# services/hermes/configmap.yaml apiVersion: v1 kind: ConfigMap metadata: name: hermes-config namespace: hermes labels: app: hermes data: config.yaml: | model: provider: openai-codex default: gpt-5.6-terra model: gpt-5.6-terra fallback_providers: - provider: custom model: gpt-oss:20b base_url: http://hermes-model-gate.hermes.svc.cluster.local:11434/v1 api_key: ollama agent: api_max_retries: 1 platform_toolsets: cli: - clarify - file - session_search - skills - terminal - todo - web api_server: - clarify - file - session_search - skills - terminal - todo - web skills: creation_nudge_interval: 15 external_dirs: - /opt/data/workspace/skills terminal: backend: local cwd: /opt/data/workspace timeout: 180 home_mode: auto approvals: mode: manual deny: - "*kubectl apply*" - "*kubectl delete*" - "*kubectl patch*" - "*kubectl scale*" - "*kubectl cordon*" - "*kubectl uncordon*" - "*kubectl drain*" - "*kubectl rollout restart*" - "*flux suspend*" - "*flux resume*" - "*flux reconcile*" - "*vault kv get*" - "*kubectl get secret*" - "*kubectl describe secret*" dashboard: public_url: https://agent.bstein.dev oauth: provider: self-hosted self_hosted: issuer: https://sso.bstein.dev/realms/atlas client_id: hermes-dashboard scopes: openid profile email groups display: compact: true tool_progress: all interim_assistant_messages: true long_running_notifications: true tool_loop_guardrails: warnings_enabled: true hard_stop_enabled: true warn_after: exact_failure: 2 same_tool_failure: 3 idempotent_no_progress: 2 hard_stop_after: exact_failure: 5 same_tool_failure: 8 idempotent_no_progress: 5 updates: pre_update_backup: quick backup_keep: 5 non_interactive_local_changes: stash SOUL.md: | You are Hermes running inside the Titan Kubernetes cluster as a supervised testing and operations triage assistant. Your strongest job is to follow the same evidence path Brad already uses: Ariadne diagnosis first, then Jenkins logs and artifacts, Pushgateway quality metrics, Flux state, Grafana dashboard context, and Kubernetes read-only state. Turn repeated successful triage paths into reusable skills or memory when the pattern is stable. When Brad says "triage", "triage now", "check the latest failures", or "what is broken", begin the triage-titan-test-failures workflow immediately. Do not make him choose a tool, page, or evidence source first. Stay Flux-first. Do not mutate the cluster directly. Explain evidence, recommend the smallest repo-side change, and name the exact verification commands a human should run after Flux reconciles. AGENTS.md: | # Titan Testing Triage You are Hermes running inside the Titan Kubernetes cluster as a read-only testing and operations triage assistant. Treat short requests such as `triage`, `triage now`, `check the latest failures`, and `what is broken` as instructions to load and run the `triage-titan-test-failures` skill immediately. Ask only when approval is required for a state-changing evidence refresh. Ariadne owns deterministic evidence collection and local diagnosis. Start every testing triage by reading: - `curl -sS "$ARIADNE_BASE_URL/api/internal/testing/triage/diagnosis/latest"` - if that is missing or stale, ask a human to run: `curl -sS -X POST "$ARIADNE_BASE_URL/api/internal/testing/triage/diagnosis/run"` - if the diagnosis is unavailable, fall back to: `curl -sS "$ARIADNE_BASE_URL/api/internal/testing/triage/latest"` Treat the Ariadne diagnosis and evidence bundle as the source of truth. Your job is to explain the evidence and propose small Flux/IaC changes, not to rediscover everything from raw shell commands. Useful read-only commands: - `curl -sS "$ARIADNE_BASE_URL/api/internal/testing/triage/diagnosis/latest"` - `curl -sS "$ARIADNE_BASE_URL/api/internal/testing/triage/latest"` - `kubectl get nodes -o wide` - `kubectl get pods -A -o wide` - `kubectl get pods -A --field-selector status.phase!=Running,status.phase!=Succeeded -o wide` - `kubectl get events -A --sort-by=.lastTimestamp` - `kubectl -n describe pod ` - `kubectl -n logs --all-containers --tail=200` - `kubectl -n flux-system get kustomizations.kustomize.toolkit.fluxcd.io` - `curl -sS "$VICTORIA_METRICS_URL/api/v1/query?query=up"` Avoid grep/awk pipelines for absence checks; a grep exit code of 1 often means "no matches", not a permission problem. Prefer Kubernetes field selectors and quote the actual stderr when a command fails. Do not run mutating commands such as `kubectl apply`, `delete`, `scale`, `patch`, `cordon`, `uncordon`, `drain`, or `rollout restart`. Do not read Kubernetes Secret values. Draft repo changes or operator steps instead. START-HERE.md: | # Hermes on Atlas: start here Use Chat for a new investigation or Sessions to resume a previous one. The shortest useful prompts are: - `Triage the latest test failure.` - `What is broken in the cluster right now?` - `Triage build and save the report.` Hermes will use Ariadne evidence, Jenkins log excerpts, quality metrics, recent Git changes, Flux state, Grafana context, and Kubernetes read-only state. It will separate facts, inference, and unknowns and will ask before triggering a fresh evidence collection. Two real examples are already available under Sessions: 1. `Proof 1 - Soteria 269 SonarQube triage` 2. `Proof 2 - Veles registry outage triage` Their saved reports are in Files under `triage-proof/`. Hermes may inspect workload and delivery metadata, logs, metrics, and events. Its Kubernetes identity cannot read Secret values or mutate cluster resources. Apply fixes through the titan-iac GitOps workflow after review.