monitoring(ai): allow Switchyard metric scraping

services/hermes/networkpolicy.yaml

@@ -402,6 +402,15 @@ spec:
                 values: [hermes, hermes-agent, hermes-chat-tenant]
       ports:
         - {protocol: TCP, port: 9005}
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+          podSelector:
+            matchLabels:
+              app: server
+      ports:
+        - {protocol: TCP, port: 9005}
   egress:
     - to:
         - namespaceSelector:

testing/tests/test_hermes_cli_lanes.py

@@ -893,7 +893,7 @@ def test_agent_auth_is_bstein_group_and_email_bounded():
     assert '"full.path":"true"' in script
 
 
-def test_agent_network_boundary_allows_only_authenticated_web_and_broker_surfaces():
+def test_agent_network_boundary_allows_only_authenticated_and_metrics_surfaces():
     documents = [
         item
         for item in yaml.safe_load_all((HERMES / "networkpolicy.yaml").read_text())
@@ -942,6 +942,19 @@ def test_agent_network_boundary_allows_only_authenticated_web_and_broker_surface
                 {"protocol": "TCP", "port": 9006},
             ],
         },
+        {
+            "from": [
+                {
+                    "namespaceSelector": {
+                        "matchLabels": {
+                            "kubernetes.io/metadata.name": "monitoring"
+                        }
+                    },
+                    "podSelector": {"matchLabels": {"app": "server"}},
+                }
+            ],
+            "ports": [{"protocol": "TCP", "port": 9010}],
+        },
     ]
     assert isolation["spec"]["egress"] == [{}]
 
@@ -1177,6 +1190,35 @@ def test_switchyard_network_boundary_allows_vault_bootstrap():
     )
 
 
+def test_switchyard_network_boundary_allows_metrics_scraping():
+    """VictoriaMetrics may scrape Switchyard without widening its API boundary."""
+    documents = [
+        item
+        for item in yaml.safe_load_all((HERMES / "networkpolicy.yaml").read_text())
+        if item
+    ]
+    isolation = next(
+        item
+        for item in documents
+        if item.get("metadata", {}).get("name") == "hermes-switchyard-isolation"
+    )
+    assert any(
+        rule.get("from")
+        == [
+            {
+                "namespaceSelector": {
+                    "matchLabels": {
+                        "kubernetes.io/metadata.name": "monitoring"
+                    }
+                },
+                "podSelector": {"matchLabels": {"app": "server"}},
+            }
+        ]
+        and rule.get("ports") == [{"protocol": "TCP", "port": 9005}]
+        for rule in isolation["spec"]["ingress"]
+    )
+
+
 def test_owner_agent_installs_the_pinned_operator_toolchain():
     script = (SCRIPTS / "install_agent_tools.sh").read_text()
     for value in [