titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into feature/hermes-direct-cli-lane-concurrency-2-replacement

Browse Source
This commit is contained in:
bstein 2026-08-21 07:57:35 +00:00
commit 66a537ddbe
24 changed files with 51 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dockerfiles/Dockerfile.hermes-agent
View File

@ -1526,7 +1526,7 @@ function replaceOnce(source, before, after, label) {
it to the shared Hermes bot from your Telegram account. it to the shared Hermes bot from your Telegram account.
</p> </p>
<a <a
href="https://chat.hermes.bstein.dev/telegram" href="https://chat.bstein.dev/telegram"
className="mt-4 inline-flex rounded border border-current/30 px-4 py-2 text-sm font-medium text-midground hover:bg-midground/10" className="mt-4 inline-flex rounded border border-current/30 px-4 py-2 text-sm font-medium text-midground hover:bg-midground/10"
> >
Open Telegram setup Open Telegram setup

2
dockerfiles/hermes-public-extract/provider.py
View File

@ -65,7 +65,7 @@ def _fetch_public(url: str) -> tuple[str, str, str]:
"""Fetch one public URL with redirect, size, MIME, and policy checks.""" """Fetch one public URL with redirect, size, MIME, and policy checks."""
current = url current = url
headers = { headers = {
"User-Agent": "HermesPrivateChat/1.0 (+https://chat.hermes.bstein.dev)", "User-Agent": "HermesPrivateChat/1.0 (+https://chat.bstein.dev)",
"Accept": "text/html, text/plain;q=0.9, application/xhtml+xml;q=0.8", "Accept": "text/html, text/plain;q=0.9, application/xhtml+xml;q=0.8",
} }
with httpx.Client(follow_redirects=False, timeout=15.0, headers=headers) as client: with httpx.Client(follow_redirects=False, timeout=15.0, headers=headers) as client:

2
dockerfiles/hermes-webui-atlas-voice.js
View File

@ -1,4 +1,4 @@
// Natural turn-taking for chat.hermes.bstein.dev using the private Jetsons. // Natural turn-taking for chat.bstein.dev using the private Jetsons.
(function(){ (function(){
'use strict'; 'use strict';

4
infrastructure/core/coredns-custom.yaml
View File

@ -18,7 +18,7 @@ data:
192.168.22.9 call.live.bstein.dev 192.168.22.9 call.live.bstein.dev
192.168.22.9 cd.bstein.dev 192.168.22.9 cd.bstein.dev
192.168.22.9 chat.ai.bstein.dev 192.168.22.9 chat.ai.bstein.dev
192.168.22.9 chat.hermes.bstein.dev 192.168.22.9 chat.bstein.dev
192.168.22.9 ci.bstein.dev 192.168.22.9 ci.bstein.dev
192.168.22.9 cloud.bstein.dev 192.168.22.9 cloud.bstein.dev
192.168.22.9 health.bstein.dev 192.168.22.9 health.bstein.dev
@ -45,7 +45,7 @@ data:
192.168.22.9 stream.bstein.dev 192.168.22.9 stream.bstein.dev
192.168.22.9 wolf.bstein.dev 192.168.22.9 wolf.bstein.dev
192.168.22.9 tasks.bstein.dev 192.168.22.9 tasks.bstein.dev
192.168.22.9 triage.hermes.bstein.dev 192.168.22.9 triage.bstein.dev
192.168.22.9 vault.bstein.dev 192.168.22.9 vault.bstein.dev
fallthrough fallthrough
} }

4
knowledge/catalog/atlas.json
View File

@ -4404,7 +4404,7 @@
} }
}, },
{ {
"host": "chat.hermes.bstein.dev", "host": "chat.bstein.dev",
"path": "/", "path": "/",
"backend": { "backend": {
"namespace": "hermes", "namespace": "hermes",
@ -5164,7 +5164,7 @@
} }
}, },
{ {
"host": "triage.hermes.bstein.dev", "host": "triage.bstein.dev",
"path": "/", "path": "/",
"backend": { "backend": {
"namespace": "hermes", "namespace": "hermes",

