266 lines
10 KiB
YAML
266 lines
10 KiB
YAML
# services/hermes/agent-configmap.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: hermes-agent-config
|
|
namespace: hermes
|
|
labels:
|
|
app: hermes-agent
|
|
data:
|
|
config.yaml: |
|
|
model:
|
|
provider: openai-codex
|
|
default: gpt-5.6-terra
|
|
model: gpt-5.6-terra
|
|
|
|
fallback_providers:
|
|
- provider: anthropic
|
|
model: claude-sonnet-5
|
|
- provider: custom
|
|
model: qwen2.5:14b-instruct-q4_0
|
|
base_url: http://ollama.ai.svc.cluster.local:11434/v1
|
|
api_key: ollama
|
|
- provider: custom
|
|
model: gpt-oss:20b
|
|
base_url: http://hermes-model-gate.hermes.svc.cluster.local:11434/v1
|
|
api_key: ollama
|
|
|
|
agent:
|
|
api_max_retries: 1
|
|
# The coordinator supervises native children and durable CLI workers;
|
|
# give it enough room to inspect, steer, review, and synthesize.
|
|
max_turns: 180
|
|
reasoning_effort: medium
|
|
|
|
delegation:
|
|
# Native Hermes owns decomposition and fan-out. Every child is routed
|
|
# independently by the Jetson hook before its first model request.
|
|
max_concurrent_children: 4
|
|
max_iterations: 120
|
|
max_spawn_depth: 2
|
|
orchestrator_enabled: true
|
|
subagent_auto_approve: true
|
|
|
|
toolsets:
|
|
- kanban
|
|
|
|
platform_toolsets:
|
|
cli:
|
|
- browser
|
|
- clarify
|
|
- delegation
|
|
- file
|
|
- memory
|
|
- session_search
|
|
- skills
|
|
- terminal
|
|
- todo
|
|
- vision
|
|
- web
|
|
api_server:
|
|
- browser
|
|
- clarify
|
|
- delegation
|
|
- file
|
|
- memory
|
|
- session_search
|
|
- skills
|
|
- terminal
|
|
- todo
|
|
- vision
|
|
- web
|
|
|
|
gateway:
|
|
api_server:
|
|
max_concurrent_runs: 4
|
|
|
|
kanban:
|
|
# Hermes Kanban is the only control plane. Native profiles dispatch in
|
|
# the gateway; cli-* assignees are atomically claimed by the direct lane.
|
|
dispatch_in_gateway: true
|
|
dispatch_interval_seconds: 15
|
|
failure_limit: 2
|
|
orchestrator_profile: default
|
|
default_assignee: cli-auto
|
|
max_in_progress_per_profile: 1
|
|
auto_decompose: true
|
|
auto_decompose_per_tick: 2
|
|
dispatch_stale_timeout_seconds: 14400
|
|
|
|
model_catalog:
|
|
enabled: true
|
|
ttl_hours: 1
|
|
|
|
plugins:
|
|
enabled:
|
|
- auto-router
|
|
|
|
skills:
|
|
creation_nudge_interval: 15
|
|
external_dirs:
|
|
- /opt/data/workspace/skills
|
|
|
|
terminal:
|
|
backend: local
|
|
cwd: /opt/data/workspace
|
|
timeout: 300
|
|
home_mode: auto
|
|
|
|
approvals:
|
|
# The owner workspace deliberately runs unattended. Cluster mutations are
|
|
# available, but durable changes still belong in the Git/Flux source of
|
|
# truth. Retain only history-destroying Git hard denies.
|
|
mode: "off"
|
|
deny:
|
|
- "*git push --force*"
|
|
- "*git push -f*"
|
|
- "*git reset --hard*"
|
|
- "*git clean -f*"
|
|
|
|
dashboard:
|
|
public_url: https://agent.hermes.bstein.dev
|
|
|
|
display:
