hermes: isolate Atlas SCM write authority

hermes: match canonical Forgejo PR URL
hermes: harden Forgejo client boundary
2026-08-16 23:12:08 -03:00 · 2026-08-16 23:12:08 -03:00 · 2026-08-16 23:12:08 -03:00 · 2026-08-16 23:12:08 -03:00 · 2026-08-17 02:00:37 +00:00 · 2026-08-17 01:51:36 +00:00
48 changed files with 4761 additions and 382 deletions
--- a/clusters/atlas/flux-system/applications/hermes-observer-rbac/kustomization.yaml
+++ b/clusters/atlas/flux-system/applications/hermes-observer-rbac/kustomization.yaml
@ -0,0 +1,18 @@
+# clusters/atlas/flux-system/applications/hermes-observer-rbac/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: hermes-observer-rbac
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/hermes-observer-rbac
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  wait: true
+  timeout: 5m
+  dependsOn:
+    - name: hermes
--- a/clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml
+++ b/clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml
@ -0,0 +1,19 @@
+# clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: hermes-scm-broker-code
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/hermes/scm-common
+  targetNamespace: hermes-scm
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  wait: true
+  timeout: 5m
+  dependsOn:
+    - name: hermes-scm-namespace
--- a/clusters/atlas/flux-system/applications/hermes-scm-broker/kustomization.yaml
+++ b/clusters/atlas/flux-system/applications/hermes-scm-broker/kustomization.yaml
@ -0,0 +1,27 @@
+# clusters/atlas/flux-system/applications/hermes-scm-broker/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: hermes-scm-broker
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/hermes-scm-broker
+  targetNamespace: hermes-scm
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  wait: true
+  timeout: 10m
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: hermes-scm-broker
+      namespace: hermes-scm
+  dependsOn:
+    - name: vault
+    - name: gitea
+    - name: hermes-scm-namespace
+    - name: hermes-scm-broker-code
--- a/clusters/atlas/flux-system/applications/hermes-scm-namespace/kustomization.yaml
+++ b/clusters/atlas/flux-system/applications/hermes-scm-namespace/kustomization.yaml
@ -0,0 +1,16 @@
+# clusters/atlas/flux-system/applications/hermes-scm-namespace/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: hermes-scm-namespace
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/hermes-scm-namespace
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  wait: true
+  timeout: 5m
--- a/clusters/atlas/flux-system/applications/hermes/kustomization.yaml
+++ b/clusters/atlas/flux-system/applications/hermes/kustomization.yaml
@ -60,3 +60,4 @@ spec:
    - name: keycloak
    - name: longhorn
    - name: vault
+    - name: hermes-scm-broker
--- a/clusters/atlas/flux-system/applications/kustomization.yaml
+++ b/clusters/atlas/flux-system/applications/kustomization.yaml
@ -27,7 +27,11 @@ resources:
  - jenkins/kustomization.yaml
  - ai-llm/kustomization.yaml
  - openclaw/kustomization.yaml
+  - hermes-scm-namespace/kustomization.yaml
+  - hermes-scm-broker-code/kustomization.yaml
  - hermes/kustomization.yaml
+  - hermes-observer-rbac/kustomization.yaml
+  - hermes-scm-broker/kustomization.yaml
  - hermes-chat/kustomization.yaml
  - hermes-triage-demo/kustomization.yaml
  - game-stream/kustomization.yaml
--- a/services/gitea/atlas-identity-bootstrap-job.yaml
+++ b/services/gitea/atlas-identity-bootstrap-job.yaml
@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: gitea-atlas-identity-bootstrap-3
+  name: gitea-atlas-identity-bootstrap-4
  namespace: gitea
  labels:
    app.kubernetes.io/name: gitea
--- a/services/gitea/scripts/gitea_atlas_identity_ensure.sh
+++ b/services/gitea/scripts/gitea_atlas_identity_ensure.sh
@ -19,6 +19,7 @@ source_owner="${GITEA_SOURCE_OWNER:-bstein}"
 managed_repositories="${GITEA_MANAGED_REPOSITORIES:-hermes-code-demo cassandra soteria pegasus metis ananke ariadne typhon titan-iac}"
 contributor_team=Contributors
 contributor_units='["repo.actions","repo.packages","repo.code","repo.issues","repo.wiki","repo.pulls","repo.releases","repo.projects"]'
+protected_reviewer=bstein

 die() {
  echo "Gitea Atlas identity bootstrap failed: $*" >&2
@ -272,6 +273,63 @@ transfer_managed_repositories() {
  trap - EXIT HUP INT TERM
 }

+ensure_default_branch_protection() {
+  repository=$1
+  repo_file=$(mktemp)
+  protections_file=$(mktemp)
+  protection_file=$(mktemp)
+  response_file=$(mktemp)
+
+  status=$(api_request GET "/repos/${organization}/${repository}" '' "${repo_file}")
+  expect_status "${status}" 200 "read ${repository} metadata for branch protection"
+  default_branch=$(sed -n 's/.*"default_branch":"\([^"]*\)".*/\1/p' "${repo_file}")
+  case "${default_branch}" in
+    main|master) ;;
+    *) die "${repository} has unsupported default branch ${default_branch:-missing}" ;;
+  esac
+
+  status=$(api_request GET "/repos/${organization}/${repository}/branch_protections" '' "${protections_file}")
+  expect_status "${status}" 200 "list ${repository} branch protections"
+  tr -d '[:space:]' <"${protections_file}" | sed 's/},{/}\
+{/g' | grep -F "\"rule_name\":\"${default_branch}\"" >"${protection_file}" || true
+  matching_rules=$(grep -c . "${protection_file}" || true)
+  [ "${matching_rules}" -le 1 ] || die "${repository} has duplicate ${default_branch} protection rules"
+
+  if [ "${matching_rules}" -eq 0 ]; then
+    payload="{\"rule_name\":\"${default_branch}\",\"enable_push\":true,\"enable_push_whitelist\":true,\"push_whitelist_usernames\":[\"${protected_reviewer}\"],\"push_whitelist_teams\":[],\"push_whitelist_deploy_keys\":false,\"enable_force_push\":false,\"enable_force_push_allowlist\":false,\"force_push_allowlist_usernames\":[],\"force_push_allowlist_teams\":[],\"force_push_allowlist_deploy_keys\":false,\"enable_merge_whitelist\":true,\"merge_whitelist_usernames\":[\"${protected_reviewer}\"],\"merge_whitelist_teams\":[],\"enable_approvals_whitelist\":true,\"approvals_whitelist_username\":[\"${protected_reviewer}\"],\"approvals_whitelist_teams\":[],\"required_approvals\":1,\"block_on_rejected_reviews\":true,\"block_on_outdated_branch\":true,\"dismiss_stale_approvals\":true,\"block_admin_merge_override\":true}"
+    status=$(api_request POST "/repos/${organization}/${repository}/branch_protections" "${payload}" "${response_file}")
+    expect_status "${status}" 201 "protect ${repository} ${default_branch}"
+    status=$(api_request GET "/repos/${organization}/${repository}/branch_protections" '' "${protections_file}")
+    expect_status "${status}" 200 "read back ${repository} branch protections"
+    tr -d '[:space:]' <"${protections_file}" | sed 's/},{/}\
+{/g' | grep -F "\"rule_name\":\"${default_branch}\"" >"${protection_file}" || true
+  fi
+
+  compact=$(tr -d '[:space:]' <"${protection_file}")
+  for required in \
+    "\"rule_name\":\"${default_branch}\"" \
+    '"enable_push":true' \
+    '"enable_push_whitelist":true' \
+    "\"push_whitelist_usernames\":[\"${protected_reviewer}\"]" \
+    '"push_whitelist_deploy_keys":false' \
+    '"enable_force_push":false' \
+    '"enable_merge_whitelist":true' \
+    "\"merge_whitelist_usernames\":[\"${protected_reviewer}\"]" \
+    '"enable_approvals_whitelist":true' \
+    "\"approvals_whitelist_username\":[\"${protected_reviewer}\"]" \
+    '"required_approvals":1' \
+    '"block_on_rejected_reviews":true' \
+    '"block_on_outdated_branch":true' \
+    '"dismiss_stale_approvals":true' \
+    '"block_admin_merge_override":true'
+  do
+    printf '%s' "${compact}" | grep -Fq "${required}" || \
+      die "${repository} ${default_branch} protection differs from the human-review policy"
+  done
+
+  rm -f "${repo_file}" "${protections_file}" "${protection_file}" "${response_file}"
+}
+
 wait_for_gitea
 ensure_user "${reconciler_user}" "${reconciler_email}" true
 ensure_user "${hermes_user}" "${hermes_email}" false
@ -318,6 +376,10 @@ expect_status "${status}" 204 "add Hermes to Atlas contributors"

 transfer_managed_repositories

+for repository in ${managed_repositories}; do
+  ensure_default_branch_protection "${repository}"
+done
+
 vault_write gitea/atlas-reconciler "{\"data\":{\"username\":\"${reconciler_user}\",\"token\":\"${reconciler_token}\",\"base_url\":\"${public_url}\"}}"
 vault_write hermes/developer-gitea "{\"data\":{\"username\":\"${hermes_user}\",\"email\":\"${hermes_email}\",\"token\":\"${hermes_token}\",\"base_url\":\"${public_url}\"}}"

--- a/services/hermes-observer-rbac/kustomization.yaml
+++ b/services/hermes-observer-rbac/kustomization.yaml
@ -0,0 +1,6 @@
+# services/hermes-observer-rbac/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - rbac.yaml
+  - rolebindings.yaml
--- a/services/hermes-observer-rbac/rbac.yaml
+++ b/services/hermes-observer-rbac/rbac.yaml
@ -0,0 +1,112 @@
+# services/hermes-observer-rbac/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: hermes-agent-cluster-observer-v2
+  labels:
+    app.kubernetes.io/name: hermes-agent
+    app.kubernetes.io/part-of: hermes
+rules:
+  - apiGroups: [""]
+    resources:
+      - namespaces
+      - nodes
+      - persistentvolumes
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources:
+      - csidrivers
+      - csinodes
+      - storageclasses
+      - volumeattachments
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: hermes-agent-namespaced-observer-v2
+  labels:
+    app.kubernetes.io/name: hermes-agent
+    app.kubernetes.io/part-of: hermes
+rules:
+  - apiGroups: [""]
+    resources:
+      - configmaps
+      - endpoints
+      - events
+      - persistentvolumeclaims
+      - pods
+      - pods/log
+      - replicationcontrollers
+      - resourcequotas
+      - services
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources:
+      - controllerrevisions
+      - daemonsets
+      - deployments
+      - replicasets
+      - statefulsets
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["cronjobs", "jobs"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["autoscaling"]
+    resources: ["horizontalpodautoscalers"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses", "networkpolicies"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["policy"]
+    resources: ["poddisruptionbudgets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["csistoragecapacities"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups:
+      - helm.toolkit.fluxcd.io
+      - image.toolkit.fluxcd.io
+      - kustomize.toolkit.fluxcd.io
+      - notification.toolkit.fluxcd.io
+      - source.toolkit.fluxcd.io
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["longhorn.io"]
+    resources:
+      - backingimages
+      - engines
+      - instancemanagers
+      - nodes
+      - replicas
+      - settings
+      - volumes
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: hermes-agent-cluster-observer-v2
+  labels:
+    app.kubernetes.io/name: hermes-agent
+    app.kubernetes.io/part-of: hermes
+subjects:
+  - kind: ServiceAccount
+    name: hermes-agent
+    namespace: hermes
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: hermes-agent-cluster-observer-v2
--- a/services/hermes-observer-rbac/rolebindings.yaml
+++ b/services/hermes-observer-rbac/rolebindings.yaml
@ -0,0 +1,204 @@
+# services/hermes-observer-rbac/rolebindings.yaml
+apiVersion: v1
+kind: List
+items:
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: ai}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: bstein-dev-home}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: cassandra}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: cert-manager}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: climate}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: comms}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: crypto}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: default}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: finance}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: flux-system}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: game-stream}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: gitea}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: harbor}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: health}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: hermes}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: hermes-chat}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: hermes-triage-demo}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: jellyfin}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: jenkins}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: kube-node-lease}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: kube-public}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: kube-system}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: logging}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: longhorn-system}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: mailu-mailserver}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: maintenance}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: metallb-system}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: monitoring}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: nextcloud}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: openclaw}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: outline}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: planka}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: postgres}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: quality}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: sso}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: sui-metrics}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: traefik}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: vault}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: vaultwarden}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
+  - apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata: {name: hermes-agent-observer, namespace: veles}
+    subjects: [{kind: ServiceAccount, name: hermes-agent, namespace: hermes}]
+    roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: hermes-agent-namespaced-observer-v2}
--- a/services/hermes-scm-broker/deployment.yaml
+++ b/services/hermes-scm-broker/deployment.yaml
@ -0,0 +1,97 @@
+# services/hermes-scm-broker/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hermes-scm-broker
+  namespace: hermes-scm
+  labels:
+    app: hermes-scm-broker
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: hermes-scm-broker
+  template:
+    metadata:
+      labels:
+        app: hermes-scm-broker
+      annotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/role: hermes-scm-broker
+        vault.hashicorp.com/agent-inject-secret-gitea-token: kv/data/atlas/hermes/developer-gitea
+        vault.hashicorp.com/agent-inject-template-gitea-token: |
+          {{- with secret "kv/data/atlas/hermes/developer-gitea" -}}
+          {{ .Data.data.token }}
+          {{- end }}
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/agent-init-first: "true"
+        vault.hashicorp.com/agent-requests-cpu: 10m
+        vault.hashicorp.com/agent-requests-mem: 32Mi
+        vault.hashicorp.com/agent-limits-cpu: 50m
+        vault.hashicorp.com/agent-limits-mem: 64Mi
+    spec:
+      serviceAccountName: hermes-scm-broker
+      automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 10000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: [arm64]
+                  - key: node-role.kubernetes.io/worker
+                    operator: In
+                    values: ["true"]
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: hardware
+                    operator: In
+                    values: [rpi5]
+      containers:
+        - name: broker
+          image: registry.bstein.dev/bstein/hermes-agent
+          imagePullPolicy: IfNotPresent
+          command:
+            - /opt/hermes/.venv/bin/python
+            - /opt/broker/scm_broker.py
+          ports:
+            - {name: http, containerPort: 9081, protocol: TCP}
+          readinessProbe:
+            httpGet: {path: /healthz, port: http}
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet: {path: /healthz, port: http}
+            initialDelaySeconds: 15
+            periodSeconds: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+          volumeMounts:
+            - {name: broker-code, mountPath: /opt/broker, readOnly: true}
+            - {name: tmp, mountPath: /tmp}
+          resources:
+            requests: {cpu: 50m, memory: 128Mi}
+            limits: {cpu: "1", memory: 768Mi}
+      volumes:
+        - name: broker-code
+          configMap:
+            name: hermes-scm-boundary
+            defaultMode: 0555
+        - name: tmp
+          emptyDir:
+            sizeLimit: 1Gi
--- a/services/hermes-scm-broker/kustomization.yaml
+++ b/services/hermes-scm-broker/kustomization.yaml
@ -0,0 +1,11 @@
+# services/hermes-scm-broker/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: hermes-scm
+resources:
+  - service.yaml
+  - deployment.yaml
+  - networkpolicy.yaml
+images:
+  - name: registry.bstein.dev/bstein/hermes-agent
+    digest: sha256:37ebf720c783ae908a602916ffccf88d43d205a157957f5dc4b487867aee45e7
--- a/services/hermes-scm-broker/networkpolicy.yaml
+++ b/services/hermes-scm-broker/networkpolicy.yaml
@ -0,0 +1,46 @@
+# services/hermes-scm-broker/networkpolicy.yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: hermes-scm-broker-isolation
+  namespace: hermes-scm
+spec:
+  podSelector:
+    matchLabels:
+      app: hermes-scm-broker
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: hermes
+          podSelector:
+            matchLabels:
+              app: hermes-agent
+      ports:
+        - {protocol: TCP, port: 9081}
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+          podSelector:
+            matchLabels:
+              app: vault
+      ports:
+        - {protocol: TCP, port: 8200}
+    - to:
+        - ipBlock:
+            cidr: 192.168.22.9/32
+      ports:
+        - {protocol: TCP, port: 443}
--- a/services/hermes-scm-broker/service.yaml
+++ b/services/hermes-scm-broker/service.yaml
@ -0,0 +1,13 @@
+# services/hermes-scm-broker/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes-scm-broker
+  namespace: hermes-scm
+spec:
+  selector:
+    app: hermes-scm-broker
+  ports:
+    - name: http
+      port: 9081
+      targetPort: http
--- a/services/hermes-scm-namespace/kustomization.yaml
+++ b/services/hermes-scm-namespace/kustomization.yaml
@ -0,0 +1,5 @@
+# services/hermes-scm-namespace/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
--- a/services/hermes-scm-namespace/namespace.yaml
+++ b/services/hermes-scm-namespace/namespace.yaml
@ -0,0 +1,14 @@
+# services/hermes-scm-namespace/namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hermes-scm
+  labels:
+    app.kubernetes.io/name: hermes-scm-broker
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: hermes-scm-broker
+  namespace: hermes-scm
+automountServiceAccountToken: true
--- a/services/hermes/agent-configmap.yaml
+++ b/services/hermes/agent-configmap.yaml
@ -189,9 +189,9 @@ data:
    not replace these coordinator-wide rules. Never call `kanban_show` without
    a known, non-empty task ID. Ad-hoc inspection and acceptance checks do not
    need a synthetic Kanban lookup, and must load a skill only when its workflow
-    materially applies. Atlas HTTPS Git authentication is already supplied by
-    the runtime-only `GIT_ASKPASS`; use it without reading or exposing the
-    credential. Coordinator guidance lives at
+    materially applies. Atlas Git access is supplied by the isolated SCM
+    broker; no repository token is present in this pod. Use only configured
+    broker remotes and clients. Coordinator guidance lives at
    `/opt/data/workspace/AGENTS.md` when more detail is needed.

    The Jetson classifier is mandatory for AUTO selection. Switchyard may use
@ -295,70 +295,73 @@ data:
    objective's difficulty warrants it; otherwise synthesize at the original
    effort.

-    This owner-only pod has cluster-admin access across Atlas, including logs,
-    Secrets, exec, port-forwarding, rollout operations, and Flux reconciliation.
-    Prefer the titan-iac Git/Flux workflow for every durable cluster change;
-    direct operations are available for explicit operator requests, incident
-    recovery, and verification, and must be followed by a matching source-of-
-    truth change when they alter desired state. Never expose credentials in
-    chat or logs. Triage belongs at triage.hermes.bstein.dev.
+    This owner-only pod has scoped read-only Kubernetes diagnostics across
+    Atlas, including resource status, events, logs, and Flux/Helm evidence. It
+    cannot read Secrets, exec or attach to pods, create service-account tokens,
+    mutate workloads or RBAC, or reconcile Flux. Put every durable cluster
+    change on a reviewed titan-iac branch. Never expose credentials in chat or
+    logs. Triage belongs at triage.hermes.bstein.dev.

    ## Atlas engineering access

    The Atlas organization has private visibility. Repository visibility is
    preserved per project and may be public or private; do not infer a
    repository's visibility from the organization setting. Repositories are
-    canonical at `https://scm.bstein.dev/atlas/<repo>.git`. HTTPS Git
-    authentication is already supplied through `GIT_ASKPASS`. Verify the remote
+    canonical at `https://scm.bstein.dev/atlas/<repo>.git`; worker Git traffic
+    uses `http://hermes-scm-broker.hermes-scm.svc.cluster.local:9081/git/atlas/<repo>.git`.
+    Verify the broker remote
    and cleanly separate pre-existing changes, create a task branch, run the
    repository's tests, use `git push --dry-run` when proving access, and push a
    real branch only when the requested implementation is review-ready. Never
    force-push.

-    `scm.bstein.dev` is Gitea, not GitHub. Never load or follow a GitHub/`gh`
-    skill for an Atlas remote, and do not interpret an unauthenticated Gitea
-    HTTP 404 as a missing private repository. Use authenticated Git for clone,
-    fetch, and push. For pull-request metadata, comments, and merges, call
-    `/opt/coordinator/gitea_api.py METHOD /api/v1/...`; it injects the runtime
-    Vault token without exposing it to the command line, environment, output,
-    or transcript. Before a consequential merge, independently verify the
-    exact base/head ancestry and diff, run the relevant tests, and confirm the
-    candidate Jenkins result. Prefer the internal endpoint in
-    `JENKINS_BASE_URL`; when Jenkins API authorization prevents a read, use the
-    existing cluster access to inspect the controller's job/build files and
-    logs rather than guessing a public hostname. The preferred read-only path
-    is `/opt/coordinator/jenkins_build_evidence.py JOB [--branch BRANCH]
-    [--commit SHA] --wait`; it distinguishes a genuinely terminal build from
-    nested Jenkins execution metadata and returns bounded JSON/log evidence.
-    With a branch, the helper also tries the conventional `JOB-branches`
-    multibranch name. For JSON Gitea mutations, prefer repeatable shell-safe
-    `--field KEY=VALUE` arguments over hand-quoted JSON.
-    After merging, observe the default-branch build to a terminal result and
-    report exact commit, build, and test evidence.
+    `scm.bstein.dev` is Forgejo/Gitea, not GitHub. Never load or follow a
+    GitHub/`gh` skill for an Atlas remote, and do not interpret an
+    unauthenticated Gitea HTTP 404 as a missing private repository. Use
+    brokered Git for clone, fetch, and creation of a new namespaced feature
+    branch. Existing-ref updates, protected refs, deletion, and force-push are
+    rejected. For bounded
+    repository/pull-request evidence or to create a review-ready draft PR, load
+    `$manage-atlas-pull-requests` and use `/opt/scm/gitea_api.py`. The
+    client carries no repository credential; a separate least-authority
+    workload performs the allowed operation. It permits only Atlas-scoped
+    metadata reads and verified same-repository draft creation. Updates, merge,
+    approve, close, delete, comments, repository administration, and force-push
+    are unavailable; never bypass the client with raw HTTP. Leave every PR
+    unmerged for Brad's review. Independently
+    verify the exact base/head ancestry and diff, run the relevant tests, and
+    confirm the candidate Jenkins result before presenting a handoff. Prefer
+    the internal endpoint in
+    `JENKINS_BASE_URL`; when Jenkins API authorization prevents a read, use
+    Kubernetes pod logs and status evidence without exec or secret access.
+    Do not bypass the boundary to inspect controller files. If Brad separately
+    reports that he merged the PR, observe
+    the default-branch build to a terminal result and report exact commit,
+    build, and test evidence.

