From 89b9f1a4c747da0172858be7ed77d6601b0b6702 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Sat, 15 Aug 2026 17:58:47 -0300
Subject: [PATCH] hermes: isolate runtime access and expose activity

---
 .../applications/hermes/kustomization.yaml    |   4 +
 .../Dockerfile.hermes-agent.dockerignore      |   6 +
 dockerfiles/hermes-session-activity-panel.tsx |  15 +-
 knowledge/catalog/atlas-summary.json          |   2 +-
 knowledge/catalog/atlas.json                  |  25 +-
 knowledge/catalog/atlas.yaml                  |  21 +-
 knowledge/catalog/runbooks.json               |   2 +-
 knowledge/runbooks/hermes-triage-demo.md      |  11 +-
 scripts/ops/styx_prep.sh                      |  18 +-
 scripts/ops/styx_prep_nvme_luks.sh            |  10 +-
 .../knowledge/catalog/atlas-summary.json      |   2 +-
 services/comms/knowledge/catalog/atlas.json   |  25 +-
 services/comms/knowledge/catalog/atlas.yaml   |  21 +-
 .../comms/knowledge/catalog/runbooks.json     |   2 +-
 .../knowledge/runbooks/hermes-triage-demo.md  |  11 +-
 .../scripts/gitea_atlas_identity_ensure.sh    |  56 +++-
 services/hermes/agent-configmap.yaml          |  18 +-
 services/hermes/agent-deployment.yaml         | 265 +++++++++++------
 services/hermes/chat-router.yaml              |   2 +-
 services/hermes/chat-statefulset.yaml         | 105 ++++---
 services/hermes/deployment.yaml               | 153 +++++-----
 services/hermes/kustomization.yaml            |   7 +-
 .../plugins/image-gen-broker/__init__.py      |  18 +-
 services/hermes/pvc.yaml                      |  15 -
 services/hermes/scripts/claude                |   2 +-
 .../hermes/scripts/claude_oauth_broker.py     |  12 +-
 services/hermes/scripts/codex_broker.py       |  19 +-
 services/hermes/scripts/gitea_askpass.sh      |  15 +-
 services/hermes/scripts/hermes_coordinator.py |  44 ++-
 .../hermes/scripts/hermes_model_routing.py    |  34 +--
 services/hermes/scripts/image_broker.py       |  19 +-
 .../scripts/patch_api_server_sessions.py      | 183 +++++++++++-
 .../scripts/patch_process_output_redaction.py |  39 +++
 .../patch_subprocess_secret_boundary.py       |  45 +++
 .../scripts/patch_web_session_activity.py     |  96 ++++++
 .../hermes/scripts/stage_runtime_access.py    | 162 ++++++++++
 .../scripts/sync_runtime_credentials.py       | 141 +++++++++
 .../hermes/scripts/telegram_media_server.py   |  18 +-
 services/hermes/switchyard-deployment.yaml    |   2 +-
 .../maintenance/apps/ariadne-deployment.yaml  |  18 +-
 .../vault/scripts/vault_k8s_auth_configure.sh |   6 +-
 testing/tests/test_hermes_chat_quality.py     |  97 ++++--
 testing/tests/test_hermes_cli_lanes.py        |  30 +-
 testing/tests/test_hermes_coordinator.py      |  25 +-
 testing/tests/test_hermes_runtime_access.py   | 276 ++++++++++++++++++
 45 files changed, 1717 insertions(+), 380 deletions(-)
 create mode 100644 dockerfiles/Dockerfile.hermes-agent.dockerignore
 create mode 100644 services/hermes/scripts/patch_process_output_redaction.py
 create mode 100644 services/hermes/scripts/patch_subprocess_secret_boundary.py
 create mode 100644 services/hermes/scripts/patch_web_session_activity.py
 create mode 100644 services/hermes/scripts/stage_runtime_access.py
 create mode 100644 services/hermes/scripts/sync_runtime_credentials.py
 create mode 100644 testing/tests/test_hermes_runtime_access.py

diff --git a/clusters/atlas/flux-system/applications/hermes/kustomization.yaml b/clusters/atlas/flux-system/applications/hermes/kustomization.yaml
index 57fed46e..3949282b 100644
--- a/clusters/atlas/flux-system/applications/hermes/kustomization.yaml
+++ b/clusters/atlas/flux-system/applications/hermes/kustomization.yaml
@@ -30,6 +30,10 @@ spec:
       kind: Deployment
       name: hermes-agent
       namespace: hermes
+    - apiVersion: apps/v1
+      kind: DaemonSet
+      name: hermes-node-ssh-access
+      namespace: hermes
     - apiVersion: apps/v1
       kind: Deployment
       name: hermes
diff --git a/dockerfiles/Dockerfile.hermes-agent.dockerignore b/dockerfiles/Dockerfile.hermes-agent.dockerignore
new file mode 100644
index 00000000..d5e5ddcc
--- /dev/null
+++ b/dockerfiles/Dockerfile.hermes-agent.dockerignore
@@ -0,0 +1,6 @@
+**
+!dockerfiles/hermes-python-sandbox-tool.py
+!dockerfiles/hermes-public-extract/
+!dockerfiles/hermes-public-extract/**
+!dockerfiles/hermes-session-activity-panel.tsx
+!dockerfiles/hermes-session-migrate.py
diff --git a/dockerfiles/hermes-session-activity-panel.tsx b/dockerfiles/hermes-session-activity-panel.tsx
index 130c8ac9..f2be9ddc 100644
--- a/dockerfiles/hermes-session-activity-panel.tsx
+++ b/dockerfiles/hermes-session-activity-panel.tsx
@@ -104,8 +104,9 @@ function ActivityMessage({
 
 /**
  * Show every persisted message and tool event without relying on xterm's
- * canvas. API workers default to this view; the normal terminal remains one
- * click away and continues running underneath it.
+ * canvas. Resumed sessions default to this view so an unknown or delayed
+ * backend source classification cannot hide activity; the normal terminal
+ * remains one click away and continues running underneath it.
  */
 export function SessionActivityPanel({
   sessionId,
@@ -129,7 +130,7 @@ export function SessionActivityPanel({
         api.getSessionMessages(sessionId, profile ?? ""),
       ]);
       setDetail(nextDetail);
-      setMessages(response.messages);
+      setMessages(Array.isArray(response.messages) ? response.messages : []);
       setError(null);
       setPollTime(Date.now());
       if (stickToBottom.current) {
@@ -169,9 +170,6 @@ export function SessionActivityPanel({
         ? "Working"
         : "Run finished";
 
-  // Ordinary interactive TUI sessions keep their established terminal UI.
-  if (detail && detail.source !== "api_server") return null;
-
   if (!expanded) {
     return (
       <Button
@@ -235,6 +233,11 @@ export function SessionActivityPanel({
       <div
         ref={scrollRef}
         className="min-h-0 flex-1 space-y-2 overflow-y-auto p-3"
+        role="log"
+        aria-live="polite"
+        aria-relevant="additions text"
+        aria-busy={running && messages.length === 0}
+        aria-label="Chronological Hermes worker activity"
         tabIndex={0}
         onScroll={(event) => {
           const node = event.currentTarget;
diff --git a/knowledge/catalog/atlas-summary.json b/knowledge/catalog/atlas-summary.json
index 004af8ca..9acf7417 100644
--- a/knowledge/catalog/atlas-summary.json
+++ b/knowledge/catalog/atlas-summary.json
@@ -3,6 +3,6 @@
     "helmrelease_host_hints": 23,
     "http_endpoints": 61,
     "services": 91,
-    "workloads": 124
+    "workloads": 125
   }
 }
diff --git a/knowledge/catalog/atlas.json b/knowledge/catalog/atlas.json
index 6fcdd018..98628e38 100644
--- a/knowledge/catalog/atlas.json
+++ b/knowledge/catalog/atlas.json
@@ -892,6 +892,19 @@
         "wger/server@sha256:710588b78af4e0aa0b4d8a8061e4563e16eae80eeaccfe7f9e0d9cbdd7f0cbc5"
       ]
     },
+    {
+      "kind": "DaemonSet",
+      "namespace": "hermes",
+      "name": "hermes-node-ssh-access",
+      "labels": {
+        "app": "hermes-node-ssh-access"
+      },
+      "serviceAccountName": "hermes-node-ssh-access",
+      "nodeSelector": {},
+      "images": [
+        "busybox:1.37"
+      ]
+    },
     {
       "kind": "Deployment",
       "namespace": "hermes",
@@ -902,7 +915,7 @@
       "serviceAccountName": "hermes-triage",
       "nodeSelector": {},
       "images": [
-        "registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1",
+        "registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8",
         "registry.bstein.dev/bstein/hermes-webui@sha256:9c2fe8341c7b650e08d10acead3151b19e2af737863268bafb39b3d9517575b1"
       ]
     },
@@ -917,7 +930,7 @@
       "nodeSelector": {},
       "images": [
         "quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561",
-        "registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1"
+        "registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8"
       ]
     },
     {
@@ -1164,7 +1177,7 @@
       "serviceAccountName": "hermes-chat",
       "nodeSelector": {},
       "images": [
-        "registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1",
+        "registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8",
         "registry.bstein.dev/bstein/hermes-webui@sha256:9c2fe8341c7b650e08d10acead3151b19e2af737863268bafb39b3d9517575b1"
       ]
     },
@@ -1515,7 +1528,7 @@
         "kubernetes.io/os": "linux"
       },
       "images": [
-        "registry.bstein.dev/bstein/metis-sentinel:0.1.0-292-amd64"
+        "registry.bstein.dev/bstein/metis-sentinel:0.1.0-293-amd64"
       ]
     },
     {
@@ -1531,7 +1544,7 @@
         "kubernetes.io/os": "linux"
       },
       "images": [
-        "registry.bstein.dev/bstein/metis-sentinel:0.1.0-291-arm64"
+        "registry.bstein.dev/bstein/metis-sentinel:0.1.0-293-arm64"
       ]
     },
     {
@@ -1648,7 +1661,7 @@
       "serviceAccountName": "metis",
       "nodeSelector": {},
       "images": [
-        "registry.bstein.dev/bstein/metis:0.1.0-291-arm64"
+        "registry.bstein.dev/bstein/metis:0.1.0-293-arm64"
       ]
     },
     {
diff --git a/knowledge/catalog/atlas.yaml b/knowledge/catalog/atlas.yaml
index 3ee78f4d..6e355e7f 100644
--- a/knowledge/catalog/atlas.yaml
+++ b/knowledge/catalog/atlas.yaml
@@ -596,6 +596,15 @@ workloads:
   images:
   - nginx:1.27.5-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
   - wger/server@sha256:710588b78af4e0aa0b4d8a8061e4563e16eae80eeaccfe7f9e0d9cbdd7f0cbc5
+- kind: DaemonSet
+  namespace: hermes
+  name: hermes-node-ssh-access
+  labels:
+    app: hermes-node-ssh-access
+  serviceAccountName: hermes-node-ssh-access
+  nodeSelector: {}
+  images:
+  - busybox:1.37
 - kind: Deployment
   namespace: hermes
   name: hermes
@@ -604,7 +613,7 @@ workloads:
   serviceAccountName: hermes-triage
   nodeSelector: {}
   images:
-  - registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1
+  - registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8
   - registry.bstein.dev/bstein/hermes-webui@sha256:9c2fe8341c7b650e08d10acead3151b19e2af737863268bafb39b3d9517575b1
 - kind: Deployment
   namespace: hermes
@@ -615,7 +624,7 @@ workloads:
   nodeSelector: {}
   images:
   - quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561
-  - registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1
+  - registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8
 - kind: Deployment
   namespace: hermes
   name: hermes-chat-router
@@ -788,7 +797,7 @@ workloads:
   serviceAccountName: hermes-chat
   nodeSelector: {}
   images:
-  - registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1
+  - registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8
   - registry.bstein.dev/bstein/hermes-webui@sha256:9c2fe8341c7b650e08d10acead3151b19e2af737863268bafb39b3d9517575b1
 - kind: Deployment
   namespace: jellyfin
@@ -1028,7 +1037,7 @@ workloads:
     kubernetes.io/arch: amd64
     kubernetes.io/os: linux
   images:
-  - registry.bstein.dev/bstein/metis-sentinel:0.1.0-292-amd64
+  - registry.bstein.dev/bstein/metis-sentinel:0.1.0-293-amd64
 - kind: DaemonSet
   namespace: maintenance
   name: metis-sentinel-arm64
@@ -1039,7 +1048,7 @@ workloads:
     kubernetes.io/arch: arm64
     kubernetes.io/os: linux
   images:
-  - registry.bstein.dev/bstein/metis-sentinel:0.1.0-291-arm64
+  - registry.bstein.dev/bstein/metis-sentinel:0.1.0-293-arm64
 - kind: DaemonSet
   namespace: maintenance
   name: node-image-sweeper
@@ -1118,7 +1127,7 @@ workloads:
   serviceAccountName: metis
   nodeSelector: {}
   images:
-  - registry.bstein.dev/bstein/metis:0.1.0-291-arm64
+  - registry.bstein.dev/bstein/metis:0.1.0-293-arm64
 - kind: Deployment
   namespace: maintenance
   name: oauth2-proxy-metis
diff --git a/knowledge/catalog/runbooks.json b/knowledge/catalog/runbooks.json
index f0d7306f..f72f166b 100644
--- a/knowledge/catalog/runbooks.json
+++ b/knowledge/catalog/runbooks.json
@@ -50,7 +50,7 @@
     "tags": [],
     "entrypoints": [],
     "source_paths": [],
-    "body": "# Hermes Automated Triage Demo \u2014 Runbook\n\nHow to arm, run, watch, and roll back the automated failure-to-repair demo.\nArchitecture background: `knowledge/hermes-automated-triage-24h-plan.md`.\n\n## What the loop does\n\n```text\nYou arm the failure (SEED_FAILURE=true)\n  -> Jenkins job hermes-triage-demo fails (fixture reads \"unhealthy\")\n  -> test-runner pod also writes the incident JSON to stdout\n     (Fluent Bit ships it to OpenSearch kube-*)\n  -> Ariadne polls the job every minute, opens incident <job>/<build>\n  -> Ariadne bundles Jenkins evidence + bounded OpenSearch excerpts\n  -> Ariadne calls the Hermes Agent API (/v1/runs) with\n     $triage-titan-test-failures\n  -> Hermes returns schema-valid diagnosis + requested_action\n  -> Ariadne authorizes (twelve gates) and, if remediation is enabled,\n     patches the fixture ConfigMap back to \"healthy\" in process\n  -> Ariadne triggers ONE rebuild with SEED_FAILURE=false\n  -> rebuild passes -> incident resolved\nAnything else -> issue in the service repo + human_required metric\n```\n\nThe model behind Hermes is `anthropic/claude-opus-5` as of 2026-08-06, with\n`openai-codex/gpt-5.6-terra` as first fallback and a local `gpt-oss:20b`\nbehind that, so an expired Anthropic credential degrades rather than stops.\n\nTwo behaviours worth knowing before you demo, because both look like nothing\nhappening:\n\n- **A build that never finishes** is escalated once it passes\n  `ARIADNE_HERMES_HUNG_BUILD_MINUTES` (default 45). No model is consulted -\n  the console is still being written - so the issue says only that the build\n  overran and is holding an agent slot.\n- **Alerting no longer fires on every escalation.** The issue in the service\n  repository is the durable artifact. Email now means either a repair ran and\n  failed, or an escalation has sat untouched for six hours.\n\n## Arming the demo\n\nJenkins UI: `https://ci.bstein.dev/job/hermes-triage-demo/` \u2192 *Build with\nParameters* \u2192 check `SEED_FAILURE` \u2192 Build.\n\nCLI (any Jenkins user API token):\n\n```bash\ncurl -u <user>:<token> -X POST \\\n  \"https://ci.bstein.dev/job/hermes-triage-demo/buildWithParameters?SEED_FAILURE=true\"\n```\n\nThat is the only manual step. Everything after the red build is automatic.\n\nRun `scripts/ops/hermes_triage_demo.sh preflight` first. The check that most\noften decides whether a rehearsal holds its timings is the agent pool: the\nKubernetes cloud caps concurrent agent pods at `containerCapStr: \"5\"`, and when\nreal CI has taken all five the demo build sits in the queue reporting *\"All\nnodes of label ... are offline\"* with no other symptom. Observed 2026-08-06: a\nrun armed at 02:13:42 did not start seeding until 02:19:37, close to six\nminutes of dead air, purely because five other builds held the pool. Wait for a\nfree slot before starting, or quiesce CI.\n\n## Expected timings (measured live 2026-08-06, Ariadne 0.1.0-402)\n\nTime the demo from the moment the build goes **red**, not from arming. Arming\nonly queues a Jenkins build, and that leg is at the mercy of the agent pool.\n\n- Red \u2192 fixture patched back to healthy: **25s** (\u226460 s detection tick, ~16 s\n  Hermes diagnosis, then a single in-process Kubernetes API call).\n- Red \u2192 rebuild triggered: **38s**.\n- Red \u2192 rebuild green and incident resolved: **1m04s**.\n\nThe whole automated leg is just over a minute, and there is no silent phase\nlonger than the detection tick. Budgeted Hermes timeout is 420 s; observed\ndiagnosis runs are 15\u201321 s.\n\nArming \u2192 red was **6m21s** on this run, but 5m35s of that was queue wait\nbehind a saturated agent pool. On an idle pool expect roughly 1m45s.\n\nThe earlier 2026-08-05 figures (1m15s red\u2192repaired, 4m00s total) were measured\nwhen the repair spawned its own Kubernetes Job. Converting the repair to an\nin-process call removed a whole pod launch from the critical path.\n\n## Watching it live\n\n- Jenkins: `https://ci.bstein.dev/job/hermes-triage-demo/` (red build N,\n  then green build N+1 with `SEED_FAILURE=false`).\n- Ariadne incident state:\n  `GET http://ariadne.maintenance/api/internal/audit/events` (in-cluster) or\n  `/api/admin/audit/events` (Keycloak JWT) \u2014 event types\n  `hermes_autotriage_incident`, `hermes_autotriage_diagnosis`,\n  `hermes_autotriage_action`. Status flow:\n  `detected \u2192 diagnosed \u2192 repairing \u2192 awaiting_rebuild \u2192 resolved`.\n- Metrics (VictoriaMetrics / Grafana Explore):\n  `ariadne_hermes_triage_incident{jenkins_job=\"hermes-triage-demo\"}`,\n  `ariadne_hermes_triage_action_total`,\n  `ariadne_hermes_triage_duration_seconds`.\n- Repair evidence: `kubectl -n hermes-triage-demo get jobs` shows\n  `hermes-demo-test-<N>` (failed) and `hermes-demo-repair-<N>` (succeeded);\n  both TTL-clean after 1 h.\n- Hermes side: the run appears in the dashboard at\n  `https://agent.hermes.bstein.dev` (session/run history).\n- Escalation path: alert `HermesTriageHumanRequired` in vmalert\n  (`vmalert-atlas-availability` deployment, 1 m interval, `for: 2m`)\n  fires to Alertmanager for any `human_required` incident. Gauges are\n  republished every tick from stored incident state (restart-safe), and\n  the alert self-clears once a newer build of the same job is green.\n  Note: Alertmanager's default receiver is currently null \u2014 the alert is\n  visible in vmalert/Alertmanager/Grafana but pushes no notification.\n\n## Demonstrating safe escalation (second path)\n\nAny failure that does not match the demo-fixture signature \u2014 or any\ninvalid/low-confidence/unknown-action Hermes response \u2014 ends as\n`status=\"human_required\"` with **no mutation**. The simplest live demo:\ntemporarily set `ARIADNE_HERMES_AUTOREMEDIATION_ENABLED=false` (see below)\nand arm the failure; Ariadne diagnoses fully but executes nothing, and the\nalert fires instead.\n\n## Kill switch and rollback\n\n- Instant behavioral off-switch (Flux-managed, in\n  `services/maintenance/apps/ariadne-deployment.yaml`):\n  `ARIADNE_HERMES_AUTOREMEDIATION_ENABLED=false` \u2192 diagnose-only.\n  `ARIADNE_HERMES_AUTOTRIAGE_ENABLED=false` \u2192 fully off.\n- The automatic loop can only ever: create Jobs named\n  `hermes-demo-repair-*` in namespace `hermes-triage-demo`, and trigger\n  rebuilds of allowlisted jobs (`ARIADNE_HERMES_AUTOTRIAGE_JOB_ALLOWLIST`,\n  currently `hermes-triage-demo` only). One action + one rebuild per\n  incident, ever (storage-backed idempotency).\n- Full teardown: remove `hermes-triage-demo` from\n  `clusters/atlas/flux-system/applications/kustomization.yaml` (Flux prunes\n  the namespace) and delete the `pipelineJob('hermes-triage-demo')` block\n  from `services/jenkins/configmap-jcasc.yaml`.\n\n## Credentials\n\n- Ariadne \u2192 Hermes: `Authorization: Bearer` key shared via the\n  `hermes-api-server-key` Secret present in both `hermes` and `maintenance`\n  namespaces (Hermes's init container seeds it into the persistent `.env`).\n  NOTE: currently manually created (Vault migration pending \u2014 see plan\n  handoff); rotating = write new value to both Secrets, restart hermes\n  deployment and ariadne deployment.\n- Ariadne \u2192 Jenkins: existing `JENKINS_API_USER/TOKEN` from Vault\n  (`atlas/maintenance/ariadne-db`)."
+    "body": "# Hermes Automated Triage Demo \u2014 Runbook\n\nHow to arm, run, watch, and roll back the automated failure-to-repair demo.\nArchitecture background: `knowledge/hermes-automated-triage-24h-plan.md`.\n\n## What the loop does\n\n```text\nYou arm the failure (SEED_FAILURE=true)\n  -> Jenkins job hermes-triage-demo fails (fixture reads \"unhealthy\")\n  -> test-runner pod also writes the incident JSON to stdout\n     (Fluent Bit ships it to OpenSearch kube-*)\n  -> Ariadne polls the job every minute, opens incident <job>/<build>\n  -> Ariadne bundles Jenkins evidence + bounded OpenSearch excerpts\n  -> Ariadne calls the Hermes Agent API (/v1/runs) with\n     $triage-titan-test-failures\n  -> Hermes returns schema-valid diagnosis + requested_action\n  -> Ariadne authorizes (twelve gates) and, if remediation is enabled,\n     patches the fixture ConfigMap back to \"healthy\" in process\n  -> Ariadne triggers ONE rebuild with SEED_FAILURE=false\n  -> rebuild passes -> incident resolved\nAnything else -> issue in the service repo + human_required metric\n```\n\nThe model behind Hermes is `anthropic/claude-opus-5` as of 2026-08-06, with\n`openai-codex/gpt-5.6-terra` as first fallback and a local `gpt-oss:20b`\nbehind that, so an expired Anthropic credential degrades rather than stops.\n\nTwo behaviours worth knowing before you demo, because both look like nothing\nhappening:\n\n- **A build that never finishes** is escalated once it passes\n  `ARIADNE_HERMES_HUNG_BUILD_MINUTES` (default 45). No model is consulted -\n  the console is still being written - so the issue says only that the build\n  overran and is holding an agent slot.\n- **Alerting no longer fires on every escalation.** The issue in the service\n  repository is the durable artifact. Email now means either a repair ran and\n  failed, or an escalation has sat untouched for six hours.\n\n## Arming the demo\n\nJenkins UI: `https://ci.bstein.dev/job/hermes-triage-demo/` \u2192 *Build with\nParameters* \u2192 check `SEED_FAILURE` \u2192 Build.\n\nCLI (any Jenkins user API token):\n\n```bash\ncurl -u <user>:<token> -X POST \\\n  \"https://ci.bstein.dev/job/hermes-triage-demo/buildWithParameters?SEED_FAILURE=true\"\n```\n\nThat is the only manual step. Everything after the red build is automatic.\n\nRun `scripts/ops/hermes_triage_demo.sh preflight` first. The check that most\noften decides whether a rehearsal holds its timings is the agent pool: the\nKubernetes cloud caps concurrent agent pods at `containerCapStr: \"5\"`, and when\nreal CI has taken all five the demo build sits in the queue reporting *\"All\nnodes of label ... are offline\"* with no other symptom. Observed 2026-08-06: a\nrun armed at 02:13:42 did not start seeding until 02:19:37, close to six\nminutes of dead air, purely because five other builds held the pool. Wait for a\nfree slot before starting, or quiesce CI.\n\n## Expected timings (measured live 2026-08-06, Ariadne 0.1.0-402)\n\nTime the demo from the moment the build goes **red**, not from arming. Arming\nonly queues a Jenkins build, and that leg is at the mercy of the agent pool.\n\n- Red \u2192 fixture patched back to healthy: **25s** (\u226460 s detection tick, ~16 s\n  Hermes diagnosis, then a single in-process Kubernetes API call).\n- Red \u2192 rebuild triggered: **38s**.\n- Red \u2192 rebuild green and incident resolved: **1m04s**.\n\nThe whole automated leg is just over a minute, and there is no silent phase\nlonger than the detection tick. Budgeted Hermes timeout is 420 s; observed\ndiagnosis runs are 15\u201321 s.\n\nArming \u2192 red was **6m21s** on this run, but 5m35s of that was queue wait\nbehind a saturated agent pool. On an idle pool expect roughly 1m45s.\n\nThe earlier 2026-08-05 figures (1m15s red\u2192repaired, 4m00s total) were measured\nwhen the repair spawned its own Kubernetes Job. Converting the repair to an\nin-process call removed a whole pod launch from the critical path.\n\n## Watching it live\n\n- Jenkins: `https://ci.bstein.dev/job/hermes-triage-demo/` (red build N,\n  then green build N+1 with `SEED_FAILURE=false`).\n- Ariadne incident state:\n  `GET http://ariadne.maintenance/api/internal/audit/events` (in-cluster) or\n  `/api/admin/audit/events` (Keycloak JWT) \u2014 event types\n  `hermes_autotriage_incident`, `hermes_autotriage_diagnosis`,\n  `hermes_autotriage_action`. Status flow:\n  `detected \u2192 diagnosed \u2192 repairing \u2192 awaiting_rebuild \u2192 resolved`.\n- Metrics (VictoriaMetrics / Grafana Explore):\n  `ariadne_hermes_triage_incident{jenkins_job=\"hermes-triage-demo\"}`,\n  `ariadne_hermes_triage_action_total`,\n  `ariadne_hermes_triage_duration_seconds`.\n- Repair evidence: `kubectl -n hermes-triage-demo get jobs` shows\n  `hermes-demo-test-<N>` (failed) and `hermes-demo-repair-<N>` (succeeded);\n  both TTL-clean after 1 h.\n- Hermes side: the run appears in the dashboard at\n  `https://agent.hermes.bstein.dev` (session/run history).\n- Escalation path: alert `HermesTriageHumanRequired` in vmalert\n  (`vmalert-atlas-availability` deployment, 1 m interval, `for: 2m`)\n  fires to Alertmanager for any `human_required` incident. Gauges are\n  republished every tick from stored incident state (restart-safe), and\n  the alert self-clears once a newer build of the same job is green.\n  Note: Alertmanager's default receiver is currently null \u2014 the alert is\n  visible in vmalert/Alertmanager/Grafana but pushes no notification.\n\n## Demonstrating safe escalation (second path)\n\nAny failure that does not match the demo-fixture signature \u2014 or any\ninvalid/low-confidence/unknown-action Hermes response \u2014 ends as\n`status=\"human_required\"` with **no mutation**. The simplest live demo:\ntemporarily set `ARIADNE_HERMES_AUTOREMEDIATION_ENABLED=false` (see below)\nand arm the failure; Ariadne diagnoses fully but executes nothing, and the\nalert fires instead.\n\n## Kill switch and rollback\n\n- Instant behavioral off-switch (Flux-managed, in\n  `services/maintenance/apps/ariadne-deployment.yaml`):\n  `ARIADNE_HERMES_AUTOREMEDIATION_ENABLED=false` \u2192 diagnose-only.\n  `ARIADNE_HERMES_AUTOTRIAGE_ENABLED=false` \u2192 fully off.\n- The automatic loop can only ever: create Jobs named\n  `hermes-demo-repair-*` in namespace `hermes-triage-demo`, and trigger\n  rebuilds of allowlisted jobs (`ARIADNE_HERMES_AUTOTRIAGE_JOB_ALLOWLIST`,\n  currently `hermes-triage-demo` only). One action + one rebuild per\n  incident, ever (storage-backed idempotency).\n- Full teardown: remove `hermes-triage-demo` from\n  `clusters/atlas/flux-system/applications/kustomization.yaml` (Flux prunes\n  the namespace) and delete the `pipelineJob('hermes-triage-demo')` block\n  from `services/jenkins/configmap-jcasc.yaml`.\n\n## Credentials\n\n- Ariadne \u2192 Hermes: `Authorization: Bearer` key from\n  `kv/atlas/hermes/triage-api`. Vault Agent injects it into both workloads at\n  runtime; it is not stored in either persistent Hermes state or a manually\n  maintained Kubernetes Secret. Rotate the Vault value and roll both tracked\n  deployments through Flux.\n- Ariadne \u2192 Jenkins: existing `JENKINS_API_USER/TOKEN` from Vault\n  (`atlas/maintenance/ariadne-db`)."
   },
   {
     "path": "runbooks/kb-authoring.md",
diff --git a/knowledge/runbooks/hermes-triage-demo.md b/knowledge/runbooks/hermes-triage-demo.md
index b7c224a0..1a5a64e6 100644
--- a/knowledge/runbooks/hermes-triage-demo.md
+++ b/knowledge/runbooks/hermes-triage-demo.md
@@ -135,11 +135,10 @@ alert fires instead.
 
