From 4385a292492a41f7b9cd2588a5f124cd63d0bdd6 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Sun, 2 Aug 2026 14:15:07 -0300
Subject: [PATCH] fix(hermes): stabilize operator sessions

---
 services/hermes/configmap.yaml     |  4 ----
 services/hermes/deployment.yaml    | 15 +--------------
 services/hermes/kustomization.yaml |  8 --------
 services/hermes/oauth2-proxy.yaml  |  7 +++----
 4 files changed, 4 insertions(+), 30 deletions(-)

diff --git a/services/hermes/configmap.yaml b/services/hermes/configmap.yaml
index 2af03da6e..4f7d9196e 100644
--- a/services/hermes/configmap.yaml
+++ b/services/hermes/configmap.yaml
@@ -45,10 +45,6 @@ data:
       external_dirs:
         - /opt/data/workspace/skills
 
-    plugins:
-      enabled:
-        - atlas-operator-guide
-
     terminal:
       backend: local
       cwd: /opt/data/workspace
diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index bee76e5b1..30919e4a3 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -23,7 +23,7 @@ spec:
         ai.bstein.dev/model: openai-codex/gpt-5.6-terra with local gpt-oss:20b fallback
         ai.bstein.dev/role: testing-triage
         ai.bstein.dev/placement: arm64 gateway lane (rpi5 preferred)
-        ai.bstein.dev/config-rev: "20260802-operator-guide"
+        ai.bstein.dev/config-rev: "20260802-session-stability"
     spec:
       serviceAccountName: hermes-triage
       automountServiceAccountToken: true
@@ -196,9 +196,6 @@ spec:
             - name: mastery-skill
               mountPath: /opt/data/workspace/skills/master-hermes-on-atlas
               readOnly: true
-            - name: operator-guide-plugin
-              mountPath: /opt/data/plugins/atlas-operator-guide
-              readOnly: true
           readinessProbe:
             httpGet:
               path: /api/status
@@ -255,13 +252,3 @@ spec:
                 path: references/mastery-rubric.md
               - key: two-hour-proof-sprint.md
                 path: references/two-hour-proof-sprint.md
-        - name: operator-guide-plugin
-          configMap:
-            name: hermes-operator-guide-plugin
-            items:
-              - key: manifest.json
-                path: dashboard/manifest.json
-              - key: index.js
-                path: dashboard/dist/index.js
-              - key: style.css
-                path: dashboard/dist/style.css
diff --git a/services/hermes/kustomization.yaml b/services/hermes/kustomization.yaml
index 0966dccc8..04f07d923 100644
--- a/services/hermes/kustomization.yaml
+++ b/services/hermes/kustomization.yaml
@@ -41,11 +41,3 @@ configMapGenerator:
       - two-hour-proof-sprint.md=skills/master-hermes-on-atlas/references/two-hour-proof-sprint.md
     options:
       disableNameSuffixHash: true
-  - name: hermes-operator-guide-plugin
-    namespace: hermes
-    files:
-      - manifest.json=plugins/atlas-operator-guide/dashboard/manifest.json
-      - index.js=plugins/atlas-operator-guide/dashboard/dist/index.js
-      - style.css=plugins/atlas-operator-guide/dashboard/dist/style.css
-    options:
-      disableNameSuffixHash: true
diff --git a/services/hermes/oauth2-proxy.yaml b/services/hermes/oauth2-proxy.yaml
index 6cba6ffa7..d9971f0d6 100644
--- a/services/hermes/oauth2-proxy.yaml
+++ b/services/hermes/oauth2-proxy.yaml
@@ -104,12 +104,11 @@ spec:
             - --email-domain=*
             - --authenticated-emails-file=/etc/oauth2-proxy/allowed-emails
             - --set-xauthrequest=true
-            - --pass-access-token=true
-            - --set-authorization-header=true
+            - --session-cookie-minimal=true
             - --cookie-secure=true
             - --cookie-samesite=lax
-            - --cookie-refresh=20m
-            - --cookie-expire=24h
+            - --cookie-refresh=0
+            - --cookie-expire=8h
             - --upstream=http://hermes.hermes.svc.cluster.local:9119
             - --http-address=0.0.0.0:4180
             - --skip-provider-button=true