    The workspace already has a non-secret Hermes Git author identity. Do not
    use `git reset --hard`, even in a fresh clone; use a detached worktree or a
    clean branch switch when comparing revisions, and preserve any unexpected
-    file as user state. Use the Gitea pull-request merge endpoint for an open
-    PR so both Git history and PR state remain auditable. If an authorized
-    manual merge already reached the base branch, reconcile the open PR with
-    `Do=manually-merged` and its exact merge commit instead of leaving stale
-    review state.
+    file as user state. PR publication ends at the verified open draft; Brad
+    owns review and merge authority.

    The terminal PATH contains the pinned operator tools. Start cluster work
    with `kubectl config current-context`, read-only status/events/logs, and the
-    relevant `titan-iac` manifests. Put durable desired-state changes on a
-    reviewable `titan-iac` branch, validate Kustomize and client dry-run, then
-    use Flux reconciliation after the tracked change is published. Direct
-    `kubectl` mutations are for explicit incident recovery or ephemeral
-    verification, not ordinary delivery.
+    relevant `titan-iac` manifests. The broker namespace is deliberately
+    excluded from agent RBAC. Kubernetes cannot express a deny on one namespace
+    inside an all-namespace list, so enumerate namespaces and run namespaced
+    diagnostics instead of relying on `kubectl ... --all-namespaces`. Put
+    durable desired-state changes on a
+    reviewable `titan-iac` branch and validate Kustomize and client dry-run.
+    Brad owns merge and Flux reconciliation. Direct `kubectl` mutation is not
+    available to the agent; hand an explicit incident mutation back to Brad.

-    Node SSH uses a dedicated audited Hermes identity: `ssh titan-04` (or any
-    current Kubernetes node name). Host keys are pinned and password fallback
-    is disabled. Use SSH only for host-level evidence or repairs that cannot be
-    performed through Kubernetes. Read first, identify the exact node and
-    impact, avoid fleet-wide destructive commands, and reflect persistent host
-    configuration in the appropriate tracked provisioning source.
+    Node SSH uses the dedicated locked-password `hermes-agent` OS account:
+    `ssh titan-04` (or any current Kubernetes node name). Host keys are pinned,
+    password fallback is disabled, and the account has no sudo, disk, runtime,
+    or Kubernetes-storage authority. Use it for unprivileged host evidence;
+    hand privileged host repair back to Brad and reflect persistent changes in
+    the tracked provisioning source.