 ## Credentials
 
-- Ariadne → Hermes: `Authorization: Bearer` key shared via the
-  `hermes-api-server-key` Secret present in both `hermes` and `maintenance`
-  namespaces (Hermes's init container seeds it into the persistent `.env`).
-  NOTE: currently manually created (Vault migration pending — see plan
-  handoff); rotating = write new value to both Secrets, restart hermes
-  deployment and ariadne deployment.
+- Ariadne → Hermes: `Authorization: Bearer` key from
+  `kv/atlas/hermes/triage-api`. Vault Agent injects it into both workloads at
+  runtime; it is not stored in either persistent Hermes state or a manually
+  maintained Kubernetes Secret. Rotate the Vault value and roll both tracked
+  deployments through Flux.
 - Ariadne → Jenkins: existing `JENKINS_API_USER/TOKEN` from Vault
   (`atlas/maintenance/ariadne-db`).
diff --git a/scripts/ops/styx_prep.sh b/scripts/ops/styx_prep.sh
index 0dfcf7f6..e7ee8fd9 100755
--- a/scripts/ops/styx_prep.sh
+++ b/scripts/ops/styx_prep.sh
@@ -3,15 +3,26 @@ set -euo pipefail
 
 # === CONFIG ===
 STYX_USER="styx"
-STYX_PASS="TempPass#123"       # change at first login
+STYX_PASS="${STYX_PASS:-}"
 STYX_HOSTNAME="styx"
-SSH_PUBKEY=""                  # e.g., 'ssh-ed25519 AAAA... your@host' (optional)
+SSH_PUBKEY="${SSH_PUBKEY:-}"
 
 # === helpers ===
 require_root() {
   if [[ $EUID -ne 0 ]]; then exec sudo -E "$0" "$@"; fi
 }
 
+require_runtime_access() {
+  [[ -n "$STYX_PASS" ]] || {
+    echo "STYX_PASS must be injected at runtime from Vault." >&2
+    exit 1
+  }
+  [[ -n "$SSH_PUBKEY" ]] || {
+    echo "SSH_PUBKEY must be injected at runtime from Vault." >&2
+    exit 1
+  }
+}
+
 ensure_binfmt_arm64() {
   # If binfmt for arm64 isn't registered, register it via Docker (idempotent).
   if [[ ! -e /proc/sys/fs/binfmt_misc/qemu-aarch64 ]]; then
@@ -176,6 +187,7 @@ cleanup() {
 
 main() {
   require_root
+  require_runtime_access
   ensure_binfmt_arm64
   find_parts
   trap 'echo "ERROR at line $LINENO" >&2; cleanup' ERR INT
@@ -185,7 +197,7 @@ main() {
   boot_tweaks
   cleanup
   echo "✅ Done. Move the NVMe to the Pi and boot."
-  echo "   Login: user '${STYX_USER}'  pass '${STYX_PASS}'  (change with 'passwd')."
+  echo "   Login: user '${STYX_USER}' (change the injected bootstrap password with 'passwd')."
   echo "   Quick checks on the Pi:"
   echo "     sudo i2cdetect -y 1"
   echo "     rpicam-still -n -o test.jpg   # (if rpicam-apps installed)"
diff --git a/scripts/ops/styx_prep_nvme_luks.sh b/scripts/ops/styx_prep_nvme_luks.sh
index d5ea0c5a..5546c219 100755
--- a/scripts/ops/styx_prep_nvme_luks.sh
+++ b/scripts/ops/styx_prep_nvme_luks.sh
@@ -15,8 +15,8 @@ TGT_BOOT="/mnt/target-boot"
 
 STYX_USER="styx"
 STYX_HOSTNAME="titan-ag"
-STYX_PASS="TempPass#123"                # will be forced to change on first login via cloud-init
-SSH_PUBKEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOb8oMX6u0z3sH/p/WBGlvPXXdbGETCKzWYwR/dd6fZb titan-bastion"
+STYX_PASS="${STYX_PASS:-}"
+SSH_PUBKEY="${SSH_PUBKEY:-}"
 
 # Video / input prefs
 DSI_FLAGS="video=DSI-1:800x480@60D video=HDMI-A-1:off video=HDMI-A-2:off"
@@ -27,6 +27,11 @@ need(){ command -v "$1" >/dev/null || fatal "Missing tool: $1"; }
 
 require_root(){ [[ $EUID -eq 0 ]] || exec sudo -E "$0" "$@"; }
 
+require_runtime_access() {
+  [[ -n "$STYX_PASS" ]] || fatal "STYX_PASS must be injected at runtime from Vault."
+  [[ -n "$SSH_PUBKEY" ]] || fatal "SSH_PUBKEY must be injected at runtime from Vault."
+}
+
 part() {
   local n="$1"
   if [[ "$NVME" =~ [0-9]$ ]]; then
@@ -544,6 +549,7 @@ cleanup(){
 
