fix(ci): stop the tag push from re-deploying, and make the infra bump idempotent

Two runs of the full build+deploy fired for every push, and the second died:

    nothing to commit, working tree clean
    ❌  Failure - Main Update infra repo

The deploy was fine both times — the second run had nothing left to do. The
cause is the pair of triggers meeting: ci.yml ran on `push` to main AND on a
`v*` tag, and cd.yml keys off "CI succeeded", so `git push origin main` followed
by `git push origin refs/tags/vX` produced two CI runs for one sha and two
deploys behind them. The tag run carries the same github.sha, so it rebuilt the
same image and then found the infra manifest already pointing at it.

Nothing consumed the tag-triggered run: there is no release workflow, and cd.yml
reads github.sha rather than the tag. Dropping `tags:` removes the duplicate
build outright.

The idempotency guard stays anyway, because a manual re-run has the same shape
and should not ring the CI-red alarm for work that is already done — infra#366
turns a red run into a tracked issue, so a false red costs a real triage.

Closes #118

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -1,7 +1,6 @@
 # Supervisor MCP server
 SUPERVISOR_PORT=3200
 SUPERVISOR_CONFIG_DIR=./config/supervisor
-SUPERVISOR_MODELS_FILE=./config/models.yaml
 
 # LiteLLM gateway (iguana)
 LITELLM_BASE_URL=http://iguana:4000

.gitea/workflows/cd.yml

@@ -81,11 +81,19 @@ jobs:
           git config user.email "cd-bot@d-ma.be"
           git config user.name "CD Bot"
           git add "k3s/apps/supervisor/ingestion-deployment.yaml"
-          git commit -m "chore(deploy): ingestion → ${IMAGE_TAG}"
-          GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \
-            git push
-
-          echo "Infra repo updated: ingestion → ${IMAGE_TAG}"
+          # Idempotent: `git commit` exits 1 on an empty index, so a run that
+          # finds the bump already applied failed the whole job and rang the
+          # CI-red alarm for a deploy that was fine (hyperguild#118). Two
+          # sources of a no-op run: a manual re-run, and the tag-push CI run
+          # that used to shadow the branch-push one for the same sha.
+          if git diff --cached --quiet; then
+            echo "Infra already at ${IMAGE_TAG} — nothing to commit"
+          else
+            git commit -m "chore(deploy): ingestion → ${IMAGE_TAG}"
+            GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \
+              git push
+            echo "Infra repo updated: ingestion → ${IMAGE_TAG}"
+          fi
 
       - name: Trigger Flux reconcile (immediate)
         run: |

.gitea/workflows/ci.yml

@@ -2,8 +2,13 @@ name: CI
 
 "on":
   push:
+    # Branch only. A `v*` tag here points at a commit main already tested, so
+    # the tag push re-ran the whole gate and — because cd.yml keys off "CI
+    # succeeded" — triggered a SECOND full image build and deploy for the same
+    # sha. That second deploy then died on "nothing to commit" (hyperguild#118).
+    # Nothing consumes a tag-triggered run: there is no release workflow, and
+    # cd.yml reads github.sha, not the tag.
     branches: [main]
-    tags: ["v*"]
   pull_request:
     branches: [main]
 

Procfile

@@ -1,2 +1 @@
 ingestion: cd ingestion && INGEST_BRAIN_DIR=../brain INGEST_PORT=3300 INGEST_WATCH_INTERVAL=30 go run ./cmd/server/
-supervisor: SUPERVISOR_CONFIG_DIR=./config/supervisor SUPERVISOR_MODELS_FILE=./config/models.yaml SUPERVISOR_SESSIONS_DIR=./brain/sessions INGEST_BASE_URL=http://localhost:3300 INGEST_SVC_URL=http://localhost:3300 go run ./cmd/supervisor/

Taskfile.yml

@@ -21,7 +21,7 @@ tasks:
   # ── Development ────────────────────────────────────────────────────────────
 
   start:
-    desc: Start ingestion + supervisor (requires goreman — go install github.com/mattn/goreman@latest)
+    desc: Start ingestion (requires goreman — go install github.com/mattn/goreman@latest)
     cmds:
       - goreman start
 
@@ -32,11 +32,6 @@ tasks:
       - lsof -ti:3200 | xargs kill -9 2>/dev/null || true
       - echo "hyperguild stopped"
 
-  supervisor:dev:
-    desc: Run supervisor MCP server (development)
-    cmds:
-      - go run ./cmd/supervisor
-
   hyperguild:dev:
     desc: Run hyperguild CLI from source (e.g. task hyperguild:dev -- tier)
     cmds:
@@ -67,14 +62,9 @@ tasks:
   build:
     desc: Build all binaries
     cmds:
-      - task: supervisor:build
+      - task: hyperguild:build
       - task: ingestion:build
 