    Treat every credential, SSH identity, host-trust record, and
    credential-bearing access-client state as runtime-only Vault data. Keep
@ -395,7 +398,7 @@ data:
    <low|medium|high|xhigh> [model]` for a persistent override. The first native
    Codex worker requires one device-code login; refreshed provider credentials
    persist through Vault while client caches remain disposable. The owner
-    workspace includes cluster-admin Kubernetes
-    access plus `kubectl`, `flux`, `helm`, `kustomize`, `vault`, `sops`, `age`,
+    workspace includes scoped read-only Kubernetes diagnostics plus `kubectl`,
+    `flux`, `helm`, `kustomize`, `vault`, `sops`, `age`,
    `terraform`, `k9s`, `jq`, `yq`, `gh`, Git, SSH, Python, Node, the
    browser/computer tools, and the native provider CLIs.
--- a/services/hermes/agent-deployment.yaml
+++ b/services/hermes/agent-deployment.yaml
@ -46,16 +46,6 @@ spec:
          {{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
          {{ .Data.data.codex_auth_json }}
          {{- end }}
-        vault.hashicorp.com/agent-inject-secret-gitea-token: kv/data/atlas/hermes/developer-gitea
-        vault.hashicorp.com/agent-inject-template-gitea-token: |
-          {{- with secret "kv/data/atlas/hermes/developer-gitea" -}}
-          {{ .Data.data.token }}
-          {{- end }}
-        vault.hashicorp.com/agent-inject-secret-gitea-username: kv/data/atlas/hermes/developer-gitea
-        vault.hashicorp.com/agent-inject-template-gitea-username: |
-          {{- with secret "kv/data/atlas/hermes/developer-gitea" -}}
-          {{ .Data.data.username }}
-          {{- end }}
        vault.hashicorp.com/agent-inject-secret-node-ssh-private-key: kv/data/atlas/hermes/developer-ssh
        vault.hashicorp.com/agent-inject-template-node-ssh-private-key: |
          {{- with secret "kv/data/atlas/hermes/developer-ssh" -}}
@ -185,9 +175,8 @@ spec:
                chmod 0600 "${profile_env}"
                chown 10000:10000 "${profile_env}"
              done
-              upsert_env GIT_ASKPASS /opt/coordinator/gitea_askpass.sh
              upsert_env GIT_TERMINAL_PROMPT 0
-              upsert_env GITEA_BASE_URL https://scm.bstein.dev
+              upsert_env HERMES_SCM_BROKER_URL http://hermes-scm-broker.hermes-scm.svc.cluster.local:9081
              upsert_env JENKINS_BASE_URL http://jenkins.jenkins.svc.cluster.local:8080
              upsert_env ARIADNE_BASE_URL http://ariadne.maintenance.svc.cluster.local
              upsert_env VICTORIA_METRICS_URL http://victoria-metrics-single-server.monitoring.svc.cluster.local:8428
@ -662,6 +651,8 @@ spec:
            - {name: subprocess-secret-patch, mountPath: /opt/hermes/tools/process_registry.py, subPath: process_registry.py}
            - {name: kubeconfig, mountPath: /opt/data/home/.kube/config, subPath: config, readOnly: true}
            - {name: auto-router-plugin, mountPath: /opt/data/plugins/auto-router, readOnly: true}
+            - {name: atlas-pr-skill, mountPath: /opt/data/workspace/skills/manage-atlas-pull-requests, readOnly: true}
+            - {name: scm-boundary, mountPath: /opt/scm, readOnly: true}
            - {name: routing-catalog, mountPath: /routing-catalog, readOnly: true}
            - {name: tmp, mountPath: /tmp}
          startupProbe:
@ -825,6 +816,8 @@ spec:
            - {name: subprocess-secret-patch, mountPath: /opt/hermes/tools/process_registry.py, subPath: process_registry.py}
            - {name: kubeconfig, mountPath: /opt/data/home/.kube/config, subPath: config, readOnly: true}
            - {name: auto-router-plugin, mountPath: /opt/data/plugins/auto-router, readOnly: true}
+            - {name: atlas-pr-skill, mountPath: /opt/data/workspace/skills/manage-atlas-pull-requests, readOnly: true}
+            - {name: scm-boundary, mountPath: /opt/scm, readOnly: true}
            - {name: routing-catalog, mountPath: /routing-catalog, readOnly: true}
            - {name: tmp, mountPath: /tmp}
            - {name: ttyd-index, mountPath: /ttyd-index, readOnly: true}
@ -893,6 +886,8 @@ spec:
            - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
            - {name: kubeconfig, mountPath: /opt/data/home/.kube/config, subPath: config, readOnly: true}
            - {name: auto-router-plugin, mountPath: /opt/data/plugins/auto-router, readOnly: true}
+            - {name: atlas-pr-skill, mountPath: /opt/data/workspace/skills/manage-atlas-pull-requests, readOnly: true}
+            - {name: scm-boundary, mountPath: /opt/scm, readOnly: true}
            - {name: tmp, mountPath: /tmp}
          resources:
            requests: {cpu: 100m, memory: 256Mi}
@ -1187,6 +1182,16 @@ spec:
              - {key: dashboard-api.py, path: dashboard/plugin_api.py}
              - {key: dashboard-index.js, path: dashboard/dist/index.js}
              - {key: dashboard-style.css, path: dashboard/dist/style.css}
+        - name: atlas-pr-skill
+          configMap:
+            name: hermes-atlas-pr-skill
+            items:
+              - {key: SKILL.md, path: SKILL.md}
+              - {key: openai.yaml, path: agents/openai.yaml}
+        - name: scm-boundary
+          configMap:
+            name: hermes-scm-boundary
+            defaultMode: 0555
        - name: image-policy
          configMap:
            name: hermes-image-policy
--- a/services/hermes/agent-kubeconfig.yaml
+++ b/services/hermes/agent-kubeconfig.yaml
@ -11,9 +11,9 @@ users:
    user:
      tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
 contexts:
-  - name: atlas-owner
+  - name: atlas-observer
    context:
      cluster: atlas
      user: hermes-agent
      namespace: default
-current-context: atlas-owner
+current-context: atlas-observer
--- a/services/hermes/agent-rbac.yaml
+++ b/services/hermes/agent-rbac.yaml
@ -1,16 +0,0 @@
-# services/hermes/agent-rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: hermes-agent-cluster-admin
-  labels:
-    app.kubernetes.io/name: hermes-agent
-    app.kubernetes.io/part-of: hermes
-subjects:
-  - kind: ServiceAccount
-    name: hermes-agent
-    namespace: hermes
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
--- a/services/hermes/kustomization.yaml
+++ b/services/hermes/kustomization.yaml
@ -7,13 +7,13 @@ images:
    digest: sha256:37ebf720c783ae908a602916ffccf88d43d205a157957f5dc4b487867aee45e7
 resources:
  - namespace.yaml
+  - scm-common
  - vault-serviceaccount.yaml
  - configmap.yaml
  - agent-configmap.yaml
  - chat-configmap.yaml
  - switchyard-configmap.yaml
  - rbac.yaml
-  - agent-rbac.yaml
  - node-ssh-access.yaml
  - pvc.yaml
  - switchyard-pvc.yaml
@ -69,8 +69,6 @@ configMapGenerator:
      - classifier_broker.py=scripts/classifier_broker.py
      - claude_oauth_broker.py=scripts/claude_oauth_broker.py
      - worker_route_broker.py=scripts/worker_route_broker.py
-      - gitea_api.py=scripts/gitea_api.py
-      - gitea_askpass.sh=scripts/gitea_askpass.sh
      - hermes_coordinator.py=scripts/hermes_coordinator.py
      - hermes_model_routing.py=scripts/hermes_model_routing.py
      - hermes_stt_client.py=scripts/hermes_stt_client.py
@ -104,6 +102,12 @@ configMapGenerator:
      - config=agent-kubeconfig.yaml
    options:
      disableNameSuffixHash: true
+  - name: hermes-node-account-hardener
+    namespace: hermes
+    files:
+      - node_account_hardening.py=scripts/node_account_hardening.py
+    options:
+      disableNameSuffixHash: true
  - name: hermes-auto-router-plugin
    namespace: hermes
    files:
@ -158,3 +162,10 @@ configMapGenerator:
      - alert-review.md=skills/tune-atlas-alerts/references/alert-review.md
    options:
      disableNameSuffixHash: true
+  - name: hermes-atlas-pr-skill
+    namespace: hermes
+    files:
+      - SKILL.md=skills/manage-atlas-pull-requests/SKILL.md
+      - openai.yaml=skills/manage-atlas-pull-requests/agents/openai.yaml
+    options:
+      disableNameSuffixHash: true
--- a/services/hermes/networkpolicy.yaml
+++ b/services/hermes/networkpolicy.yaml
@ -119,11 +119,65 @@ spec:
              app: server
      ports:
        - {protocol: TCP, port: 9010}
-  # agent.hermes.bstein.dev is an owner-only engineering workstation. The
-  # browser boundary remains OAuth-protected, while its workers need to reach
-  # every cluster namespace, Atlas LAN service, and hosted provider endpoint.
  egress:
-    - {}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    - to:
+        - namespaceSelector:
+            matchExpressions:
+              - key: kubernetes.io/metadata.name
+                operator: NotIn
+                values: [gitea, hermes-scm]
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: hermes-scm
+          podSelector:
+            matchLabels:
+              app: hermes-scm-broker
+      ports:
+        - {protocol: TCP, port: 9081}
+    - to:
+        - ipBlock:
+            cidr: 10.43.0.1/32
+      ports:
+        - {protocol: TCP, port: 443}
+    - to:
+        - ipBlock:
+            cidr: 192.168.0.0/16
+            except:
+              - 192.168.22.9/32
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: hermes-node-ssh-access-isolation
+  namespace: hermes
+spec:
+  podSelector:
+    matchLabels:
+      app: hermes-node-ssh-access
+  policyTypes: [Ingress, Egress]
+  ingress: []
+  egress: []
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
--- a/services/hermes/node-ssh-access.yaml
+++ b/services/hermes/node-ssh-access.yaml
@ -45,32 +45,15 @@ spec:
        - operator: Exists
      containers:
        - name: key-reconciler
-          image: busybox:1.37
+          image: registry.bstein.dev/bstein/hermes-agent
          imagePullPolicy: IfNotPresent
          command: [/bin/sh, -ec]
          args:
            - |
-              reconcile() {
-                key="$(cat /vault/secrets/node-ssh-public-key)"
-                found=0
-                for user in atlas oceanus; do
-                  home="/host-home/${user}"
-                  [ -d "${home}" ] || continue
-                  found=1
-                  identity="$(awk -F: -v name="${user}" '$1 == name {print $3 ":" $4; exit}' /host-etc/passwd)"
-                  [ -n "${identity}" ] || identity="$(stat -c %u:%g "${home}")"
-                  uid="${identity%%:*}"
-                  gid="${identity##*:}"
-                  install -d -m 0700 -o "${uid}" -g "${gid}" "${home}/.ssh"
-                  touch "${home}/.ssh/authorized_keys"
-                  grep -qxF "${key}" "${home}/.ssh/authorized_keys" || printf '%s\n' "${key}" >> "${home}/.ssh/authorized_keys"
-                  chown "${uid}:${gid}" "${home}/.ssh/authorized_keys"
-                  chmod 0600 "${home}/.ssh/authorized_keys"
-                done
-                [ "${found}" = 1 ] || { echo "no supported node SSH account found" >&2; return 1; }
-              }
              while true; do
-                reconcile
+                /opt/hermes/.venv/bin/python \
+                  /opt/node-hardener/node_account_hardening.py \
+                  --public-key-file /vault/secrets/node-ssh-public-key
                sleep 300
              done
          securityContext:
@ -83,8 +66,18 @@ spec:
          volumeMounts:
            - name: host-home
              mountPath: /host-home
-            - name: host-passwd
-              mountPath: /host-etc/passwd
+            - name: host-etc
+              mountPath: /host-etc
+            - name: host-k3s
+              mountPath: /host-k3s
+            - name: host-kubelet
+              mountPath: /host-kubelet
+            - name: host-run-k3s
+              mountPath: /host-run-k3s
+            - name: host-run-containerd
+              mountPath: /host-run-containerd
+            - name: coordinator
+              mountPath: /opt/node-hardener
              readOnly: true
            - name: vault-secrets
              mountPath: /vault/secrets
@ -94,19 +87,39 @@ spec:
          resources:
            requests:
              cpu: 5m
-              memory: 8Mi
+              memory: 32Mi
            limits:
              cpu: 50m
-              memory: 32Mi
+              memory: 128Mi
      volumes:
        - name: host-home
          hostPath:
            path: /home
            type: Directory
-        - name: host-passwd
+        - name: host-etc
          hostPath:
-            path: /etc/passwd
-            type: File
+            path: /etc
+            type: Directory
+        - name: host-k3s
+          hostPath:
+            path: /var/lib/rancher/k3s
+            type: Directory
+        - name: host-kubelet
+          hostPath:
+            path: /var/lib/kubelet
+            type: Directory
+        - name: host-run-k3s
+          hostPath:
+            path: /run/k3s
+            type: Directory
+        - name: host-run-containerd
+          hostPath:
+            path: /run/containerd
+            type: Directory
+        - name: coordinator
+          configMap:
+            name: hermes-node-account-hardener
+            defaultMode: 0555
        - name: vault-secrets
          csi:
            driver: secrets-store.csi.k8s.io
--- a/services/hermes/scm-common/kustomization.yaml
+++ b/services/hermes/scm-common/kustomization.yaml
@ -0,0 +1,12 @@
+# services/hermes/scm-common/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+configMapGenerator:
+  - name: hermes-scm-boundary
+    files:
+      - gitea_api.py=scripts/gitea_api.py
+      - gitea_api_policy.py=scripts/gitea_api_policy.py
+      - scm_broker.py=scripts/scm_broker.py
+      - scm_broker_client.py=scripts/scm_broker_client.py
+    options:
+      disableNameSuffixHash: true
--- a/services/hermes/scm-common/scripts/gitea_api.py
+++ b/services/hermes/scm-common/scripts/gitea_api.py
@ -0,0 +1,494 @@
+#!/usr/bin/env python3
+"""Use the private Atlas Forgejo API through a least-authority PR boundary."""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import json
+import os
+import re
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from collections.abc import Callable
+from pathlib import Path
+
+from gitea_api_policy import (
+    PolicyError,
+    _draft_title,
+    _reject_forbidden,
+    _validate_body,
+    _validate_pr_number,
+    _validate_pr_number_segment,
+    _validate_query,
+    _validate_ref,
+    _validate_ref_bounds,
+    _validate_repo,
+    _validate_sha,
+)
+
+CANONICAL_BASE_URL = "https://scm.bstein.dev"
+ALLOWED_OWNER = "atlas"
+DEFAULT_TOKEN_FILE = Path("/vault/secrets/gitea-token")
+CREATE_PATH_RE = re.compile(r"/api/v1/repos/atlas/([^/]+)/pulls\Z")
+MAX_ERROR_BYTES = 8192
+MAX_RESPONSE_BYTES = 2 * 1024 * 1024
+MAX_API_TARGET_LENGTH = 768
+MAX_API_PATH_LENGTH = 512
+RAW_API_TARGET_RE = re.compile(r"[A-Za-z0-9/_.?&=-]+\Z")
+
+
+class RejectRedirectHandler(urllib.request.HTTPRedirectHandler):
+    """Reject every redirect before urllib can copy authentication headers."""
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise PolicyError("Forgejo redirects are not allowed")
+
+
+_SAFE_OPENER = urllib.request.build_opener(RejectRedirectHandler())
+
+
+def _safe_urlopen(request: urllib.request.Request, timeout: int):
+    """Open one request using a handler that never follows redirects."""
+    return _SAFE_OPENER.open(request, timeout=timeout)
+
+
+def read_token(path: Path = DEFAULT_TOKEN_FILE) -> str:
+    """Read the token from the pod-lifetime Vault projection."""
+    token = path.read_text(encoding="utf-8").strip()
+    if not token:
+        raise ValueError(f"runtime credential is empty: {path}")
+    return token
+
+
+def configured_base_url() -> str:
+    """Reject attempts to redirect credentials away from the canonical origin."""
+    configured = os.environ.get("GITEA_BASE_URL", CANONICAL_BASE_URL)
+    if configured != CANONICAL_BASE_URL:
+        raise PolicyError("Forgejo origin is fixed to the private Atlas SCM service")
+    return configured
+
+
+def _split_api_path(path: str) -> urllib.parse.SplitResult:
+    if not isinstance(path, str) or len(path) > MAX_API_TARGET_LENGTH:
+        raise PolicyError("API target exceeds the safe size limit")
+    if (
+        not path.isascii()
+        or any(ord(character) < 32 or ord(character) == 127 for character in path)
+        or "\\" in path
+        or not RAW_API_TARGET_RE.fullmatch(path)
+    ):
+        raise PolicyError("API target contains non-canonical raw characters")
+    target = urllib.parse.urlsplit(path)
+    canonical = urllib.parse.urlunsplit(("", "", target.path, target.query, ""))
+    if canonical != path:
+        raise PolicyError("API target is not in exact canonical form")
+    if target.scheme or target.netloc or target.fragment:
+        raise PolicyError("API path must be relative to the Atlas SCM origin")
+    if not target.path.startswith("/api/v1/"):
+        raise PolicyError("API path must start with /api/v1/")
+    if len(target.path) > MAX_API_PATH_LENGTH:
+        raise PolicyError("API path exceeds the safe size limit")
+    segments = target.path.split("/")
+    if "//" in target.path or any(segment in {".", ".."} for segment in segments):
+        raise PolicyError("encoded or non-canonical API paths are not allowed")
+    return target
+
+
+def _authorize_read(
+    target: urllib.parse.SplitResult, *, forbidden: tuple[str, ...] = ()
+) -> str:
+    """Allow only repository, PR, branch, commit, and status metadata reads."""
+    prefix = "/api/v1/repos/atlas/"
+    remainder = target.path.removeprefix(prefix)
+    if remainder == target.path:
+        raise PolicyError("reads are limited to explicit Atlas repository metadata")
+    repo, separator, suffix = remainder.partition("/")
+    _reject_forbidden(repo, "repository", forbidden)
+    _validate_repo(repo)
+
+    if not separator:
+        _validate_query(target, set())
+        return "repository"
+    if suffix == "pulls":
+        _validate_query(target, {"page", "limit", "state"})
+        return "pull-list"
+    content_match = re.fullmatch(r"pulls/([^/]+)\.(?:patch|diff)", suffix)
+    if content_match:
+        _validate_pr_number_segment(content_match.group(1))
+        raise PolicyError("repository API route is outside the metadata read allowlist")
+    pull_match = re.fullmatch(r"pulls/([^/]+)", suffix)
+    if pull_match:
+        _validate_pr_number_segment(pull_match.group(1))
+        _validate_query(target, set())
+        return "pull"
+    evidence_match = re.fullmatch(r"pulls/([^/]+)/(?:commits|files)", suffix)
+    if evidence_match:
+        _validate_pr_number_segment(evidence_match.group(1))
+        _validate_query(target, {"page", "limit"})
+        return "pull-evidence"
+    if suffix == "branches":
+        _validate_query(target, {"page", "limit"})
+        return "branch-list"
+    branch_match = re.fullmatch(r"branches/([^/]+)", suffix)
+    if branch_match:
+        _validate_ref(branch_match.group(1), "branch")
+        _validate_query(target, set())
+        return "branch"
+    if suffix == "commits":
+        _validate_query(target, {"page", "limit"})
+        return "commit-list"
+    if re.fullmatch(r"git/commits/[0-9a-fA-F]{40}", suffix):
+        _validate_query(target, set())
+        return "commit"
+    if re.fullmatch(
+        r"(?:commits/[0-9a-fA-F]{40}/status|commits/[0-9a-fA-F]{40}/statuses|statuses/[0-9a-fA-F]{40})",
+        suffix,
+    ):
+        _validate_query(target, {"page", "limit"})
+        return "status"
+    raise PolicyError("repository API route is outside the metadata read allowlist")
+
+
+def api_url(base_url: str, path: str) -> str:
+    """Return a canonical same-origin URL without forwarding credentials."""
+    if base_url != CANONICAL_BASE_URL:
+        raise PolicyError("Forgejo origin is fixed to the private Atlas SCM service")
+    target = _split_api_path(path)
+    return urllib.parse.urlunsplit(
+        ("https", "scm.bstein.dev", target.path, target.query, "")
+    )
+
+
+def authorize_request(
+    method: str,
+    path: str,
+    data: object | None,
+    *,
+    forbidden: tuple[str, ...] = (),
+) -> str:
+    """Validate one request and return its bounded operation name."""
+    normalized_method = method.upper()
+    target = _split_api_path(path)
+    if normalized_method == "GET":
+        if data is not None:
+            raise PolicyError("read operations cannot include a request body")
+        return _authorize_read(target, forbidden=forbidden)
+    if target.query:
+        raise PolicyError("mutating operations cannot include query parameters")
+    if normalized_method != "POST":
+        raise PolicyError("only read and create-draft operations are available")
+    match = CREATE_PATH_RE.fullmatch(target.path)
+    if not match:
+        raise PolicyError("POST is limited to creating an Atlas draft pull request")
+    _reject_forbidden(match.group(1), "repository", forbidden)
+    _validate_repo(match.group(1))
+    if not isinstance(data, dict) or set(data) != {"base", "body", "head", "title"}:
+        raise PolicyError("draft creation accepts only base, body, head, and title")
+    if data["title"] != _draft_title(data["title"], forbidden=forbidden):
+        raise PolicyError("new pull requests must use the Gitea draft-title prefix")
+    _validate_body(data["body"], forbidden=forbidden)
+    _validate_ref_bounds(data["base"], "base", forbidden=forbidden)
+    _validate_ref_bounds(data["head"], "head", forbidden=forbidden)
+    _validate_ref(data["base"], "base", forbidden=forbidden)
+    _validate_ref(data["head"], "head", forbidden=forbidden)
+    return "create-draft"
+
+
+def build_request(
+    method: str,
+    path: str,
+    *,
+    base_url: str,
+    token: str,
+    data: object | None = None,
+) -> urllib.request.Request:
+    """Build an authorized request without putting the token in its URL or body."""
+    authorize_request(method, path, data, forbidden=(token,))
+    return _build_request(method, path, base_url=base_url, token=token, data=data)
+
+
+def _build_request(
+    method: str,
+    path: str,
+    *,
+    base_url: str,
+    token: str,
+    data: object | None = None,
+) -> urllib.request.Request:
+    """Build one already-authorized upstream request."""
+    payload = None
+    if data is not None:
+        payload = json.dumps(data, separators=(",", ":")).encode("utf-8")
+    return urllib.request.Request(
+        api_url(base_url, path),
+        data=payload,
+        method=method.upper(),
+        headers={
+            "Accept": "application/json",
+            "Authorization": f"token {token}",
+            "Content-Type": "application/json",
+            "User-Agent": "hermes-atlas-pr-client/2",
+        },
+    )
+
+
+def redact_bytes(value: bytes, token: str) -> bytes:
+    """Remove exact runtime-token and authorization-header values from output."""
+    redacted = value.replace(token.encode("utf-8"), b"[REDACTED]")
+    return re.sub(
+        rb"(?i)(authorization\s*[:=]\s*)(?:token|bearer)?\s*[^\s,;\"}]+",
+        rb"\1[REDACTED]",
+        redacted,
+    )
+
+
+def _reject_response_credential(value: bytes, token: str) -> None:
+    """Fail closed if an upstream body reflects any ordinary token encoding."""
+    raw = token.encode("utf-8")
+    forms = {
+        raw,
+        base64.b64encode(raw),
+        base64.b64encode(b"hermes-automation:" + raw),
+        urllib.parse.quote(token, safe="").encode("ascii"),
+    }
+    if any(form and form in value for form in forms):
+        raise PolicyError("Forgejo response contains runtime credential material")
+
+
+def _request(
+    method: str,
+    path: str,
+    data: object | None,
+    *,
+    token: str,
+    opener: Callable[..., object] = _safe_urlopen,
+    authorized: bool = False,
+    expected_status: int,
+) -> bytes:
+    builder = _build_request if authorized else build_request
+    request = builder(method, path, base_url=configured_base_url(), token=token, data=data)
+    with opener(request, timeout=30) as response:  # type: ignore[attr-defined]
+        status = getattr(response, "status", None)
+        if status is None and hasattr(response, "getcode"):
+            status = response.getcode()  # type: ignore[attr-defined]
+        if status != expected_status:
+            raise PolicyError("Forgejo returned an unexpected HTTP status")
+        if response.headers.get_content_type() != "application/json":  # type: ignore[attr-defined]
+            raise PolicyError("Forgejo returned an unexpected response type")
+        body = response.read(MAX_RESPONSE_BYTES + 1)  # type: ignore[attr-defined]
+    if len(body) > MAX_RESPONSE_BYTES:
+        raise PolicyError("Forgejo response exceeds the safe size limit")
+    _reject_response_credential(body, token)
+    return redact_bytes(body, token)
+
+
+def read(
+    path: str, *, token: str, opener: Callable[..., object] = _safe_urlopen
+) -> bytes:
+    """Read one explicitly allowed Atlas repository metadata resource."""
+    return _request(
+        "GET", path, None, token=token, opener=opener, expected_status=200
+    )
+
+
+def _nested(document: dict[str, object], *keys: str) -> object:
+    value: object = document
+    for key in keys:
+        if not isinstance(value, dict) or key not in value:
+            raise PolicyError("Forgejo omitted required pull-request evidence")
+        value = value[key]
+    return value
+
+
+def _require_create_response(
+    value: bytes,
+    *,
+    repo: str,
+    base: str,
+    head: str,
+    head_sha: str,
+    title: str,
+    body: str,
+) -> dict[str, object]:
+    """Require exact server evidence for the intended open draft handoff."""
+    try:
+        document = json.loads(value)
+    except json.JSONDecodeError as exc:
+        raise PolicyError("Forgejo returned invalid pull-request metadata") from exc
+    if not isinstance(document, dict):
+        raise PolicyError("Forgejo returned invalid pull-request metadata")
+    number = _validate_pr_number(document.get("number"))
+    full_name = f"{ALLOWED_OWNER}/{repo}"
+    expected_html = f"{CANONICAL_BASE_URL}/{full_name}/pulls/{number}"
+    checks = (
+        document.get("state") == "open",
+        document.get("draft") is True,
+        document.get("merged") is False,
+        document.get("html_url") == expected_html,
+        document.get("url") == expected_html,
+        document.get("title") == title,
+        document.get("body") == body,
+        _nested(document, "base", "ref") == base,
+        _nested(document, "base", "repo", "full_name") == full_name,
+        _nested(document, "head", "ref") == head,
+        _nested(document, "head", "sha") == head_sha,
+        _nested(document, "head", "repo", "full_name") == full_name,
+    )
+    if not all(checks):
+        raise PolicyError("Forgejo did not confirm the exact draft pull-request state")
+    return document
+
+
+def create_draft(
+    repo: str,
+    *,
+    base: str,
+    head: str,
+    head_sha: str,
+    title: str,
+    body: str,
+    token: str,
+    opener: Callable[..., object] = _safe_urlopen,
+) -> bytes:
+    """Create and verify a same-repository draft pull request for human review."""
+    _reject_forbidden(repo, "repository", (token,))
+    repo = _validate_repo(repo)
+    title = _draft_title(title, forbidden=(token,))
+    body = _validate_body(body, forbidden=(token,))
+    head_sha = _validate_sha(head_sha)
+    _validate_ref_bounds(base, "base", forbidden=(token,))
+    _validate_ref_bounds(head, "head", forbidden=(token,))
+    base = _validate_ref(base, "base", forbidden=(token,))
+    head = _validate_ref(head, "head", forbidden=(token,))
+    data = {"base": base, "body": body, "head": head, "title": title}
+    result = _request(
+        "POST",
+        f"/api/v1/repos/{ALLOWED_OWNER}/{repo}/pulls",
+        data,
+        token=token,
+        opener=opener,
+        authorized=True,
+        expected_status=201,
+    )
+    _require_create_response(
+        result,
+        repo=repo,
+        base=base,
+        head=head,
+        head_sha=head_sha,
+        title=title,
+        body=body,
+    )
+    return result
+
+
+def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
+    """Parse the intentionally narrow read and create-draft operations."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="validate and describe the request without reading a token or using the network",
+    )
+    subparsers = parser.add_subparsers(dest="operation", required=True)
+    read_parser = subparsers.add_parser("read", help="read allowed Atlas metadata")
+    read_parser.add_argument("path")
+    create_parser = subparsers.add_parser(
+        "create-draft", help="create a same-repository draft pull request"
+    )
+    create_parser.add_argument("repo")
+    create_parser.add_argument("--base", required=True)
+    create_parser.add_argument("--head", required=True)
+    create_parser.add_argument("--head-sha", required=True)
+    create_parser.add_argument("--title", required=True)
+    create_parser.add_argument("--body", default="")
+    return parser.parse_args(argv)
+
+
+def _operation(
+    args: argparse.Namespace, *, validate_refs: bool = True
+) -> tuple[str, str, object | None]:
+    if args.operation == "read":
+        return "GET", args.path, None
+    repo = _validate_repo(args.repo)
+    _validate_sha(args.head_sha)
+    body = _validate_body(args.body)
+    title = _draft_title(args.title)
+    _validate_ref_bounds(args.base, "base")
+    _validate_ref_bounds(args.head, "head")
+    base = _validate_ref(args.base, "base") if validate_refs else args.base
+    head = _validate_ref(args.head, "head") if validate_refs else args.head
+    data = {
+        "base": base,
+        "body": body,
+        "head": head,
+        "title": title,
+    }
+    return "POST", f"/api/v1/repos/{ALLOWED_OWNER}/{repo}/pulls", data
+
+
+def _write_body(body: bytes) -> None:
+    if body:
+        sys.stdout.buffer.write(body)
+        if not body.endswith(b"\n"):
+            sys.stdout.buffer.write(b"\n")
+
+
+def main(argv: list[str] | None = None) -> int:
+    """Validate, optionally describe, and execute one safe Forgejo operation."""
+    try:
+        args = parse_args(argv)
+        if args.dry_run:
+            method, path, data = _operation(args, validate_refs=False)
+            operation = authorize_request(method, path, data)
+            print(
+                json.dumps(
+                    {
+                        "dry_run": True,
+                        "host": "scm.bstein.dev",
+                        "operation": operation,
+                        "owner": ALLOWED_OWNER,
+                        "path": path,
+                        "request_fields": sorted(data)
+                        if isinstance(data, dict)
+                        else [],
+                    },
+                    sort_keys=True,
+                )
+            )
+            return 0
+        method, path, data = _operation(args, validate_refs=False)
+        from scm_broker_client import create_draft as broker_create_draft
+        from scm_broker_client import read as broker_read
+
+        if args.operation == "read":
+            body = broker_read(path)
+        else:
+            assert isinstance(data, dict)
+            body = broker_create_draft(
+                args.repo,
+                base=str(data["base"]),
+                head=str(data["head"]),
+                head_sha=args.head_sha,
+                title=str(data["title"]),
+                body=str(data["body"]),
+            )
+        _write_body(body)
+        return 0
+    except urllib.error.HTTPError as exc:
+        exc.read(MAX_ERROR_BYTES)
+        print(f"SCM broker request failed with HTTP {exc.code}", file=sys.stderr)
+        return 1
+    except (OSError, PolicyError, ValueError, json.JSONDecodeError):
+        print(
+            "Forgejo request rejected or unavailable; no credential was disclosed",
+            file=sys.stderr,
+        )
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
--- a/services/hermes/scm-common/scripts/gitea_api_policy.py
+++ b/services/hermes/scm-common/scripts/gitea_api_policy.py
@ -0,0 +1,490 @@
+"""Validation policy for Hermes' least-authority Atlas Forgejo client.
+
+The screening catches structured credential assignments, known token formats,
+and long high-entropy values. It is a fail-closed accident barrier, not proof
+that text is secret-free: a short or multiword secret under an innocuous key is
+not reliably distinguishable from prose and must never be supplied by callers.
+JSON depth/nodes/documents and multiline gaps are deliberately bounded; large
+or unusual configuration blobs are not a supported pull-request field format.
+"""
+
+# ruff: noqa: SIM905
+
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+import urllib.parse
+from collections import Counter
+from math import log2
+
+REPO_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,99}\Z")
+SHA_RE = re.compile(r"[0-9a-fA-F]{40}\Z")
+DRAFT_TITLE_PREFIX = "WIP: "
+GIT_BIN = "/usr/bin/git"
+MAX_QUERY_LENGTH = 128
+MAX_QUERY_ITEMS = 3
+MAX_QUERY_KEY_LENGTH = 16
+MAX_QUERY_VALUE_LENGTH = 16
+MAX_PAGE = 10_000
+MAX_LIMIT = 50
+MAX_PR_NUMBER = 2_147_483_647
+MAX_PR_NUMBER_DIGITS = 10
+MAX_REF_CHARACTERS = 200
+MAX_REF_UTF8_BYTES = 255
+MAX_TITLE_UTF8_BYTES = 512
+MAX_BODY_UTF8_BYTES = 32_768
+MAX_JSON_DOCUMENTS = 32
+MAX_JSON_NODES = 2_048
+MAX_JSON_DEPTH = 32
+CANONICAL_QUERY_RE = re.compile(r"[A-Za-z0-9_=&-]*\Z")
+ASSIGNMENT_RE = re.compile(
+    r"""(?mx)
+    (?<![A-Za-z0-9_.-])
+    (?P<key_quote>[\"']?)
+    (?P<key>\.?[A-Za-z][A-Za-z0-9_.-]{0,127})
+    (?P=key_quote)
+    [ \t]*(?P<separator>[:=])[ \t]*
+    (?P<value>
+      \"(?:\\.|[^\"\\\r\n])*\" |
+      '(?:\\.|[^'\\\r\n])*' |
+      [^\r\n,;}&]{0,2048}
+    )
+    """
+)
+JSON_KEY_RE = re.compile(r'"(?P<key>[^"]{1,512})"(?P<spacing>[\x00-\x20\x7f]{0,256}):')
+MULTILINE_ASSIGNMENT_RE = re.compile(
+    r"""(?mx)
+    (?<![A-Za-z0-9_.-])
+    (?P<key_quote>["']?)
+    (?P<key>\.?[A-Za-z][A-Za-z0-9_.-]{0,127})
+    (?P=key_quote)
+    [ \t]{0,64}(?:\r?\n[ \t]{0,64}){0,4}
+    (?P<separator>[:=])
+    [ \t]{0,64}(?:\r?\n[ \t]{0,64}){1,4}
+    (?P<value>[^\r\n,;}&]{1,2048})
+    """
+)
+CAMEL_BOUNDARY_RE = re.compile(r"(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])")
+CREDENTIAL_SCHEME_RE = re.compile(
+    r"(?i)\b(?:bearer|basic|token)\s+"
+    r"(?=[A-Za-z0-9+/_=.:-]{8,}\b)(?=[A-Za-z0-9+/_=.:-]*[0-9+/_=.-])"
+    r"[A-Za-z0-9+/_=.:-]{8,}"
+)
+STANDALONE_SECRET_PATTERNS = tuple(
+    re.compile(pattern, re.IGNORECASE)
+    for pattern in (
+        r"(?<![A-Za-z0-9])gh[pousr]_[A-Za-z0-9]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])sk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])[rs]k_(?:test|live)_[A-Za-z0-9]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])whsec_[A-Za-z0-9]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])npm_[A-Za-z0-9]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])pypi-[A-Za-z0-9_-]{30,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])(?:gta|gto|gitea|forgejo)_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])ya29\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])oy2[A-Za-z0-9]{40,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])SK[0-9a-f]{32}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])(?:AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])",
+        r"(?<![A-Za-z0-9])eyJ[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9])",
+        r"-----BEGIN\s+[A-Z0-9 ][A-Z0-9 -]{1,62}-----",
+        r"\bssh-(?:rsa|ed25519|dss|ecdsa-[A-Za-z0-9-]+)\s+[A-Za-z0-9+/]{16,}={0,3}",
+        r"https://hooks\.slack\.com/services/[A-Za-z0-9/_-]{20,}",
+        r"https://(?:discord(?:app)?\.com)/api/webhooks/[0-9]+/[A-Za-z0-9._-]{20,}",
+        r"https://[^\s/]*webhook\.office\.com/[^\s]{20,}",
+    )
+)
+HIGH_ENTROPY_TOKEN_RE = re.compile(
+    r"(?<![A-Za-z0-9+/_=-])[A-Za-z0-9+/_=-]{48,16384}(?![A-Za-z0-9+/_=-])"
+)
+PROSE_LEAD_WORDS = frozenset(
+    "add allow change check describe document ensure explain fix handle keep preserve "
+    "prevent reject remove review support test validate".split()
+)
+SENSITIVE_KEY_WORDS = frozenset(
+    "auth authentication authorization auths basic bearer credential credentials "
+    "passwd password pat private sas secret secrets sig signature signing token tokens "
+    "webhook".split()
+)
+KEY_MODIFIER_WORDS = frozenset(
+    "access account api auth client encryption identity private registry secret service "
+    "session signing ssh".split()
+)
+SENSITIVE_COMPACT_KEYS = frozenset(
+    "accessid accesskeyid accountkey clientemail clientid connectionstring "
+    "dockerconfigjson privatekeyid serviceaccountkey sharedaccesssignature".split()