 main(){
   require_root
+  require_runtime_access
   need losetup; need parted; need rsync
   auto_detect_target_disk
   echo "Target disk: $NVME"
diff --git a/services/comms/knowledge/catalog/atlas-summary.json b/services/comms/knowledge/catalog/atlas-summary.json
index 004af8ca..9acf7417 100644
--- a/services/comms/knowledge/catalog/atlas-summary.json
+++ b/services/comms/knowledge/catalog/atlas-summary.json
@@ -3,6 +3,6 @@
     "helmrelease_host_hints": 23,
     "http_endpoints": 61,
     "services": 91,
-    "workloads": 124
+    "workloads": 125
   }
 }
diff --git a/services/comms/knowledge/catalog/atlas.json b/services/comms/knowledge/catalog/atlas.json
index 6fcdd018..98628e38 100644
--- a/services/comms/knowledge/catalog/atlas.json
+++ b/services/comms/knowledge/catalog/atlas.json
@@ -892,6 +892,19 @@
         "wger/server@sha256:710588b78af4e0aa0b4d8a8061e4563e16eae80eeaccfe7f9e0d9cbdd7f0cbc5"
       ]
     },
+    {
+      "kind": "DaemonSet",
+      "namespace": "hermes",
+      "name": "hermes-node-ssh-access",
+      "labels": {
+        "app": "hermes-node-ssh-access"
+      },
+      "serviceAccountName": "hermes-node-ssh-access",
+      "nodeSelector": {},
+      "images": [
+        "busybox:1.37"
+      ]
+    },
     {
       "kind": "Deployment",
       "namespace": "hermes",
@@ -902,7 +915,7 @@
       "serviceAccountName": "hermes-triage",
       "nodeSelector": {},
       "images": [
-        "registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1",
+        "registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8",
         "registry.bstein.dev/bstein/hermes-webui@sha256:9c2fe8341c7b650e08d10acead3151b19e2af737863268bafb39b3d9517575b1"
       ]
     },
@@ -917,7 +930,7 @@
       "nodeSelector": {},
       "images": [
         "quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561",
-        "registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1"
+        "registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8"
       ]
     },
     {
@@ -1164,7 +1177,7 @@
       "serviceAccountName": "hermes-chat",
       "nodeSelector": {},
       "images": [
-        "registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1",
+        "registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8",
         "registry.bstein.dev/bstein/hermes-webui@sha256:9c2fe8341c7b650e08d10acead3151b19e2af737863268bafb39b3d9517575b1"
       ]
     },
@@ -1515,7 +1528,7 @@
         "kubernetes.io/os": "linux"
       },
       "images": [
-        "registry.bstein.dev/bstein/metis-sentinel:0.1.0-292-amd64"
+        "registry.bstein.dev/bstein/metis-sentinel:0.1.0-293-amd64"
       ]
     },
     {
@@ -1531,7 +1544,7 @@
         "kubernetes.io/os": "linux"
       },
       "images": [
-        "registry.bstein.dev/bstein/metis-sentinel:0.1.0-291-arm64"
+        "registry.bstein.dev/bstein/metis-sentinel:0.1.0-293-arm64"
       ]
     },
     {
@@ -1648,7 +1661,7 @@
       "serviceAccountName": "metis",
       "nodeSelector": {},
       "images": [
-        "registry.bstein.dev/bstein/metis:0.1.0-291-arm64"
+        "registry.bstein.dev/bstein/metis:0.1.0-293-arm64"
       ]
     },
     {
diff --git a/services/comms/knowledge/catalog/atlas.yaml b/services/comms/knowledge/catalog/atlas.yaml
index 3ee78f4d..6e355e7f 100644
--- a/services/comms/knowledge/catalog/atlas.yaml
+++ b/services/comms/knowledge/catalog/atlas.yaml
@@ -596,6 +596,15 @@ workloads:
   images:
   - nginx:1.27.5-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
   - wger/server@sha256:710588b78af4e0aa0b4d8a8061e4563e16eae80eeaccfe7f9e0d9cbdd7f0cbc5
+- kind: DaemonSet
+  namespace: hermes
+  name: hermes-node-ssh-access
+  labels:
+    app: hermes-node-ssh-access
+  serviceAccountName: hermes-node-ssh-access
+  nodeSelector: {}
+  images:
+  - busybox:1.37
 - kind: Deployment
   namespace: hermes
   name: hermes
@@ -604,7 +613,7 @@ workloads:
   serviceAccountName: hermes-triage
   nodeSelector: {}
   images:
-  - registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1
+  - registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8
   - registry.bstein.dev/bstein/hermes-webui@sha256:9c2fe8341c7b650e08d10acead3151b19e2af737863268bafb39b3d9517575b1
 - kind: Deployment
   namespace: hermes
@@ -615,7 +624,7 @@ workloads:
   nodeSelector: {}
   images:
   - quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561
-  - registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1
+  - registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8
 - kind: Deployment
   namespace: hermes
   name: hermes-chat-router
@@ -788,7 +797,7 @@ workloads:
   serviceAccountName: hermes-chat
   nodeSelector: {}
   images:
-  - registry.bstein.dev/bstein/hermes-agent@sha256:3154e1df5f6941583f4a369fcc9581bbf9cb9d502676e91b557e90cc576923e1
+  - registry.bstein.dev/bstein/hermes-agent@sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8
   - registry.bstein.dev/bstein/hermes-webui@sha256:9c2fe8341c7b650e08d10acead3151b19e2af737863268bafb39b3d9517575b1
 - kind: Deployment
   namespace: jellyfin
@@ -1028,7 +1037,7 @@ workloads:
     kubernetes.io/arch: amd64
     kubernetes.io/os: linux
   images:
-  - registry.bstein.dev/bstein/metis-sentinel:0.1.0-292-amd64
+  - registry.bstein.dev/bstein/metis-sentinel:0.1.0-293-amd64
 - kind: DaemonSet
   namespace: maintenance
   name: metis-sentinel-arm64
@@ -1039,7 +1048,7 @@ workloads:
     kubernetes.io/arch: arm64
     kubernetes.io/os: linux
   images:
-  - registry.bstein.dev/bstein/metis-sentinel:0.1.0-291-arm64
+  - registry.bstein.dev/bstein/metis-sentinel:0.1.0-293-arm64
 - kind: DaemonSet
   namespace: maintenance
   name: node-image-sweeper
@@ -1118,7 +1127,7 @@ workloads:
   serviceAccountName: metis
   nodeSelector: {}
   images:
-  - registry.bstein.dev/bstein/metis:0.1.0-291-arm64
+  - registry.bstein.dev/bstein/metis:0.1.0-293-arm64
 - kind: Deployment
   namespace: maintenance
   name: oauth2-proxy-metis
diff --git a/services/comms/knowledge/catalog/runbooks.json b/services/comms/knowledge/catalog/runbooks.json
index f0d7306f..f72f166b 100644
--- a/services/comms/knowledge/catalog/runbooks.json
+++ b/services/comms/knowledge/catalog/runbooks.json
@@ -50,7 +50,7 @@
     "tags": [],
     "entrypoints": [],
     "source_paths": [],
-    "body": "# Hermes Automated Triage Demo \u2014 Runbook\n\nHow to arm, run, watch, and roll back the automated failure-to-repair demo.\nArchitecture background: `knowledge/hermes-automated-triage-24h-plan.md`.\n\n## What the loop does\n\n```text\nYou arm the failure (SEED_FAILURE=true)\n  -> Jenkins job hermes-triage-demo fails (fixture reads \"unhealthy\")\n  -> test-runner pod also writes the incident JSON to stdout\n     (Fluent Bit ships it to OpenSearch kube-*)\n  -> Ariadne polls the job every minute, opens incident <job>/<build>\n  -> Ariadne bundles Jenkins evidence + bounded OpenSearch excerpts\n  -> Ariadne calls the Hermes Agent API (/v1/runs) with\n     $triage-titan-test-failures\n  -> Hermes returns schema-valid diagnosis + requested_action\n  -> Ariadne authorizes (twelve gates) and, if remediation is enabled,\n     patches the fixture ConfigMap back to \"healthy\" in process\n  -> Ariadne triggers ONE rebuild with SEED_FAILURE=false\n  -> rebuild passes -> incident resolved\nAnything else -> issue in the service repo + human_required metric\n```\n\nThe model behind Hermes is `anthropic/claude-opus-5` as of 2026-08-06, with\n`openai-codex/gpt-5.6-terra` as first fallback and a local `gpt-oss:20b`\nbehind that, so an expired Anthropic credential degrades rather than stops.\n\nTwo behaviours worth knowing before you demo, because both look like nothing\nhappening:\n\n- **A build that never finishes** is escalated once it passes\n  `ARIADNE_HERMES_HUNG_BUILD_MINUTES` (default 45). No model is consulted -\n  the console is still being written - so the issue says only that the build\n  overran and is holding an agent slot.\n- **Alerting no longer fires on every escalation.** The issue in the service\n  repository is the durable artifact. Email now means either a repair ran and\n  failed, or an escalation has sat untouched for six hours.\n\n## Arming the demo\n\nJenkins UI: `https://ci.bstein.dev/job/hermes-triage-demo/` \u2192 *Build with\nParameters* \u2192 check `SEED_FAILURE` \u2192 Build.\n\nCLI (any Jenkins user API token):\n\n```bash\ncurl -u <user>:<token> -X POST \\\n  \"https://ci.bstein.dev/job/hermes-triage-demo/buildWithParameters?SEED_FAILURE=true\"\n```\n\nThat is the only manual step. Everything after the red build is automatic.\n\nRun `scripts/ops/hermes_triage_demo.sh preflight` first. The check that most\noften decides whether a rehearsal holds its timings is the agent pool: the\nKubernetes cloud caps concurrent agent pods at `containerCapStr: \"5\"`, and when\nreal CI has taken all five the demo build sits in the queue reporting *\"All\nnodes of label ... are offline\"* with no other symptom. Observed 2026-08-06: a\nrun armed at 02:13:42 did not start seeding until 02:19:37, close to six\nminutes of dead air, purely because five other builds held the pool. Wait for a\nfree slot before starting, or quiesce CI.\n\n## Expected timings (measured live 2026-08-06, Ariadne 0.1.0-402)\n\nTime the demo from the moment the build goes **red**, not from arming. Arming\nonly queues a Jenkins build, and that leg is at the mercy of the agent pool.\n\n- Red \u2192 fixture patched back to healthy: **25s** (\u226460 s detection tick, ~16 s\n  Hermes diagnosis, then a single in-process Kubernetes API call).\n- Red \u2192 rebuild triggered: **38s**.\n- Red \u2192 rebuild green and incident resolved: **1m04s**.\n\nThe whole automated leg is just over a minute, and there is no silent phase\nlonger than the detection tick. Budgeted Hermes timeout is 420 s; observed\ndiagnosis runs are 15\u201321 s.\n\nArming \u2192 red was **6m21s** on this run, but 5m35s of that was queue wait\nbehind a saturated agent pool. On an idle pool expect roughly 1m45s.\n\nThe earlier 2026-08-05 figures (1m15s red\u2192repaired, 4m00s total) were measured\nwhen the repair spawned its own Kubernetes Job. Converting the repair to an\nin-process call removed a whole pod launch from the critical path.\n\n## Watching it live\n\n- Jenkins: `https://ci.bstein.dev/job/hermes-triage-demo/` (red build N,\n  then green build N+1 with `SEED_FAILURE=false`).\n- Ariadne incident state:\n  `GET http://ariadne.maintenance/api/internal/audit/events` (in-cluster) or\n  `/api/admin/audit/events` (Keycloak JWT) \u2014 event types\n  `hermes_autotriage_incident`, `hermes_autotriage_diagnosis`,\n  `hermes_autotriage_action`. Status flow:\n  `detected \u2192 diagnosed \u2192 repairing \u2192 awaiting_rebuild \u2192 resolved`.\n- Metrics (VictoriaMetrics / Grafana Explore):\n  `ariadne_hermes_triage_incident{jenkins_job=\"hermes-triage-demo\"}`,\n  `ariadne_hermes_triage_action_total`,\n  `ariadne_hermes_triage_duration_seconds`.\n- Repair evidence: `kubectl -n hermes-triage-demo get jobs` shows\n  `hermes-demo-test-<N>` (failed) and `hermes-demo-repair-<N>` (succeeded);\n  both TTL-clean after 1 h.\n- Hermes side: the run appears in the dashboard at\n  `https://agent.hermes.bstein.dev` (session/run history).\n- Escalation path: alert `HermesTriageHumanRequired` in vmalert\n  (`vmalert-atlas-availability` deployment, 1 m interval, `for: 2m`)\n  fires to Alertmanager for any `human_required` incident. Gauges are\n  republished every tick from stored incident state (restart-safe), and\n  the alert self-clears once a newer build of the same job is green.\n  Note: Alertmanager's default receiver is currently null \u2014 the alert is\n  visible in vmalert/Alertmanager/Grafana but pushes no notification.\n\n## Demonstrating safe escalation (second path)\n\nAny failure that does not match the demo-fixture signature \u2014 or any\ninvalid/low-confidence/unknown-action Hermes response \u2014 ends as\n`status=\"human_required\"` with **no mutation**. The simplest live demo:\ntemporarily set `ARIADNE_HERMES_AUTOREMEDIATION_ENABLED=false` (see below)\nand arm the failure; Ariadne diagnoses fully but executes nothing, and the\nalert fires instead.\n\n## Kill switch and rollback\n\n- Instant behavioral off-switch (Flux-managed, in\n  `services/maintenance/apps/ariadne-deployment.yaml`):\n  `ARIADNE_HERMES_AUTOREMEDIATION_ENABLED=false` \u2192 diagnose-only.\n  `ARIADNE_HERMES_AUTOTRIAGE_ENABLED=false` \u2192 fully off.\n- The automatic loop can only ever: create Jobs named\n  `hermes-demo-repair-*` in namespace `hermes-triage-demo`, and trigger\n  rebuilds of allowlisted jobs (`ARIADNE_HERMES_AUTOTRIAGE_JOB_ALLOWLIST`,\n  currently `hermes-triage-demo` only). One action + one rebuild per\n  incident, ever (storage-backed idempotency).\n- Full teardown: remove `hermes-triage-demo` from\n  `clusters/atlas/flux-system/applications/kustomization.yaml` (Flux prunes\n  the namespace) and delete the `pipelineJob('hermes-triage-demo')` block\n  from `services/jenkins/configmap-jcasc.yaml`.\n\n## Credentials\n\n- Ariadne \u2192 Hermes: `Authorization: Bearer` key shared via the\n  `hermes-api-server-key` Secret present in both `hermes` and `maintenance`\n  namespaces (Hermes's init container seeds it into the persistent `.env`).\n  NOTE: currently manually created (Vault migration pending \u2014 see plan\n  handoff); rotating = write new value to both Secrets, restart hermes\n  deployment and ariadne deployment.\n- Ariadne \u2192 Jenkins: existing `JENKINS_API_USER/TOKEN` from Vault\n  (`atlas/maintenance/ariadne-db`)."
+    "body": "# Hermes Automated Triage Demo \u2014 Runbook\n\nHow to arm, run, watch, and roll back the automated failure-to-repair demo.\nArchitecture background: `knowledge/hermes-automated-triage-24h-plan.md`.\n\n## What the loop does\n\n```text\nYou arm the failure (SEED_FAILURE=true)\n  -> Jenkins job hermes-triage-demo fails (fixture reads \"unhealthy\")\n  -> test-runner pod also writes the incident JSON to stdout\n     (Fluent Bit ships it to OpenSearch kube-*)\n  -> Ariadne polls the job every minute, opens incident <job>/<build>\n  -> Ariadne bundles Jenkins evidence + bounded OpenSearch excerpts\n  -> Ariadne calls the Hermes Agent API (/v1/runs) with\n     $triage-titan-test-failures\n  -> Hermes returns schema-valid diagnosis + requested_action\n  -> Ariadne authorizes (twelve gates) and, if remediation is enabled,\n     patches the fixture ConfigMap back to \"healthy\" in process\n  -> Ariadne triggers ONE rebuild with SEED_FAILURE=false\n  -> rebuild passes -> incident resolved\nAnything else -> issue in the service repo + human_required metric\n```\n\nThe model behind Hermes is `anthropic/claude-opus-5` as of 2026-08-06, with\n`openai-codex/gpt-5.6-terra` as first fallback and a local `gpt-oss:20b`\nbehind that, so an expired Anthropic credential degrades rather than stops.\n\nTwo behaviours worth knowing before you demo, because both look like nothing\nhappening:\n\n- **A build that never finishes** is escalated once it passes\n  `ARIADNE_HERMES_HUNG_BUILD_MINUTES` (default 45). No model is consulted -\n  the console is still being written - so the issue says only that the build\n  overran and is holding an agent slot.\n- **Alerting no longer fires on every escalation.** The issue in the service\n  repository is the durable artifact. Email now means either a repair ran and\n  failed, or an escalation has sat untouched for six hours.\n\n## Arming the demo\n\nJenkins UI: `https://ci.bstein.dev/job/hermes-triage-demo/` \u2192 *Build with\nParameters* \u2192 check `SEED_FAILURE` \u2192 Build.\n\nCLI (any Jenkins user API token):\n\n```bash\ncurl -u <user>:<token> -X POST \\\n  \"https://ci.bstein.dev/job/hermes-triage-demo/buildWithParameters?SEED_FAILURE=true\"\n```\n\nThat is the only manual step. Everything after the red build is automatic.\n\nRun `scripts/ops/hermes_triage_demo.sh preflight` first. The check that most\noften decides whether a rehearsal holds its timings is the agent pool: the\nKubernetes cloud caps concurrent agent pods at `containerCapStr: \"5\"`, and when\nreal CI has taken all five the demo build sits in the queue reporting *\"All\nnodes of label ... are offline\"* with no other symptom. Observed 2026-08-06: a\nrun armed at 02:13:42 did not start seeding until 02:19:37, close to six\nminutes of dead air, purely because five other builds held the pool. Wait for a\nfree slot before starting, or quiesce CI.\n\n## Expected timings (measured live 2026-08-06, Ariadne 0.1.0-402)\n\nTime the demo from the moment the build goes **red**, not from arming. Arming\nonly queues a Jenkins build, and that leg is at the mercy of the agent pool.\n\n- Red \u2192 fixture patched back to healthy: **25s** (\u226460 s detection tick, ~16 s\n  Hermes diagnosis, then a single in-process Kubernetes API call).\n- Red \u2192 rebuild triggered: **38s**.\n- Red \u2192 rebuild green and incident resolved: **1m04s**.\n\nThe whole automated leg is just over a minute, and there is no silent phase\nlonger than the detection tick. Budgeted Hermes timeout is 420 s; observed\ndiagnosis runs are 15\u201321 s.\n\nArming \u2192 red was **6m21s** on this run, but 5m35s of that was queue wait\nbehind a saturated agent pool. On an idle pool expect roughly 1m45s.\n\nThe earlier 2026-08-05 figures (1m15s red\u2192repaired, 4m00s total) were measured\nwhen the repair spawned its own Kubernetes Job. Converting the repair to an\nin-process call removed a whole pod launch from the critical path.\n\n## Watching it live\n\n- Jenkins: `https://ci.bstein.dev/job/hermes-triage-demo/` (red build N,\n  then green build N+1 with `SEED_FAILURE=false`).\n- Ariadne incident state:\n  `GET http://ariadne.maintenance/api/internal/audit/events` (in-cluster) or\n  `/api/admin/audit/events` (Keycloak JWT) \u2014 event types\n  `hermes_autotriage_incident`, `hermes_autotriage_diagnosis`,\n  `hermes_autotriage_action`. Status flow:\n  `detected \u2192 diagnosed \u2192 repairing \u2192 awaiting_rebuild \u2192 resolved`.\n- Metrics (VictoriaMetrics / Grafana Explore):\n  `ariadne_hermes_triage_incident{jenkins_job=\"hermes-triage-demo\"}`,\n  `ariadne_hermes_triage_action_total`,\n  `ariadne_hermes_triage_duration_seconds`.\n- Repair evidence: `kubectl -n hermes-triage-demo get jobs` shows\n  `hermes-demo-test-<N>` (failed) and `hermes-demo-repair-<N>` (succeeded);\n  both TTL-clean after 1 h.\n- Hermes side: the run appears in the dashboard at\n  `https://agent.hermes.bstein.dev` (session/run history).\n- Escalation path: alert `HermesTriageHumanRequired` in vmalert\n  (`vmalert-atlas-availability` deployment, 1 m interval, `for: 2m`)\n  fires to Alertmanager for any `human_required` incident. Gauges are\n  republished every tick from stored incident state (restart-safe), and\n  the alert self-clears once a newer build of the same job is green.\n  Note: Alertmanager's default receiver is currently null \u2014 the alert is\n  visible in vmalert/Alertmanager/Grafana but pushes no notification.\n\n## Demonstrating safe escalation (second path)\n\nAny failure that does not match the demo-fixture signature \u2014 or any\ninvalid/low-confidence/unknown-action Hermes response \u2014 ends as\n`status=\"human_required\"` with **no mutation**. The simplest live demo:\ntemporarily set `ARIADNE_HERMES_AUTOREMEDIATION_ENABLED=false` (see below)\nand arm the failure; Ariadne diagnoses fully but executes nothing, and the\nalert fires instead.\n\n## Kill switch and rollback\n\n- Instant behavioral off-switch (Flux-managed, in\n  `services/maintenance/apps/ariadne-deployment.yaml`):\n  `ARIADNE_HERMES_AUTOREMEDIATION_ENABLED=false` \u2192 diagnose-only.\n  `ARIADNE_HERMES_AUTOTRIAGE_ENABLED=false` \u2192 fully off.\n- The automatic loop can only ever: create Jobs named\n  `hermes-demo-repair-*` in namespace `hermes-triage-demo`, and trigger\n  rebuilds of allowlisted jobs (`ARIADNE_HERMES_AUTOTRIAGE_JOB_ALLOWLIST`,\n  currently `hermes-triage-demo` only). One action + one rebuild per\n  incident, ever (storage-backed idempotency).\n- Full teardown: remove `hermes-triage-demo` from\n  `clusters/atlas/flux-system/applications/kustomization.yaml` (Flux prunes\n  the namespace) and delete the `pipelineJob('hermes-triage-demo')` block\n  from `services/jenkins/configmap-jcasc.yaml`.\n\n## Credentials\n\n- Ariadne \u2192 Hermes: `Authorization: Bearer` key from\n  `kv/atlas/hermes/triage-api`. Vault Agent injects it into both workloads at\n  runtime; it is not stored in either persistent Hermes state or a manually\n  maintained Kubernetes Secret. Rotate the Vault value and roll both tracked\n  deployments through Flux.\n- Ariadne \u2192 Jenkins: existing `JENKINS_API_USER/TOKEN` from Vault\n  (`atlas/maintenance/ariadne-db`)."
   },
   {
     "path": "runbooks/kb-authoring.md",
diff --git a/services/comms/knowledge/runbooks/hermes-triage-demo.md b/services/comms/knowledge/runbooks/hermes-triage-demo.md
index b7c224a0..1a5a64e6 100644
--- a/services/comms/knowledge/runbooks/hermes-triage-demo.md
+++ b/services/comms/knowledge/runbooks/hermes-triage-demo.md
@@ -135,11 +135,10 @@ alert fires instead.
 
 ## Credentials
 
-- Ariadne → Hermes: `Authorization: Bearer` key shared via the
-  `hermes-api-server-key` Secret present in both `hermes` and `maintenance`
-  namespaces (Hermes's init container seeds it into the persistent `.env`).
-  NOTE: currently manually created (Vault migration pending — see plan
-  handoff); rotating = write new value to both Secrets, restart hermes
-  deployment and ariadne deployment.
+- Ariadne → Hermes: `Authorization: Bearer` key from
+  `kv/atlas/hermes/triage-api`. Vault Agent injects it into both workloads at
+  runtime; it is not stored in either persistent Hermes state or a manually
+  maintained Kubernetes Secret. Rotate the Vault value and roll both tracked
+  deployments through Flux.
 - Ariadne → Jenkins: existing `JENKINS_API_USER/TOKEN` from Vault
   (`atlas/maintenance/ariadne-db`).
diff --git a/services/gitea/scripts/gitea_atlas_identity_ensure.sh b/services/gitea/scripts/gitea_atlas_identity_ensure.sh
index c8c3288d..f98f08f5 100644
--- a/services/gitea/scripts/gitea_atlas_identity_ensure.sh
+++ b/services/gitea/scripts/gitea_atlas_identity_ensure.sh
@@ -81,6 +81,25 @@ generate_token() {
     --raw 2>/dev/null
 }
 
+token_is_valid() {
+  username=$1
+  token=$2
+  [ -n "${token}" ] || return 1
+
+  response_file=$(mktemp)
+  status=$(curl --silent --show-error \
+    --output "${response_file}" \
+    --write-out '%{http_code}' \
+    --header "Authorization: token ${token}" \
+    "${api_url}/user")
+  if [ "${status}" = 200 ] && grep -Eq "\"login\"[[:space:]]*:[[:space:]]*\"${username}\"" "${response_file}"; then
+    rm -f "${response_file}"
+    return 0
+  fi
+  rm -f "${response_file}"
+  return 1
+}
+
 api_request() {
   method=$1
   path=$2
@@ -143,6 +162,31 @@ vault_login() {
   [ -n "${vault_token}" ] || die "Vault login did not return a client token"
 }
 
+vault_read_field() {
+  path=$1
+  field=$2
+  response_file=$(mktemp)
+  status=$(curl --silent --show-error \
+    --output "${response_file}" \
+    --write-out '%{http_code}' \
+    --header "X-Vault-Token: ${vault_token}" \
+    "${vault_addr}/v1/kv/data/atlas/${path}")
+  case "${status}" in
+    200)
+      value=$(sed -n "s/.*\"${field}\":\"\([^\"]*\)\".*/\1/p" "${response_file}")
+      ;;
+    404)
+      value=
+      ;;
+    *)
+      rm -f "${response_file}"
+      die "read Vault path ${path} returned HTTP ${status}"
+      ;;
+  esac
+  rm -f "${response_file}"
+  printf '%s' "${value}"
+}
+
 vault_write() {
   path=$1
   payload=$2
@@ -231,9 +275,16 @@ transfer_managed_repositories() {
 wait_for_gitea
 ensure_user "${reconciler_user}" "${reconciler_email}" true
 ensure_user "${hermes_user}" "${hermes_email}" false
+vault_login
 
-reconciler_token=$(generate_token "${reconciler_user}")
-hermes_token=$(generate_token "${hermes_user}")
+reconciler_token=$(vault_read_field gitea/atlas-reconciler token)
+if ! token_is_valid "${reconciler_user}" "${reconciler_token}"; then
+  reconciler_token=$(generate_token "${reconciler_user}")
+fi
+hermes_token=$(vault_read_field hermes/developer-gitea token)
+if ! token_is_valid "${hermes_user}" "${hermes_token}"; then
+  hermes_token=$(generate_token "${hermes_user}")
+fi
 [ -n "${reconciler_token}" ] || die "reconciler token generation failed"
 [ -n "${hermes_token}" ] || die "Hermes token generation failed"
 
@@ -267,7 +318,6 @@ expect_status "${status}" 204 "add Hermes to Atlas contributors"
 
 transfer_managed_repositories
 
-vault_login
 vault_write gitea/atlas-reconciler "{\"data\":{\"username\":\"${reconciler_user}\",\"token\":\"${reconciler_token}\",\"base_url\":\"${public_url}\"}}"
 vault_write hermes/developer-gitea "{\"data\":{\"username\":\"${hermes_user}\",\"email\":\"${hermes_email}\",\"token\":\"${hermes_token}\",\"base_url\":\"${public_url}\"}}"
 
diff --git a/services/hermes/agent-configmap.yaml b/services/hermes/agent-configmap.yaml
index ac7c3a9b..a3905984 100644
--- a/services/hermes/agent-configmap.yaml
+++ b/services/hermes/agent-configmap.yaml
@@ -299,6 +299,19 @@ data:
     impact, avoid fleet-wide destructive commands, and reflect persistent host
     configuration in the appropriate tracked provisioning source.
 