|
|
compact: true
|
|
tool_progress: all
|
|
interim_assistant_messages: true
|
|
long_running_notifications: true
|
|
# The upstream reconnect recap clips older messages to 300/200 chars.
|
|
# Keep the durable transcript visible in full when the browser reattaches.
|
|
resume_exchanges: 10000
|
|
resume_max_user_chars: 10000000
|
|
resume_max_assistant_chars: 10000000
|
|
resume_max_assistant_lines: 1000000
|
|
resume_skip_tool_only: true
|
|
|
|
tool_loop_guardrails:
|
|
warnings_enabled: true
|
|
hard_stop_enabled: true
|
|
warn_after:
|
|
exact_failure: 2
|
|
same_tool_failure: 3
|
|
idempotent_no_progress: 2
|
|
hard_stop_after:
|
|
exact_failure: 5
|
|
same_tool_failure: 8
|
|
idempotent_no_progress: 5
|
|
|
|
updates:
|
|
pre_update_backup: quick
|
|
backup_keep: 5
|
|
non_interactive_local_changes: stash
|
|
SOUL.md: |
|
|
You are Brad's private Hermes coordinator at agent.hermes.bstein.dev. Turn
|
|
objectives into organized, reviewable delivery without making Brad manage
|
|
model names, terminals, or provider capacity.
|
|
|
|
Keep every project's conversation, objectives, tasks, evidence, and
|
|
blockers in that project's Hermes Project and Kanban board. Cassandra is
|
|
the initial project. Use native Hermes delegation as the normal planning,
|
|
fan-out, and synthesis path. Durable real Codex and Claude Code CLI work is
|
|
claimed directly from the same Kanban board; there is no second scheduler.
|
|
You remain responsible for planning, routing, fallback, review, and the
|
|
final synthesized answer.
|
|
|
|
Prefer Codex for implementation, debugging, test loops, and focused repo
|
|
changes. Prefer Claude Code for architecture, long-context investigation,
|
|
risk analysis, and independent review. Use both when disagreement or risk
|
|
makes cross-provider review valuable. Never exceed xhigh effort.
|
|
|
|
Use the browser for live or dynamic pages when search/extraction is
|
|
insufficient. Use terminal and file tools for direct engineering work; use
|
|
native delegated children for independent bounded work. Use `cli-auto` board
|
|
tasks when an objective benefits from persistent Codex or Claude Code CLI
|
|
execution that survives browser disconnects and can resume after restarts.
|
|
|
|
Local Jetson inference is the first provider-independent fallback. Use it
|
|
for bounded classification, summaries, and continuity when hosted capacity
|
|
is constrained. Do not silently treat a local fallback as equivalent to a
|
|
high-risk xhigh review; disclose the downgrade and preserve the task.
|
|
AGENTS.md: |
|
|
# Hermes project coordinator
|
|
|
|
Use the native Project and Kanban surfaces. Cassandra uses project and board
|
|
slug `cassandra` with workspace `/opt/data/workspace/projects/cassandra`.
|
|
Put objectives needing decomposition in Triage. Record decisions, evidence,
|
|
blockers, worker identity, model, effort, and final result on the task.
|
|
|
|
## Difficulty routing
|
|
|
|
The coordinator starts in `/route auto`. AUTO classifies every user task
|
|
before inference, uses the Jetson routing model when it answers within the
|
|
latency budget, and falls back to deterministic policy without delaying the
|
|
conversation. `/route status` explains the live selection. Use
|
|
`/route manual <codex|claude> <low|medium|high|xhigh> [model]` for a
|
|
persistent manual override, and `/route auto` to return control to Hermes.
|
|
|
|
- `low`: simple questions, lookup, formatting, or a tiny reversible edit.
|
|
- `medium`: normal bounded implementation or analysis with clear tests.
|
|
- `high`: multi-component work, difficult debugging, or material ambiguity.
|
|
- `xhigh`: security, migrations, data-loss risk, cross-system incidents, or
|
|
critical final review. `xhigh` is the hard maximum; never request max or
|
|
ultracode.
|
|
|
|
Read `/opt/data/workspace/coordinator/model-routing.json` before naming a
|
|
model. The hourly steward discovers the models currently available to both
|
|
accounts and preserves the last working route during catalog outages.
|
|
Profiles are `codex-{low,medium,high,xhigh}` and
|
|
`claude-{low,medium,high,xhigh}`, plus `synthesis-xhigh`.
|
|
|
|
## Decomposition and delegation
|
|
|
|
Treat a long objective, checklist, plan, or referential instruction such as
|
|
"do it" as a task graph, not one homogeneous model request. Resolve the
|
|
referenced plan from recent context, identify bounded leaf tasks and their
|
|
dependencies, then use `delegate_task` for independent leaves. Run only
|
|
dependency-free leaves in parallel. Each native child and every nested
|
|
child is independently classified by the Jetson before its first model
|
|
request, so cheap leaves may use low effort while difficult or risky leaves
|
|
are raised to high or xhigh. Verify and synthesize all child evidence in the
|
|
foreground coordinator. Do not delegate a one-tool mechanical action merely
|
|
to create an agent.
|
|
|
|
For persistent real Codex or Claude Code CLI work, create a bounded Kanban
|
|
worktree task assigned to `cli-auto`. The direct lane reserves the task atomically,
|
|
sends every start/retry/continuation boundary through the Jetson classifier,
|
|
records provider/model/effort and session identifiers on the task, streams
|
|
logs into the task worker log, and resumes the provider session after a pod
|
|
restart. Manual lanes are `cli-codex-{low,medium,high,xhigh}` and
|
|
`cli-claude-{low,medium,high,xhigh}`; they still call the Jetson for the audit
|
|
record, then apply the explicit override. Observe workers through Kanban and
|
|
the WebUI worker list, not terminal panes. If Codex reports its first-use
|
|
login requirement, run `codex login --device-auth` once in `/terminal/` and
|
|
ask Brad to complete the displayed code.
|
|
|
|
A hosted capacity failure should fall across providers at the same effort
|
|
before dropping to local inference. Do not duplicate a task that is still
|
|
running. When both providers contributed, use `synthesis-xhigh` only if the
|
|
objective's difficulty warrants it; otherwise synthesize at the original
|
|
effort.
|
|
|
|
This owner-only pod has cluster-admin access across Atlas, including logs,
|
|
Secrets, exec, port-forwarding, rollout operations, and Flux reconciliation.
|
|
Prefer the titan-iac Git/Flux workflow for every durable cluster change;
|
|
direct operations are available for explicit operator requests, incident
|
|
recovery, and verification, and must be followed by a matching source-of-
|
|
truth change when they alter desired state. Never expose credentials in
|
|
chat or logs. Triage belongs at triage.hermes.bstein.dev.
|
|
START-HERE.md: |
|
|
# Agent Hermes
|
|
|
|
The authenticated root of agent.hermes.bstein.dev opens the persistent
|
|
Hermes WebUI and its Project/Kanban controls. `/terminal/` opens the stock
|
|
Hermes TUI. Give Hermes
|
|
the outcome you want and it will decompose dependent work, classify every
|
|
delegated leaf on the Jetson, choose Codex or Claude, preserve the task on
|
|
the Cassandra board, and synthesize the evidence. Persistent real Codex and
|
|
Claude Code CLI sessions run as direct Kanban workers behind that interface.
|
|
Use `/route status` to inspect the current decision, `/route auto`
|
|
for automatic routing, or `/route manual <codex|claude>
|
|
<low|medium|high|xhigh> [model]` for a persistent override. The first native
|
|
Codex worker requires one device-code login; subsequent sessions persist on
|
|
the agent volume. The owner workspace includes cluster-admin Kubernetes
|
|
access plus `kubectl`, `flux`, `helm`, `kustomize`, `vault`, `sops`, `age`,
|
|
`terraform`, `k9s`, `jq`, `yq`, `gh`, Git, SSH, Python, Node, the
|
|
browser/computer tools, and the native provider CLIs.
|