+)
+SENSITIVE_COMPACT_SUFFIXES = tuple(
+    "accesskey accesskeyid accountkey apikey authkey clientemail clientid clientkey "
+    "connectionstring credential credentials encryptionkey identitykey password passwd "
+    "privatekeyid privatekey secret secretkey servicekey sessionkey signature signingkey "
+    "sshkey token webhook".split()
+)
+
+
+class PolicyError(ValueError):
+    """Raised when a requested Forgejo operation exceeds the safe boundary."""
+
+
+def _validate_repo(repo: str) -> str:
+    if not REPO_RE.fullmatch(repo) or repo in {".", ".."}:
+        raise PolicyError("repository name is outside the Atlas allowlist")
+    return repo
+
+
+def _reject_forbidden(value: object, name: str, forbidden: tuple[str, ...]) -> None:
+    """Reject exact runtime credentials before invoking helpers or the network."""
+    if not isinstance(value, str) or any(secret and secret in value for secret in forbidden):
+        raise PolicyError(f"{name} contains runtime credential material")
+
+
+def _validate_ref_bounds(
+    value: object, name: str, *, forbidden: tuple[str, ...] = ()
+) -> str:
+    """Reject oversized or non-encodable refs before invoking Git."""
+    _reject_forbidden(value, name, forbidden)
+    if not value or len(value) > MAX_REF_CHARACTERS:
+        raise PolicyError(f"{name} exceeds the safe branch-name limit")
+    try:
+        encoded = value.encode("utf-8", errors="strict")
+    except UnicodeEncodeError as exc:
+        raise PolicyError(f"{name} is not valid UTF-8 text") from exc
+    if len(encoded) > MAX_REF_UTF8_BYTES:
+        raise PolicyError(f"{name} exceeds the safe UTF-8 branch-name limit")
+    return value
+
+
+def _validate_ref(
+    value: object, name: str, *, forbidden: tuple[str, ...] = ()
+) -> str:
+    """Validate the complete Git ref grammar using Git itself."""
+    value = _validate_ref_bounds(value, name, forbidden=forbidden)
+    if value.startswith("-"):
+        raise PolicyError(f"{name} must be a same-repository branch name")
+    if any(ord(character) < 32 or ord(character) == 127 for character in value):
+        raise PolicyError(f"{name} must be a safe same-repository branch name")
+    result = subprocess.run(
+        [GIT_BIN, "check-ref-format", f"refs/heads/{value}"],
+        stdin=subprocess.DEVNULL,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        check=False,
+    )
+    if result.returncode != 0:
+        raise PolicyError(f"{name} must be a safe same-repository branch name")
+    return value
+
+
+def _validate_sha(value: object, name: str = "head SHA") -> str:
+    if not isinstance(value, str) or not SHA_RE.fullmatch(value):
+        raise PolicyError(f"{name} must be a full Git SHA-1")
+    return value.lower()
+
+
+def _validate_pr_number_segment(value: object) -> int:
+    """Validate a canonical bounded pull-request number from an API path."""
+    if (
+        not isinstance(value, str)
+        or len(value) > MAX_PR_NUMBER_DIGITS
+        or not re.fullmatch(r"[1-9][0-9]*", value)
+    ):
+        raise PolicyError("pull-request number must use bounded canonical ASCII digits")
+    number = int(value)
+    if number > MAX_PR_NUMBER:
+        raise PolicyError("pull-request number is outside its allowed range")
+    return number
+
+
+def _validate_pr_number(value: object) -> int:
+    """Validate a bounded pull-request number returned by Forgejo."""
+    if (
+        not isinstance(value, int)
+        or isinstance(value, bool)
+        or not 1 <= value <= MAX_PR_NUMBER
+    ):
+        raise PolicyError("Forgejo omitted a valid pull-request number")
+    return value
+
+
+def _validate_text(
+    value: object,
+    name: str,
+    maximum: int,
+    maximum_bytes: int,
+    *,
+    required: bool,
+) -> str:
+    if not isinstance(value, str):
+        raise PolicyError(f"{name} must be text")
+    if required and not value.strip():
+        raise PolicyError(f"{name} must not be empty")
+    try:
+        encoded = value.encode("utf-8", errors="strict")
+    except UnicodeEncodeError as exc:
+        raise PolicyError(f"{name} is not valid UTF-8 text") from exc
+    if len(value) > maximum or len(encoded) > maximum_bytes or "\x00" in value:
+        raise PolicyError(f"{name} exceeds the safe request limit")
+    return value
+
+
+def _normalized_key(value: str) -> tuple[tuple[str, ...], str]:
+    """Split camelCase and separator-based assignment keys into semantics."""
+    separated = CAMEL_BOUNDARY_RE.sub(" ", value.strip(".\"'"))
+    words = tuple(re.findall(r"[A-Za-z0-9]+", separated.lower()))
+    return words, "".join(words)
+
+
+def _is_sensitive_key(value: str) -> bool:
+    words, compact = _normalized_key(value)
+    word_set = set(words)
+    if word_set & SENSITIVE_KEY_WORDS:
+        return True
+    if compact in SENSITIVE_COMPACT_KEYS:
+        return True
+    if compact.endswith(SENSITIVE_COMPACT_SUFFIXES):
+        return True
+    if "key" in word_set and word_set & KEY_MODIFIER_WORDS:
+        return True
+    if {"client", "email"} <= word_set or {"client", "id"} <= word_set:
+        return True
+    if {"access", "id"} <= word_set or {"connection", "string"} <= word_set:
+        return True
+    return compact.endswith("configjson")
+
+
+def _strip_assignment_value(value: str) -> tuple[str, bool]:
+    stripped = value.strip()
+    quoted = (
+        len(stripped) >= 2 and stripped[0] in {'"', "'"} and stripped[-1] == stripped[0]
+    )
+    if quoted:
+        stripped = stripped[1:-1].strip()
+    return stripped, quoted
+
+
+def _looks_like_prose(value: str) -> bool:
+    words = re.findall(r"[A-Za-z]+(?:[-'][A-Za-z]+)?", value)
+    if len(words) < 2:
+        return False
+    if re.search(r"[$`{}\[\]\\@/:=+_]", value):
+        return False
+    return words[0].lower() in PROSE_LEAD_WORDS
+
+
+def _looks_sensitive_assignment_value(value: str) -> bool:
+    stripped, quoted = _strip_assignment_value(value)
+    if not stripped:
+        return False
+    if quoted or stripped.startswith(("{", "[", "|", ">", "!!", "&", "*")):
+        return True
+    if CREDENTIAL_SCHEME_RE.search(stripped):
+        return True
+    if any(pattern.search(stripped) for pattern in STANDALONE_SECRET_PATTERNS):
+        return True
+    if re.search(r"(?:https?://|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+)", stripped):
+        return True
+    if re.search(r"(?:\$\{|\$\(|\\[nrt]|[A-Za-z0-9+/]{16,}={0,3}\Z)", stripped):
+        return True
+    return not _looks_like_prose(stripped)
+
+
+def _is_structural_credential_assignment(key: str, value: str) -> bool:
+    words, compact_key = _normalized_key(key)
+    stripped, _quoted = _strip_assignment_value(value)
+    _value_words, compact_value = _normalized_key(stripped)
+    return (
+        compact_key == "type" and compact_value in {"serviceaccount", "credential"}
+    ) or ("service" in words and "account" in words and bool(stripped))
+
+
+def _decode_json_key(raw: str) -> tuple[str, bool]:
+    """Decode one bounded JSON key without silently accepting bad escapes."""
+    try:
+        decoded = json.loads(f'"{raw}"')
+    except (json.JSONDecodeError, UnicodeError):
+        approximate = re.sub(r"[^A-Za-z0-9]+", "_", raw.replace("\\", ""))
+        return approximate, False
+    return decoded if isinstance(decoded, str) else "", True
+
+
+def _json_value_has_sensitive_assignment(
+    value: object, *, depth: int = 0, nodes: list[int] | None = None
+) -> bool:
+    """Walk one decoded JSON value with explicit depth and node ceilings."""
+    if nodes is None:
+        nodes = [0]
+    nodes[0] += 1
+    if nodes[0] > MAX_JSON_NODES or depth > MAX_JSON_DEPTH:
+        raise PolicyError("structured pull-request text exceeds the scan limit")
+    if isinstance(value, dict):
+        for key, assigned in value.items():
+            if not isinstance(key, str):
+                continue
+            if _is_sensitive_key(key):
+                return True
+            assigned_text = assigned if isinstance(assigned, str) else ""
+            if _is_structural_credential_assignment(key, assigned_text):
+                return True
+            if _json_value_has_sensitive_assignment(
+                assigned, depth=depth + 1, nodes=nodes
+            ):
+                return True
+    elif isinstance(value, list):
+        return any(
+            _json_value_has_sensitive_assignment(item, depth=depth + 1, nodes=nodes)
+            for item in value
+        )
+    return False
+
+
+def _decoded_json_documents(value: str):
+    """Yield bounded embedded JSON object or array fragments."""
+    decoder = json.JSONDecoder()
+    index = 0
+    attempts = 0
+    while attempts < MAX_JSON_DOCUMENTS:
+        positions = [
+            position for token in "{[" if (position := value.find(token, index)) >= 0
+        ]
+        if not positions:
+            return
+        start = min(positions)
+        attempts += 1
+        try:
+            document, end = decoder.raw_decode(value, start)
+        except (json.JSONDecodeError, RecursionError, ValueError):
+            index = start + 1
+            continue
+        yield document
+        index = max(end, start + 1)
+    if "{" in value[index:] or "[" in value[index:]:
+        raise PolicyError("structured pull-request text exceeds the scan limit")
+
+
+def _has_structured_sensitive_assignment(value: str) -> bool:
+    """Detect bounded JSON and multiline YAML/env credential assignments."""
+    for candidate in JSON_KEY_RE.finditer(value):
+        decoded, valid = _decode_json_key(candidate.group("key"))
+        if _is_sensitive_key(decoded):
+            return True
+        if not valid and _is_sensitive_key(candidate.group("key").replace("\\", "")):
+            return True
+    for candidate in MULTILINE_ASSIGNMENT_RE.finditer(value):
+        key = candidate.group("key")
+        assigned = candidate.group("value")
+        if _is_structural_credential_assignment(key, assigned) or (
+            _is_sensitive_key(key) and _looks_sensitive_assignment_value(assigned)
+        ):
+            return True
+    return any(
+        _json_value_has_sensitive_assignment(item)
+        for item in _decoded_json_documents(value)
+    )
+
+
+def _has_high_entropy_token(value: str) -> bool:
+    for match in HIGH_ENTROPY_TOKEN_RE.finditer(value):
+        token = match.group(0)
+        if len(token) > 256:
+            return True
+        groups = sum(
+            bool(re.search(pattern, token))
+            for pattern in (r"[a-z]", r"[A-Z]", r"[0-9]", r"[+/_=-]")
+        )
+        counts = Counter(token)
+        entropy = -sum(
+            (count / len(token)) * log2(count / len(token)) for count in counts.values()
+        )
+        if groups >= 3 and entropy >= 4.0:
+            return True
+    return False
+
+
+def _reject_sensitive(value: str, name: str, forbidden: tuple[str, ...]) -> None:
+    if any(secret and secret in value for secret in forbidden):
+        raise PolicyError(f"pull-request {name} contains runtime credential material")
+    if CREDENTIAL_SCHEME_RE.search(value):
+        raise PolicyError(f"pull-request {name} resembles credential material")
+    if any(pattern.search(value) for pattern in STANDALONE_SECRET_PATTERNS):
+        raise PolicyError(f"pull-request {name} resembles credential material")
+    if _has_structured_sensitive_assignment(value):
+        raise PolicyError(f"pull-request {name} resembles credential material")
+    for candidate in ASSIGNMENT_RE.finditer(value):
+        key = candidate.group("key")
+        assigned = candidate.group("value")
+        if _is_structural_credential_assignment(key, assigned) or (
+            _is_sensitive_key(key) and _looks_sensitive_assignment_value(assigned)
+        ):
+            raise PolicyError(f"pull-request {name} resembles credential material")
+    if _has_high_entropy_token(value):
+        raise PolicyError(f"pull-request {name} resembles credential material")
+
+
+def _validate_body(value: object, *, forbidden: tuple[str, ...] = ()) -> str:
+    body = _validate_text(value, "body", 16384, MAX_BODY_UTF8_BYTES, required=False)
+    _reject_sensitive(body, "body", forbidden)
+    return body
+
+
+def _draft_title(value: object, *, forbidden: tuple[str, ...] = ()) -> str:
+    """Return a bounded, secret-screened Gitea draft title."""
+    title = _validate_text(
+        value, "title", 251, MAX_TITLE_UTF8_BYTES, required=True
+    ).strip()
+    _reject_sensitive(title, "title", forbidden)
+    for prefix in ("WIP:", "[WIP]"):
+        if title.upper().startswith(prefix):
+            title = title[len(prefix) :].lstrip()
+            break
+    if not title:
+        raise PolicyError("title must contain text after the draft prefix")
+    return DRAFT_TITLE_PREFIX + title
+
+
+def _validate_query(target: urllib.parse.SplitResult, allowed: set[str]) -> None:
+    """Accept only short canonical ASCII query strings with bounded pagination."""
+    raw = target.query
+    if (
+        len(raw) > MAX_QUERY_LENGTH
+        or not raw.isascii()
+        or not CANONICAL_QUERY_RE.fullmatch(raw)
+        or "%" in raw
+    ):
+        raise PolicyError("API query must use short canonical ASCII form")
+    try:
+        pairs = urllib.parse.parse_qsl(raw, keep_blank_values=True, strict_parsing=True)
+    except ValueError as exc:
+        raise PolicyError("invalid API query") from exc
+    if len(pairs) > MAX_QUERY_ITEMS:
+        raise PolicyError("too many API query parameters")
+    if len({key for key, _ in pairs}) != len(pairs):
+        raise PolicyError("duplicate API query parameters are not allowed")
+    if any(
+        not key
+        or len(key) > MAX_QUERY_KEY_LENGTH
+        or len(value) > MAX_QUERY_VALUE_LENGTH
+        for key, value in pairs
+    ):
+        raise PolicyError("API query key or value exceeds its safe limit")
+    if any(key not in allowed for key, _ in pairs):
+        raise PolicyError("API query parameter is outside the read allowlist")
+    values = dict(pairs)
+    for name in ("page", "limit"):
+        if name not in values:
+            continue
+        if not re.fullmatch(r"[0-9]+", values[name]):
+            raise PolicyError(f"{name} must use ASCII decimal digits")
+        number = int(values[name])
+        if values[name] != str(number):
+            raise PolicyError(f"{name} must use canonical ASCII decimal form")
+        ceiling = MAX_PAGE if name == "page" else MAX_LIMIT
+        if not 1 <= number <= ceiling:
+            raise PolicyError(f"{name} is outside its allowed range")
+    if "state" in values and values["state"] not in {"open", "closed", "all"}:
+        raise PolicyError("pull-request state is invalid")
--- a/services/hermes/scm-common/scripts/scm_broker.py
+++ b/services/hermes/scm-common/scripts/scm_broker.py
@ -0,0 +1,317 @@
+#!/usr/bin/env python3
+"""Serve the credential-isolated Atlas API and Git smart-HTTP boundary."""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import json
+import re
+import urllib.error
+import urllib.parse
+import urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+from gitea_api import (
+    CANONICAL_BASE_URL,
+    PolicyError,
+    create_draft,
+    read,
+    read_token,
+)
+from gitea_api_policy import _reject_forbidden, _validate_ref, _validate_repo
+
+BROKER_PORT = 9081
+GIT_USER = "hermes-automation"
+MAX_CONTROL_BODY = 64 * 1024
+MAX_GIT_REQUEST = 128 * 1024 * 1024
+MAX_GIT_RESPONSE = 128 * 1024 * 1024
+MAX_PUSH_COMMANDS = 16
+ZERO_SHA = b"0" * 40
+GIT_PATH_RE = re.compile(
+    r"/git/atlas/(?P<repo>[A-Za-z0-9][A-Za-z0-9._-]{0,99})\.git/"
+    r"(?P<operation>info/refs|git-upload-pack|git-receive-pack)\Z"
+)
+FEATURE_REF_RE = re.compile(
+    r"refs/heads/(?:(?:feature|fix|hermes|handoff)/[A-Za-z0-9][A-Za-z0-9._/-]{0,190})\Z"
+)
+
+
+class RejectRedirect(urllib.request.HTTPRedirectHandler):
+    """Reject every upstream redirect before credentials can be forwarded."""
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise PolicyError("SCM upstream redirects are not allowed")
+
+
+UPSTREAM_OPENER = urllib.request.build_opener(RejectRedirect())
+
+
+def _status(response: object) -> int | None:
+    value = getattr(response, "status", None)
+    if value is None and hasattr(response, "getcode"):
+        value = response.getcode()  # type: ignore[attr-defined]
+    return value
+
+
+def _read_bounded(stream, maximum: int, length: int | None = None) -> bytes:
+    if length is not None and not 0 <= length <= maximum:
+        raise PolicyError("SCM request exceeds the safe size limit")
+    value = stream.read(maximum + 1 if length is None else length)
+    if len(value) > maximum or (length is not None and len(value) != length):
+        raise PolicyError("SCM request exceeds the safe size limit")
+    return value
+
+
+def _load_json(handler: BaseHTTPRequestHandler) -> dict[str, object]:
+    if handler.headers.get("Transfer-Encoding"):
+        raise PolicyError("chunked broker control requests are not allowed")
+    if handler.headers.get_content_type() != "application/json":
+        raise PolicyError("broker control request must be JSON")
+    length = _content_length(handler.headers, MAX_CONTROL_BODY)
+    value = json.loads(_read_bounded(handler.rfile, MAX_CONTROL_BODY, length))
+    if not isinstance(value, dict):
+        raise PolicyError("broker control request must be an object")
+    return value
+
+
+def _git_target(raw: str) -> tuple[str, str, str]:
+    if (
+        not raw.isascii()
+        or any(ord(character) < 32 or ord(character) == 127 for character in raw)
+        or "%" in raw
+        or "\\" in raw
+        or len(raw) > 512
+    ):
+        raise PolicyError("Git target is not canonical ASCII")
+    target = urllib.parse.urlsplit(raw)
+    canonical = urllib.parse.urlunsplit(("", "", target.path, target.query, ""))
+    if canonical != raw:
+        raise PolicyError("Git target is not in exact canonical form")
+    if target.scheme or target.netloc or target.fragment:
+        raise PolicyError("Git target must be relative")
+    match = GIT_PATH_RE.fullmatch(target.path)
+    if not match:
+        raise PolicyError("Git target is outside the Atlas allowlist")
+    repo = _validate_repo(match.group("repo"))
+    operation = match.group("operation")
+    query = target.query
+    if operation == "info/refs":
+        if query not in {"service=git-upload-pack", "service=git-receive-pack"}:
+            raise PolicyError("Git discovery service is outside the allowlist")
+        service = query.removeprefix("service=")
+    elif query:
+        raise PolicyError("Git RPC query parameters are not allowed")
+    else:
+        service = operation
+    return repo, operation, service
+
+
+def _content_length(headers: object, maximum: int) -> int:
+    """Parse one short canonical bounded Content-Length header."""
+    raw = headers.get("Content-Length", "")  # type: ignore[attr-defined]
+    if (
+        not isinstance(raw, str)
+        or not raw.isascii()
+        or len(raw) > 10
+        or not raw.isdigit()
+    ):
+        raise PolicyError("SCM request length is invalid")
+    length = int(raw)
+    if raw != str(length) or not 0 <= length <= maximum:
+        raise PolicyError("SCM request length is invalid")
+    return length
+
+
+def _credential_forms(token: str) -> tuple[bytes, ...]:
+    basic = base64.b64encode(f"{GIT_USER}:{token}".encode("utf-8"))
+    return token.encode("utf-8"), basic, b"Basic " + basic
+
+
+def _reject_credential_bytes(value: bytes, token: str, context: str) -> None:
+    if any(form in value for form in _credential_forms(token)):
+        raise PolicyError(f"{context} contains runtime credential material")
+
+
+def _validate_receive_pack(body: bytes, token: str) -> None:
+    """Permit only creation of new, namespaced feature branches."""
+    _reject_credential_bytes(body, token, "Git request")
+    position = 0
+    commands = 0
+    while position + 4 <= len(body):
+        header = body[position : position + 4]
+        if not re.fullmatch(rb"[0-9a-f]{4}", header):
+            raise PolicyError("Git receive-pack command framing is invalid")
+        size = int(header, 16)
+        if size == 0:
+            if commands == 0:
+                raise PolicyError("Git receive-pack request has no ref command")
+            return
+        if size < 4 or position + size > len(body):
+            raise PolicyError("Git receive-pack command framing is invalid")
+        command = body[position + 4 : position + size].rstrip(b"\n")
+        command = command.split(b"\x00", 1)[0]
+        fields = command.split(b" ")
+        if len(fields) != 3 or not all(re.fullmatch(rb"[0-9a-f]{40}", item) for item in fields[:2]):
+            raise PolicyError("Git receive-pack ref command is invalid")
+        old_sha, new_sha, raw_ref = fields
+        if old_sha != ZERO_SHA or new_sha == ZERO_SHA:
+            raise PolicyError("Git broker permits only new feature-branch creation")
+        try:
+            ref = raw_ref.decode("ascii")
+        except UnicodeDecodeError as exc:
+            raise PolicyError("Git ref must be canonical ASCII") from exc
+        if not FEATURE_REF_RE.fullmatch(ref):
+            raise PolicyError("Git push is limited to namespaced feature branches")
+        _validate_ref(ref.removeprefix("refs/heads/"), "head", forbidden=(token,))
+        commands += 1
+        if commands > MAX_PUSH_COMMANDS:
+            raise PolicyError("Git push contains too many ref commands")
+        position += size
+    raise PolicyError("Git receive-pack request omitted its command terminator")
+
+
+def _upstream_git_request(
+    target: str,
+    *,
+    method: str,
+    body: bytes | None,
+    content_type: str | None,
+    expected_type: str,
+    token: str,
+    opener=UPSTREAM_OPENER.open,
+) -> bytes:
+    credentials = base64.b64encode(f"{GIT_USER}:{token}".encode()).decode("ascii")
+    headers = {"Accept": expected_type, "Authorization": f"Basic {credentials}"}
+    if content_type:
+        headers["Content-Type"] = content_type
+    request = urllib.request.Request(
+        CANONICAL_BASE_URL + target,
+        data=body,
+        method=method,
+        headers=headers,
+    )
+    with opener(request, timeout=120) as response:
+        if _status(response) != 200:
+            raise PolicyError("Git upstream returned an unexpected HTTP status")
+        if response.headers.get_content_type() != expected_type:
+            raise PolicyError("Git upstream returned an unexpected response type")
+        result = _read_bounded(response, MAX_GIT_RESPONSE)
+    _reject_credential_bytes(result, token, "Git upstream response")
+    return result
+
+
+class BrokerHandler(BaseHTTPRequestHandler):
+    """Expose only bounded metadata, draft creation, and smart-HTTP Git."""
+
+    server_version = "HermesSCMBroker/1"
+    sys_version = ""
+
+    def log_message(self, _format: str, *_args: object) -> None:
+        return
+
+    def _json(self, status: int, body: bytes) -> None:
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _reject(self, status: int = 400) -> None:
+        self._json(status, b'{"error":"request rejected"}')
+
+    def do_GET(self) -> None:
+        try:
+            if self.path == "/healthz":
+                self._json(200, b'{"status":"ok"}')
+                return
+            repo, operation, service = _git_target(self.path)
+            if operation != "info/refs":
+                raise PolicyError("Git RPC requires POST")
+            token = read_token()
+            _reject_forbidden(repo, "repository", (token,))
+            expected = f"application/x-{service}-advertisement"
+            body = _upstream_git_request(
+                f"/atlas/{repo}.git/info/refs?service={service}",
+                method="GET",
+                body=None,
+                content_type=None,
+                expected_type=expected,
+                token=token,
+            )
+            self.send_response(200)
+            self.send_header("Content-Type", expected)
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+        except (OSError, PolicyError, urllib.error.URLError, ValueError):
+            self._reject()
+
+    def do_POST(self) -> None:
+        try:
+            if self.path in {"/v1/metadata", "/v1/drafts"}:
+                self._control()
+            else:
+                self._git_rpc()
+        except (OSError, PolicyError, urllib.error.URLError, ValueError, json.JSONDecodeError):
+            self._reject()
+
+    def _control(self) -> None:
+        data = _load_json(self)
+        token = read_token()
+        if self.path == "/v1/metadata":
+            if set(data) != {"path"} or not isinstance(data["path"], str):
+                raise PolicyError("metadata request fields are invalid")
+            result = read(data["path"], token=token)
+        else:
+            expected = {"base", "body", "head", "head_sha", "repo", "title"}
+            if set(data) != expected or not all(isinstance(data[key], str) for key in expected):
+                raise PolicyError("draft request fields are invalid")
+            result = create_draft(token=token, **data)  # type: ignore[arg-type]
+        if token.encode("utf-8") in result:
+            raise PolicyError("SCM upstream reflected credential material")
+        self._json(200, result)
+
+    def _git_rpc(self) -> None:
+        repo, operation, service = _git_target(self.path)
+        if operation not in {"git-upload-pack", "git-receive-pack"} or service != operation:
+            raise PolicyError("Git RPC operation is outside the allowlist")
+        expected_request = f"application/x-{service}-request"
+        if self.headers.get_content_type() != expected_request or self.headers.get("Transfer-Encoding"):
+            raise PolicyError("Git RPC request type is invalid")
+        length = _content_length(self.headers, MAX_GIT_REQUEST)
+        body = _read_bounded(self.rfile, MAX_GIT_REQUEST, length)
+        token = read_token()
+        _reject_forbidden(repo, "repository", (token,))
+        if service == "git-receive-pack":
+            _validate_receive_pack(body, token)
+        else:
+            _reject_credential_bytes(body, token, "Git request")
+        expected = f"application/x-{service}-result"
+        result = _upstream_git_request(
+            f"/atlas/{repo}.git/{service}",
+            method="POST",
+            body=body,
+            content_type=expected_request,
+            expected_type=expected,
+            token=token,
+        )
+        self.send_response(200)
+        self.send_header("Content-Type", expected)
+        self.send_header("Content-Length", str(len(result)))
+        self.end_headers()
+        self.wfile.write(result)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--listen", default="0.0.0.0")
+    parser.add_argument("--port", type=int, default=BROKER_PORT)
+    args = parser.parse_args()
+    ThreadingHTTPServer((args.listen, args.port), BrokerHandler).serve_forever()
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
--- a/services/hermes/scm-common/scripts/scm_broker_client.py
+++ b/services/hermes/scm-common/scripts/scm_broker_client.py
@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""Call the credential-isolated Hermes SCM broker over its fixed cluster origin."""
+
+from __future__ import annotations
+
+import json
+import urllib.request
+from collections.abc import Callable
+
+from gitea_api_policy import PolicyError
+
+BROKER_ORIGIN = "http://hermes-scm-broker.hermes-scm.svc.cluster.local:9081"
+MAX_RESPONSE_BYTES = 2 * 1024 * 1024
+
+
+class RejectRedirectHandler(urllib.request.HTTPRedirectHandler):
+    """Keep every broker request on its fixed in-cluster origin."""
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise PolicyError("SCM broker redirects are not allowed")
+
+
+_OPENER = urllib.request.build_opener(RejectRedirectHandler())
+
+
+def _open(request: urllib.request.Request, timeout: int):
+    return _OPENER.open(request, timeout=timeout)
+
+
+def request(
+    endpoint: str,
+    payload: dict[str, object],
+    *,
+    opener: Callable[..., object] = _open,
+) -> bytes:
+    """Send one bounded broker operation without any repository credential."""
+    if endpoint not in {"/v1/metadata", "/v1/drafts"}:
+        raise PolicyError("SCM broker operation is outside the client allowlist")
+    body = json.dumps(payload, separators=(",", ":")).encode("utf-8")
+    if len(body) > 64 * 1024:
+        raise PolicyError("SCM broker request exceeds the safe size limit")
+    outgoing = urllib.request.Request(
+        BROKER_ORIGIN + endpoint,
+        data=body,
+        method="POST",
+        headers={
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+            "User-Agent": "hermes-scm-broker-client/1",
+        },
+    )
+    with opener(outgoing, timeout=30) as response:  # type: ignore[attr-defined]
+        status = getattr(response, "status", None)
+        if status is None and hasattr(response, "getcode"):
+            status = response.getcode()  # type: ignore[attr-defined]
+        if status != 200:
+            raise PolicyError("SCM broker returned an unexpected HTTP status")
+        content_type = response.headers.get_content_type()  # type: ignore[attr-defined]
+        if content_type != "application/json":
+            raise PolicyError("SCM broker returned an unexpected response type")
+        result = response.read(MAX_RESPONSE_BYTES + 1)  # type: ignore[attr-defined]
+    if len(result) > MAX_RESPONSE_BYTES:
+        raise PolicyError("SCM broker response exceeds the safe size limit")
+    json.loads(result)
+    return result
+
+
+def read(path: str, *, opener: Callable[..., object] = _open) -> bytes:
+    """Read explicitly allowed Atlas metadata through the broker."""
+    return request("/v1/metadata", {"path": path}, opener=opener)
+
+
+def create_draft(
+    repo: str,
+    *,
+    base: str,
+    head: str,
+    head_sha: str,
+    title: str,
+    body: str,
+    opener: Callable[..., object] = _open,
+) -> bytes:
+    """Create one verified draft through the broker for human review."""
+    return request(
+        "/v1/drafts",
+        {
+            "base": base,
+            "body": body,
+            "head": head,
+            "head_sha": head_sha,
+            "repo": repo,
+            "title": title,
+        },
+        opener=opener,
+    )
--- a/services/hermes/scripts/gitea_api.py
+++ b/services/hermes/scripts/gitea_api.py
@ -1,150 +0,0 @@
-#!/usr/bin/env python3
-"""Call the private Atlas Gitea API through a runtime-only token boundary."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import sys
-import urllib.error
-import urllib.parse
-import urllib.request
-from pathlib import Path
-
-
-DEFAULT_BASE_URL = "https://scm.bstein.dev"
-DEFAULT_TOKEN_FILE = Path("/runtime-access/gitea-token")
-ALLOWED_METHODS = ("GET", "POST", "PUT", "PATCH", "DELETE")
-
-
-def read_token(path: Path = DEFAULT_TOKEN_FILE) -> str:
-    """Read and validate the token from its in-memory Vault projection."""
-    token = path.read_text(encoding="utf-8").strip()
-    if not token:
-        raise ValueError(f"runtime credential is empty: {path}")
-    return token
-
-
-def api_url(base_url: str, path: str) -> str:
-    """Return a same-origin Gitea API URL for a validated API path."""
-    base = urllib.parse.urlsplit(base_url.rstrip("/"))
-    target = urllib.parse.urlsplit(path)
-    if base.scheme not in {"http", "https"} or not base.netloc:
-        raise ValueError("GITEA_BASE_URL must be an absolute HTTP(S) URL")
-    if target.scheme or target.netloc or target.fragment:
-        raise ValueError("API path must be relative to the configured Gitea origin")
-    if not target.path.startswith("/api/v1/"):
-        raise ValueError("API path must start with /api/v1/")
-    return urllib.parse.urlunsplit(
-        (base.scheme, base.netloc, target.path, target.query, "")
-    )
-
-
-def build_request(
-    method: str,
-    path: str,
-    *,
-    base_url: str,
-    token: str,
-    data: object | None = None,
-) -> urllib.request.Request:
-    """Build one authenticated request without placing the token in its URL."""
-    payload = None
-    if data is not None:
-        payload = json.dumps(data, separators=(",", ":")).encode("utf-8")
-    return urllib.request.Request(
-        api_url(base_url, path),
-        data=payload,
-        method=method,
-        headers={
-            "Accept": "application/json",
-            "Authorization": f"token {token}",
-            "Content-Type": "application/json",
-            "User-Agent": "hermes-atlas-operator/1",
-        },
-    )
-
-
-def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
-    """Parse a bounded method, API path, and optional JSON request body."""
-    parser = argparse.ArgumentParser(
-        description="Call the Atlas Gitea API using the runtime Vault token."
-    )
-    parser.add_argument("method", choices=ALLOWED_METHODS)
-    parser.add_argument("path", help="Gitea path beginning with /api/v1/")
-    data_group = parser.add_mutually_exclusive_group()
-    data_group.add_argument("--data-json", help="JSON object/array request body")
-    data_group.add_argument(
-        "--data-file", type=Path, help="path to a JSON request body"
-    )
-    data_group.add_argument(
-        "--field",
-        action="append",
-        metavar="KEY=VALUE",
-        help=(
-            "repeatable JSON field; bare text remains a string while true, false, "
-            "null, numbers, objects, and arrays are decoded as JSON"
-        ),
-    )
-    return parser.parse_args(argv)
-
-
-def parse_fields(values: list[str]) -> dict[str, object]:
-    """Build a JSON object from shell-safe, repeatable key/value arguments."""
-    result: dict[str, object] = {}
-    for value in values:
-        key, separator, raw = value.partition("=")
-        if not separator or not key or any(char.isspace() for char in key):
-            raise ValueError("each --field must be KEY=VALUE with a non-space key")
-        try:
-            result[key] = json.loads(raw)
-        except json.JSONDecodeError:
-            result[key] = raw
-    return result
-
-
-def load_data(args: argparse.Namespace) -> object | None:
-    """Decode the optional JSON body without involving a shell expansion."""
-    if args.data_json is not None:
-        return json.loads(args.data_json)
-    if args.data_file is not None:
-        return json.loads(args.data_file.read_text(encoding="utf-8"))
-    if args.field is not None:
-        return parse_fields(args.field)
-    return None
-
-
-def main(argv: list[str] | None = None) -> int:
-    """Execute the request, print only its response body, and return HTTP status."""
-    args = parse_args(argv)
-    try:
-        request = build_request(
-            args.method,
-            args.path,
-            base_url=os.environ.get("GITEA_BASE_URL", DEFAULT_BASE_URL),
-            token=read_token(),
-            data=load_data(args),
-        )
-        with urllib.request.urlopen(request, timeout=30) as response:
-            body = response.read()
-            if body:
-                sys.stdout.buffer.write(body)
-                if not body.endswith(b"\n"):
-                    sys.stdout.buffer.write(b"\n")
-        return 0
-    except urllib.error.HTTPError as exc:
-        body = exc.read(65536)
-        print(f"Gitea API returned HTTP {exc.code}", file=sys.stderr)
-        if body:
-            sys.stderr.buffer.write(body)
-            if not body.endswith(b"\n"):
-                sys.stderr.buffer.write(b"\n")
-        return 1
-    except (OSError, ValueError, json.JSONDecodeError) as exc:
-        print(f"Gitea API request failed: {exc}", file=sys.stderr)
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
--- a/services/hermes/scripts/gitea_askpass.sh
+++ b/services/hermes/scripts/gitea_askpass.sh
@ -1,19 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-case "${1:-}" in
-  *Username*)
-    if [ -s /runtime-access/gitea-username ]; then
-      tr -d '\r\n' </runtime-access/gitea-username
-    else
-      printf '%s' hermes-automation
-    fi
-    printf '\n'
-    ;;
-  *Password*)
-    test -s /runtime-access/gitea-token
-    tr -d '\r\n' </runtime-access/gitea-token
-    printf '\n'
-    ;;
-  *) exit 1 ;;
-esac
--- a/services/hermes/scripts/hermes_coordinator.py
+++ b/services/hermes/scripts/hermes_coordinator.py
@ -24,8 +24,10 @@ from hermes_model_routing import (