+    Treat every credential, SSH identity, host-trust record, and
+    credential-bearing access-client state as runtime-only Vault data. Keep
+    non-secret endpoints, RBAC policy, and client behavior in tracked GitOps
+    configuration, but never reconstruct secret or trust values in a manifest,
+    commit, transcript, or command output. Use dedicated Kubernetes-auth roles
+    with Vault Agent or Secrets Store CSI injection for workloads. For an
+    explicitly authorized operator Vault change, obtain the existing admin
+    credential from the `vault` namespace at execution time, keep it only in
+    process scope, suppress value-bearing output, and unset it immediately
+    afterward. Verify public-key fingerprints through an already authenticated
+    path before changing trust or authorization, and rotate an identity if any
+    private material may have escaped its runtime boundary.
+
     After a failed tool attempt, failing test, contradicted claim, rejected
     review, or incomplete evidence, do not repeat the same low-capability plan.
     Reassess the objective and raise provider capability or effort by at least
@@ -319,8 +332,9 @@ data:
     Use `/route status` to inspect the current decision, `/route auto`
     for automatic routing, or `/route manual <codex|claude>
     <low|medium|high|xhigh> [model]` for a persistent override. The first native
-    Codex worker requires one device-code login; subsequent sessions persist on
-    the agent volume. The owner workspace includes cluster-admin Kubernetes
+    Codex worker requires one device-code login; refreshed provider credentials
+    persist through Vault while client caches remain disposable. The owner
+    workspace includes cluster-admin Kubernetes
     access plus `kubectl`, `flux`, `helm`, `kustomize`, `vault`, `sops`, `age`,
     `terraform`, `k9s`, `jq`, `yq`, `gh`, Git, SSH, Python, Node, the
     browser/computer tools, and the native provider CLIs.
diff --git a/services/hermes/agent-deployment.yaml b/services/hermes/agent-deployment.yaml
index 1ea4cff4..ac2a6b75 100644
--- a/services/hermes/agent-deployment.yaml
+++ b/services/hermes/agent-deployment.yaml
@@ -25,13 +25,23 @@ spec:
         ai.bstein.dev/execution: Hermes Kanban with durable direct Codex and Claude Code CLI workers
         ai.bstein.dev/model-policy: Jetson-assisted AUTO routing, low through xhigh, cross-provider fallback
         ai.bstein.dev/placement: rpi5 preferred; Jetson deferred until state storage is available
-        ai.bstein.dev/config-rev: "20260815-worker-restart-recovery"
+        ai.bstein.dev/config-rev: "20260815-runtime-access-boundary"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/role: hermes-agent
-        vault.hashicorp.com/agent-inject-secret-anthropic-token: kv/data/atlas/hermes/agent-tokens
-        vault.hashicorp.com/agent-inject-template-anthropic-token: |
+        vault.hashicorp.com/agent-inject-secret-agent-api-key: kv/data/atlas/hermes/agent-tokens
+        vault.hashicorp.com/agent-inject-template-agent-api-key: |
           {{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
-          {{ .Data.data.anthropic_oauth_token }}
+          {{ .Data.data.agent_api_key }}
+          {{- end }}
+        vault.hashicorp.com/agent-inject-secret-claude-credentials: kv/data/atlas/hermes/agent-tokens
+        vault.hashicorp.com/agent-inject-template-claude-credentials: |
+          {{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
+          {{ .Data.data.claude_credentials_json }}
+          {{- end }}
+        vault.hashicorp.com/agent-inject-secret-codex-auth: kv/data/atlas/hermes/agent-tokens
+        vault.hashicorp.com/agent-inject-template-codex-auth: |
+          {{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
+          {{ .Data.data.codex_auth_json }}
           {{- end }}
         vault.hashicorp.com/agent-inject-secret-gitea-token: kv/data/atlas/hermes/developer-gitea
         vault.hashicorp.com/agent-inject-template-gitea-token: |
@@ -140,15 +150,16 @@ spec:
               cp /config/SOUL.md /opt/data/SOUL.md
               cp /config/AGENTS.md /opt/data/workspace/AGENTS.md
               cp /config/START-HERE.md /opt/data/workspace/START-HERE.md
-              cp /vault/secrets/node-ssh-config /opt/data/home/.ssh/config
-              cp /vault/secrets/node-ssh-known-hosts /opt/data/home/.ssh/known_hosts
-              if [ -s /vault/secrets/node-ssh-private-key ]; then
-                cp /vault/secrets/node-ssh-private-key /opt/data/home/.ssh/id_ed25519_atlas_nodes
-                chmod 0600 /opt/data/home/.ssh/id_ed25519_atlas_nodes
-              fi
-              chmod 0600 \
+              rm -f \
+                /opt/data/auth.json \
+                /opt/data/home/.claude/.credentials.json \
+                /opt/data/home/.codex/auth.json \
                 /opt/data/home/.ssh/config \
-                /opt/data/home/.ssh/known_hosts
+                /opt/data/home/.ssh/known_hosts \
+                /opt/data/home/.ssh/id_ed25519_atlas_nodes
+              ln -s /runtime-access/node-ssh-config /opt/data/home/.ssh/config
+              ln -s /runtime-access/node-ssh-known-hosts /opt/data/home/.ssh/known_hosts
+              ln -s /runtime-access/node-ssh-private-key /opt/data/home/.ssh/id_ed25519_atlas_nodes
               chmod 0700 /opt/data/home/.ssh
               touch "${env_file}"
               upsert_env() {
@@ -157,26 +168,19 @@ spec:
                 { grep -v "^${key}=" "${env_file}" || true; printf '%s=%s\n' "${key}" "${value}"; } > "${env_file}.tmp"
                 mv "${env_file}.tmp" "${env_file}"
               }
-              if ! grep -q '^API_SERVER_KEY=' "${env_file}"; then
-                api_key="$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n')"
-                upsert_env API_SERVER_KEY "${api_key}"
-              fi
-              if [ -s /vault/secrets/anthropic-token ]; then
-                token="$(tr -d '\r\n' < /vault/secrets/anthropic-token)"
-                [ -z "${token}" ] || upsert_env CLAUDE_CODE_OAUTH_TOKEN "${token}"
-              fi
-              if [ -s /vault/secrets/gitea-token ]; then
-                token="$(tr -d '\r\n' < /vault/secrets/gitea-token)"
-                case "${token}" in ""|"<no value>"|"<nil>") ;; *) upsert_env GITEA_TOKEN "${token}" ;; esac
-              fi
-              if [ -s /vault/secrets/gitea-username ]; then
-                username="$(tr -d '\r\n' < /vault/secrets/gitea-username)"
-                case "${username}" in ""|"<no value>"|"<nil>") ;; *) upsert_env GITEA_USERNAME "${username}" ;; esac
-              fi
-              if [ -s /vault/secrets/chat-relay-key ]; then
-                token="$(tr -d '\r\n' < /vault/secrets/chat-relay-key)"
-                [ -z "${token}" ] || upsert_env HERMES_IMAGE_BROKER_KEY "${token}"
-              fi
+              for key in ANTHROPIC_API_KEY API_SERVER_KEY CLAUDE_API_KEY CLAUDE_CODE_OAUTH_TOKEN GITEA_TOKEN GITEA_USERNAME HERMES_IMAGE_BROKER_KEY OPENAI_API_KEY; do
+                grep -v "^${key}=" "${env_file}" > "${env_file}.tmp" || true
+                mv "${env_file}.tmp" "${env_file}"
+              done
+              for profile_env in /opt/data/profiles/*/.env; do
+                [ -f "${profile_env}" ] || continue
+                for key in ANTHROPIC_API_KEY API_SERVER_KEY CLAUDE_API_KEY CLAUDE_CODE_OAUTH_TOKEN GITEA_TOKEN GITEA_USERNAME HERMES_IMAGE_BROKER_KEY OPENAI_API_KEY; do
+                  grep -v "^${key}=" "${profile_env}" > "${profile_env}.tmp" || true
+                  mv "${profile_env}.tmp" "${profile_env}"
+                done
+                chmod 0600 "${profile_env}"
+                chown 10000:10000 "${profile_env}"
+              done
               upsert_env GIT_ASKPASS /opt/coordinator/gitea_askpass.sh
               upsert_env GIT_TERMINAL_PROMPT 0
               chmod 0600 "${env_file}"
@@ -191,8 +195,6 @@ spec:
                 /opt/data/home/.codex \
                 /opt/data/home/.kube \
                 /opt/data/home/.ssh \
-                /opt/data/home/.ssh/config \
-                /opt/data/home/.ssh/known_hosts \
                 /opt/data/cli-lanes \
                 /opt/data/logs \
                 /opt/data/provider-health \
@@ -207,9 +209,6 @@ spec:
                 /opt/data/workspace/AGENTS.md \
                 /opt/data/workspace/START-HERE.md \
                 "${env_file}"
-              if [ -f /opt/data/home/.ssh/id_ed25519_atlas_nodes ]; then
-                chown 10000:10000 /opt/data/home/.ssh/id_ed25519_atlas_nodes
-              fi
           securityContext:
             allowPrivilegeEscalation: false
             runAsUser: 0
@@ -225,6 +224,26 @@ spec:
           resources:
             requests: {cpu: 25m, memory: 32Mi}
             limits: {cpu: 100m, memory: 64Mi}
+        - name: stage-runtime-access
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
+          imagePullPolicy: IfNotPresent
+          command:
+            - /opt/hermes/.venv/bin/python
+            - /opt/coordinator/stage_runtime_access.py
+            - agent
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 0
+            runAsGroup: 0
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - {name: home, mountPath: /opt/data}
+            - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
+            - {name: runtime-access, mountPath: /runtime-access}
+          resources:
+            requests: {cpu: 25m, memory: 32Mi}
+            limits: {cpu: 100m, memory: 64Mi}
         - name: install-agent-tools
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
           imagePullPolicy: IfNotPresent
@@ -380,6 +399,52 @@ spec:
           resources:
             requests: {cpu: 25m, memory: 64Mi}
             limits: {cpu: 100m, memory: 128Mi}
+        - name: patch-web-session-activity
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
+          imagePullPolicy: IfNotPresent
+          command:
+            - /opt/hermes/.venv/bin/python
+            - /opt/coordinator/patch_web_session_activity.py
+            - /opt/hermes/hermes_cli/web_server.py
+            - /patched/web_server.py
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 10000
+            runAsGroup: 10000
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: coordinator
+              mountPath: /opt/coordinator
+              readOnly: true
+            - name: web-server-patch
+              mountPath: /patched
+          resources:
+            requests: {cpu: 25m, memory: 64Mi}
+            limits: {cpu: 100m, memory: 128Mi}
+        - name: patch-subprocess-secret-boundary
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              /opt/hermes/.venv/bin/python /opt/coordinator/patch_subprocess_secret_boundary.py \
+                /opt/hermes/tools/environments/local.py /patched/local.py
+              /opt/hermes/.venv/bin/python /opt/coordinator/patch_process_output_redaction.py \
+                /opt/hermes/tools/process_registry.py /patched/process_registry.py
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 10000
+            runAsGroup: 10000
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
+            - {name: subprocess-secret-patch, mountPath: /patched}
+          resources:
+            requests: {cpu: 25m, memory: 64Mi}
+            limits: {cpu: 100m, memory: 128Mi}
         - name: patch-codex-runtime
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
           imagePullPolicy: IfNotPresent
@@ -422,10 +487,10 @@ spec:
             - --once
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
-            - {name: CODEX_HOME, value: /opt/data/home/.codex}
-            - {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
+            - {name: CODEX_HOME, value: /runtime-access/codex}
+            - {name: CLAUDE_CONFIG_DIR, value: /runtime-access/claude}
             - {name: PYTHONPATH, value: /opt/hermes}
             - {name: HERMES_ROUTING_CATALOG_PATH, value: /routing-catalog/catalog.json}
             - {name: HERMES_CASSANDRA_ACTIVE_WORKTREE, value: /opt/data/workspace/projects/cassandra-hermes-v69}
@@ -438,7 +503,7 @@ spec:
               type: RuntimeDefault
           volumeMounts:
             - {name: home, mountPath: /opt/data}
-            - {name: provider-auth, mountPath: /shared-auth}
+            - {name: runtime-access, mountPath: /runtime-access}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
             - {name: routing-catalog, mountPath: /routing-catalog}
@@ -464,10 +529,10 @@ spec:
               /opt/hermes/.venv/bin/python /opt/coordinator/hermes_coordinator.py --once
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
-            - {name: CODEX_HOME, value: /opt/data/home/.codex}
-            - {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
+            - {name: CODEX_HOME, value: /runtime-access/codex}
+            - {name: CLAUDE_CONFIG_DIR, value: /runtime-access/claude}
             - {name: PYTHONPATH, value: /opt/hermes}
             - {name: HERMES_ROUTING_CATALOG_PATH, value: /routing-catalog/catalog.json}
             - {name: HERMES_CASSANDRA_ACTIVE_WORKTREE, value: /opt/data/workspace/projects/cassandra-hermes-v69}
@@ -480,7 +545,7 @@ spec:
               type: RuntimeDefault
           volumeMounts:
             - {name: home, mountPath: /opt/data}
-            - {name: provider-auth, mountPath: /shared-auth}
+            - {name: runtime-access, mountPath: /runtime-access}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
             - {name: routing-catalog, mountPath: /routing-catalog}
@@ -518,16 +583,19 @@ spec:
               set -a
               . /opt/data/.env
               set +a
+              API_SERVER_KEY="$(tr -d '\r\n' < /runtime-access/agent-api-key)"
+              test -n "${API_SERVER_KEY}"
+              export API_SERVER_KEY
               exec /init /opt/hermes/docker/main-wrapper.sh gateway run
           ports:
             - {name: api, containerPort: 8642, protocol: TCP}
             - {name: dashboard, containerPort: 9119, protocol: TCP}
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
-            - {name: CODEX_HOME, value: /opt/data/home/.codex}
-            - {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
+            - {name: CODEX_HOME, value: /runtime-access/codex}
+            - {name: CLAUDE_CONFIG_DIR, value: /runtime-access/claude}
             - {name: KUBECONFIG, value: /opt/data/home/.kube/config}
             - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/opt/hermes/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}
             - {name: PLAYWRIGHT_BROWSERS_PATH, value: /opt/hermes/.playwright}
@@ -551,11 +619,13 @@ spec:
             - {name: HERMES_ROUTING_CATALOG_PATH, value: /routing-catalog/catalog.json}
             - {name: HERMES_CODEX_HEALTH_PATH, value: /opt/data/provider-health/codex.json}
             - {name: HERMES_CLAUDE_HEALTH_PATH, value: /opt/data/provider-health/claude.json}
+            - {name: HERMES_IMAGE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key}
           volumeMounts:
             - {name: home, mountPath: /opt/data}
-            - {name: provider-auth, mountPath: /shared-auth}
+            - {name: runtime-access, mountPath: /runtime-access}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
+            - {name: web-server-patch, mountPath: /opt/hermes/hermes_cli/web_server.py, subPath: web_server.py}
             - {name: codex-runtime-patch, mountPath: /opt/hermes/hermes_cli/runtime_provider.py, subPath: runtime_provider.py}
             - {name: codex-runtime-patch, mountPath: /opt/hermes/agent/transports/codex_app_server_session.py, subPath: codex_app_server_session.py}
             - {name: codex-runtime-patch, mountPath: /opt/hermes/agent/codex_runtime.py, subPath: codex_runtime.py}
@@ -564,6 +634,8 @@ spec:
             - {name: codex-runtime-patch, mountPath: /opt/hermes/agent/auxiliary_client.py, subPath: auxiliary_client.py}
             - {name: tui-gateway-patch, mountPath: /opt/hermes/tui_gateway/server.py, subPath: server.py}
             - {name: api-server-patch, mountPath: /opt/hermes/gateway/platforms/api_server.py, subPath: api_server.py}
+            - {name: subprocess-secret-patch, mountPath: /opt/hermes/tools/environments/local.py, subPath: local.py}
+            - {name: subprocess-secret-patch, mountPath: /opt/hermes/tools/process_registry.py, subPath: process_registry.py}
             - {name: kubeconfig, mountPath: /opt/data/home/.kube/config, subPath: config, readOnly: true}
             - {name: auto-router-plugin, mountPath: /opt/data/plugins/auto-router, readOnly: true}
             - {name: routing-catalog, mountPath: /routing-catalog, readOnly: true}
@@ -699,9 +771,9 @@ spec:
           env:
             - {name: HOME, value: /opt/data/home}
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
-            - {name: CODEX_HOME, value: /opt/data/home/.codex}
-            - {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
+            - {name: CODEX_HOME, value: /runtime-access/codex}
+            - {name: CLAUDE_CONFIG_DIR, value: /runtime-access/claude}
             - {name: KUBECONFIG, value: /opt/data/home/.kube/config}
             - {name: PYTHONPATH, value: /opt/hermes}
             - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin}
@@ -715,7 +787,7 @@ spec:
             - {name: HERMES_CLAUDE_HEALTH_PATH, value: /opt/data/provider-health/claude.json}
           volumeMounts:
             - {name: home, mountPath: /opt/data}
-            - {name: provider-auth, mountPath: /shared-auth}
+            - {name: runtime-access, mountPath: /runtime-access}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
             - {name: codex-runtime-patch, mountPath: /opt/hermes/hermes_cli/runtime_provider.py, subPath: runtime_provider.py}
@@ -725,6 +797,8 @@ spec:
             - {name: codex-runtime-patch, mountPath: /opt/hermes/agent/conversation_loop.py, subPath: conversation_loop.py}
             - {name: codex-runtime-patch, mountPath: /opt/hermes/agent/auxiliary_client.py, subPath: auxiliary_client.py}
             - {name: tui-gateway-patch, mountPath: /opt/hermes/tui_gateway/server.py, subPath: server.py}
+            - {name: subprocess-secret-patch, mountPath: /opt/hermes/tools/environments/local.py, subPath: local.py}
+            - {name: subprocess-secret-patch, mountPath: /opt/hermes/tools/process_registry.py, subPath: process_registry.py}
             - {name: kubeconfig, mountPath: /opt/data/home/.kube/config, subPath: config, readOnly: true}
             - {name: auto-router-plugin, mountPath: /opt/data/plugins/auto-router, readOnly: true}
             - {name: routing-catalog, mountPath: /routing-catalog, readOnly: true}
@@ -769,10 +843,10 @@ spec:
               exec /opt/hermes/.venv/bin/python /opt/coordinator/cli_lane_runner.py
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
-            - {name: CODEX_HOME, value: /opt/data/home/.codex}
-            - {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
+            - {name: CODEX_HOME, value: /runtime-access/codex}
+            - {name: CLAUDE_CONFIG_DIR, value: /runtime-access/claude}
             - {name: KUBECONFIG, value: /opt/data/home/.kube/config}
             - {name: PYTHONPATH, value: /opt/hermes}
             - {name: HERMES_CLI_LANE_CONCURRENCY, value: "4"}
@@ -790,7 +864,7 @@ spec:
               type: RuntimeDefault
           volumeMounts:
             - {name: home, mountPath: /opt/data}
-            - {name: provider-auth, mountPath: /shared-auth}
+            - {name: runtime-access, mountPath: /runtime-access}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
             - {name: kubeconfig, mountPath: /opt/data/home/.kube/config, subPath: config, readOnly: true}
@@ -805,10 +879,10 @@ spec:
           command: [/opt/hermes/.venv/bin/python, /opt/coordinator/hermes_coordinator.py, --loop, --interval, "3600"]
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
-            - {name: CODEX_HOME, value: /opt/data/home/.codex}
-            - {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
+            - {name: CODEX_HOME, value: /runtime-access/codex}
+            - {name: CLAUDE_CONFIG_DIR, value: /runtime-access/claude}
             - {name: PYTHONPATH, value: /opt/hermes}
             - {name: HERMES_ROUTING_CATALOG_PATH, value: /routing-catalog/catalog.json}
             - {name: HERMES_CASSANDRA_ACTIVE_WORKTREE, value: /opt/data/workspace/projects/cassandra-hermes-v69}
@@ -821,33 +895,57 @@ spec:
               type: RuntimeDefault
           volumeMounts:
             - {name: home, mountPath: /opt/data}
-            - {name: provider-auth, mountPath: /shared-auth}
+            - {name: runtime-access, mountPath: /runtime-access}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
             - {name: routing-catalog, mountPath: /routing-catalog}
           resources:
             requests: {cpu: 25m, memory: 64Mi}
             limits: {cpu: 250m, memory: 512Mi}
+        - name: credential-sync
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
+          imagePullPolicy: IfNotPresent
+          command:
+            - /opt/hermes/.venv/bin/python
+            - /opt/coordinator/sync_runtime_credentials.py
+          env:
+            - {name: HERMES_CREDENTIAL_SYNC_VAULT_ROLE, value: hermes-credential-sync}
+            - {name: HERMES_CREDENTIAL_SYNC_INTERVAL, value: "60"}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
+            - {name: runtime-access, mountPath: /runtime-access/claude, subPath: claude, readOnly: true}
+            - {name: runtime-access, mountPath: /runtime-access/codex, subPath: codex, readOnly: true}
+          resources:
+            requests: {cpu: 10m, memory: 32Mi}
+            limits: {cpu: 100m, memory: 128Mi}
         - name: image-broker
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
           imagePullPolicy: IfNotPresent
           command: [/bin/sh, -ec]
           args:
             - |
-              set -a
-              . /opt/data/.env
-              set +a
               exec /opt/hermes/.venv/bin/python /opt/coordinator/image_broker.py
           ports:
             - {name: image-broker, containerPort: 9002, protocol: TCP}
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
-            - {name: CODEX_HOME, value: /opt/data/home/.codex}
+            - {name: CODEX_HOME, value: /runtime-access/codex}
             - {name: PYTHONPATH, value: /opt/hermes}
             - {name: HERMES_IMAGE_BROKER_DEFAULT_MODEL, value: atlas-image-auto-high}
             - {name: HERMES_IMAGE_BROKER_LISTEN_PORT, value: "9002"}
+            - {name: HERMES_IMAGE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key}
             - {name: HERMES_LOCAL_IMAGE_URL, value: http://hermes-local-image.hermes.svc.cluster.local:9004}
             - {name: HERMES_IMAGE_POLICY_PATH, value: /etc/hermes-image-policy/policy.json}
           readinessProbe:
@@ -870,7 +968,7 @@ spec:
               type: RuntimeDefault
           volumeMounts:
             - {name: home, mountPath: /opt/data}
-            - {name: provider-auth, mountPath: /shared-auth}
+            - {name: runtime-access, mountPath: /runtime-access}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: codex-runtime-patch, mountPath: /opt/hermes/agent/auxiliary_client.py, subPath: auxiliary_client.py}
             - {name: image-policy, mountPath: /etc/hermes-image-policy, readOnly: true}
@@ -884,19 +982,17 @@ spec:
           command: [/bin/sh, -ec]
           args:
             - |
-              set -a
-              . /opt/data/.env
-              set +a
               exec /opt/hermes/.venv/bin/python /opt/coordinator/codex_broker.py
           ports:
             - {name: codex-broker, containerPort: 9003, protocol: TCP}
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
-            - {name: CODEX_HOME, value: /opt/data/home/.codex}
+            - {name: CODEX_HOME, value: /runtime-access/codex}
             - {name: PYTHONPATH, value: /opt/hermes}
             - {name: HERMES_CODEX_BROKER_LISTEN_PORT, value: "9003"}
+            - {name: HERMES_CODEX_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key}
             - {name: HERMES_CODEX_HEALTH_PATH, value: /opt/data/provider-health/codex.json}
             - {name: HERMES_ROUTING_CATALOG_PATH, value: /routing-catalog/catalog.json}
           readinessProbe:
@@ -919,7 +1015,7 @@ spec:
               type: RuntimeDefault
           volumeMounts:
             - {name: home, mountPath: /opt/data}
-            - {name: provider-auth, mountPath: /shared-auth}
+            - {name: runtime-access, mountPath: /runtime-access}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: codex-runtime-patch, mountPath: /opt/hermes/agent/auxiliary_client.py, subPath: auxiliary_client.py}
             - {name: tmp, mountPath: /tmp}
@@ -933,23 +1029,21 @@ spec:
           command: [/bin/sh, -ec]
           args:
             - |
-              set -a
-              . /opt/data/.env
-              set +a
               unset ANTHROPIC_API_KEY CLAUDE_API_KEY
               exec /opt/hermes/.venv/bin/python /opt/coordinator/claude_oauth_broker.py
           ports:
             - {name: claude-broker, containerPort: 9006, protocol: TCP}
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
-            - {name: CODEX_HOME, value: /opt/data/home/.codex}
-            - {name: CLAUDE_CONFIG_DIR, value: /opt/data/home/.claude}
+            - {name: CODEX_HOME, value: /runtime-access/codex}
+            - {name: CLAUDE_CONFIG_DIR, value: /runtime-access/claude}
             - {name: PYTHONPATH, value: /opt/hermes}
             - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin}
             - {name: HERMES_CLAUDE_BIN, value: /opt/coordinator/claude}
             - {name: HERMES_CLAUDE_BROKER_PORT, value: "9006"}
+            - {name: HERMES_CLAUDE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key}
             - {name: HERMES_CLAUDE_BROKER_READ_TIMEOUT, value: "1800"}
             - {name: HERMES_CLAUDE_HEALTH_PATH, value: /opt/data/provider-health/claude.json}
             - {name: HERMES_ROUTING_CATALOG_PATH, value: /routing-catalog/catalog.json}
@@ -973,7 +1067,7 @@ spec:
               type: RuntimeDefault
           volumeMounts:
             - {name: home, mountPath: /opt/data}
-            - {name: provider-auth, mountPath: /shared-auth}
+            - {name: runtime-access, mountPath: /runtime-access}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
             - {name: tmp, mountPath: /tmp}
@@ -985,9 +1079,10 @@ spec:
         - name: home
           persistentVolumeClaim:
             claimName: hermes-agent-home
-        - name: provider-auth
-          persistentVolumeClaim:
-            claimName: hermes-provider-auth
+        - name: runtime-access
+          emptyDir:
+            medium: Memory
+            sizeLimit: 128Mi
         - name: routing-catalog
           persistentVolumeClaim:
             claimName: hermes-routing-catalog
@@ -1008,6 +1103,10 @@ spec:
           emptyDir: {}
         - name: api-server-patch
           emptyDir: {}
+        - name: web-server-patch
+          emptyDir: {}
+        - name: subprocess-secret-patch
+          emptyDir: {}
         - name: codex-runtime-patch
           emptyDir: {}
         - name: auto-router-plugin
diff --git a/services/hermes/chat-router.yaml b/services/hermes/chat-router.yaml
index 92b4f5fe..30a5411e 100644
--- a/services/hermes/chat-router.yaml
+++ b/services/hermes/chat-router.yaml
@@ -20,7 +20,7 @@ spec:
         app: hermes-chat-router
       annotations:
         ai.bstein.dev/role: privacy-preserving-chat-tenant-router
-        ai.bstein.dev/config-rev: "20260813-telegram-token-v3"
+        ai.bstein.dev/config-rev: "20260815-runtime-access-boundary"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/agent-init-first: "true"
diff --git a/services/hermes/chat-statefulset.yaml b/services/hermes/chat-statefulset.yaml
index ffaa5d0e..6ad5eff3 100644
--- a/services/hermes/chat-statefulset.yaml
+++ b/services/hermes/chat-statefulset.yaml
@@ -29,14 +29,9 @@ spec:
         ai.bstein.dev/router-wire-contract: ollama-numeric-keepalive
         ai.bstein.dev/isolation: one Hermes process and PVC per Keycloak subject
         ai.bstein.dev/model-policy: uniform automatic policy with per-user overrides
-        ai.bstein.dev/config-rev: "20260812-stream-recovery"
+        ai.bstein.dev/config-rev: "20260815-runtime-access-boundary"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/role: hermes-chat
-        vault.hashicorp.com/agent-inject-secret-anthropic-token: kv/data/atlas/hermes/agent-tokens
-        vault.hashicorp.com/agent-inject-template-anthropic-token: |
-          {{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
-          {{ .Data.data.anthropic_oauth_token }}
-          {{- end }}
         vault.hashicorp.com/agent-inject-secret-chat-relay-key: kv/data/atlas/hermes/chat-telegram
         vault.hashicorp.com/agent-inject-template-chat-relay-key: |
           {{- with secret "kv/data/atlas/hermes/chat-telegram" -}}
@@ -111,26 +106,11 @@ spec:
               cp /config/SOUL.md /opt/data/SOUL.md
               cp /config/AGENTS.md /opt/data/workspace/AGENTS.md
               touch /opt/data/.env
-              relay_key=""
-              if [ -s /vault/secrets/chat-relay-key ]; then
-                relay_key="$(tr -d '\r\n' < /vault/secrets/chat-relay-key)"
-              fi
-              if [ -z "${relay_key}" ]; then
-                api_key="$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n')"
-                relay_key="${api_key}"
-              fi
-              { grep -v '^API_SERVER_KEY=' /opt/data/.env || true; printf 'API_SERVER_KEY=%s\n' "${relay_key}"; } > /opt/data/.env.tmp
-              mv /opt/data/.env.tmp /opt/data/.env
-              { grep -v '^HERMES_IMAGE_BROKER_KEY=' /opt/data/.env || true; printf 'HERMES_IMAGE_BROKER_KEY=%s\n' "${relay_key}"; } > /opt/data/.env.tmp
-              mv /opt/data/.env.tmp /opt/data/.env
-              if [ -s /vault/secrets/anthropic-token ]; then
-                token="$(tr -d '\r\n' < /vault/secrets/anthropic-token)"
-                if [ -n "${token}" ]; then
-                  { grep -v '^CLAUDE_CODE_OAUTH_TOKEN=' /opt/data/.env || true; printf 'CLAUDE_CODE_OAUTH_TOKEN=%s\n' "${token}"; } > /opt/data/.env.tmp
-                  mv /opt/data/.env.tmp /opt/data/.env
-                fi
-              fi
-              rm -f /vault/secrets/anthropic-token /vault/secrets/chat-relay-key
+              for key in ANTHROPIC_API_KEY API_SERVER_KEY CLAUDE_API_KEY CLAUDE_CODE_OAUTH_TOKEN GITEA_TOKEN GITEA_USERNAME HERMES_IMAGE_BROKER_KEY OPENAI_API_KEY; do
+                grep -v "^${key}=" /opt/data/.env > /opt/data/.env.tmp || true
+                mv /opt/data/.env.tmp /opt/data/.env
+              done
+              rm -f /opt/data/auth.json
               chmod 0600 /opt/data/.env
               chown 10000:10000 \
                 /opt/data \
@@ -157,6 +137,25 @@ spec:
           resources:
             requests: {cpu: 25m, memory: 32Mi}
             limits: {cpu: 100m, memory: 64Mi}
+        - name: stage-runtime-access
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
+          imagePullPolicy: IfNotPresent
+          command:
+            - /opt/hermes/.venv/bin/python
+            - /opt/coordinator/stage_runtime_access.py
+            - chat
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 0
+            runAsGroup: 0
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
+            - {name: runtime-access, mountPath: /runtime-access}
+          resources:
+            requests: {cpu: 25m, memory: 32Mi}
+            limits: {cpu: 100m, memory: 64Mi}
         - name: patch-auth
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
           imagePullPolicy: IfNotPresent
@@ -197,6 +196,29 @@ spec:
           resources:
             requests: {cpu: 25m, memory: 64Mi}
             limits: {cpu: 100m, memory: 128Mi}
+        - name: patch-subprocess-secret-boundary
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              /opt/hermes/.venv/bin/python /opt/coordinator/patch_subprocess_secret_boundary.py \
+                /opt/hermes/tools/environments/local.py /patched/local.py
+              /opt/hermes/.venv/bin/python /opt/coordinator/patch_process_output_redaction.py \
+                /opt/hermes/tools/process_registry.py /patched/process_registry.py
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 10000
+            runAsGroup: 10000
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
+            - {name: subprocess-secret-patch, mountPath: /patched}
+          resources:
+            requests: {cpu: 25m, memory: 64Mi}
+            limits: {cpu: 100m, memory: 128Mi}
       containers:
         - name: hermes
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
@@ -209,12 +231,15 @@ spec:
               set -a
               . /opt/data/.env
               set +a
+              API_SERVER_KEY="$(tr -d '\r\n' < /runtime-access/chat-relay-key)"
+              test -n "${API_SERVER_KEY}"
+              export API_SERVER_KEY
               exec /opt/hermes/.venv/bin/hermes gateway run
           ports:
             - {name: api, containerPort: 8642, protocol: TCP}
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
             - {name: TERMINAL_CWD, value: /opt/data/workspace}
             - {name: HERMES_WRITE_SAFE_ROOT, value: /opt/data/workspace}
@@ -228,16 +253,16 @@ spec:
             - {name: API_SERVER_PORT, value: "8642"}
             - {name: API_SERVER_CORS_ORIGINS, value: https://chat.hermes.bstein.dev}
             - {name: HERMES_IMAGE_BROKER_URL, value: http://hermes-image-broker.hermes.svc.cluster.local:9002}
+            - {name: HERMES_IMAGE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key}
             - {name: HERMES_AUTO_ROUTER_PROFILE, value: chat}
           volumeMounts:
             - {name: home, mountPath: /opt/data}
             - {name: workspace, mountPath: /opt/data/workspace}
-            # The shared provider pool uses auth.lock to serialize token refresh
-            # across tenant gateways. Tenant files and conversations remain on
-            # their own PVCs; only provider credentials are shared here.
-            - {name: provider-auth, mountPath: /shared-auth}
+            - {name: runtime-access, mountPath: /runtime-access}
             - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
             - {name: stream-recovery-patch, mountPath: /opt/hermes/agent/conversation_loop.py, subPath: conversation_loop.py}
+            - {name: subprocess-secret-patch, mountPath: /opt/hermes/tools/environments/local.py, subPath: local.py}
+            - {name: subprocess-secret-patch, mountPath: /opt/hermes/tools/process_registry.py, subPath: process_registry.py}
             - {name: image-plugin, mountPath: /opt/hermes/plugins/image_gen/atlas-broker, readOnly: true}
             - {name: auto-router-plugin, mountPath: /opt/data/plugins/auto-router, readOnly: true}
           readinessProbe:
@@ -265,7 +290,7 @@ spec:
           command: [/bin/sh, -ec]
           args:
             - |
-              api_key="$(sed -n 's/^API_SERVER_KEY=//p' /opt/data/.env | tail -n 1)"
+              api_key="$(tr -d '\r\n' < /runtime-access/chat-relay-key)"
               test -n "${api_key}"
               export API_SERVER_KEY="${api_key}"
               export HERMES_WEBUI_GATEWAY_API_KEY="${api_key}"
@@ -274,7 +299,7 @@ spec:
             - {name: webui, containerPort: 8787, protocol: TCP}
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
             - {name: HERMES_WEBUI_AGENT_DIR, value: /opt/hermes}
             - {name: HERMES_WEBUI_HOST, value: 0.0.0.0}
@@ -302,7 +327,7 @@ spec:
           volumeMounts:
             - {name: home, mountPath: /opt/data}
             - {name: workspace, mountPath: /opt/data/workspace}
-            - {name: provider-auth, mountPath: /shared-auth, readOnly: true}
+            - {name: runtime-access, mountPath: /runtime-access, readOnly: true}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: tmp, mountPath: /tmp}
           readinessProbe:
@@ -338,11 +363,12 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.name
-            - {name: HERMES_MEDIA_RELAY_KEY_FILE, value: /opt/data/.env}
+            - {name: HERMES_MEDIA_RELAY_KEY_FILE, value: /runtime-access/chat-relay-key}
           volumeMounts:
             - {name: home, mountPath: /opt/data, readOnly: true}
             - {name: workspace, mountPath: /opt/data/workspace, readOnly: true}
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
+            - {name: runtime-access, mountPath: /runtime-access, readOnly: true}
           readinessProbe:
             httpGet: {path: /healthz, port: telegram-media}
             initialDelaySeconds: 2
@@ -364,9 +390,10 @@ spec:
             requests: {cpu: 10m, memory: 24Mi}
             limits: {cpu: 100m, memory: 64Mi}
       volumes:
-        - name: provider-auth
-          persistentVolumeClaim:
-            claimName: hermes-provider-auth
+        - name: runtime-access
+          emptyDir:
+            medium: Memory
+            sizeLimit: 2Mi
         - name: config
           configMap:
             name: hermes-chat-config
@@ -378,6 +405,8 @@ spec:
           emptyDir: {}
         - name: stream-recovery-patch
           emptyDir: {}
+        - name: subprocess-secret-patch
+          emptyDir: {}
         - name: auto-router-plugin
           configMap:
             name: hermes-auto-router-plugin
diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index 5f03b585..944cf381 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -25,17 +25,13 @@ spec:
         ai.bstein.dev/model: anthropic/claude-opus-5, falling back to openai-codex/gpt-5.6-terra then titan-20 Qwen 14B
         ai.bstein.dev/role: testing-triage
         ai.bstein.dev/placement: titan-21 preferred, Jetson preferred, arm64 fallback
-        ai.bstein.dev/config-rev: "20260813-api-lineage-cleanup"
-        # The Anthropic credential comes from Vault rather than a manually
-        # created Secret. The role is declared in
-        # services/vault/scripts/vault_k8s_auth_configure.sh and bound to
-        # this pod's service account.
+        ai.bstein.dev/config-rev: "20260815-runtime-access-boundary"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/role: hermes
-        vault.hashicorp.com/agent-inject-secret-anthropic-token: kv/data/atlas/hermes/agent-tokens
-        vault.hashicorp.com/agent-inject-template-anthropic-token: |
-          {{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
-          {{ .Data.data.anthropic_oauth_token }}
+        vault.hashicorp.com/agent-inject-secret-triage-api-key: kv/data/atlas/hermes/triage-api
+        vault.hashicorp.com/agent-inject-template-triage-api-key: |
+          {{- with secret "kv/data/atlas/hermes/triage-api" -}}
+          {{ .Data.data.api_key }}
           {{- end }}
         vault.hashicorp.com/agent-pre-populate-only: "true"
         # Without this the agent init container is appended after the
@@ -99,24 +95,6 @@ spec:
         - name: init-config
           image: busybox:1.37
           imagePullPolicy: IfNotPresent
-          env:
-            # When the Flux/Vault-managed shared key Secret exists, it becomes
-            # the API_SERVER_KEY in the persistent .env (which overrides pod
-            # env at runtime). Optional: absent Secret keeps the old behavior
-            # of generating a random key on first boot.
-            - name: API_SERVER_KEY_SEED
-              valueFrom:
-                secretKeyRef:
-                  name: hermes-api-server-key
-                  key: api-key
-                  optional: true
-            # Fallback only; Vault is preferred when its file is present.
-            - name: CLAUDE_CODE_OAUTH_TOKEN_SEED
-              valueFrom:
-                secretKeyRef:
-                  name: hermes-anthropic-token
-                  key: token
-                  optional: true
           command:
             - sh
             - -c
@@ -135,37 +113,13 @@ spec:
               cp /guide/OPERATOR-RUNBOOK.md /opt/data/HERMES-OPERATOR-RUNBOOK.md
               cp /config/ATLAS-TRIAGE-PROOFS.md /opt/data/ATLAS-TRIAGE-PROOFS.md
               touch /opt/data/.env
-              if [ -n "${API_SERVER_KEY_SEED:-}" ]; then
-                grep -v '^API_SERVER_KEY=' /opt/data/.env > /opt/data/.env.tmp || true
-                printf 'API_SERVER_KEY=%s\n' "${API_SERVER_KEY_SEED}" >> /opt/data/.env.tmp
+              for key in ANTHROPIC_API_KEY API_SERVER_KEY CLAUDE_API_KEY CLAUDE_CODE_OAUTH_TOKEN GITEA_TOKEN GITEA_USERNAME HERMES_IMAGE_BROKER_KEY OPENAI_API_KEY; do
+                grep -v "^${key}=" /opt/data/.env > /opt/data/.env.tmp || true
                 mv /opt/data/.env.tmp /opt/data/.env
-              fi
-              if ! grep -q '^API_SERVER_KEY=' /opt/data/.env; then
-                api_key="$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n')"
-                printf '\nAPI_SERVER_KEY=%s\n' "${api_key}" >> /opt/data/.env
-              fi
-              # Anthropic credential: Vault first, then the manual Secret. The
-              # Secret is retained only as a rollback path while the migration
-              # settles; delete it once Vault has been serving for a while.
-              anthropic=""
-              if [ -r /vault/secrets/anthropic-token ]; then
-                anthropic="$(cat /vault/secrets/anthropic-token)"
-              elif [ -n "${CLAUDE_CODE_OAUTH_TOKEN_SEED:-}" ]; then
-                anthropic="${CLAUDE_CODE_OAUTH_TOKEN_SEED}"
-              fi
-              if [ -n "${anthropic}" ]; then
-                grep -v '^CLAUDE_CODE_OAUTH_TOKEN=' /opt/data/.env > /opt/data/.env.tmp || true
-                printf 'CLAUDE_CODE_OAUTH_TOKEN=%s\n' "${anthropic}" >> /opt/data/.env.tmp
-                mv /opt/data/.env.tmp /opt/data/.env
-              fi
+              done
+              rm -f /opt/data/auth.json
               chmod 0600 /opt/data/.env
-              mkdir -p /shared-auth
-              if [ ! -s /shared-auth/auth.json ] && [ -s /opt/data/auth.json ]; then
-                cp /opt/data/auth.json /shared-auth/auth.json
-                chmod 0600 /shared-auth/auth.json
-              fi
               chown -R 10000:10000 /opt/data
-              chown -R 10000:10000 /shared-auth
           securityContext:
             runAsUser: 0
             runAsGroup: 0
@@ -176,8 +130,6 @@ spec:
               mountPath: /config
             - name: operator-guide
               mountPath: /guide
-            - name: provider-auth
-              mountPath: /shared-auth
           resources:
             requests:
               cpu: 25m
@@ -185,6 +137,25 @@ spec:
             limits:
               cpu: 100m
               memory: 64Mi
+        - name: stage-runtime-access
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
+          imagePullPolicy: IfNotPresent
+          command:
+            - /opt/hermes/.venv/bin/python
+            - /opt/coordinator/stage_runtime_access.py
+            - triage
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 0
+            runAsGroup: 0
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
+            - {name: runtime-access, mountPath: /runtime-access}
+          resources:
+            requests: {cpu: 25m, memory: 32Mi}
+            limits: {cpu: 100m, memory: 64Mi}
         - name: patch-auth
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
           imagePullPolicy: IfNotPresent
@@ -239,6 +210,29 @@ spec:
           resources:
             requests: {cpu: 25m, memory: 64Mi}
             limits: {cpu: 100m, memory: 128Mi}
+        - name: patch-subprocess-secret-boundary
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              /opt/hermes/.venv/bin/python /opt/coordinator/patch_subprocess_secret_boundary.py \
+                /opt/hermes/tools/environments/local.py /patched/local.py
+              /opt/hermes/.venv/bin/python /opt/coordinator/patch_process_output_redaction.py \
+                /opt/hermes/tools/process_registry.py /patched/process_registry.py
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 10000
+            runAsGroup: 10000
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
+            - {name: subprocess-secret-patch, mountPath: /patched}
+          resources:
+            requests: {cpu: 25m, memory: 64Mi}
+            limits: {cpu: 100m, memory: 128Mi}
         - name: install-kubectl
           image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
           imagePullPolicy: IfNotPresent
@@ -267,11 +261,13 @@ spec:
         - name: hermes
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
           imagePullPolicy: IfNotPresent
-          command: [/opt/hermes/.venv/bin/hermes]
+          command: [/bin/sh, -ec]
           args:
-            - gateway
-            - run
-            - --no-supervise
+            - |
+              API_SERVER_KEY="$(tr -d '\r\n' < /runtime-access/triage-api-key)"
+              test -n "${API_SERVER_KEY}"
+              export API_SERVER_KEY
+              exec /opt/hermes/.venv/bin/hermes gateway run --no-supervise
           ports:
             - name: api
               containerPort: 8642
@@ -280,7 +276,7 @@ spec:
             - name: HERMES_HOME
               value: /opt/data
             - name: HERMES_AUTH_FILE
-              value: /shared-auth/auth.json
+              value: /runtime-access/hermes-auth.json
             - name: HOME
               value: /opt/data/home
             - name: PATH
@@ -313,14 +309,6 @@ spec:
               value: automated-triage
             - name: HERMES_API_DEFAULT_PARENT_MATCH_PREFIXES
               value: "A static-analysis finding, not a build failure.||Use $triage-titan-test-failures."
-            # Claude subscription OAuth token (sk-ant-oat01...). The anthropic
-            # provider accepts ANTHROPIC_API_KEY, ANTHROPIC_TOKEN, or this, in
-            # that order; an OAuth token is not an API key, so it must arrive
-            # under this name. Optional, so Hermes still starts without it and
-            # falls back to openai-codex.
-            # TODO: migrate to Vault alongside the Gitea token; this manual
-            # Secret was created in the interest of demo time.
-
           securityContext:
             allowPrivilegeEscalation: false
             runAsNonRoot: true
@@ -333,14 +321,20 @@ spec:
           volumeMounts:
             - name: home
               mountPath: /opt/data
-            - name: provider-auth
-              mountPath: /shared-auth
+            - name: runtime-access
+              mountPath: /runtime-access
             - name: auth-patch
               mountPath: /opt/hermes/hermes_cli/auth.py
               subPath: auth.py
             - name: api-server-patch
               mountPath: /opt/hermes/gateway/platforms/api_server.py
               subPath: api_server.py
+            - name: subprocess-secret-patch
+              mountPath: /opt/hermes/tools/environments/local.py
+              subPath: local.py
+            - name: subprocess-secret-patch
+              mountPath: /opt/hermes/tools/process_registry.py
+              subPath: process_registry.py
             - name: tools
               mountPath: /usr/local/bin/kubectl
               subPath: kubectl
@@ -390,7 +384,7 @@ spec:
           command: [/bin/sh, -ec]
           args:
             - |
-              api_key="$(sed -n 's/^API_SERVER_KEY=//p' /opt/data/.env | tail -n 1)"
+              api_key="$(tr -d '\r\n' < /runtime-access/triage-api-key)"
               test -n "${api_key}"
               export API_SERVER_KEY="${api_key}"
               export HERMES_WEBUI_GATEWAY_API_KEY="${api_key}"
@@ -399,7 +393,7 @@ spec:
             - {name: dashboard, containerPort: 8787, protocol: TCP}
           env:
             - {name: HERMES_HOME, value: /opt/data}
-            - {name: HERMES_AUTH_FILE, value: /shared-auth/auth.json}
+            - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
             - {name: HOME, value: /opt/data/home}
             - {name: HERMES_WEBUI_AGENT_DIR, value: /opt/hermes}
             - {name: HERMES_WEBUI_HOST, value: 0.0.0.0}
@@ -417,7 +411,7 @@ spec:
             - {name: HERMES_ROUTER_PROFILE, value: triage}
           volumeMounts:
             - {name: home, mountPath: /opt/data}
-            - {name: provider-auth, mountPath: /shared-auth, readOnly: true}
+            - {name: runtime-access, mountPath: /runtime-access, readOnly: true}
             - {name: tmp, mountPath: /tmp}
           readinessProbe:
             httpGet: {path: /health, port: dashboard}
@@ -446,9 +440,10 @@ spec:
         - name: home
           persistentVolumeClaim:
             claimName: hermes-home
-        - name: provider-auth
-          persistentVolumeClaim:
-            claimName: hermes-provider-auth
+        - name: runtime-access
+          emptyDir:
+            medium: Memory
+            sizeLimit: 2Mi
         - name: config
           configMap:
             name: hermes-config
@@ -468,6 +463,8 @@ spec:
           emptyDir: {}
         - name: api-server-patch
           emptyDir: {}
+        - name: subprocess-secret-patch
+          emptyDir: {}
         - name: tmp
           emptyDir:
             sizeLimit: 256Mi
diff --git a/services/hermes/kustomization.yaml b/services/hermes/kustomization.yaml
index c74e5971..528d01ea 100644
--- a/services/hermes/kustomization.yaml
+++ b/services/hermes/kustomization.yaml
@@ -4,7 +4,7 @@ kind: Kustomization
 namespace: hermes
 images:
   - name: registry.bstein.dev/bstein/hermes-agent
-    digest: sha256:cce1f65dc7d30fdce4b1748cc7d3434b9761ae9946a8c8be6049204c503d60a8
+    digest: sha256:0d9faa7970e4166eb3d06772decc570a695e36ca27327e4a0e8074aa05030b78
 resources:
   - namespace.yaml
   - vault-serviceaccount.yaml
@@ -76,6 +76,11 @@ configMapGenerator:
       - migrate_herdr_state.py=scripts/migrate_herdr_state.py
       - migrate_api_session_lineage.py=scripts/migrate_api_session_lineage.py
       - patch_api_server_sessions.py=scripts/patch_api_server_sessions.py
+      - patch_web_session_activity.py=scripts/patch_web_session_activity.py
+      - patch_subprocess_secret_boundary.py=scripts/patch_subprocess_secret_boundary.py
+      - patch_process_output_redaction.py=scripts/patch_process_output_redaction.py
+      - stage_runtime_access.py=scripts/stage_runtime_access.py
+      - sync_runtime_credentials.py=scripts/sync_runtime_credentials.py
       - patch_hermes_auth.py=scripts/patch_hermes_auth.py
       - patch_codex_runtime.py=scripts/patch_codex_runtime.py
       - patch_stream_recovery.py=scripts/patch_stream_recovery.py
diff --git a/services/hermes/plugins/image-gen-broker/__init__.py b/services/hermes/plugins/image-gen-broker/__init__.py
index 66122bce..d7583f60 100644
--- a/services/hermes/plugins/image-gen-broker/__init__.py
+++ b/services/hermes/plugins/image-gen-broker/__init__.py
@@ -159,15 +159,17 @@ HOSTED_EDIT_SCHEMA = {
 
