fix(hermes): stabilize operator sessions

services/hermes/configmap.yaml

@@ -45,10 +45,6 @@ data:
       external_dirs:
         - /opt/data/workspace/skills
 
-    plugins:
-      enabled:
-        - atlas-operator-guide
-
     terminal:
       backend: local
       cwd: /opt/data/workspace

services/hermes/deployment.yaml

@@ -23,7 +23,7 @@ spec:
         ai.bstein.dev/model: openai-codex/gpt-5.6-terra with local gpt-oss:20b fallback
         ai.bstein.dev/role: testing-triage
         ai.bstein.dev/placement: arm64 gateway lane (rpi5 preferred)
-        ai.bstein.dev/config-rev: "20260802-operator-guide"
+        ai.bstein.dev/config-rev: "20260802-session-stability"
     spec:
       serviceAccountName: hermes-triage
       automountServiceAccountToken: true
@@ -196,9 +196,6 @@ spec:
             - name: mastery-skill
               mountPath: /opt/data/workspace/skills/master-hermes-on-atlas
               readOnly: true
-            - name: operator-guide-plugin
-              mountPath: /opt/data/plugins/atlas-operator-guide
-              readOnly: true
           readinessProbe:
             httpGet:
               path: /api/status
@@ -255,13 +252,3 @@ spec:
                 path: references/mastery-rubric.md
               - key: two-hour-proof-sprint.md
                 path: references/two-hour-proof-sprint.md
-        - name: operator-guide-plugin
-          configMap:
-            name: hermes-operator-guide-plugin
-            items:
-              - key: manifest.json
-                path: dashboard/manifest.json
-              - key: index.js
-                path: dashboard/dist/index.js
-              - key: style.css
-                path: dashboard/dist/style.css

services/hermes/kustomization.yaml

@@ -41,11 +41,3 @@ configMapGenerator:
       - two-hour-proof-sprint.md=skills/master-hermes-on-atlas/references/two-hour-proof-sprint.md
     options:
       disableNameSuffixHash: true
-  - name: hermes-operator-guide-plugin
-    namespace: hermes
-    files:
-      - manifest.json=plugins/atlas-operator-guide/dashboard/manifest.json
-      - index.js=plugins/atlas-operator-guide/dashboard/dist/index.js
-      - style.css=plugins/atlas-operator-guide/dashboard/dist/style.css
-    options:
-      disableNameSuffixHash: true

services/hermes/oauth2-proxy.yaml

@@ -104,12 +104,11 @@ spec:
             - --email-domain=*
             - --authenticated-emails-file=/etc/oauth2-proxy/allowed-emails
             - --set-xauthrequest=true
-            - --pass-access-token=true
-            - --set-authorization-header=true
+            - --session-cookie-minimal=true
             - --cookie-secure=true
             - --cookie-samesite=lax
-            - --cookie-refresh=20m
-            - --cookie-expire=24h
+            - --cookie-refresh=0
+            - --cookie-expire=8h
             - --upstream=http://hermes.hermes.svc.cluster.local:9119
             - --http-address=0.0.0.0:4180
             - --skip-provider-button=true