4
knowledge/catalog/atlas.yaml
View File

@ -2888,7 +2888,7 @@ http_endpoints:
kind: Ingress kind: Ingress
name: bstein-dev-home name: bstein-dev-home
source: bstein-dev-home source: bstein-dev-home
- host: chat.hermes.bstein.dev - host: chat.bstein.dev
path: / path: /
backend: backend:
namespace: hermes namespace: hermes
@ -3361,7 +3361,7 @@ http_endpoints:
kind: Ingress kind: Ingress
name: planka name: planka
source: planka source: planka
- host: triage.hermes.bstein.dev - host: triage.bstein.dev
path: / path: /
backend: backend:
namespace: hermes namespace: hermes

8
knowledge/diagrams/atlas-http.mmd
View File

@ -51,9 +51,9 @@ flowchart LR
host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway
wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"] wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"]
svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway
host_chat_hermes_bstein_dev["chat.hermes.bstein.dev"] host_chat_bstein_dev["chat.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"] svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"]
host_chat_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat host_chat_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat
wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"] wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"]
svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat
host_ci_bstein_dev["ci.bstein.dev"] host_ci_bstein_dev["ci.bstein.dev"]
@ -170,9 +170,9 @@ flowchart LR
host_tasks_bstein_dev --> svc_planka_planka host_tasks_bstein_dev --> svc_planka_planka
wl_planka_planka["planka/planka (Deployment)"] wl_planka_planka["planka/planka (Deployment)"]
svc_planka_planka --> wl_planka_planka svc_planka_planka --> wl_planka_planka
host_triage_hermes_bstein_dev["triage.hermes.bstein.dev"] host_triage_bstein_dev["triage.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"] svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"]
host_triage_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage host_triage_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage
wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"] wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"]
svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage
host_vault_bstein_dev["vault.bstein.dev"] host_vault_bstein_dev["vault.bstein.dev"]

4
services/comms/knowledge/catalog/atlas.json
View File

@ -4404,7 +4404,7 @@
} }
}, },
{ {
"host": "chat.hermes.bstein.dev", "host": "chat.bstein.dev",
"path": "/", "path": "/",
"backend": { "backend": {
"namespace": "hermes", "namespace": "hermes",
@ -5164,7 +5164,7 @@
} }
}, },
{ {
"host": "triage.hermes.bstein.dev", "host": "triage.bstein.dev",
"path": "/", "path": "/",
"backend": { "backend": {
"namespace": "hermes", "namespace": "hermes",

4
services/comms/knowledge/catalog/atlas.yaml
View File

@ -2888,7 +2888,7 @@ http_endpoints:
kind: Ingress kind: Ingress
name: bstein-dev-home name: bstein-dev-home
source: bstein-dev-home source: bstein-dev-home
- host: chat.hermes.bstein.dev - host: chat.bstein.dev
path: / path: /
backend: backend:
namespace: hermes namespace: hermes
@ -3361,7 +3361,7 @@ http_endpoints:
kind: Ingress kind: Ingress
name: planka name: planka
source: planka source: planka
- host: triage.hermes.bstein.dev - host: triage.bstein.dev
path: / path: /
backend: backend:
namespace: hermes namespace: hermes

8
services/comms/knowledge/diagrams/atlas-http.mmd
View File

@ -51,9 +51,9 @@ flowchart LR
host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway
wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"] wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"]
svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway
host_chat_hermes_bstein_dev["chat.hermes.bstein.dev"] host_chat_bstein_dev["chat.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"] svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"]
host_chat_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat host_chat_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat
wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"] wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"]
svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat
host_ci_bstein_dev["ci.bstein.dev"] host_ci_bstein_dev["ci.bstein.dev"]
@ -170,9 +170,9 @@ flowchart LR
host_tasks_bstein_dev --> svc_planka_planka host_tasks_bstein_dev --> svc_planka_planka
wl_planka_planka["planka/planka (Deployment)"] wl_planka_planka["planka/planka (Deployment)"]
svc_planka_planka --> wl_planka_planka svc_planka_planka --> wl_planka_planka
host_triage_hermes_bstein_dev["triage.hermes.bstein.dev"] host_triage_bstein_dev["triage.bstein.dev"]
svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"] svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"]
host_triage_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage host_triage_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage
wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"] wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"]
svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage
host_vault_bstein_dev["vault.bstein.dev"] host_vault_bstein_dev["vault.bstein.dev"]

