From 4de37f4f3a640a107daadeecf3b57963649791b1 Mon Sep 17 00:00:00 2001
From: flux-bot <ops@bstein.dev>
Date: Mon, 24 Aug 2026 19:08:58 +0000
Subject: [PATCH] chore(hermes): promote validated image release

---
 services/hermes/agent-deployment.yaml |  6 +++---
 services/hermes/chat-statefulset.yaml | 10 +++++-----
 services/hermes/deployment.yaml       |  2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/services/hermes/agent-deployment.yaml b/services/hermes/agent-deployment.yaml
index 32d4e2b8..4b612dff 100644
--- a/services/hermes/agent-deployment.yaml
+++ b/services/hermes/agent-deployment.yaml
@@ -1361,7 +1361,7 @@ spec:
         # foundation as the only enabled card until the Worker lifecycle gates
         # in docs/hux/WORKER-PLAN.md pass on this instance.
         - name: hux
-          image: registry.bstein.dev/bstein/hermes-webui:git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release@sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release"}
+          image: registry.bstein.dev/bstein/hermes-webui:git-3fd760de0eda63a13ee842c324f62b9daf5cb8fe-build-25-release@sha256:7e8a1305a8ca521e32ca1a20499afdde1c43161d38f132ab00d893fde50391ea # {"$imagepolicy": "hermes:hermes-webui-release"}
           imagePullPolicy: IfNotPresent
           command: [/opt/hermes/.venv/bin/python, -m, hux.server]
           ports:
@@ -1380,9 +1380,9 @@ spec:
             - {name: HUX_CONTEXT_KEY_FILE, value: /var/lib/hux/context/context-key}
             - {name: HUX_CANARY_FILE, value: /var/lib/hux/context/redaction-canary}
             - name: HUX_IMAGE_TAG
-              value: git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release # {"$imagepolicy": "hermes:hermes-webui-release:tag"}
+              value: git-3fd760de0eda63a13ee842c324f62b9daf5cb8fe-build-25-release # {"$imagepolicy": "hermes:hermes-webui-release:tag"}
             - name: HUX_IMAGE_DIGEST
-              value: sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release:digest"}
+              value: sha256:7e8a1305a8ca521e32ca1a20499afdde1c43161d38f132ab00d893fde50391ea # {"$imagepolicy": "hermes:hermes-webui-release:digest"}
             - {name: HUX_READS_PER_MINUTE, value: "600"}
             - {name: HUX_WRITES_PER_MINUTE, value: "120"}
             - {name: HUX_REQUEST_TIMEOUT_SECONDS, value: "10"}
diff --git a/services/hermes/chat-statefulset.yaml b/services/hermes/chat-statefulset.yaml
index 958d3bed..f8cbe021 100644
--- a/services/hermes/chat-statefulset.yaml
+++ b/services/hermes/chat-statefulset.yaml
@@ -487,7 +487,7 @@ spec:
             requests: {cpu: 250m, memory: 256Mi}
             limits: {cpu: "1", memory: 2Gi}
         - name: webui
-          image: registry.bstein.dev/bstein/hermes-webui:git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release@sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release"}
+          image: registry.bstein.dev/bstein/hermes-webui:git-3fd760de0eda63a13ee842c324f62b9daf5cb8fe-build-25-release@sha256:7e8a1305a8ca521e32ca1a20499afdde1c43161d38f132ab00d893fde50391ea # {"$imagepolicy": "hermes:hermes-webui-release"}
           imagePullPolicy: IfNotPresent
           command: [/bin/sh, -ec]
           args:
@@ -565,7 +565,7 @@ spec:
             requests: {cpu: 100m, memory: 224Mi}
             limits: {cpu: 750m, memory: 1Gi}
         - name: hux
-          image: registry.bstein.dev/bstein/hermes-webui:git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release@sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release"}
+          image: registry.bstein.dev/bstein/hermes-webui:git-3fd760de0eda63a13ee842c324f62b9daf5cb8fe-build-25-release@sha256:7e8a1305a8ca521e32ca1a20499afdde1c43161d38f132ab00d893fde50391ea # {"$imagepolicy": "hermes:hermes-webui-release"}
           imagePullPolicy: IfNotPresent
           command: [/bin/sh, -ec]
           args:
@@ -593,9 +593,9 @@ spec:
             - {name: HUX_CONTEXT_KEY_FILE, value: /var/lib/hux/context/context-key}
             - {name: HUX_CANARY_FILE, value: /var/lib/hux/context/redaction-canary}
             - name: HUX_IMAGE_TAG
-              value: git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release # {"$imagepolicy": "hermes:hermes-webui-release:tag"}
+              value: git-3fd760de0eda63a13ee842c324f62b9daf5cb8fe-build-25-release # {"$imagepolicy": "hermes:hermes-webui-release:tag"}
             - name: HUX_IMAGE_DIGEST
-              value: sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release:digest"}
+              value: sha256:7e8a1305a8ca521e32ca1a20499afdde1c43161d38f132ab00d893fde50391ea # {"$imagepolicy": "hermes:hermes-webui-release:digest"}
             - {name: HUX_SWITCHYARD_ROUTE_CATALOG, value: 'atlas/manual/codex/luna,atlas/manual/codex/terra,atlas/manual/codex/sol,atlas/manual/claude/haiku,atlas/manual/claude/fable,atlas/manual/claude/sonnet,atlas/manual/claude/opus,atlas/manual/local/qwen-14b'}
             - {name: HUX_RELEASE_EVIDENCE_KEY_FILE, value: /run/hermes-hux-evidence/evidence-key}
             - {name: HUX_RELEASE_EVIDENCE_POLICY_FILE, value: /etc/hux-evidence/policy.json}
@@ -641,7 +641,7 @@ spec:
             requests: {cpu: 25m, memory: 64Mi}
             limits: {cpu: 250m, memory: 256Mi}
         - name: hux-evidence-producer
-          image: registry.bstein.dev/bstein/hermes-webui:git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release@sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release"}
+          image: registry.bstein.dev/bstein/hermes-webui:git-3fd760de0eda63a13ee842c324f62b9daf5cb8fe-build-25-release@sha256:7e8a1305a8ca521e32ca1a20499afdde1c43161d38f132ab00d893fde50391ea # {"$imagepolicy": "hermes:hermes-webui-release"}
           imagePullPolicy: IfNotPresent
           command: [/bin/sh, -ec]
           args:
diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index f5856166..39887300 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -388,7 +388,7 @@ spec:
               cpu: "2"
               memory: 4Gi
         - name: webui
-          image: registry.bstein.dev/bstein/hermes-webui:git-d041f1d1ee3ce06e132f85a271c626f90ac3cc63-build-24-release@sha256:1ea5b4ad7852fd9edf93bd6f4574abeaf10ed55bff40dc08ccf52a661a9fefd3 # {"$imagepolicy": "hermes:hermes-webui-release"}
+          image: registry.bstein.dev/bstein/hermes-webui:git-3fd760de0eda63a13ee842c324f62b9daf5cb8fe-build-25-release@sha256:7e8a1305a8ca521e32ca1a20499afdde1c43161d38f132ab00d893fde50391ea # {"$imagepolicy": "hermes:hermes-webui-release"}
           imagePullPolicy: IfNotPresent
           command: [/bin/sh, -ec]
           args: