OpenSpec: исследование + tavily-proxy-setup, local-extractor (spec-driven для инфраструктуры)

openspec/specs/tunnel-proxy/spec.md

@@ -0,0 +1,33 @@
+# tunnel-proxy Specification
+
+## Purpose
+TBD - created by archiving change add-vpn-tunnel-proxy. Update Purpose after archive.
+
+## Requirements
+
+### Requirement: Persistent SOCKS5 Tunnel
+The system MUST maintain a persistent SOCKS5 proxy tunnel from the host to VPS01, listening on 127.0.0.1:1080.
+
+#### Scenario: Tunnel starts on boot
+- GIVEN the host boots
+- WHEN systemd starts telegram-tunnel.service
+- THEN the tunnel listens on 127.0.0.1:1080
+- AND the SSH connection is established with key /mnt/yandex-disk/.ssh_box/timewebVPS
+
+#### Scenario: Tunnel dies
+- GIVEN the tunnel process exits unexpectedly
+- WHEN systemd detects failure
+- THEN the service restarts automatically (Restart=always)
+
+### Requirement: Tunnel Health Monitoring
+The system MUST verify tunnel liveness at least every 60 seconds.
+
+#### Scenario: Health check passes
+- GIVEN the tunnel is running
+- WHEN checking connectivity through 127.0.0.1:1080
+- THEN curl through the proxy returns HTTP 200 for a known endpoint
+
+#### Scenario: Health check fails
+- GIVEN the tunnel is down
+- WHEN the watchdog fires
+- THEN a notification is raised (no routine "all ok" messages)

openspec/specs/web-extract-tavily/spec.md

@@ -0,0 +1,42 @@
+# web-extract-tavily Specification
+
+## Purpose
+TBD - created by archiving change tavily-proxy-setup. Update Purpose after archive.
+
+## Requirements
+
+### Requirement: Tavily Extract Backend
+The system MUST use Tavily as the web_extract backend, reachable via the local proxy at http://127.0.0.1:8971.
+
+#### Scenario: Extract works
+- GIVEN the Hermes web tool calls web_extract
+- WHEN the URL is a normal web page
+- THEN the page content is returned as markdown
+- AND the request goes through the local proxy to the Tavily API over SOCKS5
+
+#### Scenario: Proxy is down
+- GIVEN the tavily-proxy.service is stopped
+- WHEN web_extract is called
+- THEN the call fails with a connection error (not a silent wrong result)
+
+### Requirement: Proxy Auto-Start
+The system MUST start tavily-proxy.service automatically at boot and restart it on failure.
+
+#### Scenario: Boot
+- GIVEN the host boots
+- WHEN systemd starts
+- THEN tavily-proxy.service is active
+- AND it listens on 127.0.0.1:8971
+
+#### Scenario: Proxy crash
+- GIVEN the proxy process exits unexpectedly
+- WHEN systemd detects failure
+- THEN the service restarts automatically
+
+### Requirement: Tunnel Dependency
+The proxy MUST depend on the SOCKS5 tunnel (telegram-tunnel.service); it must not start before the tunnel is up, and must restart if the tunnel is unavailable.
+
+#### Scenario: Tunnel down
+- GIVEN telegram-tunnel.service is inactive
+- WHEN tavily-proxy.service is requested
+- THEN the proxy stays stopped (or retries) until the tunnel is back