6
services/hermes/NOTES.md
View File

@ -1,8 +1,8 @@
# Hermes on Atlas: operator guide # Hermes on Atlas: operator guide
This is the mental model and demonstration script for the operator instance at This is the mental model and demonstration script for the operator instance at
`triage.hermes.bstein.dev`. Read it once, then prove each section in the live UI. The `triage.bstein.dev`. Read it once, then prove each section in the live UI. The
consumer instance at `chat.hermes.bstein.dev` is intentionally separate and is not the consumer instance at `chat.bstein.dev` is intentionally separate and is not the
place to perform infrastructure triage. place to perform infrastructure triage.
`agent.hermes.bstein.dev` is the owner-only engineering control plane. Its root `agent.hermes.bstein.dev` is the owner-only engineering control plane. Its root
@ -14,7 +14,7 @@ its conversation-first layout is a better fit.
## Consumer chat and Telegram ## Consumer chat and Telegram
`chat.hermes.bstein.dev` uses the pinned Hermes WebUI rather than the operator `chat.bstein.dev` uses the pinned Hermes WebUI rather than the operator
dashboard. Keycloak still authenticates every browser request, and the tenant dashboard. Keycloak still authenticates every browser request, and the tenant
router permanently assigns each Keycloak subject to one Hermes process and one router permanently assigns each Keycloak subject to one Hermes process and one
PVC. The four slots are an isolation pool, not a provider round robin: every PVC. The four slots are an isolation pool, not a provider round robin: every

4
services/hermes/agent-certificate.yaml
View File

@ -11,5 +11,5 @@ spec:
name: letsencrypt name: letsencrypt
dnsNames: dnsNames:
- agent.hermes.bstein.dev - agent.hermes.bstein.dev
- chat.hermes.bstein.dev - chat.bstein.dev
- triage.hermes.bstein.dev - triage.bstein.dev

2
services/hermes/agent-configmap.yaml
View File

@ -322,7 +322,7 @@ data:
cannot read Secrets, exec or attach to pods, create service-account tokens, cannot read Secrets, exec or attach to pods, create service-account tokens,
mutate workloads or RBAC, or reconcile Flux. Put every durable cluster mutate workloads or RBAC, or reconcile Flux. Put every durable cluster
change on a reviewed titan-iac branch. Never expose credentials in chat or change on a reviewed titan-iac branch. Never expose credentials in chat or
logs. Triage belongs at triage.hermes.bstein.dev. logs. Triage belongs at triage.bstein.dev.
## Atlas engineering access ## Atlas engineering access

8
services/hermes/agent-ingress.yaml
View File

@ -88,11 +88,11 @@ spec:
tls: tls:
- hosts: - hosts:
- agent.hermes.bstein.dev - agent.hermes.bstein.dev
- chat.hermes.bstein.dev - chat.bstein.dev
- triage.hermes.bstein.dev - triage.bstein.dev
secretName: hermes-sites-tls secretName: hermes-sites-tls
rules: rules:
- host: chat.hermes.bstein.dev - host: chat.bstein.dev
http: http:
paths: paths:
- path: / - path: /
@ -102,7 +102,7 @@ spec:
name: oauth2-proxy-hermes-chat name: oauth2-proxy-hermes-chat
port: port:
name: http name: http
- host: triage.hermes.bstein.dev - host: triage.bstein.dev
http: http:
paths: paths:
- path: / - path: /