-  supervisor:build:
-    desc: Build supervisor binary
-    cmds:
-      - go build -trimpath -ldflags="-s -w -X main.version={{.VERSION}}" -o bin/supervisor ./cmd/supervisor
-
   ingestion:build:
     desc: Build ingestion server binary
     dir: ingestion
@@ -84,7 +74,7 @@ tasks:
   # ── Quality ────────────────────────────────────────────────────────────────
 
   check:
-    desc: Run all checks (context freshness + lint + test + vet) across all modules
+    desc: Run all checks (context freshness + lint + test + vet + build) across all modules
     cmds:
       # Context sync is skipped under CI, matching dma-cli, gitea-mcp, and the
       # rest of the estate. It is not a preference: context-sync.sh walks UP
@@ -120,6 +110,12 @@ tasks:
       - task: lint
       - task: test
       - task: vet
+      # `build` is in the gate deliberately (hyperguild#120). vet and test walk
+      # ./... , which enumerates the packages that EXIST — so a build target
+      # naming a DELETED package is invisible to both. `task build` pointed at
+      # ./cmd/supervisor for months after that directory was removed, and CI
+      # stayed green the whole time because nothing in check ever built.
+      - task: build
       - task: security:gitleaks
 
   # ── Security ─────────────────────────────────────────────
@@ -173,19 +169,6 @@ tasks:
       - govulncheck ./... || true
       - cd ingestion && go vet ./...
 
-  supervisor:test:smoke:
-    desc: Smoke test supervisor via MCP (requires start running)
-    cmds:
-      - |
-        curl -s -X POST http://localhost:${SUPERVISOR_PORT:-3200}/mcp \
-          -H "Content-Type: application/json" \
-          -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | jq .
-
-  smoke:routing:
-    desc: Boot the routing pod against live LiteLLM + brain and verify _routing logs land
-    cmds:
-      - bash scripts/smoke-routing.sh
-
   # ── Git / Release ──────────────────────────────────────────────────────────
 
   tag:

config/models.yaml

@@ -1,26 +0,0 @@
-# Model selection — first entry per skill is used.
-# Override per-call by passing model in the MCP tool args.
-# Model names come from LiteLLM /v1/models (host/name format).
-
-default_chain:
-  - iguana/qwen3-coder-next
-
-skills:
-  tdd:
-    chain:
-      - koala/qwen3-coder-30b
-  review:
-    chain:
-      - iguana/devstral
-  debug:
-    chain:
-      - iguana/deepseek-r1-14b
-  spec:
-    chain:
-      - koala/phi4-14b
-  retrospective:
-    chain:
-      - iguana/qwen3-coder-next
-  trainer:
-    chain:
-      - iguana/qwen3-coder-next

internal/config/config.go

@@ -7,7 +7,6 @@ type Config struct {
 	LiteLLMBaseURL string // LITELLM_BASE_URL, default http://iguana:4000
 	LiteLLMAPIKey  string // LITELLM_API_KEY
 	ConfigDir      string // SUPERVISOR_CONFIG_DIR, default ./config/supervisor
-	ModelsFile     string // SUPERVISOR_MODELS_FILE, default <ConfigDir>/../models.yaml
 	IngestBaseURL  string // INGEST_BASE_URL, default http://localhost:3300
 	IngestSvcURL   string // INGEST_SVC_URL — base URL for brain_ingest (/ingest, /ingest-path)
 	KBRetrievalURL string // KB_RETRIEVAL_URL — base URL for brain_search
@@ -23,7 +22,6 @@ func Load() (Config, error) {
 		LiteLLMAPIKey:  os.Getenv("LITELLM_API_KEY"),
 		ConfigDir:      envOr("SUPERVISOR_CONFIG_DIR", "./config/supervisor"),
 	}
-	cfg.ModelsFile = envOr("SUPERVISOR_MODELS_FILE", cfg.ConfigDir+"/../models.yaml")
 	cfg.IngestBaseURL = envOr("INGEST_BASE_URL", "http://localhost:3300")
 	cfg.IngestSvcURL = envOr("INGEST_SVC_URL", "")
 	cfg.KBRetrievalURL = envOr("KB_RETRIEVAL_URL", "")

internal/config/models.go

@@ -1,49 +0,0 @@
-package config
-
-import (
-	"fmt"
-	"os"
-
-	"gopkg.in/yaml.v3"
-)
-
-type skillChain struct {
-	Chain []string `yaml:"chain"`
-}
-
-type modelsFile struct {
-	DefaultChain []string              `yaml:"default_chain"`
-	Skills       map[string]skillChain `yaml:"skills"`
-}
-
-type Models struct {
-	data modelsFile
-}
-
-func LoadModels(path string) (Models, error) {
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		return Models{}, fmt.Errorf("load models: %w", err)
-	}
-	var f modelsFile
-	if err := yaml.Unmarshal(raw, &f); err != nil {
-		return Models{}, fmt.Errorf("parse models: %w", err)
-	}
-	return Models{data: f}, nil
-}
-
-// ModelFor returns the primary model to use for a skill.
-// If override is non-empty, it is returned directly.
-// Falls back to default_chain[0] when the skill has no explicit entry.
-func (m Models) ModelFor(skill, override string) string {
-	if override != "" {
-		return override
-	}
-	if sc, ok := m.data.Skills[skill]; ok && len(sc.Chain) > 0 {
-		return sc.Chain[0]
-	}
-	if len(m.data.DefaultChain) > 0 {
-		return m.data.DefaultChain[0]
-	}
-	return ""
-}

internal/config/models_test.go

@@ -1,53 +0,0 @@
-package config_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"git.d-ma.be/mathias/hyperguild/internal/config"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const testYAML = `
-default_chain:
-  - ollama/qwen3-coder-30b-tuned
-  - claude-sonnet-4-6
-
-skills:
-  review:
-    chain:
-      - ollama/devstral-tuned
-      - ollama/gemma4
-      - claude-sonnet-4-6
-  spec:
-    chain:
-      - ollama/phi4
-      - claude-opus-4-6
-`
-
-func writeModels(t *testing.T, content string) string {
-	t.Helper()
-	f := filepath.Join(t.TempDir(), "models.yaml")
-	require.NoError(t, os.WriteFile(f, []byte(content), 0o644))
-	return f
-}
-
-func TestModelsModelForSkillWithEntry(t *testing.T) {
-	m, err := config.LoadModels(writeModels(t, testYAML))
-	require.NoError(t, err)
-	assert.Equal(t, "ollama/devstral-tuned", m.ModelFor("review", ""))
-}
-
-func TestModelsModelForDefaultFallback(t *testing.T) {
-	m, err := config.LoadModels(writeModels(t, testYAML))
-	require.NoError(t, err)
-	assert.Equal(t, "ollama/qwen3-coder-30b-tuned", m.ModelFor("trainer", ""))
-}
-
-func TestModelsModelForCallerOverride(t *testing.T) {
-	m, err := config.LoadModels(writeModels(t, testYAML))
-	require.NoError(t, err)
-	assert.Equal(t, "claude-opus-4-6", m.ModelFor("review", "claude-opus-4-6"))
-}

scripts/smoke-routing.sh

@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Boot the routing binary and exercise its four tools against live deps.
-# Skipped when LITELLM_BASE_URL or BRAIN_URL is unreachable.
-
-LITELLM_BASE_URL="${LITELLM_BASE_URL:-https://llm-api.d-ma.be}"
-BRAIN_URL="${BRAIN_URL:-http://koala:30330}"
-
-if ! curl -sS --max-time 2 "${LITELLM_BASE_URL}/v1/models" >/dev/null 2>&1; then
-  echo "SKIP: LITELLM at ${LITELLM_BASE_URL} unreachable"
-  exit 0
-fi
-if ! curl -sS --max-time 2 "${BRAIN_URL}/query" -X POST -d '{"query":"x","k":1}' -H 'Content-Type: application/json' >/dev/null 2>&1; then
-  echo "SKIP: BRAIN at ${BRAIN_URL} unreachable"
-  exit 0
-fi
-
-PORT=33310
-BIN=$(mktemp)
-trap 'rm -f $BIN; pkill -P $$ -f "$BIN" 2>/dev/null || true' EXIT
-
-go build -o "$BIN" ./cmd/routing
-
-LITELLM_BASE_URL="$LITELLM_BASE_URL" BRAIN_URL="$BRAIN_URL" \
-  ROUTING_PORT="$PORT" SUPERVISOR_CONFIG_DIR="$(pwd)/config/supervisor" \
-  "$BIN" &
-
-# Wait for the binary to bind.
-for _ in $(seq 1 50); do
-  curl -sS "http://127.0.0.1:${PORT}/healthz" >/dev/null 2>&1 && break
-  sleep 0.1
-done
-
-call_tool() {
-  local tool="$1"
-  local args="$2"
-  curl -sS -X POST "http://127.0.0.1:${PORT}/mcp" \
-    -H 'Content-Type: application/json' \
-    -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"${tool}\",\"arguments\":${args}}}" \
-    | jq -e '.result // .error' > /dev/null
-}
-
-echo "calling tools/list..."
-curl -sS -X POST "http://127.0.0.1:${PORT}/mcp" \
-  -H 'Content-Type: application/json' \
-  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
-  | jq -r '.result.tools | map(.name) | sort | .[]'
-
-echo "calling each tool..."
-call_tool review          '{"project_root":"/tmp","files":["README.md"],"session_id":"smoke-1"}'
-call_tool debug           '{"project_root":"/tmp","error":"smoke test","session_id":"smoke-1"}'
-call_tool retrospective   '{"session_id":"smoke-1"}'
-call_tool trainer         '{"session_id":"smoke-1"}'
-
-echo "checking brain has _routing entries..."
-sleep 2
-COUNT=$(curl -sS "${BRAIN_URL}/pass-rate?skill=_routing&window=1h" | jq -r '.total // 0')
-if [ "${COUNT}" -lt 4 ]; then
-  echo "FAIL: expected >=4 _routing entries in last 1h, got ${COUNT}"
-  exit 1
-fi
-
-echo "PASS: smoke:routing"