 
 def _broker_key() -> str:
-    """Load the internal relay key from process env or the private .env."""
-    value = os.environ.get("HERMES_IMAGE_BROKER_KEY", "").strip()
-    if value:
-        return value
-    home = Path(os.environ.get("HERMES_HOME", "/opt/data"))
+    """Load the internal relay key from its runtime-only Vault file."""
+    secret_path = Path(
+        os.environ.get(
+            "HERMES_IMAGE_BROKER_KEY_FILE",
+            "/runtime-access/chat-relay-key",
+        )
+    )
     try:
-        for line in (home / ".env").read_text(encoding="utf-8").splitlines():
-            if line.startswith("HERMES_IMAGE_BROKER_KEY="):
-                return line.split("=", 1)[1].strip()
+        value = secret_path.read_text(encoding="utf-8").strip()
+        if value:
+            return value
     except OSError:
         pass
     return ""
diff --git a/services/hermes/pvc.yaml b/services/hermes/pvc.yaml
index 1348719e..4b07ccb7 100644
--- a/services/hermes/pvc.yaml
+++ b/services/hermes/pvc.yaml
@@ -31,21 +31,6 @@ spec:
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
-metadata:
-  name: hermes-provider-auth
-  namespace: hermes
-  labels:
-    app.kubernetes.io/part-of: hermes
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: astreae
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
 metadata:
   name: hermes-chat-router-state
   namespace: hermes
diff --git a/services/hermes/scripts/claude b/services/hermes/scripts/claude
index 9683ac2e..33548d79 100755
--- a/services/hermes/scripts/claude
+++ b/services/hermes/scripts/claude
@@ -5,5 +5,5 @@ set -eu
 exec /opt/data/tools/bin/claude \
   --dangerously-skip-permissions \
   --autocompact auto \
-  --settings /opt/data/home/.claude/settings.json \
+  --settings "${CLAUDE_CONFIG_DIR:-/runtime-access/claude}/settings.json" \
   "$@"
diff --git a/services/hermes/scripts/claude_oauth_broker.py b/services/hermes/scripts/claude_oauth_broker.py
index 2a20b4c6..df44605f 100644
--- a/services/hermes/scripts/claude_oauth_broker.py
+++ b/services/hermes/scripts/claude_oauth_broker.py
@@ -66,11 +66,8 @@ _auth_probe_at = 0.0
 _auth_probe_value: dict[str, Any] = {}
 
 
-def _read_secret(env_name: str, file_env_name: str) -> str:
-    """Read a secret from an environment value or mounted file."""
-    value = os.environ.get(env_name, "").strip()
-    if value:
-        return value
+def _read_secret(file_env_name: str) -> str:
+    """Read a secret only from its runtime-mounted file."""
     path = os.environ.get(file_env_name, "").strip()
     if not path:
         return ""
@@ -82,10 +79,7 @@ def _read_secret(env_name: str, file_env_name: str) -> str:
 
 def _relay_key() -> str:
     """Return the internal relay key shared with Switchyard."""
-    return (
-        _read_secret("HERMES_CLAUDE_BROKER_KEY", "HERMES_CLAUDE_BROKER_KEY_FILE")
-        or os.environ.get("HERMES_IMAGE_BROKER_KEY", "").strip()
-    )
+    return _read_secret("HERMES_CLAUDE_BROKER_KEY_FILE")
 
 
 def _authorized(authorization: str | None, api_key: str | None) -> bool:
diff --git a/services/hermes/scripts/codex_broker.py b/services/hermes/scripts/codex_broker.py
index 3d803c1a..87ad1e50 100644
--- a/services/hermes/scripts/codex_broker.py
+++ b/services/hermes/scripts/codex_broker.py
@@ -23,7 +23,22 @@ from routing_catalog import resolve_route
 
 HOST = os.environ.get("HERMES_CODEX_BROKER_LISTEN_HOST", "0.0.0.0")
 PORT = int(os.environ.get("HERMES_CODEX_BROKER_LISTEN_PORT", "9003"))
-TOKEN = os.environ.get("HERMES_IMAGE_BROKER_KEY", "").strip()
+
+
+def _relay_token() -> str:
+    """Read relay auth without exporting it to Codex subprocesses."""
+    path = Path(
+        os.environ.get(
+            "HERMES_CODEX_BROKER_KEY_FILE", "/runtime-access/chat-relay-key"
+        )
+    )
+    try:
+        return path.read_text(encoding="utf-8").strip()
+    except OSError:
+        return ""
+
+
+TOKEN = _relay_token()
 UPSTREAM = os.environ.get(
     "HERMES_CODEX_BROKER_UPSTREAM",
     "https://chatgpt.com/backend-api/codex",
@@ -613,7 +628,7 @@ class Handler(BaseHTTPRequestHandler):
 def main() -> None:
     """Serve until Kubernetes terminates the sidecar."""
     if not TOKEN:
-        raise SystemExit("HERMES_IMAGE_BROKER_KEY is required")
+        raise SystemExit("runtime relay key is unavailable")
     try:
         token = _access_token()
     except RuntimeError as exc:
diff --git a/services/hermes/scripts/gitea_askpass.sh b/services/hermes/scripts/gitea_askpass.sh
index f80bdc93..d6146d80 100755
--- a/services/hermes/scripts/gitea_askpass.sh
+++ b/services/hermes/scripts/gitea_askpass.sh
@@ -2,7 +2,18 @@
 set -eu
 
 case "${1:-}" in
-  *Username*) printf '%s\n' "${GITEA_USERNAME:-hermes-automation}" ;;
-  *Password*) printf '%s\n' "${GITEA_TOKEN:-}" ;;
+  *Username*)
+    if [ -s /runtime-access/gitea-username ]; then
+      tr -d '\r\n' </runtime-access/gitea-username
+    else
+      printf '%s' hermes-automation
+    fi
+    printf '\n'
+    ;;
+  *Password*)
+    test -s /runtime-access/gitea-token
+    tr -d '\r\n' </runtime-access/gitea-token
+    printf '\n'
+    ;;
   *) exit 1 ;;
 esac
diff --git a/services/hermes/scripts/hermes_coordinator.py b/services/hermes/scripts/hermes_coordinator.py
index 90a3bcb4..f24ce33d 100644
--- a/services/hermes/scripts/hermes_coordinator.py
+++ b/services/hermes/scripts/hermes_coordinator.py
@@ -25,6 +25,7 @@ from hermes_model_routing import (
 
 CASSANDRA_BASE_PATH = Path("/opt/data/workspace/projects/cassandra")
 CASSANDRA_REMOTE = "https://scm.bstein.dev/atlas/cassandra.git"
+DEFAULT_GITEA_TOKEN_PATH = Path("/runtime-access/gitea-token")
 
 
 def cassandra_workspace() -> Path:
@@ -138,13 +139,44 @@ def bootstrap_cassandra_state(root: Path) -> dict[str, str]:
     return {"state": "ready"}
 
 
+def _gitea_token_path() -> Path:
+    """Return the runtime-only Gitea credential path without reading it."""
+    configured = os.environ.get("HERMES_GITEA_TOKEN_FILE", "").strip()
+    return Path(configured) if configured else DEFAULT_GITEA_TOKEN_PATH
+
+
+def _gitea_token_available() -> bool:
+    """Check credential readiness without loading it into process memory."""
+    try:
+        path = _gitea_token_path()
+        return path.is_file() and path.stat().st_size > 0
+    except OSError:
+        return False
+
+
 def sync_cassandra_repo(env_values: dict[str, str]) -> str:
-    """Clone or fetch Cassandra when the optional Gitea token is available."""
-    token = env_values.get("GITEA_TOKEN", "").strip()
+    """Clone or fetch Cassandra through the runtime-only askpass credential."""
+    token_available = _gitea_token_available()
     if shutil.which("git") is None:
         return "git-unavailable"
     child_env = os.environ.copy()
-    child_env.update(env_values)
+    child_env.update(
+        {
+            key: value
+            for key, value in env_values.items()
+            if key
+            not in {
+                "API_SERVER_KEY",
+                "CLAUDE_CODE_OAUTH_TOKEN",
+                "GITEA_TOKEN",
+                "HERMES_IMAGE_BROKER_KEY",
+            }
+        }
+    )
+    child_env["GIT_ASKPASS"] = env_values.get(
+        "GIT_ASKPASS", "/opt/coordinator/gitea_askpass.sh"
+    )
+    child_env["GIT_TERMINAL_PROMPT"] = "0"
     if (CASSANDRA_BASE_PATH / ".git").exists():
         try:
             current_remote = subprocess.run(
@@ -200,7 +232,7 @@ def sync_cassandra_repo(env_values: dict[str, str]) -> str:
                     return f"remote-repair-failed-{repaired.returncode}"
         except (OSError, subprocess.TimeoutExpired):
             return "remote-repair-failed"
-        if not token:
+        if not token_available:
             return "ready; fetch skipped until Gitea token is configured"
         command = [
             "git",
@@ -215,7 +247,7 @@ def sync_cassandra_repo(env_values: dict[str, str]) -> str:
         CASSANDRA_BASE_PATH.mkdir(parents=True, exist_ok=True)
         if any(CASSANDRA_BASE_PATH.iterdir()):
             return "unmanaged-nonempty-directory"
-        if not token:
+        if not token_available:
             return "awaiting-gitea-token"
         command = [
             "git",
@@ -244,8 +276,6 @@ def sync_cassandra_repo(env_values: dict[str, str]) -> str:
 def refresh_once(root: Path) -> dict[str, Any]:
     """Refresh provider catalogs and all managed coordinator state once."""
     env_values = _read_env(root / ".env")
-    if env_values.get("CLAUDE_CODE_OAUTH_TOKEN"):
-        os.environ["CLAUDE_CODE_OAUTH_TOKEN"] = env_values["CLAUDE_CODE_OAUTH_TOKEN"]
     codex = discover_codex_models()
     claude = discover_claude_models()
     routes = configure_routes(root, codex, claude)
diff --git a/services/hermes/scripts/hermes_model_routing.py b/services/hermes/scripts/hermes_model_routing.py
index 92b2c7fa..d4b87259 100644
--- a/services/hermes/scripts/hermes_model_routing.py
+++ b/services/hermes/scripts/hermes_model_routing.py
@@ -39,11 +39,18 @@ SWITCHYARD_API = "http://hermes-switchyard.hermes.svc.cluster.local:9005/v1"
 SWITCHYARD_AUTO_ROUTE = "atlas/auto/maximum"
 ROUTING_CATALOG_PATH = os.environ.get("HERMES_ROUTING_CATALOG_PATH", "").strip()
 MANAGED_ENV_KEYS = {
+    "GIT_ASKPASS",
+    "GIT_TERMINAL_PROMPT",
+}
+RUNTIME_SECRET_ENV_KEYS = {
+    "ANTHROPIC_API_KEY",
+    "API_SERVER_KEY",
+    "CLAUDE_API_KEY",
     "CLAUDE_CODE_OAUTH_TOKEN",
     "GITEA_TOKEN",
     "GITEA_USERNAME",
-    "GIT_ASKPASS",
-    "GIT_TERMINAL_PROMPT",
+    "HERMES_IMAGE_BROKER_KEY",
+    "OPENAI_API_KEY",
 }
 
 
@@ -359,7 +366,7 @@ def _read_env(path: Path) -> dict[str, str]:
 
 
 def _update_profile_env(path: Path, source: dict[str, str]) -> None:
-    """Refresh managed credentials while preserving user-owned environment keys."""
+    """Refresh non-secret managed settings and remove stale credential copies."""
     try:
         old_lines = path.read_text(encoding="utf-8").splitlines()
     except OSError:
@@ -367,7 +374,10 @@ def _update_profile_env(path: Path, source: dict[str, str]) -> None:
     kept = [
         line
         for line in old_lines
-        if not any(line.lstrip().startswith(f"{key}=") for key in MANAGED_ENV_KEYS)
+        if not any(
+            line.lstrip().startswith(f"{key}=")
+            for key in MANAGED_ENV_KEYS | RUNTIME_SECRET_ENV_KEYS
+        )
     ]
     kept.extend(
         f"{key}={source[key]}" for key in sorted(MANAGED_ENV_KEYS) if source.get(key)
@@ -494,25 +504,13 @@ def discover_claude_models() -> Catalog:
                 )
         except (OSError, subprocess.SubprocessError, ValueError, json.JSONDecodeError):
             pass
-    token = str(os.environ.get("CLAUDE_CODE_OAUTH_TOKEN") or "").strip()
-    live: list[str] = []
-    if token:
-        try:
-            from hermes_cli.models import _fetch_anthropic_models
-
-            live = _unique_models(_fetch_anthropic_models(timeout=10.0) or [])
-        except Exception:
-            live = []
-    if live:
-        return Catalog("anthropic", live, True, True, "connected")
     try:
         from hermes_cli.models import provider_model_ids
 
         known = _unique_models(provider_model_ids("anthropic", force_refresh=True))
     except Exception:
         known = []
-    state = "degraded" if token else "not-configured"
-    return Catalog("anthropic", known, False, bool(token), state)
+    return Catalog("anthropic", known, False, False, "not-configured")
 
 
 def _profile_config(
@@ -626,8 +624,6 @@ def configure_routes(
     env_values = _read_env(root / ".env")
     routes: dict[str, list[str]] = {}
     for effort in EFFORTS:
-        codex_model = codex_models[effort]
-        claude_model = claude_models[effort]
         codex_name = f"codex-{effort}"
         claude_name = f"claude-{effort}"
         codex_route = {
diff --git a/services/hermes/scripts/image_broker.py b/services/hermes/scripts/image_broker.py
index 71ed7dba..f1f64cd4 100644
--- a/services/hermes/scripts/image_broker.py
+++ b/services/hermes/scripts/image_broker.py
@@ -20,7 +20,22 @@ HOST = os.environ.get("HERMES_IMAGE_BROKER_LISTEN_HOST", "0.0.0.0")
 # Kubernetes reserves <SERVICE>_PORT for service-link discovery and injects a
 # tcp://... value.  Keep listener configuration out of that namespace.
 PORT = int(os.environ.get("HERMES_IMAGE_BROKER_LISTEN_PORT", "9002"))
-TOKEN = os.environ.get("HERMES_IMAGE_BROKER_KEY", "").strip()
+
+
+def _relay_token() -> str:
+    """Read relay auth without exporting it to provider subprocesses."""
+    path = Path(
+        os.environ.get(
+            "HERMES_IMAGE_BROKER_KEY_FILE", "/runtime-access/chat-relay-key"
+        )
+    )
+    try:
+        return path.read_text(encoding="utf-8").strip()
+    except OSError:
+        return ""
+
+
+TOKEN = _relay_token()
 PROVIDER_PATH = Path(
     os.environ.get(
         "HERMES_IMAGE_PROVIDER_PATH",
@@ -329,7 +344,7 @@ class Handler(BaseHTTPRequestHandler):
 def main() -> None:
     """Serve until Kubernetes terminates the sidecar."""
     if not TOKEN:
-        raise SystemExit("HERMES_IMAGE_BROKER_KEY is required")
+        raise SystemExit("runtime relay key is unavailable")
     server = ThreadingHTTPServer((HOST, PORT), Handler)
     server.serve_forever()
 
diff --git a/services/hermes/scripts/patch_api_server_sessions.py b/services/hermes/scripts/patch_api_server_sessions.py
index 3e3abf5f..ce5c93a5 100644
--- a/services/hermes/scripts/patch_api_server_sessions.py
+++ b/services/hermes/scripts/patch_api_server_sessions.py
@@ -129,11 +129,20 @@ RUN_CLOSE_AFTER = '''            finally:
                 # distinguish a long model wait from completed or failed work.
                 if parent_session_id:
                     try:
+                        terminal_status = self._run_statuses.get(run_id, {}).get(
+                            "status", "failed"
+                        )
+                        activity_status = terminal_status if terminal_status in {
+                            "completed",
+                            "failed",
+                            "cancelled",
+                        } else "failed"
+                        self._record_run_activity(
+                            session_id,
+                            f"run.{activity_status}",
+                        )
                         db = self._ensure_session_db()
                         if db is not None:
-                            terminal_status = self._run_statuses.get(run_id, {}).get(
-                                "status", "failed"
-                            )
                             db.end_session(session_id, f"api_run_{terminal_status}")
                     except Exception:
                         logger.exception(
@@ -145,6 +154,156 @@ RUN_CLOSE_AFTER = '''            finally:
                 # If the asyncio wrapper is cancelled (for example via
 '''
 
+EVENT_CALLBACK_SIGNATURE_BEFORE = '''    def _make_run_event_callback(self, run_id: str, loop: "asyncio.AbstractEventLoop"):
+'''
+
+EVENT_CALLBACK_SIGNATURE_AFTER = '''    _RUN_ACTIVITY_BYTES = 512_000
+    _RUN_ACTIVITY_FILES = 256
+
+    def _record_run_activity(
+        self,
+        session_id: str,
+        event_type: str,
+        *,
+        tool_name: str = None,
+        preview: str = None,
+        is_error: bool = False,
+    ) -> None:
+        """Append a bounded, display-only event without changing agent history."""
+        labels = {
+            "run.started": "Worker started",
+            "run.completed": "Worker completed",
+            "run.failed": "Worker failed",
+            "run.cancelled": "Worker cancelled",
+            "_thinking": "Hermes is reasoning",
+            "reasoning.available": "Hermes finished a reasoning step",
+            "tool.started": "Tool started",
+            "tool.completed": "Tool failed" if is_error else "Tool finished",
+            "subagent.tool": "Nested worker tool",
+            "subagent.progress": "Nested worker progress",
+            "subagent_progress": "Nested worker progress",
+            "subagent.complete": "Nested worker finished",
+            "subagent.text": "Nested worker produced an update",
+            "subagent.thinking": "Nested worker is reasoning",
+        }
+        label = labels.get(event_type)
+        if not session_id or not label:
+            return
+        # Tool names are bounded identifiers. All previews are arbitrary model
+        # or tool text and can contain prompts, arguments, paths, or credentials,
+        # so the activity projection must never persist them.
+        detail = tool_name if event_type in {
+            "tool.started",
+            "tool.completed",
+            "subagent.tool",
+        } else ""
+        try:
+            detail = redact_sensitive_text(str(detail)).strip()[:480]
+            content = f"{label}: {detail}" if detail else label
+            entry = {
+                "role": "assistant",
+                "content": f"Activity · {content}",
+                "timestamp": time.time(),
+                "activity_event": event_type,
+            }
+            root = Path(
+                os.environ.get("HERMES_HOME", "~/.hermes")
+            ).expanduser() / "run-activity"
+            if root.is_symlink():
+                return
+            root.mkdir(mode=0o700, parents=True, exist_ok=True)
+            root.chmod(0o700)
+            digest = hashlib.sha256(session_id.encode("utf-8")).hexdigest()
+            path = root / f"{digest}.jsonl"
+            previous = root / f"{digest}.previous.jsonl"
+            if path.is_symlink() or previous.is_symlink():
+                return
+            new_file = not path.exists()
+            if path.exists() and path.stat().st_size >= self._RUN_ACTIVITY_BYTES:
+                previous.unlink(missing_ok=True)
+                path.replace(previous)
+            line = (json.dumps(entry, separators=(",", ":")) + "\\n").encode()
+            flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND
+            flags |= getattr(os, "O_NOFOLLOW", 0)
+            fd = os.open(path, flags, 0o600)
+            try:
+                os.fchmod(fd, 0o600)
+                os.write(fd, line)
+            finally:
+                os.close(fd)
+            if new_file:
+                files = sorted(
+                    root.glob("*.jsonl"),
+                    key=lambda item: item.stat().st_mtime,
+                )
+                for stale in files[:-self._RUN_ACTIVITY_FILES]:
+                    if not stale.is_symlink():
+                        stale.unlink(missing_ok=True)
+        except Exception:
+            logger.debug("Could not record run activity", exc_info=True)
+
+    def _make_run_event_callback(
+        self,
+        run_id: str,
+        loop: "asyncio.AbstractEventLoop",
+        *,
+        session_id: str,
+    ):
+'''
+
+EVENT_CALLBACK_BODY_BEFORE = '''        def _callback(event_type: str, tool_name: str = None, preview: str = None, args=None, **kwargs):
+            ts = time.time()
+            if event_type == "tool.started":
+'''
+
+EVENT_CALLBACK_BODY_AFTER = '''        def _callback(event_type: str, tool_name: str = None, preview: str = None, args=None, **kwargs):
+            ts = time.time()
+            self._record_run_activity(
+                session_id,
+                event_type,
+                tool_name=tool_name,
+                preview=preview,
+                is_error=bool(kwargs.get("is_error", False)),
+            )
+            if event_type == "tool.started":
+'''
+
+EVENT_CALLBACK_END_BEFORE = '''            # _thinking and subagent_progress are intentionally not forwarded
+'''
+
+EVENT_CALLBACK_END_AFTER = '''            elif event_type in {
+                "subagent.tool",
+                "subagent.progress",
+                "subagent_progress",
+                "subagent.complete",
+                "subagent.text",
+                "subagent.thinking",
+            }:
+                safe_preview = (
+                    redact_sensitive_text(str(tool_name or ""))[:480]
+                    if event_type == "subagent.tool"
+                    else ""
+                )
+                _push({
+                    "event": event_type,
+                    "run_id": run_id,
+                    "timestamp": ts,
+                    "tool": tool_name if event_type == "subagent.tool" else None,
+                    "preview": safe_preview,
+                })
+'''
+
+EVENT_CALLBACK_CALL_BEFORE = '''        event_cb = self._make_run_event_callback(run_id, loop)
+'''
+
+EVENT_CALLBACK_CALL_AFTER = '''        event_cb = self._make_run_event_callback(
+            run_id,
+            loop,
+            session_id=session_id,
+        )
+        self._record_run_activity(session_id, "run.started")
+'''
+
 
 def patch(source: Path, destination: Path) -> None:
     """Apply the narrow session-lineage extension and fail on upstream drift."""
@@ -155,11 +314,27 @@ def patch(source: Path, destination: Path) -> None:
         raise RuntimeError("Hermes API runs patch context changed")
     if RUN_CLOSE_BEFORE not in content:
         raise RuntimeError("Hermes API run-close patch context changed")
+    for marker, message in (
+        (EVENT_CALLBACK_SIGNATURE_BEFORE, "event callback signature"),
+        (EVENT_CALLBACK_BODY_BEFORE, "event callback body"),
+        (EVENT_CALLBACK_END_BEFORE, "event callback end"),
+        (EVENT_CALLBACK_CALL_BEFORE, "event callback call"),
+    ):
+        if marker not in content:
+            raise RuntimeError(f"Hermes API {message} patch context changed")
     destination.parent.mkdir(parents=True, exist_ok=True)
     content = content.replace(BEFORE, AFTER, 1)
     content = content.replace(RUNS_BEFORE, RUNS_AFTER, 1)
+    content = content.replace(RUN_CLOSE_BEFORE, RUN_CLOSE_AFTER, 1)
+    content = content.replace(
+        EVENT_CALLBACK_SIGNATURE_BEFORE,
+        EVENT_CALLBACK_SIGNATURE_AFTER,
+        1,
+    )
+    content = content.replace(EVENT_CALLBACK_BODY_BEFORE, EVENT_CALLBACK_BODY_AFTER, 1)
+    content = content.replace(EVENT_CALLBACK_END_BEFORE, EVENT_CALLBACK_END_AFTER, 1)
     destination.write_text(
-        content.replace(RUN_CLOSE_BEFORE, RUN_CLOSE_AFTER, 1),
+        content.replace(EVENT_CALLBACK_CALL_BEFORE, EVENT_CALLBACK_CALL_AFTER, 1),
         encoding="utf-8",
     )
 
diff --git a/services/hermes/scripts/patch_process_output_redaction.py b/services/hermes/scripts/patch_process_output_redaction.py
new file mode 100644
index 00000000..da0e7659
--- /dev/null
+++ b/services/hermes/scripts/patch_process_output_redaction.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Redact credential assignments from every background-process result."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+
+BEFORE = '''            result[field] = redact_terminal_output(value, command)
+'''
+
+AFTER = '''            result[field] = redact_sensitive_text(
+                redact_terminal_output(value, command),
+                code_file=False,
+            )
+'''
+
+
+def patch(source: Path, destination: Path) -> None:
+    """Apply unconditional result redaction and fail on upstream drift."""
+    content = source.read_text(encoding="utf-8")
+    if content.count(BEFORE) != 1:
+        raise RuntimeError("Hermes process-result redaction context changed")
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    destination.write_text(content.replace(BEFORE, AFTER, 1), encoding="utf-8")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("source", type=Path)
+    parser.add_argument("destination", type=Path)
+    args = parser.parse_args()
+    patch(args.source, args.destination)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/services/hermes/scripts/patch_subprocess_secret_boundary.py b/services/hermes/scripts/patch_subprocess_secret_boundary.py
new file mode 100644
index 00000000..6fbce96e
--- /dev/null
+++ b/services/hermes/scripts/patch_subprocess_secret_boundary.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+"""Keep Atlas runtime credentials out of Hermes-spawned subprocesses."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+
+BEFORE = '''    upper = key.upper()
+    if upper.startswith("AUXILIARY_") and (
+'''
+
+AFTER = '''    upper = key.upper()
+    if upper in {
+        "API_SERVER_KEY",
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "GITEA_TOKEN",
+        "HERMES_IMAGE_BROKER_KEY",
+    }:
+        return True
+    if upper.startswith("AUXILIARY_") and (
+'''
+
+
+def patch(source: Path, destination: Path) -> None:
+    """Apply the runtime-credential boundary and fail on upstream drift."""
+    content = source.read_text(encoding="utf-8")
+    if content.count(BEFORE) != 1:
+        raise RuntimeError("Hermes subprocess secret boundary context changed")
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    destination.write_text(content.replace(BEFORE, AFTER, 1), encoding="utf-8")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("source", type=Path)
+    parser.add_argument("destination", type=Path)
+    args = parser.parse_args()
+    patch(args.source, args.destination)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/services/hermes/scripts/patch_web_session_activity.py b/services/hermes/scripts/patch_web_session_activity.py
new file mode 100644
index 00000000..8d449764
--- /dev/null
+++ b/services/hermes/scripts/patch_web_session_activity.py
@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+"""Merge display-only worker activity into dashboard session transcripts."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+
+HELPER_MARKER = '''@app.get("/api/sessions/{session_id}/messages")
+async def get_session_messages(session_id: str, profile: Optional[str] = None):
+'''
+
+HELPER_REPLACEMENT = '''def _run_activity_messages(session_id: str) -> List[Dict[str, Any]]:
+    """Read a bounded activity journal without treating it as agent history."""
+    digest = hashlib.sha256(session_id.encode("utf-8")).hexdigest()
+    root = get_hermes_home() / "run-activity"
+    if root.is_symlink():
+        return []
+    paths = (
+        root / f"{digest}.previous.jsonl",
+        root / f"{digest}.jsonl",
+    )
+    entries: List[Dict[str, Any]] = []
+    for path in paths:
+        try:
+            if path.is_symlink() or not path.is_file():
+                continue
+            if path.stat().st_size > 600_000:
+                continue
+            for line in path.read_text(encoding="utf-8").splitlines():
+                item = json.loads(line)
+                if not isinstance(item, dict):
+                    continue
+                content = item.get("content")
+                timestamp = item.get("timestamp")
+                if not isinstance(content, str) or not isinstance(
+                    timestamp, (int, float)
+                ):
+                    continue
+                entries.append(
+                    {
+                        "role": "assistant",
+                        "content": content[:1_000],
+                        "timestamp": float(timestamp),
+                        "observed": True,
+                    }
+                )
+        except (OSError, UnicodeError, ValueError, json.JSONDecodeError):
+            continue
+    return entries[-1_000:]
+
+
+@app.get("/api/sessions/{session_id}/messages")
+async def get_session_messages(session_id: str, profile: Optional[str] = None):
+'''
+
+MESSAGES_BEFORE = '''        messages = db.get_messages(sid)
+        return {"session_id": sid, "messages": messages}
+'''
+
+MESSAGES_AFTER = '''        messages = [
+            *db.get_messages(sid),
+            *_run_activity_messages(sid),
+        ]
+        messages.sort(key=lambda item: float(item.get("timestamp") or 0.0))
+        return {"session_id": sid, "messages": messages}
+'''
+
+
+def patch(source: Path, destination: Path) -> None:
+    """Apply the activity projection and fail closed on upstream drift."""
+    content = source.read_text(encoding="utf-8")
+    if HELPER_MARKER not in content:
+        raise RuntimeError("Hermes dashboard activity helper context changed")
+    if MESSAGES_BEFORE not in content:
+        raise RuntimeError("Hermes dashboard messages context changed")
+    content = content.replace(HELPER_MARKER, HELPER_REPLACEMENT, 1)
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    destination.write_text(
+        content.replace(MESSAGES_BEFORE, MESSAGES_AFTER, 1),
+        encoding="utf-8",
+    )
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("source", type=Path)
+    parser.add_argument("destination", type=Path)
+    args = parser.parse_args()
+    patch(args.source, args.destination)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/services/hermes/scripts/stage_runtime_access.py b/services/hermes/scripts/stage_runtime_access.py
new file mode 100644
index 00000000..f4d73160
--- /dev/null
+++ b/services/hermes/scripts/stage_runtime_access.py
@@ -0,0 +1,162 @@
+#!/usr/bin/env python3
+"""Stage Vault-projected access material into a pod-lifetime filesystem."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+
+
+VAULT_ROOT = Path("/vault/secrets")
+RUNTIME_ROOT = Path("/runtime-access")
+PERSISTENT_HOME = Path("/opt/data/home")
+OWNER_UID = 10000
+OWNER_GID = 10000
+
+
+def _owned_directory(path: Path) -> None:
+    """Create one private directory owned by the unprivileged Hermes user."""
+    path.mkdir(mode=0o700, parents=True, exist_ok=True)
+    path.chmod(0o700)
+    os.chown(path, OWNER_UID, OWNER_GID)
+
+
+def _copy_secret(source_name: str, destination: Path) -> str:
+    """Copy a non-empty Vault projection without logging its value."""
+    value = (VAULT_ROOT / source_name).read_text(encoding="utf-8").strip()
+    if not value:
+        raise RuntimeError(f"Vault projection {source_name} is empty")
+    destination.write_text(value + "\n", encoding="utf-8")
+    destination.chmod(0o600)
+    os.chown(destination, OWNER_UID, OWNER_GID)
+    return value
+
+
+def _validated_json(source_name: str, destination: Path, required: tuple[str, ...]) -> None:
+    """Stage one credential document after checking its expected shape."""
+    value = _copy_secret(source_name, destination)
+    try:
+        document = json.loads(value)
+    except json.JSONDecodeError:
+        destination.unlink(missing_ok=True)
+        raise
+    current = document
+    for key in required:
+        if not isinstance(current, dict) or key not in current:
+            destination.unlink(missing_ok=True)
+            raise RuntimeError(f"Vault projection {source_name} has an invalid shape")
+        current = current[key]
+    if not isinstance(current, str) or not current:
+        destination.unlink(missing_ok=True)
+        raise RuntimeError(f"Vault projection {source_name} has an empty credential")
+
+
+def _link_noncredential_state(
+    source: Path,
+    destination: Path,
+    allowed: tuple[str, ...],
+) -> None:
+    """Expose only an explicit allowlist of persistent, non-credential state."""
+    if not source.is_dir():
+        return
+    for name in allowed:
+        item = source / name
+        if not item.exists() or item.is_symlink():
+            continue
+        target = destination / name
+        if target.exists() or target.is_symlink():
+            continue
+        target.symlink_to(item)
+
+
+def _write_empty_auth_store() -> None:
+    """Create a private, non-credential Hermes auth store for Switchyard routes."""
+    path = RUNTIME_ROOT / "hermes-auth.json"
+    path.write_text(
+        json.dumps(
+            {"version": 1, "providers": {}, "credential_pool": {}},
+            separators=(",", ":"),
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+    path.chmod(0o600)
+    os.chown(path, OWNER_UID, OWNER_GID)
+
+
+def stage_agent() -> None:
+    """Stage the owner agent's complete runtime access set."""
+    for path in (RUNTIME_ROOT, RUNTIME_ROOT / "claude", RUNTIME_ROOT / "codex"):
+        _owned_directory(path)
+    for name in (
+        "agent-api-key",
+        "chat-relay-key",
+        "gitea-token",
+        "gitea-username",
+        "node-ssh-private-key",
+        "node-ssh-config",
+        "node-ssh-known-hosts",
+    ):
+        _copy_secret(name, RUNTIME_ROOT / name)
+    _validated_json(
+        "claude-credentials",
+        RUNTIME_ROOT / "claude" / ".credentials.json",
+        ("claudeAiOauth", "refreshToken"),
+    )
+    _validated_json(
+        "codex-auth",
+        RUNTIME_ROOT / "codex" / "auth.json",
+        ("tokens", "refresh_token"),
+    )
+    _link_noncredential_state(
+        PERSISTENT_HOME / ".claude",
+        RUNTIME_ROOT / "claude",
+        ("settings.json", "hooks", "plugins"),
+    )
+    _link_noncredential_state(
+        PERSISTENT_HOME / ".codex",
+        RUNTIME_ROOT / "codex",
+        (
+            "config.toml",
+            "hooks.json",
+            "herdr-agent-state.sh",
+            "rules",
+            "skills",
+            "plugins",
+        ),
+    )
+    _write_empty_auth_store()
+
+
+def stage_chat() -> None:
+    """Stage only the relay credential needed by an isolated chat tenant."""
+    _owned_directory(RUNTIME_ROOT)
+    _copy_secret("chat-relay-key", RUNTIME_ROOT / "chat-relay-key")
+    _write_empty_auth_store()
+
+
+def stage_triage() -> None:
+    """Stage the automated-triage API credential without a persistent copy."""
+    _owned_directory(RUNTIME_ROOT)
+    _copy_secret("triage-api-key", RUNTIME_ROOT / "triage-api-key")
+    _write_empty_auth_store()
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("mode", choices=("agent", "chat", "triage"))
+    args = parser.parse_args()
+    if args.mode == "agent":
+        stage_agent()
+    elif args.mode == "chat":
+        stage_chat()
+    else:
+        stage_triage()
+    print("Runtime access staged from Vault.", flush=True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/services/hermes/scripts/sync_runtime_credentials.py b/services/hermes/scripts/sync_runtime_credentials.py
new file mode 100644
index 00000000..f8323f55
--- /dev/null
+++ b/services/hermes/scripts/sync_runtime_credentials.py
@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+"""Persist refreshed coding-client OAuth documents back into Vault."""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+from pathlib import Path
+from typing import Any
+from urllib.error import HTTPError, URLError
+from urllib.request import Request, urlopen
+
+
+VAULT_ADDR = os.environ.get(
+    "VAULT_ADDR", "http://vault.vault.svc.cluster.local:8200"
+).rstrip("/")
+VAULT_ROLE = os.environ.get(
+    "HERMES_CREDENTIAL_SYNC_VAULT_ROLE", "hermes-credential-sync"
+)
+SECRET_ENDPOINT = "/v1/kv/data/atlas/hermes/agent-tokens"
+JWT_PATH = Path("/var/run/secrets/kubernetes.io/serviceaccount/token")
+CREDENTIALS = {
+    "claude_credentials_json": (
+        Path("/runtime-access/claude/.credentials.json"),
+        ("claudeAiOauth", "refreshToken"),
+    ),
+    "codex_auth_json": (
+        Path("/runtime-access/codex/auth.json"),
+        ("tokens", "refresh_token"),
+    ),
+}
+
+
+def _request(
+    method: str,
+    path: str,
+    payload: dict[str, Any] | None = None,
+    *,
+    token: str = "",
+) -> dict[str, Any]:
+    """Issue one bounded Vault JSON request."""
+    headers = {"Content-Type": "application/json"}
+    if token:
+        headers["X-Vault-Token"] = token
+    request = Request(
+        VAULT_ADDR + path,
+        data=(json.dumps(payload).encode("utf-8") if payload is not None else None),
+        headers=headers,
+        method=method,
+    )
+    with urlopen(request, timeout=10) as response:
+        body = response.read(4 << 20)
+    value = json.loads(body)
+    if not isinstance(value, dict):
+        raise RuntimeError("Vault returned a non-object response")
+    return value
+
+
+def _login() -> str:
+    """Exchange the pod identity for the narrow credential-sync policy."""
+    response = _request(
+        "POST",
+        "/v1/auth/kubernetes/login",
+        {"role": VAULT_ROLE, "jwt": JWT_PATH.read_text(encoding="utf-8").strip()},
+    )
+    token = response.get("auth", {}).get("client_token")
+    if not isinstance(token, str) or not token:
+        raise RuntimeError("Vault login returned no client token")
+    return token
+
+
+def _credential_document(path: Path, required: tuple[str, ...]) -> str | None:
+    """Return one complete credential JSON document or ignore a partial write."""
+    try:
+        value = path.read_text(encoding="utf-8").strip()
+        document = json.loads(value)
+    except (OSError, UnicodeError, json.JSONDecodeError):
+        return None
+    current = document
+    for key in required:
+        if not isinstance(current, dict) or key not in current:
+            return None
+        current = current[key]
+    if not isinstance(current, str) or not current:
+        return None
+    return value
+
+
+def sync_once(token: str) -> list[str]:
+    """CAS-update only credential fields whose runtime documents changed."""
+    response = _request("GET", SECRET_ENDPOINT, token=token)
+    envelope = response.get("data")
+    if not isinstance(envelope, dict):
+        raise RuntimeError("Vault KV response has no data envelope")
+    data = envelope.get("data")
+    metadata = envelope.get("metadata")
+    if not isinstance(data, dict) or not isinstance(metadata, dict):
+        raise RuntimeError("Vault KV response has an invalid shape")
+    version = metadata.get("version")
+    if not isinstance(version, int) or version < 1:
+        raise RuntimeError("Vault KV response has no version")
+    updated = dict(data)
+    changed: list[str] = []
+    for field, (path, required) in CREDENTIALS.items():
+        value = _credential_document(path, required)
+        if value is not None and value != data.get(field):
+            updated[field] = value
+            changed.append(field)
+    if changed:
+        _request(
+            "POST",
+            SECRET_ENDPOINT,
+            {"options": {"cas": version}, "data": updated},
+            token=token,
+        )
+    return changed
+
+
+def main() -> int:
+    """Continuously persist refresh-token rotation without exposing values."""
+    interval = max(30, int(os.environ.get("HERMES_CREDENTIAL_SYNC_INTERVAL", "60")))
+    while True:
+        try:
+            token = _login()
+            changed = sync_once(token)
+            if changed:
+                print(
+                    "Persisted refreshed runtime credentials: " + ", ".join(changed),
+                    flush=True,
+                )
+        except (OSError, RuntimeError, HTTPError, URLError, ValueError) as error:
+            print(
+                f"Runtime credential sync deferred: {type(error).__name__}",
+                flush=True,
+            )
+        time.sleep(interval)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/services/hermes/scripts/telegram_media_server.py b/services/hermes/scripts/telegram_media_server.py
index 2d905053..2efc54c0 100644
--- a/services/hermes/scripts/telegram_media_server.py
+++ b/services/hermes/scripts/telegram_media_server.py
@@ -23,12 +23,11 @@ class MediaPathError(ValueError):
 
 
 def read_relay_key(path: Path) -> str:
-    """Read the shared relay key from the tenant's private environment file."""
-    for line in path.read_text(encoding="utf-8").splitlines():
-        key, separator, value = line.partition("=")
-        if separator and key.strip() == "API_SERVER_KEY" and value.strip():
-            return value.strip()
-    raise RuntimeError("tenant relay key is unavailable")
+    """Read the shared relay key from one runtime-only secret file."""
+    value = path.read_text(encoding="utf-8").strip()
+    if not value:
+        raise RuntimeError("tenant relay key is unavailable")
+    return value
 
 
 def tenant_slot(pod_name: str) -> str:
@@ -179,7 +178,12 @@ class TenantMediaHandler(BaseHTTPRequestHandler):
 
