hermes: pin ARM64 runtime images

dockerfiles/Dockerfile.hermes-agent

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 # dockerfiles/Dockerfile.hermes-agent
-FROM nousresearch/hermes-agent@sha256:9c841866021c54c4596849f6135717e8a4d52ba510b7f52c50aef1de1a283973
+FROM nousresearch/hermes-agent@sha256:47d4bd4cc420b70e40ed75efdade373e45b86b7382d4013a054208982bb6ba08
 
 USER root
 

dockerfiles/Dockerfile.hermes-chat-router

@@ -1,8 +1,8 @@
 # dockerfiles/Dockerfile.hermes-chat-router
 FROM --platform=$BUILDPLATFORM golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS build
 
-ARG TARGETOS
-ARG TARGETARCH
+ARG TARGETOS=linux
+ARG TARGETARCH=arm64
 
 WORKDIR /src
 COPY services/hermes/router/ ./

services/hermes/chat-router.yaml

@@ -62,7 +62,7 @@ spec:
                     values: [rpi5]
       containers:
         - name: router
-          image: registry.bstein.dev/bstein/hermes-chat-router@sha256:f854bb153e10561fc92a94dc0f82bf96dd26d775857ddbb9abd725e792876922
+          image: registry.bstein.dev/bstein/hermes-chat-router@sha256:cec7d91b6aed26c2272e6caae731286cfd4122e35e818ea06b1c19d7434f0520
           imagePullPolicy: IfNotPresent
           ports:
             - {name: http, containerPort: 8080, protocol: TCP}

services/hermes/kustomization.yaml

@@ -4,7 +4,7 @@ kind: Kustomization
 namespace: hermes
 images:
   - name: registry.bstein.dev/bstein/hermes-agent
-    digest: sha256:c520c87683fb8b8131a32d7c87eaaf7503001c69487cedc478ae9789a668eaa2
+    digest: sha256:611c1642381d2a82ff03b55dda58bcab9a2e723c495dc298d1e9f938e94ed8d4
 resources:
   - namespace.yaml
   - vault-serviceaccount.yaml

testing/tests/test_hermes_chat_quality.py

@@ -148,6 +148,10 @@ def test_sandbox_shares_only_the_tenant_workspace_without_credentials():
 
 def test_gateway_image_honors_ui_model_and_caps_reasoning():
     dockerfile = (ROOT / "dockerfiles" / "Dockerfile.hermes-agent").read_text()
+    assert (
+        "FROM nousresearch/hermes-agent@sha256:"
+        "47d4bd4cc420b70e40ed75efdade373e45b86b7382d4013a054208982bb6ba08"
+    ) in dockerfile
     assert "_resolve_request_route" in dockerfile
     assert 'allowed_providers = {"atlas-switchyard"}' in dockerfile
     assert 'reasoning_effort=body.get("reasoning_effort")' in dockerfile
@@ -183,6 +187,16 @@ def test_gateway_image_honors_ui_model_and_caps_reasoning():
     assert "Open Telegram setup" in dockerfile
 
 
+def test_telegram_router_local_build_defaults_to_cluster_architecture():
+    dockerfile = (
+        ROOT / "dockerfiles" / "Dockerfile.hermes-chat-router"
+    ).read_text(encoding="utf-8")
+
+    assert "ARG TARGETOS=linux" in dockerfile
+    assert "ARG TARGETARCH=arm64" in dockerfile
+    assert "GOOS=${TARGETOS} GOARCH=${TARGETARCH}" in dockerfile
+
+
 def test_chat_oauth_allows_stale_service_worker_retirement():
     documents = _documents(HERMES / "oauth2-proxy.yaml")
     deployment = next(