atlas-iac/dockerfiles/Dockerfile.hermes-agent.dockerignore

**
!dockerfiles/hermes-kanban-blocked-regression.py
!dockerfiles/hermes-python-sandbox-tool.py
!dockerfiles/hermes-public-extract/
!dockerfiles/hermes-public-extract/**
!dockerfiles/hermes-session-activity-panel.tsx
!dockerfiles/hermes-session-migrate.py
!dockerfiles/patch-hermes-terminal-replay.py
!dockerfiles/hermes-terminal-replay-regression.py
!dockerfiles/hermes-terminal-resume-regression.js
!dockerfiles/patch-hermes-dashboard-wheel.js
!dockerfiles/hermes-dashboard-terminal-input.ts
!dockerfiles/hermes-dashboard-terminal-input.test.ts
!dockerfiles/Dockerfile.hermes-agent
!dockerfiles/hermes-kaniko-heredoc-runner.py
!dockerfiles/patch-hermes-execution-safety.py
!dockerfiles/hermes-execution-safety-regression.py
!dockerfiles/hermes_execution_patch_support.py
!dockerfiles/patch_hermes_run_safety.py
!dockerfiles/patch_hermes_decomposition_safety.py
!dockerfiles/hermes_execution_regression_support.py
!dockerfiles/hermes_run_safety_regression.py
!dockerfiles/hermes_decomposition_safety_regression.py
!dockerfiles/hermes_lane_compatibility_regression.py
!services/
!services/hermes/
!services/hermes/scripts/
!services/hermes/scripts/*.py
hermes: isolate runtime access and expose activity 2026-08-15 17:58:47 -03:00			`**`
hermes: harden worker isolation and blocked-task semantics Three narrowly scoped Hermes reliability fixes backed by live evidence from the Cassandra/titan-iac proof run. Worker concurrency. Three simultaneous direct CLI workers on the 4-core hermes-agent node drove load to ~45 and made the hermes and oauth2-proxy containers fail their probes, leaving the pod 8/10 Ready; two workers stayed at 10/10. Cap HERMES_CLI_LANE_CONCURRENCY at 2 and lower the cli-lane-runner CPU limit from 3 to 2 so the dashboard and auth sidecars keep a guaranteed share of the node. Requests are unchanged: the pod still asks for 745m total, so placement does not move. Service links. Kubernetes injects a service-link variable pair for every service in the namespace, and hermes-claude-broker produces HERMES_CLAUDE_BROKER_PORT=tcp://10.43.31.76:9006 — a value the broker parses as an int. That contaminated worker and test environments even though the deployment already addresses every service by DNS name. Set enableServiceLinks: false on the hermes-agent pod spec. Blocked-task scheduling. create_task(initial_status="blocked") records a created event carrying status=blocked but never a blocked event, while _has_sticky_block() only inspects blocked/unblocked events. recompute_ready() considers blocked tasks, so an explicitly parked task with no incomplete parent auto-promoted on the next dispatcher cycle. Teach _has_sticky_block() to also recognize a created event whose payload status is blocked, which covers tasks created before this image patch without adding a persisted field. Dependency-driven promotion and the circuit-breaker failure-limit guard are untouched; unblock_task() still releases either kind of block. hermes-kanban-blocked-regression.py runs against the real upstream kanban_db API during the image build, so the build fails if any of these semantics regress. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2026-08-16 20:53:22 +00:00			`!dockerfiles/hermes-kanban-blocked-regression.py`
hermes: isolate runtime access and expose activity 2026-08-15 17:58:47 -03:00			`!dockerfiles/hermes-python-sandbox-tool.py`
			`!dockerfiles/hermes-public-extract/`
			`!dockerfiles/hermes-public-extract/**`
			`!dockerfiles/hermes-session-activity-panel.tsx`
			`!dockerfiles/hermes-session-migrate.py`
fix(hermes): relay history scrolling and repaint reattached terminals 2026-09-14 00:27:30 -05:00			`!dockerfiles/patch-hermes-terminal-replay.py`
			`!dockerfiles/hermes-terminal-replay-regression.py`
fix(hermes): preserve paused editors during terminal reattachment 2026-09-14 00:36:31 -05:00			`!dockerfiles/hermes-terminal-resume-regression.js`
fix(hermes): relay history scrolling and repaint reattached terminals 2026-09-14 00:27:30 -05:00			`!dockerfiles/patch-hermes-dashboard-wheel.js`
			`!dockerfiles/hermes-dashboard-terminal-input.ts`
			`!dockerfiles/hermes-dashboard-terminal-input.test.ts`
hermes: add daemonless agent image release lane 2026-08-16 20:04:17 -03:00			`!dockerfiles/Dockerfile.hermes-agent`
			`!dockerfiles/hermes-kaniko-heredoc-runner.py`
hermes: preserve terminal results and prevent duplicate fanout 2026-08-16 19:57:54 -03:00			`!dockerfiles/patch-hermes-execution-safety.py`
			`!dockerfiles/hermes-execution-safety-regression.py`
hermes: bind terminal commit to journal inode 2026-08-16 21:55:28 -03:00			`!dockerfiles/hermes_execution_patch_support.py`
			`!dockerfiles/patch_hermes_run_safety.py`
			`!dockerfiles/patch_hermes_decomposition_safety.py`
			`!dockerfiles/hermes_execution_regression_support.py`
			`!dockerfiles/hermes_run_safety_regression.py`
			`!dockerfiles/hermes_decomposition_safety_regression.py`
hermes: gate mixed image lane APIs 2026-08-17 08:16:35 -03:00			`!dockerfiles/hermes_lane_compatibility_regression.py`
hermes: bind terminal commit to journal inode 2026-08-16 21:55:28 -03:00			`!services/`
			`!services/hermes/`
			`!services/hermes/scripts/`
hermes: resume preserved PR publications without model retries 2026-09-13 17:54:54 -05:00			`!services/hermes/scripts/*.py`