From fb1131053a0fac679143fbf3af45c92324fec944 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Thu, 6 Aug 2026 05:00:09 -0300
Subject: [PATCH] feat(hermes): switch the primary model to Claude Opus 5

The Codex weekly limit is close, so make anthropic/claude-opus-5 primary and
demote openai-codex to first fallback with the local gpt-oss:20b behind it.

The credential is a Claude subscription OAuth token, not an API key. The
anthropic provider resolves ANTHROPIC_API_KEY, then ANTHROPIC_TOKEN, then
CLAUDE_CODE_OAUTH_TOKEN, so the OAuth token must arrive under the last name
to be treated correctly. Marked optional so Hermes still starts and falls
back if the Secret is absent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 services/hermes/configmap.yaml  |  8 +++++---
 services/hermes/deployment.yaml | 13 +++++++++++++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/services/hermes/configmap.yaml b/services/hermes/configmap.yaml
index becb0da10..3c14415a4 100644
--- a/services/hermes/configmap.yaml
+++ b/services/hermes/configmap.yaml
@@ -9,11 +9,13 @@ metadata:
 data:
   config.yaml: |
     model:
-      provider: openai-codex
-      default: gpt-5.6-terra
-      model: gpt-5.6-terra
+      provider: anthropic
+      default: claude-opus-5
+      model: claude-opus-5
 
     fallback_providers:
+      - provider: openai-codex
+        model: gpt-5.6-terra
       - provider: custom
         model: gpt-oss:20b
         base_url: http://hermes-model-gate.hermes.svc.cluster.local:11434/v1
diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index 7a49900c2..d2d299542 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -211,6 +211,19 @@ spec:
               value: https://scm.bstein.dev
             - name: GRAFANA_BASE_URL
               value: https://metrics.bstein.dev
+            # Claude subscription OAuth token (sk-ant-oat01...). The anthropic
+            # provider accepts ANTHROPIC_API_KEY, ANTHROPIC_TOKEN, or this, in
+            # that order; an OAuth token is not an API key, so it must arrive
+            # under this name. Optional, so Hermes still starts without it and
+            # falls back to openai-codex.
+            # TODO: migrate to Vault alongside the Gitea token; this manual
+            # Secret was created in the interest of demo time.
+            - name: CLAUDE_CODE_OAUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: hermes-anthropic-token
+                  key: token
+                  optional: true
           volumeMounts:
             - name: home
               mountPath: /opt/data