que YA NO manda DM (solo resumen diario de 23:50):
-#   · ciclos mudos / pausados a propósito (promo hoy) — el resumen diario ya
-#     trae la sección "Ciclos: piezas producidas"
-#   · merges que tocan CODEOWNERS — el resumen diario (sección 3) lista los
-#     merges del día; la sección 3b lista los PRs abiertos
-#   · rollbacks recuperados — el autodeploy usa dm_once (un aviso por
-#     incidente) y el resumen diario lista los deploys/rollbacks del journal
-
-logger -t cayce-urgent-watch "tick ok (gemini=\$${COST:-0})"

docs/DECISIONS.md

@@ -17,3 +17,11 @@ excepciones (check-clean-trees en verde).
 Todo push queda identificado por autor; el reporte diario lista los pushes
 del día por autor, y todo merge a main que toque archivos de CODEOWNERS
 dispara DM urgente si no lo mergeó pattern.
+
+## D4 (r32, regla dura R7): Nada de builds ni pruebas en /srv/*
+NINGUN agente compila, instala dependencias ni prueba codigo dentro de
+los directorios de produccion (/srv/*). Todo build, npm ci, prueba o
+servidor de testeo va en una copia bajo /tmp o en el workspace del
+runner (/var/lib/gitea-act/work). Antecedente: r31 — un build de prueba
+sobrescribio el .next de produccion de bitcoinhotels por ~7 minutos.
+Los checkouts de /srv solo los toca el autodeploy (con su lock).