2
services/hermes/chat-configmap.yaml
View File

@ -68,7 +68,7 @@ data:
atlas/manual/claude/opus: {provider: atlas-switchyard, model: atlas/manual/claude/opus} atlas/manual/claude/opus: {provider: atlas-switchyard, model: atlas/manual/claude/opus}
atlas/manual/local/qwen-14b: {provider: atlas-switchyard, model: atlas/manual/local/qwen-14b} atlas/manual/local/qwen-14b: {provider: atlas-switchyard, model: atlas/manual/local/qwen-14b}
dashboard: dashboard:
public_url: https://chat.hermes.bstein.dev public_url: https://chat.bstein.dev
display: display:
compact: true compact: true
tool_progress: all tool_progress: all

4
services/hermes/chat-statefulset.yaml
View File

@ -277,7 +277,7 @@ spec:
- {name: API_SERVER_ENABLED, value: "true"} - {name: API_SERVER_ENABLED, value: "true"}
- {name: API_SERVER_HOST, value: 0.0.0.0} - {name: API_SERVER_HOST, value: 0.0.0.0}
- {name: API_SERVER_PORT, value: "8642"} - {name: API_SERVER_PORT, value: "8642"}
- {name: API_SERVER_CORS_ORIGINS, value: https://chat.hermes.bstein.dev} - {name: API_SERVER_CORS_ORIGINS, value: https://chat.bstein.dev}
- {name: HERMES_IMAGE_BROKER_URL, value: http://hermes-image-broker.hermes.svc.cluster.local:9002} - {name: HERMES_IMAGE_BROKER_URL, value: http://hermes-image-broker.hermes.svc.cluster.local:9002}
- {name: HERMES_IMAGE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key} - {name: HERMES_IMAGE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key}
- {name: HERMES_AUTO_ROUTER_PROFILE, value: chat} - {name: HERMES_AUTO_ROUTER_PROFILE, value: chat}
@ -345,7 +345,7 @@ spec:
# NetworkPolicy admits this port only from hermes-chat-router; the # NetworkPolicy admits this port only from hermes-chat-router; the
# CIDR lets the WebUI validate that router's changing pod address. # CIDR lets the WebUI validate that router's changing pod address.
- {name: HERMES_WEBUI_TRUSTED_PROXY_CIDRS, value: 10.42.0.0/16} - {name: HERMES_WEBUI_TRUSTED_PROXY_CIDRS, value: 10.42.0.0/16}
- {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://chat.hermes.bstein.dev} - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://chat.bstein.dev}
- {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"} - {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"}
- {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"} - {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"}
- {name: HERMES_ROUTER_PROFILE, value: chat} - {name: HERMES_ROUTER_PROFILE, value: chat}

6
services/hermes/configmap.yaml
View File

@ -83,7 +83,7 @@ data:
- "*kubectl describe secret*" - "*kubectl describe secret*"
dashboard: dashboard:
public_url: https://triage.hermes.bstein.dev public_url: https://triage.bstein.dev
display: display:
compact: true compact: true
@ -111,10 +111,10 @@ data:
You are Hermes running inside the Titan Kubernetes cluster as a supervised You are Hermes running inside the Titan Kubernetes cluster as a supervised
testing and operations triage assistant. testing and operations triage assistant.
This is the dedicated triage appliance at triage.hermes.bstein.dev. Keep This is the dedicated triage appliance at triage.bstein.dev. Keep
automated Ariadne intake and testing conversations here. Project delivery automated Ariadne intake and testing conversations here. Project delivery
and coding orchestration belong to agent.hermes.bstein.dev; general user and coding orchestration belong to agent.hermes.bstein.dev; general user
chat belongs to chat.hermes.bstein.dev. chat belongs to chat.bstein.dev.
Start in AUTO routing with a careful, intelligence-biased posture. Every Start in AUTO routing with a careful, intelligence-biased posture. Every
new request is classified locally before a hosted model is selected. The new request is classified locally before a hosted model is selected. The