 CASSANDRA_BASE_PATH = Path("/opt/data/workspace/projects/cassandra")
-CASSANDRA_REMOTE = "https://scm.bstein.dev/atlas/cassandra.git"
-DEFAULT_GITEA_TOKEN_PATH = Path("/runtime-access/gitea-token")
+CASSANDRA_REMOTE = (
+    "http://hermes-scm-broker.hermes-scm.svc.cluster.local:9081/"
+    "git/atlas/cassandra.git"
+)


 def cassandra_workspace() -> Path:
@ -139,24 +141,8 @@ def bootstrap_cassandra_state(root: Path) -> dict[str, str]:
    return {"state": "ready"}


-def _gitea_token_path() -> Path:
-    """Return the runtime-only Gitea credential path without reading it."""
-    configured = os.environ.get("HERMES_GITEA_TOKEN_FILE", "").strip()
-    return Path(configured) if configured else DEFAULT_GITEA_TOKEN_PATH
-
-
-def _gitea_token_available() -> bool:
-    """Check credential readiness without loading it into process memory."""
-    try:
-        path = _gitea_token_path()
-        return path.is_file() and path.stat().st_size > 0
-    except OSError:
-        return False
-
-
 def sync_cassandra_repo(env_values: dict[str, str]) -> str:
-    """Clone or fetch Cassandra through the runtime-only askpass credential."""
-    token_available = _gitea_token_available()
+    """Clone or fetch Cassandra through the credential-isolated SCM broker."""
    if shutil.which("git") is None:
        return "git-unavailable"
    child_env = os.environ.copy()
@ -173,9 +159,7 @@ def sync_cassandra_repo(env_values: dict[str, str]) -> str:
            }
        }
    )
-    child_env["GIT_ASKPASS"] = env_values.get(
-        "GIT_ASKPASS", "/opt/coordinator/gitea_askpass.sh"
-    )
+    child_env.pop("GIT_ASKPASS", None)
    child_env["GIT_TERMINAL_PROMPT"] = "0"
    if (CASSANDRA_BASE_PATH / ".git").exists():
        try:
@ -232,8 +216,6 @@ def sync_cassandra_repo(env_values: dict[str, str]) -> str:
                    return f"remote-repair-failed-{repaired.returncode}"
        except (OSError, subprocess.TimeoutExpired):
            return "remote-repair-failed"
-        if not token_available:
-            return "ready; fetch skipped until Gitea token is configured"
        command = [
            "git",
            "-C",
@ -247,8 +229,6 @@ def sync_cassandra_repo(env_values: dict[str, str]) -> str:
        CASSANDRA_BASE_PATH.mkdir(parents=True, exist_ok=True)
        if any(CASSANDRA_BASE_PATH.iterdir()):
            return "unmanaged-nonempty-directory"
-        if not token_available:
-            return "awaiting-gitea-token"
        command = [
            "git",
            "clone",
--- a/services/hermes/scripts/node_account_hardening.py
+++ b/services/hermes/scripts/node_account_hardening.py
@ -0,0 +1,456 @@
+#!/usr/bin/env python3
+"""Reconcile a dedicated unprivileged Hermes SSH account on one Atlas node."""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import errno
+import os
+import stat
+import struct
+from pathlib import Path
+
+HOST_ETC = Path("/host-etc")
+HOST_HOME = Path("/host-home")
+HOST_K3S = Path("/host-k3s")
+HOST_KUBELET = Path("/host-kubelet")
+HOST_RUN_K3S = Path("/host-run-k3s")
+HOST_RUN_CONTAINERD = Path("/host-run-containerd")
+ACCOUNT = "hermes-agent"
+ACCOUNT_UID = 1200
+ACCOUNT_GID = 1200
+ACCOUNT_HOME = "/home/hermes-agent"
+ACCOUNT_SHELL = "/bin/bash"
+HOST_ROOT_UID = 0
+HOST_ROOT_GID = 0
+LEGACY_ACCOUNTS = ("atlas", "oceanus")
+MAX_ACCOUNT_FILE = 2 * 1024 * 1024
+MAX_AUTHORIZED_KEYS = 1024 * 1024
+ACL_VERSION = 2
+ACL_UNDEFINED_ID = 0xFFFFFFFF
+ACL_USER_OBJ = 0x01
+ACL_USER = 0x02
+ACL_GROUP_OBJ = 0x04
+ACL_GROUP = 0x08
+ACL_MASK = 0x10
+ACL_OTHER = 0x20
+ACL_HEADER = struct.Struct("<I")
+ACL_ENTRY = struct.Struct("<HHI")
+ACL_XATTR = "system.posix_acl_access"
+
+
+class HardeningError(RuntimeError):
+    """Raised before an unsafe or ambiguous host-account change."""
+
+
+def _read_regular(path: Path, maximum: int = MAX_ACCOUNT_FILE) -> tuple[bytes, os.stat_result]:
+    flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
+    descriptor = os.open(path, flags)
+    try:
+        metadata = os.fstat(descriptor)
+        if not stat.S_ISREG(metadata.st_mode) or metadata.st_size > maximum:
+            raise HardeningError(f"unsafe regular file: {path.name}")
+        value = os.read(descriptor, maximum + 1)
+    finally:
+        os.close(descriptor)
+    if len(value) != metadata.st_size:
+        raise HardeningError(f"short file read: {path.name}")
+    return value, metadata
+
+
+def _records(value: bytes, fields: int, name: str) -> list[list[str]]:
+    try:
+        text = value.decode("utf-8")
+    except UnicodeDecodeError as exc:
+        raise HardeningError(f"{name} is not UTF-8") from exc
+    if not text.endswith("\n"):
+        raise HardeningError(f"{name} is missing its final newline")
+    records = []
+    names = set()
+    for line in text.splitlines():
+        parts = line.split(":")
+        if len(parts) != fields or not parts[0] or parts[0] in names:
+            raise HardeningError(f"{name} has an invalid record")
+        names.add(parts[0])
+        records.append(parts)
+    return records
+
+
+def _encode(records: list[list[str]]) -> bytes:
+    return ("\n".join(":".join(record) for record in records) + "\n").encode()
+
+
+def _expected_records() -> dict[str, list[str]]:
+    return {
+        "passwd": [
+            ACCOUNT,
+            "x",
+            str(ACCOUNT_UID),
+            str(ACCOUNT_GID),
+            "Hermes Agent",
+            ACCOUNT_HOME,
+            ACCOUNT_SHELL,
+        ],
+        "group": [ACCOUNT, "x", str(ACCOUNT_GID), ""],
+        "shadow": [ACCOUNT, "!", "1", "0", "99999", "7", "", "", ""],
+        "gshadow": [ACCOUNT, "!", "", ""],
+    }
+
+
+def _reconcile_record(
+    records: list[list[str]], expected: list[str], *, identity_index: int
+) -> list[list[str]]:
+    for record in records:
+        same_name = record[0] == expected[0]
+        same_identity = record[identity_index] == expected[identity_index]
+        if same_name or same_identity:
+            if record != expected:
+                raise HardeningError("dedicated Hermes account identity conflicts")
+            return records
+    return [*records, expected]
+
+
+def _backup_once(path: Path, value: bytes, metadata: os.stat_result) -> Path:
+    backup = path.with_name(path.name + ".hermes-boundary-backup")
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0)
+    try:
+        descriptor = os.open(backup, flags, stat.S_IMODE(metadata.st_mode))
+    except FileExistsError:
+        _read_regular(backup)
+        return backup
+    try:
+        if os.write(descriptor, value) != len(value):
+            raise HardeningError(f"short backup write: {path.name}")
+        os.fchown(descriptor, metadata.st_uid, metadata.st_gid)
+        os.fsync(descriptor)
+    finally:
+        os.close(descriptor)
+    return backup
+
+
+def _atomic_write(
+    path: Path, value: bytes, *, mode: int, uid: int, gid: int
+) -> None:
+    temporary = path.with_name(f".{path.name}.hermes-{os.getpid()}")
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0)
+    descriptor = os.open(temporary, flags, mode)
+    try:
+        if os.write(descriptor, value) != len(value):
+            raise HardeningError(f"short atomic write: {path.name}")
+        os.fchmod(descriptor, mode)
+        os.fchown(descriptor, uid, gid)
+        os.fsync(descriptor)
+    except Exception:
+        temporary.unlink(missing_ok=True)
+        raise
+    finally:
+        os.close(descriptor)
+    os.replace(temporary, path)
+    directory = os.open(path.parent, os.O_RDONLY)
+    try:
+        os.fsync(directory)
+    finally:
+        os.close(directory)
+
+
+def _reconcile_databases() -> None:
+    expected = _expected_records()
+    definitions = (
+        ("passwd", 7, 2),
+        ("group", 4, 2),
+        ("shadow", 9, 0),
+        ("gshadow", 4, 0),
+    )
+    planned = []
+    account_present = False
+    for name, fields, identity_index in definitions:
+        path = HOST_ETC / name
+        value, metadata = _read_regular(path)
+        records = _records(value, fields, name)
+        updated = _reconcile_record(
+            records, expected[name], identity_index=identity_index
+        )
+        if name == "passwd":
+            account_present = expected[name] in records
+        planned.append((path, value, metadata, _encode(updated)))
+    try:
+        (HOST_HOME / ACCOUNT).lstat()
+    except FileNotFoundError:
+        pass
+    else:
+        if not account_present:
+            raise HardeningError("dedicated Hermes account home already exists")
+    for path, value, metadata, _updated in planned:
+        _backup_once(path, value, metadata)
+    try:
+        for path, _old, metadata, updated in planned:
+            _atomic_write(
+                path,
+                updated,
+                mode=stat.S_IMODE(metadata.st_mode),
+                uid=metadata.st_uid,
+                gid=metadata.st_gid,
+            )
+        for path, _old, _metadata, _updated in planned:
+            name = path.name
+            fields = next(item[1] for item in definitions if item[0] == name)
+            records = _records(_read_regular(path)[0], fields, name)
+            if expected[name] not in records:
+                raise HardeningError("dedicated Hermes account validation failed")
+    except Exception:
+        for path, old, metadata, _updated in planned:
+            _atomic_write(
+                path,
+                old,
+                mode=stat.S_IMODE(metadata.st_mode),
+                uid=metadata.st_uid,
+                gid=metadata.st_gid,
+            )
+        raise
+
+
+def _validated_public_key(path: Path) -> bytes:
+    value, _ = _read_regular(path, 16 * 1024)
+    line = value.strip()
+    if b"\n" in line or b"\r" in line:
+        raise HardeningError("Hermes public key must contain one line")
+    fields = line.split()
+    if len(fields) not in {2, 3} or fields[0] not in {
+        b"ssh-ed25519",
+        b"ecdsa-sha2-nistp256",
+        b"ssh-rsa",
+    }:
+        raise HardeningError("Hermes public key format is unsupported")
+    try:
+        base64.b64decode(fields[1], validate=True)
+    except ValueError as exc:
+        raise HardeningError("Hermes public key payload is invalid") from exc
+    return line
+
+
+def _directory(path: Path, *, mode: int, uid: int, gid: int) -> None:
+    try:
+        path.mkdir(mode=mode)
+    except FileExistsError:
+        pass
+    metadata = path.lstat()
+    if not stat.S_ISDIR(metadata.st_mode) or stat.S_ISLNK(metadata.st_mode):
+        raise HardeningError(f"unsafe account directory: {path.name}")
+    if metadata.st_uid not in {0, uid} or metadata.st_gid not in {0, gid}:
+        raise HardeningError(f"account directory ownership conflicts: {path.name}")
+    os.chown(path, uid, gid)
+    path.chmod(mode)
+
+
+def _without_key(value: bytes, key: bytes) -> bytes:
+    return b"".join(
+        line
+        for line in value.splitlines(keepends=True)
+        if line.strip(b"\r\n") != key
+    )
+
+
+def _move_key(public_key: Path) -> None:
+    key = _validated_public_key(public_key)
+    home = HOST_HOME / ACCOUNT
+    ssh = home / ".ssh"
+    _directory(home, mode=0o700, uid=ACCOUNT_UID, gid=ACCOUNT_GID)
+    _directory(ssh, mode=0o700, uid=ACCOUNT_UID, gid=ACCOUNT_GID)
+    target = ssh / "authorized_keys"
+    if target.exists():
+        current, metadata = _read_regular(target, MAX_AUTHORIZED_KEYS)
+        if current != key + b"\n":
+            _backup_once(target, current, metadata)
+    _atomic_write(target, key + b"\n", mode=0o600, uid=ACCOUNT_UID, gid=ACCOUNT_GID)
+    for legacy in LEGACY_ACCOUNTS:
+        authorized = HOST_HOME / legacy / ".ssh" / "authorized_keys"
+        try:
+            value, metadata = _read_regular(authorized, MAX_AUTHORIZED_KEYS)
+        except FileNotFoundError:
+            continue
+        updated = _without_key(value, key)
+        if updated == value:
+            continue
+        _backup_once(authorized, value, metadata)
+        _atomic_write(
+            authorized,
+            updated,
+            mode=stat.S_IMODE(metadata.st_mode),
+            uid=metadata.st_uid,
+            gid=metadata.st_gid,
+        )
+    if _read_regular(target, MAX_AUTHORIZED_KEYS)[0] != key + b"\n":
+        raise HardeningError("dedicated Hermes authorized key validation failed")
+
+
+def _decode_acl(value: bytes, mode: int) -> list[tuple[int, int, int]]:
+    """Decode a bounded POSIX ACL or derive one from ordinary mode bits."""
+    if not value:
+        group = (mode >> 3) & 0o7
+        return [
+            (ACL_USER_OBJ, (mode >> 6) & 0o7, ACL_UNDEFINED_ID),
+            (ACL_GROUP_OBJ, group, ACL_UNDEFINED_ID),
+            (ACL_MASK, group, ACL_UNDEFINED_ID),
+            (ACL_OTHER, mode & 0o7, ACL_UNDEFINED_ID),
+        ]
+    if len(value) < ACL_HEADER.size or (len(value) - ACL_HEADER.size) % ACL_ENTRY.size:
+        raise HardeningError("sensitive directory ACL is malformed")
+    if ACL_HEADER.unpack_from(value)[0] != ACL_VERSION:
+        raise HardeningError("sensitive directory ACL version is unsupported")
+    entries = [
+        ACL_ENTRY.unpack_from(value, offset)
+        for offset in range(ACL_HEADER.size, len(value), ACL_ENTRY.size)
+    ]
+    if any(permission > 0o7 for _tag, permission, _identifier in entries):
+        raise HardeningError("sensitive directory ACL permission is malformed")
+    required = {ACL_USER_OBJ, ACL_GROUP_OBJ, ACL_OTHER}
+    if not required <= {tag for tag, _permission, _identifier in entries}:
+        raise HardeningError("sensitive directory ACL is incomplete")
+    return entries
+
+
+def _encode_acl(entries: list[tuple[int, int, int]]) -> bytes:
+    return ACL_HEADER.pack(ACL_VERSION) + b"".join(
+        ACL_ENTRY.pack(*entry) for entry in entries
+    )
+
+
+def _acl_with_deny(value: bytes, mode: int) -> bytes:
+    entries = _decode_acl(value, mode)
+    entries = [
+        entry
+        for entry in entries
+        if not (entry[0] == ACL_USER and entry[2] == ACCOUNT_UID)
+    ]
+    entries.append((ACL_USER, 0, ACCOUNT_UID))
+    if not any(tag == ACL_MASK for tag, _permission, _identifier in entries):
+        entries.append((ACL_MASK, (mode >> 3) & 0o7, ACL_UNDEFINED_ID))
+    order = {
+        ACL_USER_OBJ: 0,
+        ACL_USER: 1,
+        ACL_GROUP_OBJ: 2,
+        ACL_GROUP: 3,
+        ACL_MASK: 4,
+        ACL_OTHER: 5,
+    }
+    entries.sort(key=lambda entry: (order.get(entry[0], 99), entry[2]))
+    return _encode_acl(entries)
+
+
+def _read_acl(path: Path) -> bytes:
+    try:
+        return os.getxattr(path, ACL_XATTR, follow_symlinks=False)
+    except OSError as exc:
+        if exc.errno in {errno.ENODATA, getattr(errno, "ENOATTR", errno.ENODATA)}:
+            return b""
+        raise
+
+
+def _validate_acl_backup(value: bytes) -> None:
+    if value[:1] not in {b"A", b"N"}:
+        raise HardeningError("sensitive directory ACL backup is malformed")
+    if value[:1] == b"A":
+        if len(value) == 1:
+            raise HardeningError("sensitive directory ACL backup is malformed")
+        _decode_acl(value[1:], 0)
+    elif value != b"N":
+        raise HardeningError("sensitive directory ACL backup is malformed")
+
+
+def _acl_backup_once(path: Path, value: bytes) -> None:
+    """Persist the original ACL as a private, durable host recovery file."""
+    root = HOST_ETC / "hermes-node-boundary"
+    _directory(root, mode=0o700, uid=HOST_ROOT_UID, gid=HOST_ROOT_GID)
+    backup = root / f"{path.name}.acl"
+    encoded = b"A" + value if value else b"N"
+    try:
+        existing, _metadata = _read_regular(backup, 64 * 1024)
+    except FileNotFoundError:
+        pass
+    else:
+        _validate_acl_backup(existing)
+        return
+
+    temporary = root / f".{path.name}.acl.hermes-{os.getpid()}"
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0)
+    descriptor = os.open(temporary, flags, 0o600)
+    try:
+        if os.write(descriptor, encoded) != len(encoded):
+            raise HardeningError("short sensitive directory ACL backup write")
+        os.fchmod(descriptor, 0o600)
+        os.fchown(descriptor, HOST_ROOT_UID, HOST_ROOT_GID)
+        os.fsync(descriptor)
+    except Exception:
+        temporary.unlink(missing_ok=True)
+        raise
+    finally:
+        os.close(descriptor)
+    try:
+        os.link(temporary, backup, follow_symlinks=False)
+    except FileExistsError:
+        # Another reconciler won the race; never overwrite the first backup.
+        pass
+    finally:
+        temporary.unlink(missing_ok=True)
+    stored, _metadata = _read_regular(backup, 64 * 1024)
+    _validate_acl_backup(stored)
+    directory = os.open(root, os.O_RDONLY)
+    try:
+        os.fsync(directory)
+    finally:
+        os.close(directory)
+
+
+def _deny_sensitive_root(path: Path) -> None:
+    metadata = path.lstat()
+    if not stat.S_ISDIR(metadata.st_mode) or stat.S_ISLNK(metadata.st_mode):
+        raise HardeningError(f"unsafe sensitive directory: {path.name}")
+    if metadata.st_uid != HOST_ROOT_UID:
+        raise HardeningError(f"sensitive directory is not root-owned: {path.name}")
+    current = _read_acl(path)
+    _acl_backup_once(path, current)
+    updated = _acl_with_deny(current, stat.S_IMODE(metadata.st_mode))
+    try:
+        os.setxattr(path, ACL_XATTR, updated, follow_symlinks=False)
+        verified = _decode_acl(_read_acl(path), stat.S_IMODE(metadata.st_mode))
+        if (ACL_USER, 0, ACCOUNT_UID) not in verified:
+            raise HardeningError("sensitive directory ACL validation failed")
+    except Exception:
+        if current:
+            os.setxattr(path, ACL_XATTR, current, follow_symlinks=False)
+        else:
+            try:
+                os.removexattr(path, ACL_XATTR, follow_symlinks=False)
+            except OSError as exc:
+                if exc.errno not in {
+                    errno.ENODATA,
+                    getattr(errno, "ENOATTR", errno.ENODATA),
+                }:
+                    raise
+        raise
+
+
+def _deny_sensitive_roots() -> None:
+    for path in (HOST_K3S, HOST_KUBELET, HOST_RUN_K3S, HOST_RUN_CONTAINERD):
+        _deny_sensitive_root(path)
+
+
+def reconcile(public_key: Path) -> None:
+    """Create the locked account and move only the Hermes authorization key."""
+    _reconcile_databases()
+    _deny_sensitive_roots()
+    _move_key(public_key)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--public-key-file", type=Path, required=True)
+    args = parser.parse_args()
+    reconcile(args.public_key_file)
+    print("Dedicated Hermes node account reconciled.", flush=True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
--- a/services/hermes/scripts/stage_runtime_access.py
+++ b/services/hermes/scripts/stage_runtime_access.py
@ -86,6 +86,21 @@ def _write_empty_auth_store() -> None:
    os.chown(path, OWNER_UID, OWNER_GID)


