docs: second pass of diagram corrections after the remaining work landed

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

knowledge/hermes-triage-diagram-corrections.md

@@ -83,6 +83,46 @@ exception.
 - **A failure superseded by a newer build can be skipped entirely.** Detection
   reads `lastBuild`, so a red build replaced quickly is never triaged.
 
+## Second pass, after the remaining work landed
+
+Everything previously marked conditional is now done, which changes three
+things structurally rather than cosmetically.
+
+**Not every incident reaches Hermes any more.** The diagram's main flow runs
+intake -> hermes_plane -> controls -> response, which reads as though every
+incident is diagnosed by the model. A build that overruns its time cap is now
+escalated by Ariadne alone, with no model call at all, because its console is
+still being written and any root cause would be invented. That needs its own
+edge from the detector straight to the human path, bypassing `hermes_plane`
+and `controls` entirely. It is also the honest picture of the trust boundary:
+some conclusions are Ariadne's own observations, and the issue body now says
+so rather than crediting a diagnosis that never happened.
+
+**The Jenkins evidence limitation is gone, not narrowed.** Delete
+`jenkins_limit` and the "Per-test evidence waits on Jenkins plugins" line from
+`current_limits`. `junit` and `pipeline-stage-view` are installed, `testReport`
+and `wfapi` return 200, and the bundle now carries `failed_tests` with the
+failing test name, class and assertion, plus `first_failed_stage`. The
+collector always fetched both and had simply been receiving 404s. The `bundle`
+node should list them as populated fields, because they are what the diagnosis
+now rests on rather than scraped console text.
+
+**The detector watches branches, not just jobs.** A multibranch project is a
+folder with no `lastBuild`; it was returned as skipped on every tick. The
+detector now expands a folder into its branch jobs, capped at five, so
+`detector` should say it watches configured jobs *and the branches inside
+multibranch folders*.
+
+Smaller corrections to the same nodes:
+
+- `evidence_sources` may include a service's own namespace, not only the demo
+  namespace and `jenkins`, where the job is mapped to one.
+- The human path files an issue even for an incident triaged before issue
+  filing existed, reusing the classification the original diagnosis recorded
+  so one open issue per job and classification still holds.
+- Hermes's credential comes from Vault, not a manually created Secret. If the
+  diagram ever shows credential provenance, that is now the accurate source.
+
 ## Conditional on work that was blocked
 
 `model_gate` should now read `anthropic/claude-opus-5` primary, with

services/comms/knowledge/hermes-triage-diagram-corrections.md

@@ -83,6 +83,46 @@ exception.
 - **A failure superseded by a newer build can be skipped entirely.** Detection
   reads `lastBuild`, so a red build replaced quickly is never triaged.
 
+## Second pass, after the remaining work landed
+
+Everything previously marked conditional is now done, which changes three
+things structurally rather than cosmetically.
+
+**Not every incident reaches Hermes any more.** The diagram's main flow runs
+intake -> hermes_plane -> controls -> response, which reads as though every
+incident is diagnosed by the model. A build that overruns its time cap is now
+escalated by Ariadne alone, with no model call at all, because its console is
+still being written and any root cause would be invented. That needs its own
+edge from the detector straight to the human path, bypassing `hermes_plane`
+and `controls` entirely. It is also the honest picture of the trust boundary:
+some conclusions are Ariadne's own observations, and the issue body now says
+so rather than crediting a diagnosis that never happened.
+
+**The Jenkins evidence limitation is gone, not narrowed.** Delete
+`jenkins_limit` and the "Per-test evidence waits on Jenkins plugins" line from
+`current_limits`. `junit` and `pipeline-stage-view` are installed, `testReport`
+and `wfapi` return 200, and the bundle now carries `failed_tests` with the
+failing test name, class and assertion, plus `first_failed_stage`. The
+collector always fetched both and had simply been receiving 404s. The `bundle`
+node should list them as populated fields, because they are what the diagnosis
+now rests on rather than scraped console text.
+
+**The detector watches branches, not just jobs.** A multibranch project is a
+folder with no `lastBuild`; it was returned as skipped on every tick. The
+detector now expands a folder into its branch jobs, capped at five, so
+`detector` should say it watches configured jobs *and the branches inside
+multibranch folders*.
+
+Smaller corrections to the same nodes:
+
+- `evidence_sources` may include a service's own namespace, not only the demo
+  namespace and `jenkins`, where the job is mapped to one.
+- The human path files an issue even for an incident triaged before issue
+  filing existed, reusing the classification the original diagnosis recorded
+  so one open issue per job and classification still holds.
+- Hermes's credential comes from Vault, not a manually created Secret. If the
+  diagram ever shows credential provenance, that is now the accurate source.
+
 ## Conditional on work that was blocked
 
 `model_gate` should now read `anthropic/claude-opus-5` primary, with