6
services/hermes/deployment.yaml
View File

@ -284,7 +284,7 @@ spec:
- name: HERMES_DASHBOARD - name: HERMES_DASHBOARD
value: "0" value: "0"
- name: HERMES_DASHBOARD_PUBLIC_URL - name: HERMES_DASHBOARD_PUBLIC_URL
value: https://triage.hermes.bstein.dev value: https://triage.bstein.dev
- name: API_SERVER_ENABLED - name: API_SERVER_ENABLED
value: "true" value: "true"
- name: API_SERVER_HOST - name: API_SERVER_HOST
@ -292,7 +292,7 @@ spec:
- name: API_SERVER_PORT - name: API_SERVER_PORT
value: "8642" value: "8642"
- name: API_SERVER_CORS_ORIGINS - name: API_SERVER_CORS_ORIGINS
value: https://triage.hermes.bstein.dev value: https://triage.bstein.dev
- name: VICTORIA_METRICS_URL - name: VICTORIA_METRICS_URL
value: http://victoria-metrics-single-server.monitoring.svc.cluster.local:8428 value: http://victoria-metrics-single-server.monitoring.svc.cluster.local:8428
- name: ARIADNE_BASE_URL - name: ARIADNE_BASE_URL
@ -405,7 +405,7 @@ spec:
- {name: HERMES_WEBUI_GATEWAY_USE_RUNS_API, value: "true"} - {name: HERMES_WEBUI_GATEWAY_USE_RUNS_API, value: "true"}
- {name: HERMES_WEBUI_SKIP_ONBOARDING, value: "1"} - {name: HERMES_WEBUI_SKIP_ONBOARDING, value: "1"}
- {name: HERMES_WEBUI_SECURE, value: "1"} - {name: HERMES_WEBUI_SECURE, value: "1"}
- {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.hermes.bstein.dev} - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.bstein.dev}
- {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"} - {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"}
- {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"} - {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"}
- {name: HERMES_ROUTER_PROFILE, value: triage} - {name: HERMES_ROUTER_PROFILE, value: triage}

4
services/hermes/oauth2-proxy.yaml
View File

@ -82,7 +82,7 @@ spec:
args: args:
- --provider=oidc - --provider=oidc
- --config=/vault/secrets/oidc-config - --config=/vault/secrets/oidc-config
- --redirect-url=https://triage.hermes.bstein.dev/oauth2/callback - --redirect-url=https://triage.bstein.dev/oauth2/callback
- --oidc-issuer-url=https://sso.bstein.dev/realms/atlas - --oidc-issuer-url=https://sso.bstein.dev/realms/atlas
- --user-id-claim=sub - --user-id-claim=sub
- --code-challenge-method=S256 - --code-challenge-method=S256
@ -181,7 +181,7 @@ spec:
args: args:
- --provider=oidc - --provider=oidc
- --config=/vault/secrets/oidc-config - --config=/vault/secrets/oidc-config
- --redirect-url=https://chat.hermes.bstein.dev/oauth2/callback - --redirect-url=https://chat.bstein.dev/oauth2/callback
- --oidc-issuer-url=https://sso.bstein.dev/realms/atlas - --oidc-issuer-url=https://sso.bstein.dev/realms/atlas
- --user-id-claim=sub - --user-id-claim=sub
- --code-challenge-method=S256 - --code-challenge-method=S256

4
services/hermes/router/telegram.go
View File

@ -249,7 +249,7 @@ func (bot *telegramBot) handleUpdate(update telegramUpdate) {
command, args := commandParts(message.Text) command, args := commandParts(message.Text)
if command == "start" || command == "link" { if command == "start" || command == "link" {
if len(args) == 0 { if len(args) == 0 {
_ = bot.sendText(message.Chat.ID, "Sign in to chat.hermes.bstein.dev, open Telegram, and create a one-time link code.") _ = bot.sendText(message.Chat.ID, "Sign in to chat.bstein.dev, open Telegram, and create a one-time link code.")
return return
} }
if _, err := bot.router.consumeLink(userID, args[0]); err != nil { if _, err := bot.router.consumeLink(userID, args[0]); err != nil {
@ -273,7 +273,7 @@ func (bot *telegramBot) handleUpdate(update telegramUpdate) {
} }
slot, linked := bot.router.telegramSlot(userID) slot, linked := bot.router.telegramSlot(userID)
if !linked { if !linked {
_ = bot.sendText(message.Chat.ID, "This Telegram account is not linked. Sign in to chat.hermes.bstein.dev and open Telegram to connect it.") _ = bot.sendText(message.Chat.ID, "This Telegram account is not linked. Sign in to chat.bstein.dev and open Telegram to connect it.")
return return
} }
if command == "topic" { if command == "topic" {

