From f9dc4bd306069174dbccb5cc7ee9795c23c1f76f Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Mon, 10 Aug 2026 21:29:41 -0300
Subject: [PATCH] flux(hermes): track owner oauth sidecar health

---
 .../applications/hermes/kustomization.yaml         |  4 ----
 testing/tests/test_hermes_cli_lanes.py             | 14 ++++++++++++++
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/clusters/atlas/flux-system/applications/hermes/kustomization.yaml b/clusters/atlas/flux-system/applications/hermes/kustomization.yaml
index e0028fcfa..366c6dabd 100644
--- a/clusters/atlas/flux-system/applications/hermes/kustomization.yaml
+++ b/clusters/atlas/flux-system/applications/hermes/kustomization.yaml
@@ -42,10 +42,6 @@ spec:
       kind: Deployment
       name: hermes-chat-router
       namespace: hermes
-    - apiVersion: apps/v1
-      kind: Deployment
-      name: oauth2-proxy-hermes-agent
-      namespace: hermes
     - apiVersion: apps/v1
       kind: Deployment
       name: oauth2-proxy-hermes-chat
diff --git a/testing/tests/test_hermes_cli_lanes.py b/testing/tests/test_hermes_cli_lanes.py
index 55df05ab2..3ebbdb156 100644
--- a/testing/tests/test_hermes_cli_lanes.py
+++ b/testing/tests/test_hermes_cli_lanes.py
@@ -17,6 +17,10 @@ import yaml
 SCRIPTS = Path(__file__).parents[2] / "services/hermes/scripts"
 HERMES = Path(__file__).parents[2] / "services/hermes"
 KEYCLOAK = Path(__file__).parents[2] / "services/keycloak"
+FLUX_HERMES = (
+    Path(__file__).parents[2]
+    / "clusters/atlas/flux-system/applications/hermes/kustomization.yaml"
+)
 
 
 def _load(name: str):
@@ -704,6 +708,16 @@ def test_agent_root_is_stock_dashboard_and_terminal_is_a_separate_path():
     ] == "hermes-hermes-agent-terminal-slash@kubernetescrd"
 
 
+def test_flux_health_checks_follow_the_owner_oauth_sidecar():
+    flux = yaml.safe_load(FLUX_HERMES.read_text())
+    checks = {
+        (item["kind"], item["name"])
+        for item in flux["spec"]["healthChecks"]
+    }
+    assert ("Deployment", "hermes-agent") in checks
+    assert ("Deployment", "oauth2-proxy-hermes-agent") not in checks
+
+
 def test_agent_auth_is_bstein_group_and_email_bounded():
     deployment = _agent_deployment()
     oauth = next(