From 04f060db3e299bc04f9269b9d2881b0da6a33be4 Mon Sep 17 00:00:00 2001 From: flux-bot Date: Mon, 24 Aug 2026 17:22:30 +0000 Subject: [PATCH] chore(hermes): promote validated image release --- services/hermes/agent-deployment.yaml | 30 +++++++++++++-------------- services/hermes/chat-statefulset.yaml | 10 ++++----- services/hermes/deployment.yaml | 2 +- 3 files changed, 21 insertions(+), 21 deletions(-) diff --git a/services/hermes/agent-deployment.yaml b/services/hermes/agent-deployment.yaml index 2e17c842..32d4e2b8 100644 --- a/services/hermes/agent-deployment.yaml +++ b/services/hermes/agent-deployment.yaml @@ -636,7 +636,7 @@ spec: - {name: PYTHONPATH, value: /opt/hermes} - {name: HERMES_ROUTING_CATALOG_PATH, value: /routing-catalog/catalog.json} - {name: HERMES_CASSANDRA_ACTIVE_WORKTREE, value: /opt/data/workspace/projects/cassandra-hermes-v69} - - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin} + - {name: PATH, value: '/opt/coordinator:/opt/data/tools/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin'} securityContext: allowPrivilegeEscalation: false runAsUser: 10000 @@ -679,7 +679,7 @@ spec: - {name: PYTHONPATH, value: /opt/hermes} - {name: HERMES_ROUTING_CATALOG_PATH, value: /routing-catalog/catalog.json} - {name: HERMES_CASSANDRA_ACTIVE_WORKTREE, value: /opt/data/workspace/projects/cassandra-hermes-v69} - - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin} + - {name: PATH, value: '/opt/coordinator:/opt/data/tools/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin'} securityContext: allowPrivilegeEscalation: false runAsUser: 10000 @@ -742,7 +742,7 @@ spec: - {name: CLAUDE_CONFIG_DIR, value: /runtime-access/claude} - {name: HERMES_CLAUDE_BIN, value: /opt/coordinator/claude} - {name: KUBECONFIG, value: /opt/data/home/.kube/config} - - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/opt/hermes/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin} + - {name: PATH, value: '/opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/opt/hermes/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'} - {name: PLAYWRIGHT_BROWSERS_PATH, value: /opt/hermes/.playwright} - {name: AGENT_BROWSER_EXECUTABLE_PATH, value: /opt/hermes/.playwright/chromium_headless_shell-1228/chrome-linux/headless_shell} - {name: AGENT_BROWSER_ARGS, value: "--no-sandbox,--disable-dev-shm-usage"} @@ -750,7 +750,7 @@ spec: - {name: HERMES_DASHBOARD_HOST, value: 127.0.0.1} - {name: HERMES_DASHBOARD_PORT, value: "9119"} - {name: HERMES_DASHBOARD_FILES_ROOT, value: /opt/data/workspace} - - {name: HERMES_DASHBOARD_PUBLIC_URL, value: https://worker.bstein.dev} + - {name: HERMES_DASHBOARD_PUBLIC_URL, value: 'https://worker.bstein.dev'} - {name: HERMES_TUI_AGENT_INIT_TIMEOUT_S, value: "180"} - {name: HERMES_STREAM_STALE_TIMEOUT, value: "600"} - {name: HERMES_API_CALL_STALE_TIMEOUT, value: "600"} @@ -809,19 +809,19 @@ spec: - {name: home, mountPath: /run/hermes-hux-subject, subPath: hux/binding, readOnly: true} startupProbe: exec: - command: [curl, -fsS, http://127.0.0.1:9119/api/status] + command: [curl, -fsS, 'http://127.0.0.1:9119/api/status'] periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 60 readinessProbe: exec: - command: [curl, -fsS, http://127.0.0.1:9119/api/status] + command: [curl, -fsS, 'http://127.0.0.1:9119/api/status'] initialDelaySeconds: 30 periodSeconds: 10 timeoutSeconds: 5 livenessProbe: exec: - command: [curl, -fsS, http://127.0.0.1:9119/api/status] + command: [curl, -fsS, 'http://127.0.0.1:9119/api/status'] initialDelaySeconds: 90 periodSeconds: 30 timeoutSeconds: 10 @@ -949,7 +949,7 @@ spec: - {name: HERMES_CLAUDE_BIN, value: /opt/coordinator/claude} - {name: KUBECONFIG, value: /opt/data/home/.kube/config} - {name: PYTHONPATH, value: /opt/hermes} - - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin} + - {name: PATH, value: '/opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin'} - {name: PLAYWRIGHT_BROWSERS_PATH, value: /opt/hermes/.playwright} - {name: AGENT_BROWSER_EXECUTABLE_PATH, value: /opt/hermes/.playwright/chromium_headless_shell-1228/chrome-linux/headless_shell} - {name: AGENT_BROWSER_ARGS, value: "--no-sandbox,--disable-dev-shm-usage"} @@ -1033,7 +1033,7 @@ spec: - {name: HERMES_CLI_LANE_METRICS_PORT, value: "9011"} - {name: HERMES_CLI_QUOTA_METRICS_URL, value: "http://127.0.0.1:9010/metrics"} - {name: HERMES_AUTO_ROUTER_PROFILE, value: agent} - - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin} + - {name: PATH, value: '/opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin'} securityContext: allowPrivilegeEscalation: false capabilities: @@ -1079,7 +1079,7 @@ spec: - {name: PYTHONPATH, value: /opt/hermes} - {name: HERMES_ROUTING_CATALOG_PATH, value: /routing-catalog/catalog.json} - {name: HERMES_CASSANDRA_ACTIVE_WORKTREE, value: /opt/data/workspace/projects/cassandra-hermes-v69} - - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin} + - {name: PATH, value: '/opt/coordinator:/opt/data/tools/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin'} securityContext: allowPrivilegeEscalation: false runAsUser: 10000 @@ -1224,7 +1224,7 @@ spec: - {name: HERMES_IMAGE_BROKER_DEFAULT_MODEL, value: atlas-image-auto-high} - {name: HERMES_IMAGE_BROKER_LISTEN_PORT, value: "9002"} - {name: HERMES_IMAGE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key} - - {name: HERMES_LOCAL_IMAGE_URL, value: http://hermes-local-image.hermes.svc.cluster.local:9004} + - {name: HERMES_LOCAL_IMAGE_URL, value: 'http://hermes-local-image.hermes.svc.cluster.local:9004'} - {name: HERMES_IMAGE_POLICY_PATH, value: /etc/hermes-image-policy/policy.json} readinessProbe: tcpSocket: {port: image-broker} @@ -1318,7 +1318,7 @@ spec: - {name: CODEX_HOME, value: /runtime-access/codex} - {name: CLAUDE_CONFIG_DIR, value: /runtime-access/claude} - {name: PYTHONPATH, value: /opt/hermes} - - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin} + - {name: PATH, value: '/opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin'} - {name: HERMES_CLAUDE_BIN, value: /opt/coordinator/claude} - {name: HERMES_CLAUDE_BROKER_PORT, value: "9006"} - {name: HERMES_CLAUDE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key} @@ -1361,7 +1361,7 @@ spec: # foundation as the only enabled card until the Worker lifecycle gates # in docs/hux/WORKER-PLAN.md pass on this instance. - name: hux - image: registry.bstein.dev/bstein/hermes-webui:git-043aa9ee89c13fc0f4fb270f489c09a0e2f18b12-build-23-release@sha256:b3b5830d08deb5b2f7fcc9e5c62ee9e71ad39a7e56df7bfbc583be424a9a87d6 # {"$imagepolicy": "hermes:hermes-webui-release"} + image: registry.bstein.dev/bstein/hermes-webui:git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release@sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release"} imagePullPolicy: IfNotPresent command: [/opt/hermes/.venv/bin/python, -m, hux.server] ports: @@ -1380,9 +1380,9 @@ spec: - {name: HUX_CONTEXT_KEY_FILE, value: /var/lib/hux/context/context-key} - {name: HUX_CANARY_FILE, value: /var/lib/hux/context/redaction-canary} - name: HUX_IMAGE_TAG - value: git-043aa9ee89c13fc0f4fb270f489c09a0e2f18b12-build-23-release # {"$imagepolicy": "hermes:hermes-webui-release:tag"} + value: git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release # {"$imagepolicy": "hermes:hermes-webui-release:tag"} - name: HUX_IMAGE_DIGEST - value: sha256:b3b5830d08deb5b2f7fcc9e5c62ee9e71ad39a7e56df7bfbc583be424a9a87d6 # {"$imagepolicy": "hermes:hermes-webui-release:digest"} + value: sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release:digest"} - {name: HUX_READS_PER_MINUTE, value: "600"} - {name: HUX_WRITES_PER_MINUTE, value: "120"} - {name: HUX_REQUEST_TIMEOUT_SECONDS, value: "10"} diff --git a/services/hermes/chat-statefulset.yaml b/services/hermes/chat-statefulset.yaml index 4713b476..958d3bed 100644 --- a/services/hermes/chat-statefulset.yaml +++ b/services/hermes/chat-statefulset.yaml @@ -487,7 +487,7 @@ spec: requests: {cpu: 250m, memory: 256Mi} limits: {cpu: "1", memory: 2Gi} - name: webui - image: registry.bstein.dev/bstein/hermes-webui:git-043aa9ee89c13fc0f4fb270f489c09a0e2f18b12-build-23-release@sha256:b3b5830d08deb5b2f7fcc9e5c62ee9e71ad39a7e56df7bfbc583be424a9a87d6 # {"$imagepolicy": "hermes:hermes-webui-release"} + image: registry.bstein.dev/bstein/hermes-webui:git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release@sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release"} imagePullPolicy: IfNotPresent command: [/bin/sh, -ec] args: @@ -565,7 +565,7 @@ spec: requests: {cpu: 100m, memory: 224Mi} limits: {cpu: 750m, memory: 1Gi} - name: hux - image: registry.bstein.dev/bstein/hermes-webui:git-043aa9ee89c13fc0f4fb270f489c09a0e2f18b12-build-23-release@sha256:b3b5830d08deb5b2f7fcc9e5c62ee9e71ad39a7e56df7bfbc583be424a9a87d6 # {"$imagepolicy": "hermes:hermes-webui-release"} + image: registry.bstein.dev/bstein/hermes-webui:git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release@sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release"} imagePullPolicy: IfNotPresent command: [/bin/sh, -ec] args: @@ -593,9 +593,9 @@ spec: - {name: HUX_CONTEXT_KEY_FILE, value: /var/lib/hux/context/context-key} - {name: HUX_CANARY_FILE, value: /var/lib/hux/context/redaction-canary} - name: HUX_IMAGE_TAG - value: git-043aa9ee89c13fc0f4fb270f489c09a0e2f18b12-build-23-release # {"$imagepolicy": "hermes:hermes-webui-release:tag"} + value: git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release # {"$imagepolicy": "hermes:hermes-webui-release:tag"} - name: HUX_IMAGE_DIGEST - value: sha256:b3b5830d08deb5b2f7fcc9e5c62ee9e71ad39a7e56df7bfbc583be424a9a87d6 # {"$imagepolicy": "hermes:hermes-webui-release:digest"} + value: sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release:digest"} - {name: HUX_SWITCHYARD_ROUTE_CATALOG, value: 'atlas/manual/codex/luna,atlas/manual/codex/terra,atlas/manual/codex/sol,atlas/manual/claude/haiku,atlas/manual/claude/fable,atlas/manual/claude/sonnet,atlas/manual/claude/opus,atlas/manual/local/qwen-14b'} - {name: HUX_RELEASE_EVIDENCE_KEY_FILE, value: /run/hermes-hux-evidence/evidence-key} - {name: HUX_RELEASE_EVIDENCE_POLICY_FILE, value: /etc/hux-evidence/policy.json} @@ -641,7 +641,7 @@ spec: requests: {cpu: 25m, memory: 64Mi} limits: {cpu: 250m, memory: 256Mi} - name: hux-evidence-producer - image: registry.bstein.dev/bstein/hermes-webui:git-043aa9ee89c13fc0f4fb270f489c09a0e2f18b12-build-23-release@sha256:b3b5830d08deb5b2f7fcc9e5c62ee9e71ad39a7e56df7bfbc583be424a9a87d6 # {"$imagepolicy": "hermes:hermes-webui-release"} + image: registry.bstein.dev/bstein/hermes-webui:git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release@sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release"} imagePullPolicy: IfNotPresent command: [/bin/sh, -ec] args: diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml index 2a169ced..f5856166 100644 --- a/services/hermes/deployment.yaml +++ b/services/hermes/deployment.yaml @@ -388,7 +388,7 @@ spec: cpu: "2" memory: 4Gi - name: webui - image: registry.bstein.dev/bstein/hermes-webui:git-043aa9ee89c13fc0f4fb270f489c09a0e2f18b12-build-23-release@sha256:b3b5830d08deb5b2f7fcc9e5c62ee9e71ad39a7e56df7bfbc583be424a9a87d6 # {"$imagepolicy": "hermes:hermes-webui-release"} + image: registry.bstein.dev/bstein/hermes-webui:git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release@sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release"} imagePullPolicy: IfNotPresent command: [/bin/sh, -ec] args: