From 1d2d386aeb7b30962faad15002aca540640cba52 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Sat, 15 Aug 2026 22:32:08 -0300
Subject: [PATCH] hermes: pin ARM64 runtime images

---
 dockerfiles/Dockerfile.hermes-agent       |  2 +-
 dockerfiles/Dockerfile.hermes-chat-router |  4 ++--
 services/hermes/chat-router.yaml          |  2 +-
 services/hermes/kustomization.yaml        |  2 +-
 testing/tests/test_hermes_chat_quality.py | 14 ++++++++++++++
 5 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/dockerfiles/Dockerfile.hermes-agent b/dockerfiles/Dockerfile.hermes-agent
index a5f25fd6..108ce940 100644
--- a/dockerfiles/Dockerfile.hermes-agent
+++ b/dockerfiles/Dockerfile.hermes-agent
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 # dockerfiles/Dockerfile.hermes-agent
-FROM nousresearch/hermes-agent@sha256:9c841866021c54c4596849f6135717e8a4d52ba510b7f52c50aef1de1a283973
+FROM nousresearch/hermes-agent@sha256:47d4bd4cc420b70e40ed75efdade373e45b86b7382d4013a054208982bb6ba08
 
 USER root
 
diff --git a/dockerfiles/Dockerfile.hermes-chat-router b/dockerfiles/Dockerfile.hermes-chat-router
index f7fa5a04..a045b0c4 100644
--- a/dockerfiles/Dockerfile.hermes-chat-router
+++ b/dockerfiles/Dockerfile.hermes-chat-router
@@ -1,8 +1,8 @@
 # dockerfiles/Dockerfile.hermes-chat-router
 FROM --platform=$BUILDPLATFORM golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS build
 
-ARG TARGETOS
-ARG TARGETARCH
+ARG TARGETOS=linux
+ARG TARGETARCH=arm64
 
 WORKDIR /src
 COPY services/hermes/router/ ./
diff --git a/services/hermes/chat-router.yaml b/services/hermes/chat-router.yaml
index 5d449e72..142c5112 100644
--- a/services/hermes/chat-router.yaml
+++ b/services/hermes/chat-router.yaml
@@ -62,7 +62,7 @@ spec:
                     values: [rpi5]
       containers:
         - name: router
-          image: registry.bstein.dev/bstein/hermes-chat-router@sha256:f854bb153e10561fc92a94dc0f82bf96dd26d775857ddbb9abd725e792876922
+          image: registry.bstein.dev/bstein/hermes-chat-router@sha256:cec7d91b6aed26c2272e6caae731286cfd4122e35e818ea06b1c19d7434f0520
           imagePullPolicy: IfNotPresent
           ports:
             - {name: http, containerPort: 8080, protocol: TCP}
diff --git a/services/hermes/kustomization.yaml b/services/hermes/kustomization.yaml
index bdce00db..f7601e27 100644
--- a/services/hermes/kustomization.yaml
+++ b/services/hermes/kustomization.yaml
@@ -4,7 +4,7 @@ kind: Kustomization
 namespace: hermes
 images:
   - name: registry.bstein.dev/bstein/hermes-agent
-    digest: sha256:c520c87683fb8b8131a32d7c87eaaf7503001c69487cedc478ae9789a668eaa2
+    digest: sha256:611c1642381d2a82ff03b55dda58bcab9a2e723c495dc298d1e9f938e94ed8d4
 resources:
   - namespace.yaml
   - vault-serviceaccount.yaml
diff --git a/testing/tests/test_hermes_chat_quality.py b/testing/tests/test_hermes_chat_quality.py
index c94831d2..e830d302 100644
--- a/testing/tests/test_hermes_chat_quality.py
+++ b/testing/tests/test_hermes_chat_quality.py
@@ -148,6 +148,10 @@ def test_sandbox_shares_only_the_tenant_workspace_without_credentials():
 
 def test_gateway_image_honors_ui_model_and_caps_reasoning():
     dockerfile = (ROOT / "dockerfiles" / "Dockerfile.hermes-agent").read_text()
+    assert (
+        "FROM nousresearch/hermes-agent@sha256:"
+        "47d4bd4cc420b70e40ed75efdade373e45b86b7382d4013a054208982bb6ba08"
+    ) in dockerfile
     assert "_resolve_request_route" in dockerfile
     assert 'allowed_providers = {"atlas-switchyard"}' in dockerfile
     assert 'reasoning_effort=body.get("reasoning_effort")' in dockerfile
@@ -183,6 +187,16 @@ def test_gateway_image_honors_ui_model_and_caps_reasoning():
     assert "Open Telegram setup" in dockerfile
 
 
+def test_telegram_router_local_build_defaults_to_cluster_architecture():
+    dockerfile = (
+        ROOT / "dockerfiles" / "Dockerfile.hermes-chat-router"
+    ).read_text(encoding="utf-8")
+
+    assert "ARG TARGETOS=linux" in dockerfile
+    assert "ARG TARGETARCH=arm64" in dockerfile
+    assert "GOOS=${TARGETOS} GOARCH=${TARGETARCH}" in dockerfile
+
+
 def test_chat_oauth_allows_stale_service_worker_retirement():
     documents = _documents(HERMES / "oauth2-proxy.yaml")
     deployment = next(