+def _stage_node_ssh_config() -> None:
+    """Force every Atlas node alias onto the dedicated Hermes OS account."""
+    destination = RUNTIME_ROOT / "node-ssh-config"
+    source = _copy_secret("node-ssh-config", destination)
+    if "\x00" in source:
+        destination.unlink(missing_ok=True)
+        raise RuntimeError("node SSH config contains invalid control data")
+    destination.write_text(
+        "Host titan-*\n  User hermes-agent\n" + source.rstrip() + "\n",
+        encoding="utf-8",
+    )
+    destination.chmod(0o600)
+    os.chown(destination, OWNER_UID, OWNER_GID)
+
+
 def stage_agent() -> None:
    """Stage the owner agent's complete runtime access set."""
    for path in (RUNTIME_ROOT, RUNTIME_ROOT / "claude", RUNTIME_ROOT / "codex"):
@ -93,13 +108,11 @@ def stage_agent() -> None:
    for name in (
        "agent-api-key",
        "chat-relay-key",
-        "gitea-token",
-        "gitea-username",
        "node-ssh-private-key",
-        "node-ssh-config",
        "node-ssh-known-hosts",
    ):
        _copy_secret(name, RUNTIME_ROOT / name)
+    _stage_node_ssh_config()
    _validated_json(
        "claude-credentials",
        RUNTIME_ROOT / "claude" / ".credentials.json",
--- a/services/hermes/skills/manage-atlas-pull-requests/SKILL.md
+++ b/services/hermes/skills/manage-atlas-pull-requests/SKILL.md
@ -0,0 +1,64 @@
+---
+name: manage-atlas-pull-requests
+description: Read bounded private Atlas repository and pull-request metadata or create a verified draft pull request after a tested branch is pushed through Hermes' least-authority Forgejo client. Use for PR handoff in scm.bstein.dev/atlas repositories. Never use it to update, merge, approve, close, delete, or force-push.
+---
+
+# Manage Atlas pull requests
+
+Use `/opt/scm/gitea_api.py` for Forgejo API access. The agent pod has no
+repository credential. The client calls a separate least-authority broker;
+never bypass it with `curl` or direct Gitea HTTP.
+
+Use the configured broker Git remote for clone, fetch, and creation of a new
+namespaced feature branch. Existing-ref updates, protected refs, deletion,
+and force-push are rejected by the broker. Never replace that remote with a
+credential-bearing URL.
+
+## Read repository or PR state
+
+Pass one allowed Atlas metadata API path to the read operation:
+
+```sh
+/opt/scm/gitea_api.py read /api/v1/repos/atlas/REPO/pulls/NUMBER
+```
+
+The client exposes only repository metadata, PRs and PR evidence, branches,
+commits, and commit status. Hooks, Actions secrets/variables, collaborators,
+protections, reviews, merge endpoints, releases, and administration are
+rejected even as reads. Responses are size-bounded. Treat returned state as
+evidence, not authorization to change it.
+
+## Create a review handoff
+
+Before opening a PR, verify the remote, branch, clean worktree, diff, tests, and
+exact pushed commit. Never force-push. Pass that full 40-character pushed head
+SHA explicitly. Keep the short body free of credentials and credential-like
+text. The client screens structured assignments, known token formats, and long
+high-entropy values as an accidental-disclosure barrier. It cannot prove text
+is secret-free: short or multiword secrets under innocuous names may resemble
+ordinary prose, so never place credential material in either field. Structured
+inspection is deliberately bounded; large, deeply nested, or unusual config
+blobs do not belong in these fields and may be rejected. Validate without
+reading a credential or using the network:
+
+```sh
+/opt/scm/gitea_api.py --dry-run create-draft REPO \
+  --base main --head hermes/TASK --head-sha FULL_PUSHED_SHA \
+  --title "Focused change" --body "Tests and review evidence"
+```
+
+Run the same command without `--dry-run` only when the branch is review-ready.
+The client accepts success only when Forgejo returns the exact requested
+repository, base/head refs, head SHA, title/body, canonical URLs, positive PR
+number, and open/unmerged/draft state. Report its URL and exact head commit to
+Brad. Leave it unmerged for human review. PR updates are intentionally absent;
+publish a corrected tested commit and ask Brad how to proceed if metadata must
+change.
+
+## Stop at the authority boundary
+
+Update, merge, approve, close, delete, branch mutation, comments, releases,
+repository administration, and force-push are intentionally unavailable. Do
+not bypass the client with a raw HTTP request. If one of those actions is
+needed, present the tested commit and evidence to Brad and stop for human
+review.
--- a/services/hermes/skills/manage-atlas-pull-requests/agents/openai.yaml
+++ b/services/hermes/skills/manage-atlas-pull-requests/agents/openai.yaml
@ -0,0 +1,4 @@
+interface:
+  display_name: "Manage Atlas Pull Requests"
+  short_description: "Create safe draft PR handoffs for human review"
+  default_prompt: "Use $manage-atlas-pull-requests to inspect the requested Atlas repository or prepare a tested branch as an unmerged draft pull request. Preserve the human review boundary."
--- a/services/maintenance/apps/metis-configmap.yaml
+++ b/services/maintenance/apps/metis-configmap.yaml
@ -15,7 +15,7 @@ data:
  METIS_MAX_DEVICE_BYTES: "1000000000000"
  METIS_NAMESPACE: maintenance
  METIS_REMOTE_POD_TIMEOUT_SEC: "14400"
-  METIS_RUNNER_IMAGE_AMD64: registry.bstein.dev/bstein/metis:0.1.0-295-amd64 # {"$imagepolicy": "maintenance:metis-amd64"}
+  METIS_RUNNER_IMAGE_AMD64: registry.bstein.dev/bstein/metis:0.1.0-296-amd64 # {"$imagepolicy": "maintenance:metis-amd64"}
  METIS_RUNNER_IMAGE_ARM64: registry.bstein.dev/bstein/metis:0.1.0-295-arm64 # {"$imagepolicy": "maintenance:metis-arm64"}
  METIS_HARBOR_REGISTRY: registry.bstein.dev
  METIS_HARBOR_PROJECT: metis
--- a/services/maintenance/node-ops/metis-sentinel-amd64-daemonset.yaml
+++ b/services/maintenance/node-ops/metis-sentinel-amd64-daemonset.yaml
@ -32,7 +32,7 @@ spec:
        kubernetes.io/arch: amd64
      containers:
        - name: metis-sentinel
-          image: registry.bstein.dev/bstein/metis-sentinel:0.1.0-295-amd64 # {"$imagepolicy": "maintenance:metis-sentinel-amd64"}
+          image: registry.bstein.dev/bstein/metis-sentinel:0.1.0-296-amd64 # {"$imagepolicy": "maintenance:metis-sentinel-amd64"}
          imagePullPolicy: Always
          envFrom:
            - configMapRef:
--- a/services/vault/hermes-auth-role-bootstrap-job.yaml
+++ b/services/vault/hermes-auth-role-bootstrap-job.yaml
@ -3,7 +3,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: vault-k8s-auth-hermes-8
+  name: vault-k8s-auth-hermes-9
  namespace: vault
 spec:
  backoffLimit: 2
--- a/services/vault/scripts/vault_k8s_auth_configure.sh
+++ b/services/vault/scripts/vault_k8s_auth_configure.sh
@ -256,7 +256,9 @@ write_policy_and_role "game-stream" "game-stream" "game-stream-vault" \
 write_policy_and_role "hermes" "hermes" "hermes-vault,hermes-triage" \
  "hermes/triage-oidc hermes/agent-tokens hermes/triage-api" ""
 write_policy_and_role "hermes-agent" "hermes" "hermes-agent,hermes-switchyard" \
-  "hermes/agent-oidc hermes/agent-tokens hermes/chat-telegram hermes/developer-keycloak hermes/developer-gitea hermes/developer-harbor hermes/developer-jenkins hermes/developer-ssh" ""
+  "hermes/agent-oidc hermes/agent-tokens hermes/chat-telegram hermes/developer-keycloak hermes/developer-harbor hermes/developer-jenkins hermes/developer-ssh" ""
+write_policy_and_role "hermes-scm-broker" "hermes-scm" "hermes-scm-broker" \
+  "hermes/developer-gitea" ""
 write_policy_and_role "hermes-credential-sync" "hermes" "hermes-agent" \
  "" "hermes/agent-tokens"
 write_policy_and_role "hermes-node-ssh" "hermes" "hermes-node-ssh-access" \
--- a/testing/tests/test_hermes_chat_quality.py
+++ b/testing/tests/test_hermes_chat_quality.py
@ -92,16 +92,23 @@ def test_agent_config_keeps_delegated_reviewers_from_owning_task_lifecycle():
    assert "Atlas organization has private visibility" in instructions
    assert "may be public or private" in instructions
    assert "do not infer a\nrepository's visibility" in instructions
-    assert "already supplied through `GIT_ASKPASS`" in instructions
+    assert "brokered Git for clone, fetch" in instructions
+    assert "client carries no repository credential" in instructions
    assert "Never call `kanban_show` without a known, non-empty task ID" in instructions
    assert "bounded ad-hoc inspection and acceptance checks may" in instructions
    assert "load implementation or TDD skills" in instructions
    assert "Never call `kanban_show` without\na known, non-empty task ID" in soul
    assert "must load a skill only when its workflow\nmaterially applies" in soul
-    assert "runtime-only `GIT_ASKPASS`" in soul
-    assert "`scm.bstein.dev` is Gitea, not GitHub" in instructions
-    assert "Never load or follow a GitHub/`gh`" in instructions
-    assert "/opt/coordinator/gitea_api.py METHOD /api/v1/..." in instructions
+    assert "no repository token is present in this pod" in soul
+    assert "`scm.bstein.dev` is Forgejo/Gitea, not GitHub" in instructions
+    assert "GitHub/`gh` skill for an Atlas remote" in instructions
+    assert "load\n`$manage-atlas-pull-requests`" in instructions
+    assert "Updates, merge,\napprove, close, delete, comments" in instructions
+    assert "Leave every PR\nunmerged for Brad's review" in instructions
+    assert "Use the Gitea pull-request merge endpoint" not in instructions
+    assert "reconcile the open PR" not in instructions
+    assert "use Flux reconciliation after" not in instructions
+    assert "PR publication ends at the verified open draft" in instructions
    assert "JENKINS_BASE_URL" in instructions
    assert "Do not\nuse `git reset --hard`" in instructions
    rendered = (HERMES / "agent-deployment.yaml").read_text()
@ -554,13 +561,15 @@ def test_chat_image_generation_uses_private_owner_broker():
        "app": "hermes-chat-tenant"
    }
    vault_policy = (VAULT / "scripts" / "vault_k8s_auth_configure.sh").read_text()
-    assert (
-        '"hermes/agent-oidc hermes/agent-tokens hermes/chat-telegram '
-        'hermes/developer-keycloak hermes/developer-gitea '
-        'hermes/developer-harbor hermes/developer-jenkins '
-        'hermes/developer-ssh"'
-        in vault_policy
-    )
+    agent_role = vault_policy[
+        vault_policy.index('write_policy_and_role "hermes-agent"') :
+        vault_policy.index(
+            "write_policy_and_role",
+            vault_policy.index('write_policy_and_role "hermes-agent"') + 1,
+        )
+    ]
+    assert "hermes/developer-gitea" not in agent_role
+    assert 'write_policy_and_role "hermes-scm-broker" "hermes-scm"' in vault_policy
    assert (
        'write_policy_and_role "hermes-node-ssh" "hermes" '
        '"hermes-node-ssh-access"' in vault_policy
--- a/testing/tests/test_hermes_cli_lanes.py
+++ b/testing/tests/test_hermes_cli_lanes.py
@ -15,7 +15,8 @@ import pytest
 import yaml


-SCRIPTS = Path(__file__).parents[2] / "services/hermes/scripts"
+ROOT = Path(__file__).parents[2]
+SCRIPTS = ROOT / "services/hermes/scripts"
 sys.path.insert(0, str(SCRIPTS))
 HERMES = Path(__file__).parents[2] / "services/hermes"
 KEYCLOAK = Path(__file__).parents[2] / "services/keycloak"
@ -1353,20 +1354,27 @@ def test_agent_network_boundary_allows_only_authenticated_and_metrics_surfaces()
            "ports": [{"protocol": "TCP", "port": 9010}],
        },
    ]
-    assert isolation["spec"]["egress"] == [{}]
+    egress = isolation["spec"]["egress"]
+    assert any(
+        rule.get("ports") == [{"protocol": "TCP", "port": 9081}]
+        for rule in egress
+    )
+    assert "hermes-scm" in yaml.safe_dump(egress)
+    assert "gitea" in yaml.safe_dump(egress)
+    assert egress != [{}]


-def test_owner_agent_has_cluster_admin_kubernetes_context():
+def test_owner_agent_has_scoped_read_only_kubernetes_context():
    config = yaml.safe_load((HERMES / "agent-kubeconfig.yaml").read_text())
-    assert config["current-context"] == "atlas-owner"
+    assert config["current-context"] == "atlas-observer"
    assert config["contexts"][0]["context"]["namespace"] == "default"
-    rbac_path = HERMES / "agent-rbac.yaml"
+    rbac_path = ROOT / "services/hermes-observer-rbac/rbac.yaml"
    documents = [item for item in yaml.safe_load_all(rbac_path.read_text()) if item]
    binding = next(item for item in documents if item["kind"] == "ClusterRoleBinding")
    assert binding["roleRef"] == {
        "apiGroup": "rbac.authorization.k8s.io",
        "kind": "ClusterRole",
-        "name": "cluster-admin",
+        "name": "hermes-agent-cluster-observer-v2",
    }
    assert binding["subjects"] == [
        {"kind": "ServiceAccount", "name": "hermes-agent", "namespace": "hermes"}
@ -1441,15 +1449,16 @@ def test_owner_agent_has_pinned_dedicated_node_ssh_access():
        "secretProviderClass": "hermes-node-ssh-access"
    }
    reconciler = pod["containers"][0]["args"][0]
-    assert "cat /vault/secrets/node-ssh-public-key" in reconciler
-    assert "grep -qxF" in reconciler
-    assert "for user in atlas oceanus" in reconciler
-    assert "/host-etc/passwd" in reconciler
-    assert "chown \"${uid}:${gid}\"" in reconciler
-    host_passwd = next(
-        item for item in pod["volumes"] if item["name"] == "host-passwd"
-    )
-    assert host_passwd["hostPath"] == {"path": "/etc/passwd", "type": "File"}
+    assert "/opt/node-hardener/node_account_hardening.py" in reconciler
+    assert "--public-key-file /vault/secrets/node-ssh-public-key" in reconciler
+    assert "sleep 300" in reconciler
+    host_etc = next(item for item in pod["volumes"] if item["name"] == "host-etc")
+    assert host_etc["hostPath"] == {"path": "/etc", "type": "Directory"}
+    hardener = (HERMES / "scripts/node_account_hardening.py").read_text()
+    assert 'ACCOUNT = "hermes-agent"' in hardener
+    assert 'LEGACY_ACCOUNTS = ("atlas", "oceanus")' in hardener
+    assert 'ACCOUNT_UID = 1200' in hardener
+    assert 'ACCOUNT_GID = 1200' in hardener


 def test_owner_agent_tracks_no_ssh_identity_or_host_key_material():
@ -1518,7 +1527,9 @@ def test_switchyard_has_a_dedicated_non_owner_identity_and_read_only_catalog():

    rbac = [
        item
-        for item in yaml.safe_load_all((HERMES / "agent-rbac.yaml").read_text())
+        for item in yaml.safe_load_all(
+            (ROOT / "services/hermes-observer-rbac/rbac.yaml").read_text()
+        )
        if item
    ]
    binding = next(item for item in rbac if item["kind"] == "ClusterRoleBinding")
--- a/testing/tests/test_hermes_coordinator.py
+++ b/testing/tests/test_hermes_coordinator.py
@ -445,8 +445,10 @@ def test_cassandra_sync_repairs_existing_worktree(
    assert all("GITEA_TOKEN" not in environment for environment in environments)


-def test_cassandra_sync_repairs_origin_without_token(tmp_path: Path, monkeypatch):
-    """Missing credentials skip only the fetch, not the local origin repair."""
+def test_cassandra_sync_repairs_origin_through_broker_without_token(
+    tmp_path: Path, monkeypatch
+):
+    """Repository sync uses the credential-isolated broker remote."""
    workspace = tmp_path / "cassandra"
    (workspace / ".git").mkdir(parents=True)
    monkeypatch.setattr(coordinator, "CASSANDRA_BASE_PATH", workspace)
@ -461,8 +463,13 @@ def test_cassandra_sync_repairs_origin_without_token(tmp_path: Path, monkeypatch
    monkeypatch.setattr(coordinator.subprocess, "run", run)
    state = coordinator.sync_cassandra_repo({})

-    assert state == "ready; fetch skipped until Gitea token is configured"
-    assert [command[-3] for command in commands] == ["remote", "set-url"]
+    assert state == "ready"
+    assert any(
+        "hermes-scm-broker.hermes-scm.svc.cluster.local" in " ".join(cmd)
+        for cmd in commands
+    )
+    assert all("token" not in " ".join(cmd).lower() for cmd in commands)
+    assert commands[-1][-4:] == ["fetch", "--quiet", "--prune", "origin"]


 def test_migrate_open_cassandra_tasks_preserves_running_and_done_tasks():
--- a/testing/tests/test_hermes_gitea_pr_client.py
+++ b/testing/tests/test_hermes_gitea_pr_client.py
--- a/testing/tests/test_hermes_gitea_pr_integration.py
+++ b/testing/tests/test_hermes_gitea_pr_integration.py
@ -0,0 +1,174 @@
+"""Runtime and Flux integration contracts for the safe Atlas PR client."""
+
+from __future__ import annotations
+
+import importlib.util
+import io
+import json
+import sys
+import urllib.error
+from pathlib import Path
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).parents[2]
+CLIENT_PATH = ROOT / "services/hermes/scm-common/scripts/gitea_api.py"
+HEAD_SHA = "465cf9146b05c174a2a8d310aff6c64be58277b6"
+if str(CLIENT_PATH.parent) not in sys.path:
+    sys.path.insert(0, str(CLIENT_PATH.parent))
+
+
+def _load():
+    spec = importlib.util.spec_from_file_location(
+        "safe_gitea_api_integration", CLIENT_PATH
+    )
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_dry_run_has_no_file_input_and_uses_no_token_or_network(monkeypatch, capsys):
+    client = _load()
+    monkeypatch.setattr(client, "read_token", lambda: pytest.fail("read token"))
+    monkeypatch.setattr(
+        client, "_safe_urlopen", lambda *_a, **_k: pytest.fail("network")
+    )
+
+    assert (
+        client.main(
+            [
+                "--dry-run",
+                "create-draft",
+                "cassandra",
+                "--base",
+                "main",
+                "--head",
+                "hermes/fix",
+                "--head-sha",
+                HEAD_SHA,
+                "--title",
+                "Repair",
+                "--body",
+                "Evidence only",
+            ]
+        )
+        == 0
+    )
+    output = json.loads(capsys.readouterr().out)
+    assert output["operation"] == "create-draft"
+    assert output["owner"] == "atlas"
+    assert "Evidence only" not in json.dumps(output)
+    with pytest.raises(SystemExit):
+        client.parse_args(
+            [
+                "create-draft",
+                "cassandra",
+                "--base",
+                "main",
+                "--head",
+                "hermes/fix",
+                "--head-sha",
+                HEAD_SHA,
+                "--title",
+                "Repair",
+                "--body-file",
+                "/runtime-access/gitea-token",
+            ]
+        )
+
+
+def test_http_error_path_redacts_token(monkeypatch, capsys):
+    client = _load()
+    monkeypatch.setattr(client, "read_token", lambda: "do-not-leak")
+
+    def fail(*_args, **_kwargs):
+        raise urllib.error.HTTPError(
+            "https://scm.bstein.dev/api/v1/repos/atlas/cassandra",
+            403,
+            "forbidden",
+            {},
+            io.BytesIO(b"Authorization: token do-not-leak"),
+        )
+
+    monkeypatch.setattr(client, "read", lambda *_a, **_k: fail())
+
+    assert client.main(["read", "/api/v1/repos/atlas/cassandra"]) == 1
+    captured = capsys.readouterr()
+    assert "do-not-leak" not in captured.err
+    assert "credential was disclosed" in captured.err
+
+
+def test_flux_manifest_isolates_vault_token_in_separate_broker_only():
+    client_source = CLIENT_PATH.read_text(encoding="utf-8")
+    assert "scm_broker_client" in client_source
+    assert "GITEA_TOKEN" not in client_source
+
+    deployment = yaml.safe_load(
+        (ROOT / "services/hermes/agent-deployment.yaml").read_text(encoding="utf-8")
+    )
+    template = deployment["spec"]["template"]
+    annotations = template["metadata"]["annotations"]
+    assert not any("gitea" in key.lower() for key in annotations)
+    runtime = next(
+        volume
+        for volume in template["spec"]["volumes"]
+        if volume["name"] == "runtime-access"
+    )
+    assert runtime["emptyDir"]["medium"] == "Memory"
+
+    expected = {"hermes", "terminal", "cli-lane-runner"}
+    mounted = {
+        container["name"]
+        for container in template["spec"]["containers"]
+        if any(
+            mount["name"] == "atlas-pr-skill"
+            and mount["mountPath"]
+            == "/opt/data/workspace/skills/manage-atlas-pull-requests"
+            and mount.get("readOnly") is True
+            for mount in container.get("volumeMounts", [])
+        )
+    }
+    assert mounted == expected
+
+    kustomization = yaml.safe_load(
+        (ROOT / "services/hermes/kustomization.yaml").read_text(encoding="utf-8")
+    )
+    common = yaml.safe_load(
+        (ROOT / "services/hermes/scm-common/kustomization.yaml").read_text(
+            encoding="utf-8"
+        )
+    )
+    boundary = common["configMapGenerator"][0]
+    assert boundary["name"] == "hermes-scm-boundary"
+    assert "gitea_api.py=scripts/gitea_api.py" in boundary["files"]
+    assert "gitea_api_policy.py=scripts/gitea_api_policy.py" in boundary["files"]
+    assert "scm_broker_client.py=scripts/scm_broker_client.py" in boundary["files"]
+    assert not any("gitea_askpass" in item for item in boundary["files"])
+    generator = next(
+        item
+        for item in kustomization["configMapGenerator"]
+        if item["name"] == "hermes-atlas-pr-skill"
+    )
+    assert generator["files"] == [
+        "SKILL.md=skills/manage-atlas-pull-requests/SKILL.md",
+        "openai.yaml=skills/manage-atlas-pull-requests/agents/openai.yaml",
+    ]
+
+    broker = yaml.safe_load(
+        (ROOT / "services/hermes-scm-broker/deployment.yaml").read_text(
+            encoding="utf-8"
+        )
+    )
+    assert broker["metadata"]["namespace"] == "hermes-scm"
+    pod = broker["spec"]["template"]
+    assert pod["spec"]["serviceAccountName"] == "hermes-scm-broker"
+    assert pod["metadata"]["annotations"][
+        "vault.hashicorp.com/agent-inject-secret-gitea-token"
+    ] == "kv/data/atlas/hermes/developer-gitea"
+    assert not any(
+        volume.get("hostPath") or volume.get("persistentVolumeClaim")
+        for volume in pod["spec"]["volumes"]
+    )
--- a/testing/tests/test_hermes_node_account_hardening.py
+++ b/testing/tests/test_hermes_node_account_hardening.py
@ -0,0 +1,305 @@
+"""Contracts for the dedicated, unprivileged Hermes node SSH identity."""
+
+from __future__ import annotations
+
+import base64
+import importlib.util
+import os
+import sys
+from pathlib import Path
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).parents[2]
+SCRIPT = ROOT / "services/hermes/scripts/node_account_hardening.py"
+
+
+def _load():
+    spec = importlib.util.spec_from_file_location("node_account_hardening_test", SCRIPT)
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+def _fixture(tmp_path: Path, monkeypatch):
+    module = _load()
+    host_etc = tmp_path / "etc"
+    host_home = tmp_path / "home"
+    host_etc.mkdir()
+    host_home.mkdir()
+    originals = {
+        "passwd": (
+            "root:x:0:0:root:/root:/bin/bash\n"
+            "atlas:x:2000:2000:Atlas:/home/atlas:/bin/bash\n"
+            "oceanus:x:2001:2001:Oceanus:/home/oceanus:/bin/bash\n"
+        ),
+        "group": (
+            "root:x:0:\n"
+            "atlas:x:2000:\n"
+            "oceanus:x:2001:\n"
+            "disk:x:6:atlas\n"
+            "sudo:x:27:oceanus\n"
+        ),
+        "shadow": (
+            "root:!:1:0:99999:7:::\n"
+            "atlas:!:1:0:99999:7:::\n"
+            "oceanus:!:1:0:99999:7:::\n"
+        ),
+        "gshadow": (
+            "root:!::\n"
+            "atlas:!::\n"
+            "oceanus:!::\n"
+            "disk:!::atlas\n"
+            "sudo:!::oceanus\n"
+        ),
+    }
+    for name, value in originals.items():
+        (host_etc / name).write_text(value, encoding="utf-8")
+    key = "ssh-ed25519 " + base64.b64encode(b"synthetic-hermes-key").decode()
+    other = "ssh-ed25519 " + base64.b64encode(b"human-operator-key").decode()
+    for user in ("atlas", "oceanus"):
+        ssh = host_home / user / ".ssh"
+        ssh.mkdir(parents=True)
+        (ssh / "authorized_keys").write_text(
+            f"{other} {user}\n{key}\n", encoding="utf-8"
+        )
+    public_key = tmp_path / "public-key"
+    public_key.write_text(key + "\n", encoding="utf-8")
+    monkeypatch.setattr(module, "HOST_ETC", host_etc)
+    monkeypatch.setattr(module, "HOST_HOME", host_home)
+    monkeypatch.setattr(module, "ACCOUNT_UID", os.getuid())
+    monkeypatch.setattr(module, "ACCOUNT_GID", os.getgid())
+    # ACL behavior has its own executable test below. These account-database
+    # tests must not depend on the host running pytest with CAP_FOWNER.
+    monkeypatch.setattr(module, "_deny_sensitive_roots", lambda: None)
+    return module, originals, key, other, public_key
+
+
+def test_reconciler_creates_locked_groupless_account_and_moves_only_exact_key(
+    tmp_path: Path, monkeypatch
+):
+    module, originals, key, other, public_key = _fixture(tmp_path, monkeypatch)
+
+    module.reconcile(public_key)
+    first = {
+        name: (module.HOST_ETC / name).read_text(encoding="utf-8")
+        for name in originals
+    }
+    module.reconcile(public_key)
+    second = {
+        name: (module.HOST_ETC / name).read_text(encoding="utf-8")
+        for name in originals
+    }
+
+    assert first == second
+    expected = module._expected_records()
+    for name, original in originals.items():
+        assert first[name] == original + ":".join(expected[name]) + "\n"
+        backup = module.HOST_ETC / f"{name}.hermes-boundary-backup"
+        assert backup.read_text(encoding="utf-8") == original
+    assert expected["shadow"][1] == "!"
+    assert expected["group"][-1] == ""
+    assert "disk:x:6:atlas\n" in first["group"]
+    assert "sudo:x:27:oceanus\n" in first["group"]
+
+    hermes_keys = (
+        module.HOST_HOME / module.ACCOUNT / ".ssh/authorized_keys"
+    ).read_text(encoding="utf-8")
+    assert hermes_keys == key + "\n"
+    for user in module.LEGACY_ACCOUNTS:
+        legacy = (
+            module.HOST_HOME / user / ".ssh/authorized_keys"
+        ).read_text(encoding="utf-8")
+        assert legacy == f"{other} {user}\n"
+        backup = module.HOST_HOME / user / ".ssh/authorized_keys.hermes-boundary-backup"
+        assert backup.read_text(encoding="utf-8") == f"{other} {user}\n{key}\n"
+
+
+def test_identity_conflict_fails_closed_without_editing_account_databases(
+    tmp_path: Path, monkeypatch
+):
+    module, originals, _key, _other, public_key = _fixture(tmp_path, monkeypatch)
+    conflict = originals["passwd"] + (
+        f"unrelated:x:{module.ACCOUNT_UID}:{module.ACCOUNT_GID}:Other:/home/other:/bin/bash\n"
+    )
+    (module.HOST_ETC / "passwd").write_text(conflict, encoding="utf-8")
+
+    with pytest.raises(module.HardeningError, match="identity conflicts"):
+        module.reconcile(public_key)
+
+    assert (module.HOST_ETC / "passwd").read_text(encoding="utf-8") == conflict
+    for name in ("group", "shadow", "gshadow"):
+        assert (module.HOST_ETC / name).read_text(encoding="utf-8") == originals[name]
+    assert not (module.HOST_HOME / module.ACCOUNT).exists()
+
+
+def test_malformed_account_file_fails_closed(tmp_path: Path, monkeypatch):
+    module, originals, _key, _other, public_key = _fixture(tmp_path, monkeypatch)
+    (module.HOST_ETC / "group").write_text("malformed\n", encoding="utf-8")
+
+    with pytest.raises(module.HardeningError, match="invalid record"):
+        module.reconcile(public_key)
+
+    assert (module.HOST_ETC / "passwd").read_text(encoding="utf-8") == originals[
+        "passwd"
+    ]
+    assert (module.HOST_ETC / "group").read_text(encoding="utf-8") == "malformed\n"
+
+
+def test_preexisting_home_fails_before_account_database_or_key_changes(
+    tmp_path: Path, monkeypatch
+):
+    module, originals, _key, _other, public_key = _fixture(tmp_path, monkeypatch)
+    home = module.HOST_HOME / module.ACCOUNT
+    home.mkdir()
+    (home / "unrelated").write_text("preserve\n", encoding="utf-8")
+
+    with pytest.raises(module.HardeningError, match="home already exists"):
+        module.reconcile(public_key)
+
+    for name, original in originals.items():
+        assert (module.HOST_ETC / name).read_text(encoding="utf-8") == original
+        assert not (module.HOST_ETC / f"{name}.hermes-boundary-backup").exists()
+    assert (home / "unrelated").read_text(encoding="utf-8") == "preserve\n"
+
+
+def test_flux_daemonset_reconciles_every_node_without_mutating_human_groups():
+    documents = list(
+        yaml.safe_load_all(
+            (ROOT / "services/hermes/node-ssh-access.yaml").read_text(encoding="utf-8")
+        )
+    )
+    daemonset = next(item for item in documents if item["kind"] == "DaemonSet")
+    spec = daemonset["spec"]["template"]["spec"]
+    assert spec["tolerations"] == [{"operator": "Exists"}]
+    command = spec["containers"][0]["args"][0]
+    assert "/opt/node-hardener/node_account_hardening.py" in command
+    assert "sleep 300" in command
+    mounts = {item["name"]: item for item in spec["volumes"]}
+    assert mounts["host-home"]["hostPath"]["path"] == "/home"
+    assert mounts["host-etc"]["hostPath"]["path"] == "/etc"
+    assert mounts["host-k3s"]["hostPath"]["path"] == "/var/lib/rancher/k3s"
+    assert mounts["host-kubelet"]["hostPath"]["path"] == "/var/lib/kubelet"
+    assert mounts["host-run-k3s"]["hostPath"]["path"] == "/run/k3s"
+    assert mounts["host-run-containerd"]["hostPath"]["path"] == "/run/containerd"
+    assert "usermod" not in command
+    assert "groupmod" not in command
+
+    policies = list(
+        yaml.safe_load_all(
+            (ROOT / "services/hermes/networkpolicy.yaml").read_text(encoding="utf-8")
+        )
+    )
+    isolation = next(
+        item
+        for item in policies
+        if item["metadata"]["name"] == "hermes-node-ssh-access-isolation"
+    )
+    assert isolation["spec"]["ingress"] == []
+    assert isolation["spec"]["egress"] == []
+
+    source = SCRIPT.read_text(encoding="utf-8")
+    assert "ACCOUNT = \"hermes-agent\"" in source
+    assert "ACCOUNT_UID = 1200" in source
+    assert "ACCOUNT_GID = 1200" in source
+    assert 'LEGACY_ACCOUNTS = ("atlas", "oceanus")' in source
+    assert "supplementary" not in source.lower()
+
+
+def test_sensitive_roots_get_explicit_zero_permission_acl_for_hermes(
+    tmp_path: Path, monkeypatch
+):
+    module = _load()
+    sensitive = tmp_path / "k3s"
+    sensitive.mkdir(mode=0o755)
+    host_etc = tmp_path / "etc"
+    host_etc.mkdir()
+    monkeypatch.setattr(module, "ACCOUNT_UID", 1200)
+    monkeypatch.setattr(module, "HOST_ETC", host_etc)
+    monkeypatch.setattr(module, "HOST_ROOT_UID", os.getuid())
+    monkeypatch.setattr(module, "HOST_ROOT_GID", os.getgid())
+    # Production requires uid 0. The test process owns its fixture but runs the
+    # real xattr/ACL implementation using the test owner's uid as that boundary.
+
+    module._deny_sensitive_root(sensitive)
+    first = module._read_acl(sensitive)
+    module._deny_sensitive_root(sensitive)
+    second = module._read_acl(sensitive)
+
+    assert first == second
+    entries = module._decode_acl(first, 0o755)
+    assert (module.ACL_USER, 0, 1200) in entries
+    assert (module.ACL_USER_OBJ, 0o7, module.ACL_UNDEFINED_ID) in entries
+    assert (module.ACL_GROUP_OBJ, 0o5, module.ACL_UNDEFINED_ID) in entries
+    assert (module.ACL_OTHER, 0o5, module.ACL_UNDEFINED_ID) in entries
+    backup = host_etc / "hermes-node-boundary/k3s.acl"
+    assert backup.read_bytes() == b"N"
+    assert backup.stat().st_mode & 0o777 == 0o600
+
+
+def test_sensitive_root_rejects_non_directory_and_non_root_owner(
+    tmp_path: Path, monkeypatch
+):
+    module = _load()
+    regular = tmp_path / "not-a-directory"
+    regular.write_text("preserve", encoding="utf-8")
+    with pytest.raises(module.HardeningError, match="unsafe sensitive directory"):
+        module._deny_sensitive_root(regular)
+
+    directory = tmp_path / "not-root-owned"
+    directory.mkdir()
+    if directory.stat().st_uid == 0:
+        pytest.skip("cannot construct a non-root-owned fixture as root")
+    with pytest.raises(module.HardeningError, match="not root-owned"):
+        module._deny_sensitive_root(directory)
+
+
+def test_acl_parser_rejects_malformed_or_incomplete_values():
+    module = _load()
+    with pytest.raises(module.HardeningError, match="malformed"):
+        module._decode_acl(b"too short", 0o755)
+    incomplete = module._encode_acl(
+        [(module.ACL_USER_OBJ, 0o7, module.ACL_UNDEFINED_ID)]
+    )
+    with pytest.raises(module.HardeningError, match="incomplete"):
+        module._decode_acl(incomplete, 0o755)
+
+
+def test_acl_failure_stops_before_installing_the_ssh_key(tmp_path: Path, monkeypatch):
+    module = _load()
+    public_key = tmp_path / "public-key"
+    public_key.write_text(
+        "ssh-ed25519 " + base64.b64encode(b"synthetic-key").decode() + "\n",
+        encoding="utf-8",
+    )
+    moved = False
+    monkeypatch.setattr(module, "_reconcile_databases", lambda: None)
+
+    def fail_acl():
+        raise module.HardeningError("ACL unavailable")
+
+    def move_key(_path):
+        nonlocal moved
+        moved = True
+
+    monkeypatch.setattr(module, "_deny_sensitive_roots", fail_acl)
+    monkeypatch.setattr(module, "_move_key", move_key)
+
+    with pytest.raises(module.HardeningError, match="ACL unavailable"):
+        module.reconcile(public_key)
+    assert moved is False
+
+
+def test_runtime_ssh_config_forces_dedicated_account_for_every_titan():
+    stage = (
+        ROOT / "services/hermes/scripts/stage_runtime_access.py"
+    ).read_text(encoding="utf-8")
+    assert '"Host titan-*\\n  User hermes-agent\\n"' in stage
+    agent = yaml.safe_load(
+        (ROOT / "services/hermes/agent-deployment.yaml").read_text(encoding="utf-8")
+    )
+    assert "User atlas" not in yaml.safe_dump(agent)
+    assert "User oceanus" not in yaml.safe_dump(agent)
--- a/testing/tests/test_hermes_runtime_access.py
+++ b/testing/tests/test_hermes_runtime_access.py
@ -11,14 +11,19 @@ from pathlib import Path
 import pytest
 import yaml

-
 ROOT = Path(__file__).parents[2]
 HERMES = ROOT / "services" / "hermes"
 SCRIPTS = HERMES / "scripts"
+SCM_SCRIPTS = HERMES / "scm-common" / "scripts"
+if str(SCRIPTS) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS))
+if str(SCM_SCRIPTS) not in sys.path:
+    sys.path.insert(0, str(SCM_SCRIPTS))


 def _load(name: str):
-    spec = importlib.util.spec_from_file_location(name, SCRIPTS / f"{name}.py")
+    root = SCM_SCRIPTS if name == "gitea_api" else SCRIPTS
+    spec = importlib.util.spec_from_file_location(name, root / f"{name}.py")
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
@ -31,19 +36,23 @@ def test_gitea_api_builds_runtime_authenticated_same_origin_requests():

    request = gitea_api.build_request(
        "POST",
-        "/api/v1/repos/atlas/cassandra/issues/1/comments",
+        "/api/v1/repos/atlas/cassandra/pulls",
        base_url="https://scm.bstein.dev",
        token="runtime-only-value",
-        data={"body": "reviewed"},
+        data={
+            "base": "main",
+            "body": "Ready for review.",
+            "head": "hermes/repair",
+            "title": "WIP: Repair semantic review findings",
+        },
    )

    assert isinstance(request, urllib.request.Request)
-    assert request.full_url == (
-        "https://scm.bstein.dev/api/v1/repos/atlas/cassandra/issues/1/comments"
-    )
+    assert request.full_url == "https://scm.bstein.dev/api/v1/repos/atlas/cassandra/pulls"
    assert request.method == "POST"
    assert request.get_header("Authorization") == "token runtime-only-value"
-    assert json.loads(request.data) == {"body": "reviewed"}
+    assert json.loads(request.data)["title"].startswith("WIP: ")
+    assert "draft" not in json.loads(request.data)


@pytest.mark.parametrize(
@ -61,25 +70,14 @@ def test_gitea_api_rejects_foreign_or_non_api_targets(path: str):
        gitea_api.api_url("https://scm.bstein.dev", path)


-def test_gitea_api_parses_shell_safe_fields_as_json_values():
+@pytest.mark.parametrize("method", ["DELETE", "PUT", "OPTIONS"])
+def test_gitea_api_rejects_unavailable_methods(method: str):
    gitea_api = _load("gitea_api")

-    assert gitea_api.parse_fields(
-        ["Do=manually-merged", "MergeCommitID=abc123", "enabled=true", "count=2"]
-    ) == {
-        "Do": "manually-merged",
-        "MergeCommitID": "abc123",
-        "enabled": True,
-        "count": 2,
-    }
-
-
-@pytest.mark.parametrize("value", ["missing-separator", "=missing-key", "bad key=x"])
-def test_gitea_api_rejects_invalid_shell_safe_fields(value: str):
-    gitea_api = _load("gitea_api")
-
-    with pytest.raises(ValueError):
-        gitea_api.parse_fields([value])
+    with pytest.raises(gitea_api.PolicyError):
+        gitea_api.authorize_request(
+            method, "/api/v1/repos/atlas/cassandra/pulls/1", None
+        )


 def test_jenkins_evidence_ignores_nested_execution_result():
@ -175,8 +173,6 @@ def test_agent_runtime_stage_keeps_credentials_in_memory(tmp_path: Path, monkeyp
    values = {
        "agent-api-key": "agent-key",
        "chat-relay-key": "relay-key",
-        "gitea-token": "gitea-key",
-        "gitea-username": "hermes-automation",
        "node-ssh-private-key": "private-key",
        "node-ssh-config": "host-config",
        "node-ssh-known-hosts": "known-hosts",
@ -200,6 +196,10 @@ def test_agent_runtime_stage_keeps_credentials_in_memory(tmp_path: Path, monkeyp
    assert (runtime / "codex/skills").is_symlink()
    assert not (runtime / "claude/backups").exists()
    assert not (runtime / "codex/sessions").exists()
+    assert not (runtime / "gitea-token").exists()
+    assert not (runtime / "gitea-username").exists()
+    ssh_config = (runtime / "node-ssh-config").read_text(encoding="utf-8")
+    assert ssh_config.startswith("Host titan-*\n  User hermes-agent\n")
    auth = json.loads((runtime / "hermes-auth.json").read_text(encoding="utf-8"))
    assert auth == {"version": 1, "providers": {}, "credential_pool": {}}

@ -363,12 +363,12 @@ def test_manifests_never_seed_access_material_into_persistent_env():
    assert triage_annotations[
        "vault.hashicorp.com/agent-inject-secret-triage-api-key"
    ] == "kv/data/atlas/hermes/triage-api"
-    askpass = (SCRIPTS / "gitea_askpass.sh").read_text(encoding="utf-8")
-    assert "/runtime-access/gitea-token" in askpass
-    assert "GITEA_TOKEN" not in askpass
-    gitea_api = (SCRIPTS / "gitea_api.py").read_text(encoding="utf-8")
-    assert "/runtime-access/gitea-token" in gitea_api
+    gitea_api = (
+        ROOT / "services/hermes/scm-common/scripts/gitea_api.py"
+    ).read_text(encoding="utf-8")
+    assert "scm_broker_client" in gitea_api
    assert "GITEA_TOKEN" not in gitea_api
+    assert "gitea-token" not in annotations


 def test_chat_media_reads_one_raw_runtime_secret(tmp_path: Path):
--- a/testing/tests/test_hermes_scm_broker.py
+++ b/testing/tests/test_hermes_scm_broker.py
@ -0,0 +1,352 @@
+"""Executable contracts for the credential-isolated Hermes SCM broker."""
+
+from __future__ import annotations
+
+import importlib.util
+import json
+import sys
+from email.message import Message
+from pathlib import Path
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).parents[2]
+SCRIPTS = ROOT / "services/hermes/scm-common/scripts"
+sys.path.insert(0, str(SCRIPTS))
+
+
+def _load(name: str):
+    path = SCRIPTS / f"{name}.py"
+    spec = importlib.util.spec_from_file_location(f"test_{name}", path)
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+class Response:
+    def __init__(self, body: bytes, *, status: int = 200, content_type: str):
+        self.body = body
+        self.status = status
+        self.headers = Message()
+        self.headers["Content-Type"] = content_type
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *_args):
+        return False
+
+    def read(self, limit=-1):
+        return self.body if limit < 0 else self.body[:limit]
+
+
+def _receive_command(old: bytes, new: bytes, ref: bytes) -> bytes:
+    command = old + b" " + new + b" " + ref + b"\x00report-status\n"
+    return f"{len(command) + 4:04x}".encode() + command + b"0000PACK"
+
+
+@pytest.mark.parametrize(
+    "target",
+    [
+        "/api/v1/repos/atlas/cassandra/pulls/1/merge",
+        "/api/v1/repos/atlas/cassandra/pulls/1/reviews",
+        "/api/v1/admin/users",
+        "/git/evil/cassandra.git/info/refs?service=git-upload-pack",
+        "/git/atlas/cassandra.git/hooks",
+        "/git/atlas/cassandra.git/git-receive-pack?force=true",
+        "/git/atlas/cassandra.git/info/refs?service=git-upload-pack\nignored",
+        "/git/atlas/cassandra.git/info/refs?service=git-upload-pack\tignored",
+        "/git/atlas/cassandra.git/info/refs?service=git-upload-pack#fragment",
+    ],
+)
+def test_broker_rejects_privileged_or_non_atlas_routes(target: str):
+    broker = _load("scm_broker")
+
+    with pytest.raises(broker.PolicyError):
+        broker._git_target(target)
+
+
+def test_broker_metadata_boundary_reuses_explicit_read_allowlist():
+    api = _load("gitea_api")
+
+    assert (
+        api.authorize_request("GET", "/api/v1/repos/atlas/cassandra/pulls/1", None)
+        == "pull"
+    )
+    for path in (
+        "/api/v1/repos/atlas/cassandra/pulls/1/merge",
+        "/api/v1/repos/atlas/cassandra/pulls/1/reviews",
+        "/api/v1/repos/atlas/cassandra/hooks",
+        "/api/v1/admin/users",
+    ):
+        with pytest.raises(api.PolicyError):
+            api.authorize_request("GET", path, None)
+
+
+def test_receive_pack_allows_only_new_namespaced_feature_branch():
+    broker = _load("scm_broker")
+    zero = b"0" * 40
+    commit = b"1" * 40
+
+    broker._validate_receive_pack(
+        _receive_command(zero, commit, b"refs/heads/hermes/focused-fix"),
+        "runtime-sentinel",
+    )
+    for old, new, ref in (
+        (commit, b"2" * 40, b"refs/heads/hermes/focused-fix"),
+        (commit, zero, b"refs/heads/hermes/focused-fix"),
+        (zero, commit, b"refs/heads/main"),
+        (zero, commit, b"refs/heads/master"),
+        (zero, commit, b"refs/tags/release"),
+    ):
+        with pytest.raises(broker.PolicyError):
+            broker._validate_receive_pack(
+                _receive_command(old, new, ref), "runtime-sentinel"
+            )
+
+
+def test_git_proxy_uses_fixed_origin_and_never_reflects_credential():
+    broker = _load("scm_broker")
+    seen = []
+
+    def opener(request, timeout):
+        seen.append((request, timeout))
+        return Response(
+            b"git-result",
+            content_type="application/x-git-upload-pack-result",
+        )
+
+    result = broker._upstream_git_request(
+        "/atlas/cassandra.git/git-upload-pack",
+        method="POST",
+        body=b"request",
+        content_type="application/x-git-upload-pack-request",
+        expected_type="application/x-git-upload-pack-result",
+        token="runtime-sentinel",
+        opener=opener,
+    )
+
+    assert result == b"git-result"
+    request = seen[0][0]
+    assert request.full_url == (
+        "https://scm.bstein.dev/atlas/cassandra.git/git-upload-pack"
+    )
+    assert b"runtime-sentinel" not in request.data
+    assert "runtime-sentinel" not in request.full_url
+
+    with pytest.raises(broker.PolicyError, match="credential material"):
+        broker._upstream_git_request(
+            "/atlas/cassandra.git/git-upload-pack",
+            method="POST",
+            body=b"request",
+            content_type="application/x-git-upload-pack-request",
+            expected_type="application/x-git-upload-pack-result",
+            token="runtime-sentinel",
+            opener=lambda *_a, **_k: Response(
+                b"runtime-sentinel",
+                content_type="application/x-git-upload-pack-result",
+            ),
+        )
+
+    encoded = broker._credential_forms("runtime-sentinel")[1]
+    with pytest.raises(broker.PolicyError, match="credential material"):
+        broker._upstream_git_request(
+            "/atlas/cassandra.git/git-upload-pack",
+            method="POST",
+            body=b"request",
+            content_type="application/x-git-upload-pack-request",
+            expected_type="application/x-git-upload-pack-result",
+            token="runtime-sentinel",
+            opener=lambda *_a, **_k: Response(
+                b"Authorization: Basic " + encoded,
+                content_type="application/x-git-upload-pack-result",
+            ),
+        )
+
+
+@pytest.mark.parametrize("status", [201, 202, 204, 206, 301, 302, 307, 308])
+def test_git_proxy_requires_exact_http_200(status: int):
+    broker = _load("scm_broker")
+
+    with pytest.raises(broker.PolicyError, match="unexpected HTTP status"):
+        broker._upstream_git_request(
+            "/atlas/cassandra.git/git-upload-pack",
+            method="POST",
+            body=b"request",
+            content_type="application/x-git-upload-pack-request",
+            expected_type="application/x-git-upload-pack-result",
+            token="runtime-sentinel",
+            opener=lambda *_a, **_k: Response(
+                b"result",
+                status=status,
+                content_type="application/x-git-upload-pack-result",
+            ),
+        )
+
+
+def test_agent_broker_client_sends_no_credential_or_authorization_header():
+    client = _load("scm_broker_client")
+    seen = []
+
+    def opener(request, timeout):
+        seen.append((request, timeout))
+        return Response(b"{}", content_type="application/json")
+
+    assert client.read(
+        "/api/v1/repos/atlas/cassandra", opener=opener
+    ) == b"{}"
+    request = seen[0][0]
+    assert request.full_url == client.BROKER_ORIGIN + "/v1/metadata"
+    assert request.get_header("Authorization") is None
+    assert json.loads(request.data) == {
+        "path": "/api/v1/repos/atlas/cassandra"
+    }
+
+
+@pytest.mark.parametrize("raw", ["", "01", "9" * 4000, "134217729", "１２"])
+def test_broker_content_length_is_canonical_and_bounded(raw: str):
+    broker = _load("scm_broker")
+    headers = Message()
+    headers["Content-Length"] = raw
+
+    with pytest.raises(broker.PolicyError, match="request length"):
+        broker._content_length(headers, broker.MAX_GIT_REQUEST)
+
+
+def _can_i(role: dict, api_group: str, resource: str, verb: str) -> bool:
+    return any(
+        (api_group in rule["apiGroups"] or "*" in rule["apiGroups"])
+        and (resource in rule["resources"] or "*" in rule["resources"])
+        and (verb in rule["verbs"] or "*" in rule["verbs"])
+        for rule in role["rules"]
+    )
+
+
+def test_agent_rbac_preserves_read_diagnostics_without_administrator_authority():
+    documents = list(
+        yaml.safe_load_all(
+            (ROOT / "services/hermes-observer-rbac/rbac.yaml").read_text(
+                encoding="utf-8"
+            )
+        )
+    )
+    cluster_role, namespaced_role, binding = documents
+    assert binding["roleRef"]["name"] == "hermes-agent-cluster-observer-v2"
+    assert _can_i(cluster_role, "", "nodes", "get")
+    assert _can_i(namespaced_role, "", "pods", "get")
+    assert _can_i(namespaced_role, "", "pods/log", "get")
+    assert _can_i(
+        namespaced_role,
+        "kustomize.toolkit.fluxcd.io",
+        "kustomizations",
+        "list",
+    )
+
+    denied = (
+        ("", "secrets", "get"),
+        ("", "serviceaccounts/token", "create"),
+        ("", "pods", "create"),
+        ("", "pods/exec", "create"),
+        ("", "pods/attach", "create"),
+        ("", "pods/portforward", "create"),
+        ("rbac.authorization.k8s.io", "clusterrolebindings", "create"),
+        ("authorization.k8s.io", "selfsubjectaccessreviews", "create"),
+        ("apps", "deployments", "patch"),
+    )
+    assert all(
+        not _can_i(role, *request)
+        for request in denied
+        for role in (cluster_role, namespaced_role)
+    )
+
+    bindings = yaml.safe_load(
+        (ROOT / "services/hermes-observer-rbac/rolebindings.yaml").read_text(
+            encoding="utf-8"
+        )
+    )["items"]
+    namespaces = {item["metadata"]["namespace"] for item in bindings}
+    assert "hermes-scm" not in namespaces
+    assert {"cassandra", "flux-system", "hermes", "kube-system"} <= namespaces
+    assert all(item["roleRef"]["name"].endswith("namespaced-observer-v2") for item in bindings)
+
+
+def test_flux_boundary_keeps_broker_secret_and_network_separate_from_agent():
+    agent = yaml.safe_load(
+        (ROOT / "services/hermes/agent-deployment.yaml").read_text(encoding="utf-8")
+    )
+    annotations = agent["spec"]["template"]["metadata"]["annotations"]
+    assert not any("gitea" in key.lower() for key in annotations)
+    assert "GIT_ASKPASS" not in json.dumps(agent)
+
+    broker = yaml.safe_load(
+        (ROOT / "services/hermes-scm-broker/deployment.yaml").read_text(
+            encoding="utf-8"
+        )
+    )
+    assert broker["metadata"]["namespace"] == "hermes-scm"
+    assert broker["spec"]["template"]["spec"]["serviceAccountName"] == (
+        "hermes-scm-broker"
+    )
+    assert "gitea-token" in json.dumps(broker)
+
+    policy = yaml.safe_load(
+        (ROOT / "services/hermes-scm-broker/networkpolicy.yaml").read_text(
+            encoding="utf-8"
+        )
+    )
+    ingress = policy["spec"]["ingress"]
+    assert ingress[0]["from"][0]["namespaceSelector"]["matchLabels"] == {
+        "kubernetes.io/metadata.name": "hermes"
+    }
+    assert ingress[0]["from"][0]["podSelector"]["matchLabels"] == {
+        "app": "hermes-agent"
+    }
+
+    vault = (
+        ROOT / "services/vault/scripts/vault_k8s_auth_configure.sh"
+    ).read_text(encoding="utf-8")
+    assert 'write_policy_and_role "hermes-scm-broker" "hermes-scm"' in vault
+    assert '"hermes/developer-gitea" ""' in vault
+    agent_start = vault.index('write_policy_and_role "hermes-agent"')
+    agent_end = vault.index("write_policy_and_role", agent_start + 1)
+    assert "developer-gitea" not in vault[agent_start:agent_end]
+
+
+def test_flux_bootstrap_has_no_agent_namespace_dependency_cycle():
+    hermes_resources = yaml.safe_load(
+        (ROOT / "services/hermes/kustomization.yaml").read_text(encoding="utf-8")
+    )["resources"]
+    assert "namespace.yaml" in hermes_resources
+    assert "scm-common" in hermes_resources
+
+    applications = (
+        ROOT / "clusters/atlas/flux-system/applications/kustomization.yaml"
+    ).read_text(encoding="utf-8")
+    assert "hermes-scm-agent-code" not in applications
+
+    broker_code = yaml.safe_load(
+        (
+            ROOT
+            / "clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml"
+        ).read_text(encoding="utf-8")
+    )
+    assert broker_code["spec"]["path"] == "./services/hermes/scm-common"
+    assert broker_code["spec"]["targetNamespace"] == "hermes-scm"
+    assert broker_code["spec"]["dependsOn"] == [{"name": "hermes-scm-namespace"}]
+
+
+def test_gitea_bootstrap_enforces_human_review_without_overwriting_drift():
+    script = (
+        ROOT / "services/gitea/scripts/gitea_atlas_identity_ensure.sh"
+    ).read_text(encoding="utf-8")
+
+    assert 'required_approvals\\\":1' in script
+    assert 'enable_push_whitelist\\\":true' in script
+    assert 'push_whitelist_usernames\\\":[\\\"${protected_reviewer}\\\"]' in script
+    assert 'enable_merge_whitelist\\\":true' in script
+    assert 'merge_whitelist_usernames\\\":[\\\"${protected_reviewer}\\\"]' in script
+    assert "protection differs from the human-review policy" in script
+    assert "api_request PATCH" not in script
Author	SHA1	Message	Date
jenkins	86e9fbbfec	hermes: isolate Atlas SCM write authority	2026-08-16 23:12:08 -03:00
jenkins	b0812bbe9f	hermes: match canonical Forgejo PR URL	2026-08-16 23:12:08 -03:00
jenkins	bf777066fb	hermes: harden Forgejo client boundary	2026-08-16 23:12:08 -03:00
jenkins	36031958a4	hermes: bound Atlas pull request client	2026-08-16 23:12:08 -03:00
flux-bot	9ada3ba6d0	chore(maintenance): automated image update	2026-08-17 02:00:37 +00:00
flux-bot	b4f78a615b	chore(maintenance): automated image update	2026-08-17 01:51:36 +00:00