4
services/hermes/skills/master-hermes-on-atlas/references/architecture.md
View File

@ -7,9 +7,9 @@ asserting health, placement, ownership, or current model availability.
| Surface | Purpose | Identity boundary | State and permissions | | Surface | Purpose | Identity boundary | State and permissions |
| --- | --- | --- | --- | | --- | --- | --- | --- |
| `triage.hermes.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints | | `triage.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints |
| `agent.hermes.bstein.dev` | Brad's project coordinator | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace and separate PVC; native Hermes delegates bounded work while Herdr preserves real Codex and Claude Code CLI sessions when needed | | `agent.hermes.bstein.dev` | Brad's project coordinator | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace and separate PVC; native Hermes delegates bounded work while Herdr preserves real Codex and Claude Code CLI sessions when needed |
| `chat.hermes.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access | | `chat.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access |
The instances do not share conversation state, credentials, profiles, skills The instances do not share conversation state, credentials, profiles, skills
created on their PVCs, or Kubernetes identities. They share only the inference created on their PVCs, or Kubernetes identities. They share only the inference

4
services/keycloak/scripts/hermes_access_oidc_ensure.sh
View File

@ -327,8 +327,8 @@ ensure_telegram_config() {
} }
ensure_hermes_owner ensure_hermes_owner
ensure_proxy_client "hermes-chat-proxy" "https://chat.hermes.bstein.dev" "hermes/chat-oidc" ensure_proxy_client "hermes-chat-proxy" "https://chat.bstein.dev" "hermes/chat-oidc"
ensure_proxy_client "hermes-agent-proxy" "https://agent.hermes.bstein.dev" "hermes/agent-oidc" ensure_proxy_client "hermes-agent-proxy" "https://agent.hermes.bstein.dev" "hermes/agent-oidc"
ensure_proxy_client "hermes-triage-proxy" "https://triage.hermes.bstein.dev" "hermes/triage-oidc" ensure_proxy_client "hermes-triage-proxy" "https://triage.bstein.dev" "hermes/triage-oidc"
ensure_service_account_client "hermes-automation" "hermes/developer-keycloak" ensure_service_account_client "hermes-automation" "hermes/developer-keycloak"
ensure_telegram_config ensure_telegram_config

2
services/maintenance/apps/ariadne-deployment.yaml
View File

@ -555,7 +555,7 @@ spec:
# open the run that wrote it rather than taking "Proposed by # open the run that wrote it rather than taking "Proposed by
# Hermes" on trust. # Hermes" on trust.
- name: ARIADNE_HERMES_UI_URL - name: ARIADNE_HERMES_UI_URL
value: https://triage.hermes.bstein.dev value: https://triage.bstein.dev
- name: ARIADNE_HERMES_SONAR_ENABLED - name: ARIADNE_HERMES_SONAR_ENABLED
value: "true" value: "true"
- name: ARIADNE_HERMES_SONAR_URL - name: ARIADNE_HERMES_SONAR_URL

4
services/quality/zap-baseline-configmap.yaml
View File

@ -27,8 +27,8 @@ data:
https://money.bstein.dev https://money.bstein.dev
https://health.bstein.dev https://health.bstein.dev
https://agent.hermes.bstein.dev https://agent.hermes.bstein.dev
https://chat.hermes.bstein.dev https://chat.bstein.dev
https://triage.hermes.bstein.dev https://triage.bstein.dev
https://cassandra.bstein.dev https://cassandra.bstein.dev
https://veles.bstein.dev https://veles.bstein.dev
https://matrix.live.bstein.dev https://matrix.live.bstein.dev