atlas-iac/dockerfiles/Dockerfile.hermes-agent.dockerignore

**
!dockerfiles/hermes-kanban-blocked-regression.py
!dockerfiles/hermes-python-sandbox-tool.py
!dockerfiles/hermes-public-extract/
!dockerfiles/hermes-public-extract/**
!dockerfiles/hermes-session-activity-panel.tsx
!dockerfiles/hermes-session-migrate.py
!dockerfiles/Dockerfile.hermes-agent
!dockerfiles/hermes-kaniko-heredoc-runner.py
hermes: isolate runtime access and expose activity 2026-08-15 17:58:47 -03:00			`**`
hermes: harden worker isolation and blocked-task semantics Three narrowly scoped Hermes reliability fixes backed by live evidence from the Cassandra/titan-iac proof run. Worker concurrency. Three simultaneous direct CLI workers on the 4-core hermes-agent node drove load to ~45 and made the hermes and oauth2-proxy containers fail their probes, leaving the pod 8/10 Ready; two workers stayed at 10/10. Cap HERMES_CLI_LANE_CONCURRENCY at 2 and lower the cli-lane-runner CPU limit from 3 to 2 so the dashboard and auth sidecars keep a guaranteed share of the node. Requests are unchanged: the pod still asks for 745m total, so placement does not move. Service links. Kubernetes injects a service-link variable pair for every service in the namespace, and hermes-claude-broker produces HERMES_CLAUDE_BROKER_PORT=tcp://10.43.31.76:9006 — a value the broker parses as an int. That contaminated worker and test environments even though the deployment already addresses every service by DNS name. Set enableServiceLinks: false on the hermes-agent pod spec. Blocked-task scheduling. create_task(initial_status="blocked") records a created event carrying status=blocked but never a blocked event, while _has_sticky_block() only inspects blocked/unblocked events. recompute_ready() considers blocked tasks, so an explicitly parked task with no incomplete parent auto-promoted on the next dispatcher cycle. Teach _has_sticky_block() to also recognize a created event whose payload status is blocked, which covers tasks created before this image patch without adding a persisted field. Dependency-driven promotion and the circuit-breaker failure-limit guard are untouched; unblock_task() still releases either kind of block. hermes-kanban-blocked-regression.py runs against the real upstream kanban_db API during the image build, so the build fails if any of these semantics regress. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2026-08-16 20:53:22 +00:00			`!dockerfiles/hermes-kanban-blocked-regression.py`
hermes: isolate runtime access and expose activity 2026-08-15 17:58:47 -03:00			`!dockerfiles/hermes-python-sandbox-tool.py`
			`!dockerfiles/hermes-public-extract/`
			`!dockerfiles/hermes-public-extract/**`
			`!dockerfiles/hermes-session-activity-panel.tsx`
			`!dockerfiles/hermes-session-migrate.py`
hermes: add daemonless agent image release lane 2026-08-16 20:04:17 -03:00			`!dockerfiles/Dockerfile.hermes-agent`
			`!dockerfiles/hermes-kaniko-heredoc-runner.py`