hermes(agent): complete owner operator toolbox

services/hermes/agent-configmap.yaml

@@ -260,5 +260,6 @@ data:
     <low|medium|high|xhigh> [model]` for a persistent override. The first native
     Codex worker requires one device-code login; subsequent sessions persist on
     the agent volume. The owner workspace includes cluster-admin Kubernetes
-    access plus `kubectl`, `flux`, `helm`, `kustomize`, `jq`, `yq`, `gh`, Git,
+    access plus `kubectl`, `flux`, `helm`, `kustomize`, `vault`, `sops`, `age`,
-    SSH, Python, Node, the browser/computer tools, and the native provider CLIs.
+    `terraform`, `k9s`, `jq`, `yq`, `gh`, Git, SSH, Python, Node, the
+    browser/computer tools, and the native provider CLIs.

services/hermes/agent-deployment.yaml

@@ -24,7 +24,7 @@ spec:
         ai.bstein.dev/execution: Hermes Kanban with durable direct Codex and Claude Code CLI workers
         ai.bstein.dev/model-policy: Jetson-assisted AUTO routing, low through xhigh, cross-provider fallback
         ai.bstein.dev/placement: rpi5 preferred; Jetson deferred until state storage is available
-        ai.bstein.dev/config-rev: "20260810-owner-union-access"
+        ai.bstein.dev/config-rev: "20260810-owner-union-toolbox"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/role: hermes-agent
         vault.hashicorp.com/agent-inject-secret-anthropic-token: kv/data/atlas/hermes/agent-tokens

services/hermes/scripts/install_agent_tools.sh

@@ -3,8 +3,9 @@
 set -eu
 
 tools=${HERMES_AGENT_TOOLS_DIR:-/opt/data/tools}
+python=${HERMES_AGENT_PYTHON:-/opt/hermes/.venv/bin/python}
 bin=${tools}/bin
-stamp=${tools}/.operator-cli-versions-2.7.0-3.18.6-5.7.1-1.8.1-4.47.1-2.78.0
+stamp=${tools}/.operator-cli-versions-2.7.0-3.18.6-5.7.1-1.8.1-4.47.1-2.78.0-2.0.4-3.13.3-1.3.1-0.51.0-1.15.8
 mkdir -p "${bin}"
 
 if [ -f "${stamp}" ]; then
@@ -73,4 +74,44 @@ mkdir "${work}/gh"
 tar -xzf "${work}/gh.tar.gz" -C "${work}/gh"
 publish "${work}/gh/gh_2.78.0_linux_arm64/bin/gh" gh
 
+fetch \
+  https://releases.hashicorp.com/vault/2.0.4/vault_2.0.4_linux_arm64.zip \
+  87bb68fdd04ca90cd4cf54f8cd783a037fbf860b73d85e6697f6129dac49c683 \
+  "${work}/vault.zip"
+mkdir "${work}/vault"
+"${python}" -m zipfile -e "${work}/vault.zip" "${work}/vault"
+publish "${work}/vault/vault" vault
+
+fetch \
+  https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.linux.arm64 \
+  53b0abacd38ef1b12a66d6c100956691b9cefce018d91f81e73ddf7438b94d77 \
+  "${work}/sops"
+publish "${work}/sops" sops
+
+fetch \
+  https://github.com/FiloSottile/age/releases/download/v1.3.1/age-v1.3.1-linux-arm64.tar.gz \
+  c6878a324421b69e3e20b00ba17c04bc5c6dab0030cfe55bf8f68fa8d9e9093a \
+  "${work}/age.tar.gz"
+mkdir "${work}/age"
+tar -xzf "${work}/age.tar.gz" -C "${work}/age"
+for name in age age-inspect age-keygen age-plugin-batchpass; do
+  publish "${work}/age/age/${name}" "${name}"
+done
+
+fetch \
+  https://github.com/derailed/k9s/releases/download/v0.51.0/k9s_Linux_arm64.tar.gz \
+  3ee05c82e5f9198928a4e86133608ba6a2c10a2244d6a7789e820f78319d640c \
+  "${work}/k9s.tar.gz"
+mkdir "${work}/k9s"
+tar -xzf "${work}/k9s.tar.gz" -C "${work}/k9s"
+publish "${work}/k9s/k9s" k9s
+
+fetch \
+  https://releases.hashicorp.com/terraform/1.15.8/terraform_1.15.8_linux_arm64.zip \
+  8891e9dcedc9e3b8950bc6af9d4d8af1f4cfade3062f53b9dc403a89f6ce8c9c \
+  "${work}/terraform.zip"
+mkdir "${work}/terraform"
+"${python}" -m zipfile -e "${work}/terraform.zip" "${work}/terraform"
+publish "${work}/terraform/terraform" terraform
+
 touch "${stamp}"

testing/tests/test_hermes_cli_lanes.py

@@ -703,8 +703,21 @@ def test_owner_agent_has_cluster_admin_kubernetes_context():
 
 def test_owner_agent_installs_the_pinned_operator_toolchain():
     script = (SCRIPTS / "install_agent_tools.sh").read_text()
-    for value in ["flux", "helm", "kustomize", "jq", "yq", "gh"]:
+    for value in [
-        assert f'"${{bin}}/{value}"' in script or f" {value}\n" in script
+        "flux",
+        "helm",
+        "kustomize",
+        "jq",
+        "yq",
+        "gh",
+        "vault",
+        "sops",
+        "age",
+        "age-keygen",
+        "k9s",
+        "terraform",
+    ]:
+        assert value in script
     assert script.count("sha256sum -c -") == 1
 
     deployment = _agent_deployment()