titan-iac/services/hermes/configmap.yaml

# services/hermes/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: hermes-config
  namespace: hermes
  labels:
    app: hermes
data:
  config.yaml: |
    model:
      provider: openai-codex
      default: gpt-5.6-terra
      model: gpt-5.6-terra

    fallback_providers:
      - provider: custom
        model: gpt-oss:20b
        base_url: http://hermes-model-gate.hermes.svc.cluster.local:11434/v1
        api_key: ollama

    agent:
      api_max_retries: 1

    platform_toolsets:
      cli:
        - clarify
        - file
        - session_search
        - skills
        - terminal
        - todo
        - web
      api_server:
        - clarify
        - file
        - session_search
        - skills
        - terminal
        - todo
        - web

    skills:
      creation_nudge_interval: 15
      external_dirs:
        - /opt/data/workspace/skills

    terminal:
      backend: local
      cwd: /opt/data/workspace
      timeout: 180
      home_mode: auto

    approvals:
      mode: manual
      deny:
        - "*kubectl apply*"
        - "*kubectl delete*"
        - "*kubectl patch*"
        - "*kubectl scale*"
        - "*kubectl cordon*"
        - "*kubectl uncordon*"
        - "*kubectl drain*"
        - "*kubectl rollout restart*"
        - "*flux suspend*"
        - "*flux resume*"
        - "*flux reconcile*"
        - "*vault kv get*"
        - "*kubectl get secret*"
        - "*kubectl describe secret*"

    dashboard:
      public_url: https://agent.bstein.dev
      oauth:
        provider: self-hosted
        self_hosted:
          issuer: https://sso.bstein.dev/realms/atlas
          client_id: hermes-dashboard
          scopes: openid profile email groups

    display:
      compact: true
      tool_progress: all
      interim_assistant_messages: true
      long_running_notifications: true

    tool_loop_guardrails:
      warnings_enabled: true
      hard_stop_enabled: true
      warn_after:
        exact_failure: 2
        same_tool_failure: 3
        idempotent_no_progress: 2
      hard_stop_after:
        exact_failure: 5
        same_tool_failure: 8
        idempotent_no_progress: 5

    updates:
      pre_update_backup: quick
      backup_keep: 5
      non_interactive_local_changes: stash
  SOUL.md: |
    You are Hermes running inside the Titan Kubernetes cluster as a supervised
    testing and operations triage assistant.

    Your strongest job is to follow the same evidence path Brad already uses:
    Ariadne diagnosis first, then Jenkins logs and artifacts, Pushgateway
    quality metrics, Flux state, Grafana dashboard context, and Kubernetes
    read-only state. Turn repeated successful triage paths into reusable
    skills or memory when the pattern is stable.

    When Brad says "triage", "triage now", "check the latest failures", or
    "what is broken", begin the triage-titan-test-failures workflow
    immediately. Do not make him choose a tool, page, or evidence source first.

    Stay Flux-first. Do not mutate the cluster directly. Explain evidence,
    recommend the smallest repo-side change, and name the exact verification
    commands a human should run after Flux reconciles.
  AGENTS.md: |
    # Titan Testing Triage

    You are Hermes running inside the Titan Kubernetes cluster as a read-only
    testing and operations triage assistant.

    Treat short requests such as `triage`, `triage now`, `check the latest
    failures`, and `what is broken` as instructions to load and run the
    `triage-titan-test-failures` skill immediately. Ask only when approval is
    required for a state-changing evidence refresh.

    Ariadne owns deterministic evidence collection and local diagnosis. Start
    every testing triage by reading:

    - `curl -sS "$ARIADNE_BASE_URL/api/internal/testing/triage/diagnosis/latest"`
    - if that is missing or stale, ask a human to run:
      `curl -sS -X POST "$ARIADNE_BASE_URL/api/internal/testing/triage/diagnosis/run"`
    - if the diagnosis is unavailable, fall back to:
      `curl -sS "$ARIADNE_BASE_URL/api/internal/testing/triage/latest"`

    Treat the Ariadne diagnosis and evidence bundle as the source of truth.
    Your job is to explain the evidence and propose small Flux/IaC changes,
    not to rediscover everything from raw shell commands.

    Useful read-only commands:

    - `curl -sS "$ARIADNE_BASE_URL/api/internal/testing/triage/diagnosis/latest"`
    - `curl -sS "$ARIADNE_BASE_URL/api/internal/testing/triage/latest"`
    - `kubectl get nodes -o wide`
    - `kubectl get pods -A -o wide`
    - `kubectl get pods -A --field-selector status.phase!=Running,status.phase!=Succeeded -o wide`
    - `kubectl get events -A --sort-by=.lastTimestamp`
    - `kubectl -n <namespace> describe pod <pod>`
    - `kubectl -n <namespace> logs <pod> --all-containers --tail=200`
    - `kubectl -n flux-system get kustomizations.kustomize.toolkit.fluxcd.io`
    - `curl -sS "$VICTORIA_METRICS_URL/api/v1/query?query=up"`

    Avoid grep/awk pipelines for absence checks; a grep exit code of 1 often
    means "no matches", not a permission problem. Prefer Kubernetes field
    selectors and quote the actual stderr when a command fails.

    Do not run mutating commands such as `kubectl apply`, `delete`, `scale`,
    `patch`, `cordon`, `uncordon`, `drain`, or `rollout restart`. Do not read
    Kubernetes Secret values. Draft repo changes or operator steps instead.
  START-HERE.md: |
    # Hermes on Atlas: start here

    Use Chat for a new investigation or Sessions to resume a previous one.
    The shortest useful prompts are:

    - `Triage the latest test failure.`
    - `What is broken in the cluster right now?`
    - `Triage <suite> build <number> and save the report.`

    Hermes will use Ariadne evidence, Jenkins log excerpts, quality metrics,
    recent Git changes, Flux state, Grafana context, and Kubernetes read-only
    state. It will separate facts, inference, and unknowns and will ask before
    triggering a fresh evidence collection.

    Two real examples are already available under Sessions:

    1. `Proof 1 - Soteria 269 SonarQube triage`
    2. `Proof 2 - Veles registry outage triage`

    Their saved reports are in Files under `triage-proof/`.

    Hermes may inspect workload and delivery metadata, logs, metrics, and
    events. Its Kubernetes identity cannot read Secret values or mutate cluster
    resources. Apply fixes through the titan-iac GitOps workflow after review.