 def main() -> None:
     """Start the tenant-local media handoff server."""
-    relay_key_path = Path(os.getenv("HERMES_MEDIA_RELAY_KEY_FILE", "/opt/data/.env"))
+    relay_key_path = Path(
+        os.getenv(
+            "HERMES_MEDIA_RELAY_KEY_FILE",
+            "/runtime-access/chat-relay-key",
+        )
+    )
     relay_key = read_relay_key(relay_key_path)
     slot = tenant_slot(os.getenv("POD_NAME", ""))
     server = TenantMediaServer(("0.0.0.0", 8788), relay_key, slot)
diff --git a/services/hermes/switchyard-deployment.yaml b/services/hermes/switchyard-deployment.yaml
index 10afe67b..48143682 100644
--- a/services/hermes/switchyard-deployment.yaml
+++ b/services/hermes/switchyard-deployment.yaml
@@ -22,7 +22,7 @@ spec:
       labels:
         app: hermes-switchyard
       annotations:
-        ai.bstein.dev/config-rev: "20260815-quality-escalation"
+        ai.bstein.dev/config-rev: "20260815-runtime-access-boundary"
         prometheus.io/scrape: "true"
         prometheus.io/port: "9005"
         prometheus.io/path: /metrics
diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml
index 3956eb30..d58b342d 100644
--- a/services/maintenance/apps/ariadne-deployment.yaml
+++ b/services/maintenance/apps/ariadne-deployment.yaml
@@ -38,6 +38,12 @@ spec:
           export GAME_MODE_HOOK_TOKEN="{{ .Data.data.game_mode_hook_token }}"
           {{- end }}
           {{ end }}
+          {{ with secret "kv/data/atlas/hermes/triage-api" }}
+          export ARIADNE_HERMES_API_KEY="{{ .Data.data.api_key }}"
+          {{ end }}
+          {{ with secret "kv/data/atlas/hermes/developer-gitea" }}
+          export ARIADNE_HERMES_GITEA_TOKEN="{{ .Data.data.token }}"
+          {{ end }}
           {{ with secret "kv/data/atlas/portal/atlas-portal-db" }}
           export PORTAL_DATABASE_URL="{{ .Data.data.PORTAL_DATABASE_URL }}"
           {{ end }}
@@ -489,12 +495,6 @@ spec:
               value: http://hermes.hermes.svc.cluster.local:8642
             - name: ARIADNE_HERMES_RUN_TIMEOUT_SECONDS
               value: "420"
-            - name: ARIADNE_HERMES_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: hermes-api-server-key
-                  key: api-key
-                  optional: true
             - name: ARIADNE_HERMES_CODE_ENABLED
               value: "true"
             - name: ARIADNE_HERMES_CODE_JOB
@@ -605,12 +605,6 @@ spec:
               value: metis=cmd/|pkg/,lesavka=server/|client/|common/,soteria=cmd/|internal/,bstein-dev-home=backend/|frontend/,ariadne=ariadne/,ananke=cmd/|internal/,pegasus=backend/|frontend/,atlasbot=atlasbot/
             - name: ARIADNE_HERMES_CODE_SUFFIXES
               value: metis=.go,lesavka=.rs,soteria=.go,bstein-dev-home=.py|.ts|.tsx|.js,ariadne=.py,ananke=.go,pegasus=.go|.ts|.tsx|.js,atlasbot=.py
-            - name: ARIADNE_HERMES_GITEA_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: hermes-gitea-token
-                  key: token
-                  optional: true
             - name: ARIADNE_TESTING_TRIAGE_MODEL_URL
               value: http://hermes-model-gate.hermes.svc.cluster.local:11434
             - name: ARIADNE_TESTING_TRIAGE_MODEL
diff --git a/services/vault/scripts/vault_k8s_auth_configure.sh b/services/vault/scripts/vault_k8s_auth_configure.sh
index f9545c96..73572e62 100644
--- a/services/vault/scripts/vault_k8s_auth_configure.sh
+++ b/services/vault/scripts/vault_k8s_auth_configure.sh
@@ -254,9 +254,11 @@ write_policy_and_role "health" "health" "health-vault-sync" \
 write_policy_and_role "game-stream" "game-stream" "game-stream-vault" \
   "game-stream/*" ""
 write_policy_and_role "hermes" "hermes" "hermes-vault,hermes-triage" \
-  "hermes/triage-oidc hermes/agent-tokens" ""
+  "hermes/triage-oidc hermes/agent-tokens hermes/triage-api" ""
 write_policy_and_role "hermes-agent" "hermes" "hermes-agent,hermes-switchyard" \
   "hermes/agent-oidc hermes/agent-tokens hermes/chat-telegram hermes/developer-keycloak hermes/developer-gitea hermes/developer-harbor hermes/developer-jenkins hermes/developer-ssh" ""
+write_policy_and_role "hermes-credential-sync" "hermes" "hermes-agent" \
+  "" "hermes/agent-tokens"
 write_policy_and_role "hermes-node-ssh" "hermes" "hermes-node-ssh-access" \
   "hermes/developer-ssh" ""
 write_policy_and_role "hermes-chat" "hermes" "hermes-chat" \
@@ -278,7 +280,7 @@ write_policy_and_role "cassandra-secrets" "cassandra" "cassandra-secrets-ensure"
 write_policy_and_role "cassandra-migration" "cassandra" "cassandra-db-migration" \
   "veles/veles-db cassandra/cassandra-db" ""
 write_policy_and_role "maintenance" "maintenance" "ariadne,maintenance-vault-sync,metis" \
-  "maintenance/ariadne-db maintenance/metis-oidc maintenance/soteria-oidc maintenance/metis-ssh-keys maintenance/metis-runtime portal/atlas-portal-db portal/bstein-dev-home-keycloak-admin mailu/mailu-db-secret mailu/mailu-initial-account-secret nextcloud/nextcloud-db nextcloud/nextcloud-admin health/wger-admin finance/firefly-secrets comms/mas-admin-client-runtime comms/atlasbot-credentials-runtime comms/synapse-db comms/synapse-admin vault/vault-oidc-config shared/harbor-pull shared/soteria-restic harbor/harbor-core" "" \
+  "maintenance/ariadne-db maintenance/metis-oidc maintenance/soteria-oidc maintenance/metis-ssh-keys maintenance/metis-runtime portal/atlas-portal-db portal/bstein-dev-home-keycloak-admin mailu/mailu-db-secret mailu/mailu-initial-account-secret nextcloud/nextcloud-db nextcloud/nextcloud-admin health/wger-admin finance/firefly-secrets comms/mas-admin-client-runtime comms/atlasbot-credentials-runtime comms/synapse-db comms/synapse-admin vault/vault-oidc-config shared/harbor-pull shared/soteria-restic harbor/harbor-core hermes/triage-api hermes/developer-gitea" "" \
   '
 path "kv/data/atlas/nodes/*" {
   capabilities = ["read"]
diff --git a/testing/tests/test_hermes_chat_quality.py b/testing/tests/test_hermes_chat_quality.py
index 16537a1d..d93b3a8d 100644
--- a/testing/tests/test_hermes_chat_quality.py
+++ b/testing/tests/test_hermes_chat_quality.py
@@ -173,6 +173,9 @@ def test_gateway_image_honors_ui_model_and_caps_reasoning():
     assert "Live worker activity" in activity
     assert "api.getSessionMessages" in activity
     assert "aria-live=\"polite\"" in activity
+    assert "role=\"log\"" in activity
+    assert "aria-busy={running && messages.length === 0}" in activity
+    assert 'detail.source !== "api_server"' not in activity
     assert "Poll-backed transcript; terminal rendering is not required." in activity
     assert "Open Telegram setup" in dockerfile
 
@@ -418,7 +421,8 @@ def test_chat_image_generation_uses_private_owner_broker():
     assert mounts["image-plugin"]["mountPath"] == (
         "/opt/hermes/plugins/image_gen/atlas-broker"
     )
-    assert mounts["provider-auth"].get("readOnly") is not True
+    assert mounts["runtime-access"]["mountPath"] == "/runtime-access"
+    assert "provider-auth" not in mounts
     assert not any(mount["name"] == "home" and "agent" in str(mount) for mount in hermes["volumeMounts"])
     env = {item["name"]: item["value"] for item in hermes["env"]}
     assert env["HERMES_IMAGE_BROKER_URL"].startswith("http://hermes-image-broker.")
@@ -597,7 +601,7 @@ def test_chat_reasoning_uses_switchyard_without_owner_credentials():
     statefulset = _documents(HERMES / "chat-statefulset.yaml")[0]
     assert statefulset["spec"]["template"]["metadata"]["annotations"][
         "ai.bstein.dev/config-rev"
-    ] == "20260812-stream-recovery"
+    ] == "20260815-runtime-access-boundary"
     pod_spec = statefulset["spec"]["template"]["spec"]
     patch_init = next(
         item for item in pod_spec["initContainers"]
@@ -1044,6 +1048,12 @@ def test_api_session_patch_accepts_parent_lineage(tmp_path: Path):
         + module.RUNS_BEFORE
         + "run body\n"
         + module.RUN_CLOSE_BEFORE
+        + module.EVENT_CALLBACK_SIGNATURE_BEFORE
+        + "callback docstring and push helper\n"
+        + module.EVENT_CALLBACK_BODY_BEFORE
+        + "tool start body\n"
+        + module.EVENT_CALLBACK_END_BEFORE
+        + module.EVENT_CALLBACK_CALL_BEFORE
         + "suffix\n",
         encoding="utf-8",
     )
@@ -1059,6 +1069,48 @@ def test_api_session_patch_accepts_parent_lineage(tmp_path: Path):
     assert "session_parent_conflict" in patched
     assert "db.reopen_session(session_id)" in patched
     assert 'db.end_session(session_id, f"api_run_{terminal_status}")' in patched
+    assert "def _record_run_activity(" in patched
+    assert '"_thinking": "Hermes is reasoning"' in patched
+    assert '"run.started": "Worker started"' in patched
+    assert '"run.completed": "Worker completed"' in patched
+    assert '"reasoning.available": "Hermes finished a reasoning step"' in patched
+    assert '"subagent.progress": "Nested worker progress"' in patched
+    assert "redact_sensitive_text" in patched
+    assert 'getattr(os, "O_NOFOLLOW", 0)' in patched
+    assert "os.fchmod(fd, 0o600)" in patched
+    assert "session_id=session_id" in patched
+    assert 'self._record_run_activity(session_id, "run.started")' in patched
+    assert 'detail = tool_name if event_type in {' in patched
+    assert 'if event_type == "subagent.tool"' in patched
+
+
+def test_web_session_activity_patch_projects_bounded_events(tmp_path: Path):
+    """The DOM transcript includes events without polluting agent history."""
+    module_path = HERMES / "scripts" / "patch_web_session_activity.py"
+    spec = importlib.util.spec_from_file_location("patch_web_activity", module_path)
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    source = tmp_path / "web_server.py"
+    destination = tmp_path / "patched.py"
+    source.write_text(
+        "prefix\n"
+        + module.HELPER_MARKER
+        + "    db = object()\n"
+        + module.MESSAGES_BEFORE
+        + "suffix\n",
+        encoding="utf-8",
+    )
+
+    module.patch(source, destination)
+    patched = destination.read_text(encoding="utf-8")
+
+    assert "def _run_activity_messages(" in patched
+    assert 'root = get_hermes_home() / "run-activity"' in patched
+    assert "path.stat().st_size > 600_000" in patched
+    assert "entries[-1_000:]" in patched
+    assert "*_run_activity_messages(sid)" in patched
+    assert "messages.sort(" in patched
 
 
 def test_legacy_api_sessions_are_nested_idempotently(tmp_path: Path):
@@ -1723,40 +1775,41 @@ def test_local_flux_uses_low_vram_offload_without_reducing_resolution():
     assert '"square": (1024, 1024)' in source
 
 
-def test_chat_auth_file_mount_survives_atomic_provider_refresh():
+def test_chat_auth_and_relay_are_pod_lifetime_only():
     statefulset = _documents(HERMES / "chat-statefulset.yaml")[0]
+    pod = statefulset["spec"]["template"]["spec"]
     containers = statefulset["spec"]["template"]["spec"]["containers"]
 
     for name in ("hermes", "webui"):
         container = next(item for item in containers if item["name"] == name)
         env = {item["name"]: item["value"] for item in container["env"]}
-        assert env["HERMES_AUTH_FILE"] == "/shared-auth/auth.json"
+        assert env["HERMES_AUTH_FILE"] == "/runtime-access/hermes-auth.json"
         mount = next(
-            item for item in container["volumeMounts"] if item["name"] == "provider-auth"
+            item for item in container["volumeMounts"] if item["name"] == "runtime-access"
         )
-        assert mount["mountPath"] == "/shared-auth"
+        assert mount["mountPath"] == "/runtime-access"
         assert "subPath" not in mount
 
     hermes_env = {
         item["name"]: item["value"]
         for item in next(item for item in containers if item["name"] == "hermes")["env"]
     }
-    hermes_mount = next(
-        item
-        for item in next(
-            item for item in containers if item["name"] == "hermes"
-        )["volumeMounts"]
-        if item["name"] == "provider-auth"
-    )
-    assert hermes_mount.get("readOnly") is not True
-    webui_mount = next(
-        item
-        for item in next(
-            item for item in containers if item["name"] == "webui"
-        )["volumeMounts"]
-        if item["name"] == "provider-auth"
-    )
-    assert webui_mount["readOnly"] is True
+    runtime = next(item for item in pod["volumes"] if item["name"] == "runtime-access")
+    assert runtime["emptyDir"] == {"medium": "Memory", "sizeLimit": "2Mi"}
+    assert not any(item["name"] == "provider-auth" for item in pod["volumes"])
+    init_command = next(
+        item for item in pod["initContainers"] if item["name"] == "init-config"
+    )["command"][2]
+    for key in (
+        "ANTHROPIC_API_KEY",
+        "API_SERVER_KEY",
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "GITEA_TOKEN",
+        "HERMES_IMAGE_BROKER_KEY",
+        "OPENAI_API_KEY",
+    ):
+        assert key in init_command
+    assert "printf 'API_SERVER_KEY=%s" not in init_command
     assert hermes_env["AGENT_BROWSER_EXECUTABLE_PATH"].endswith("/chrome-linux/headless_shell")
     assert "--no-sandbox" in hermes_env["AGENT_BROWSER_ARGS"]
 
diff --git a/testing/tests/test_hermes_cli_lanes.py b/testing/tests/test_hermes_cli_lanes.py
index 1f71b8d4..dc6ca7ee 100644
--- a/testing/tests/test_hermes_cli_lanes.py
+++ b/testing/tests/test_hermes_cli_lanes.py
@@ -802,16 +802,21 @@ def test_agent_refreshes_routes_after_restoring_cli_logins():
         "hermes_coordinator.py --once"
     )
     env = {item["name"]: item["value"] for item in configure["env"]}
-    assert env["HERMES_AUTH_FILE"] == "/shared-auth/auth.json"
+    assert env["HERMES_AUTH_FILE"] == "/runtime-access/hermes-auth.json"
     assert env["PYTHONPATH"] == "/opt/hermes"
     for name in ("bootstrap-coordinator", "configure-agent-clients"):
         route_env = {
             item["name"]: item["value"]
             for item in init_containers[name]["env"]
         }
-        assert route_env["CODEX_HOME"] == "/opt/data/home/.codex"
+        assert route_env["CODEX_HOME"] == "/runtime-access/codex"
+        assert route_env["CLAUDE_CONFIG_DIR"] == "/runtime-access/claude"
         assert "/opt/data/tools/bin" in route_env["PATH"]
 
+    assert "patch-web-session-activity" in init_containers
+    web_patch = init_containers["patch-web-session-activity"]
+    assert "/opt/coordinator/patch_web_session_activity.py" in web_patch["command"]
+
     containers = {
         item["name"]: item
         for item in deployment["spec"]["template"]["spec"]["containers"]
@@ -820,8 +825,18 @@ def test_agent_refreshes_routes_after_restoring_cli_logins():
         item["name"]: item["value"]
         for item in containers["model-steward"]["env"]
     }
-    assert steward_env["CODEX_HOME"] == "/opt/data/home/.codex"
+    assert steward_env["CODEX_HOME"] == "/runtime-access/codex"
+    assert steward_env["CLAUDE_CONFIG_DIR"] == "/runtime-access/claude"
     assert "/opt/data/tools/bin" in steward_env["PATH"]
+    hermes_mounts = {
+        (item["name"], item["mountPath"], item.get("subPath"))
+        for item in containers["hermes"]["volumeMounts"]
+    }
+    assert (
+        "web-server-patch",
+        "/opt/hermes/hermes_cli/web_server.py",
+        "web_server.py",
+    ) in hermes_mounts
 
 
 def test_flux_health_checks_follow_the_owner_oauth_sidecar():
@@ -941,14 +956,17 @@ def test_owner_agent_has_pinned_dedicated_node_ssh_access():
         if item["name"] == "init-config"
     )
     command = init["command"][2]
-    assert "cp /vault/secrets/node-ssh-config /opt/data/home/.ssh/config" in command
+    assert "ln -s /runtime-access/node-ssh-config /opt/data/home/.ssh/config" in command
     assert (
-        "cp /vault/secrets/node-ssh-known-hosts /opt/data/home/.ssh/known_hosts"
+        "ln -s /runtime-access/node-ssh-known-hosts /opt/data/home/.ssh/known_hosts"
         in command
     )
     assert "ln -s home/.ssh /opt/data/.ssh" in command
     assert "chmod 0700 /opt/data/home/.ssh" in command
-    assert "chmod 0600 /opt/data/home/.ssh/id_ed25519_atlas_nodes" in command
+    assert (
+        "ln -s /runtime-access/node-ssh-private-key "
+        "/opt/data/home/.ssh/id_ed25519_atlas_nodes"
+    ) in command
 
     config = yaml.safe_load((HERMES / "agent-configmap.yaml").read_text())["data"]
     assert "ssh_config" not in config
diff --git a/testing/tests/test_hermes_coordinator.py b/testing/tests/test_hermes_coordinator.py
index eeef6753..bc2d5b5f 100644
--- a/testing/tests/test_hermes_coordinator.py
+++ b/testing/tests/test_hermes_coordinator.py
@@ -207,6 +207,15 @@ def test_configure_routes_keeps_every_profile_on_switchyard(tmp_path: Path):
         "GIT_ASKPASS=/opt/coordinator/gitea_askpass.sh\n",
         encoding="utf-8",
     )
+    stale_profile = tmp_path / "profiles/codex-high"
+    stale_profile.mkdir(parents=True)
+    (stale_profile / ".env").write_text(
+        "CLAUDE_CODE_OAUTH_TOKEN=stale-claude\n"
+        "GITEA_TOKEN=stale-gitea\n"
+        "HERMES_IMAGE_BROKER_KEY=stale-relay\n"
+        "USER_SETTING=preserve\n",
+        encoding="utf-8",
+    )
     codex = routing.Catalog(
         "openai-codex", ["gpt-5.6-sol", "gpt-5.6-terra"], True, True, "connected"
     )
@@ -253,9 +262,11 @@ def test_configure_routes_keeps_every_profile_on_switchyard(tmp_path: Path):
     )
 
     profile_env = (tmp_path / "profiles/codex-high/.env").read_text(encoding="utf-8")
-    assert "CLAUDE_CODE_OAUTH_TOKEN=claude-secret" in profile_env
-    assert "GITEA_TOKEN=gitea-secret" in profile_env
+    assert "CLAUDE_CODE_OAUTH_TOKEN" not in profile_env
+    assert "GITEA_TOKEN" not in profile_env
+    assert "HERMES_IMAGE_BROKER_KEY" not in profile_env
     assert "API_SERVER_KEY" not in profile_env
+    assert "USER_SETTING=preserve" in profile_env
     assert "claude-secret" not in json.dumps(routes)
     assert (tmp_path / "profiles/codex-high/.env").stat().st_mode & 0o777 == 0o600
 
@@ -411,10 +422,15 @@ def test_cassandra_sync_repairs_existing_worktree(
     (workspace / ".git").mkdir(parents=True)
     monkeypatch.setattr(coordinator, "CASSANDRA_BASE_PATH", workspace)
     monkeypatch.setattr(coordinator.shutil, "which", lambda _name: "/usr/bin/git")
+    token_path = tmp_path / "gitea-token"
+    token_path.write_text("configured\n", encoding="utf-8")
+    monkeypatch.setenv("HERMES_GITEA_TOKEN_FILE", str(token_path))
     commands: list[list[str]] = []
+    environments: list[dict[str, str]] = []
 
-    def run(command, **_kwargs):
+    def run(command, **kwargs):
         commands.append(command)
+        environments.append(kwargs.get("env", {}))
         if command[-2:] == ["get-url", "origin"]:
             return subprocess.CompletedProcess(
                 command, 0 if current_remote else 2, stdout=f"{current_remote or ''}\n"
@@ -422,10 +438,11 @@ def test_cassandra_sync_repairs_existing_worktree(
         return subprocess.CompletedProcess(command, 0)
 
     monkeypatch.setattr(coordinator.subprocess, "run", run)
-    assert coordinator.sync_cassandra_repo({"GITEA_TOKEN": "configured"}) == "ready"
+    assert coordinator.sync_cassandra_repo({"GITEA_TOKEN": "must-not-pass"}) == "ready"
     repair_commands = [command for command in commands if repair_action in command]
     assert bool(repair_commands) is bool(repair_action)
     assert commands[-1][-4:] == ["fetch", "--quiet", "--prune", "origin"]
+    assert all("GITEA_TOKEN" not in environment for environment in environments)
 
 
 def test_cassandra_sync_repairs_origin_without_token(tmp_path: Path, monkeypatch):
diff --git a/testing/tests/test_hermes_runtime_access.py b/testing/tests/test_hermes_runtime_access.py
new file mode 100644
index 00000000..ff1e9c6e
--- /dev/null
+++ b/testing/tests/test_hermes_runtime_access.py
@@ -0,0 +1,276 @@
+"""Contracts for Hermes' Vault-only runtime access boundary."""
+
+from __future__ import annotations
+
+import importlib.util
+import json
+import sys
+from pathlib import Path
+
+import yaml
+
+
+ROOT = Path(__file__).parents[2]
+HERMES = ROOT / "services" / "hermes"
+SCRIPTS = HERMES / "scripts"
+
+
+def _load(name: str):
+    spec = importlib.util.spec_from_file_location(name, SCRIPTS / f"{name}.py")
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_agent_runtime_stage_keeps_credentials_in_memory(tmp_path: Path, monkeypatch):
+    stage = _load("stage_runtime_access")
+    vault = tmp_path / "vault"
+    runtime = tmp_path / "runtime"
+    home = tmp_path / "home"
+    vault.mkdir()
+    (home / ".claude").mkdir(parents=True)
+    (home / ".claude" / "backups").mkdir()
+    (home / ".codex" / "skills").mkdir(parents=True)
+    (home / ".codex" / "sessions").mkdir()
+    (home / ".claude" / "settings.json").write_text("{}\n", encoding="utf-8")
+    (home / ".claude" / "backups" / "credentials.json").write_text(
+        "do-not-link\n", encoding="utf-8"
+    )
+    values = {
+        "agent-api-key": "agent-key",
+        "chat-relay-key": "relay-key",
+        "gitea-token": "gitea-key",
+        "gitea-username": "hermes-automation",
+        "node-ssh-private-key": "private-key",
+        "node-ssh-config": "host-config",
+        "node-ssh-known-hosts": "known-hosts",
+        "claude-credentials": json.dumps(
+            {"claudeAiOauth": {"refreshToken": "claude-refresh"}}
+        ),
+        "codex-auth": json.dumps({"tokens": {"refresh_token": "codex-refresh"}}),
+    }
+    for name, value in values.items():
+        (vault / name).write_text(value + "\n", encoding="utf-8")
+    monkeypatch.setattr(stage, "VAULT_ROOT", vault)
+    monkeypatch.setattr(stage, "RUNTIME_ROOT", runtime)
+    monkeypatch.setattr(stage, "PERSISTENT_HOME", home)
+    monkeypatch.setattr(stage.os, "chown", lambda *_args: None)
+
+    stage.stage_agent()
+
+    assert (runtime / "claude/.credentials.json").stat().st_mode & 0o777 == 0o600
+    assert (runtime / "codex/auth.json").stat().st_mode & 0o777 == 0o600
+    assert (runtime / "claude/settings.json").is_symlink()
+    assert (runtime / "codex/skills").is_symlink()
+    assert not (runtime / "claude/backups").exists()
+    assert not (runtime / "codex/sessions").exists()
+    auth = json.loads((runtime / "hermes-auth.json").read_text(encoding="utf-8"))
+    assert auth == {"version": 1, "providers": {}, "credential_pool": {}}
+
+
+def test_invalid_runtime_json_is_removed(tmp_path: Path, monkeypatch):
+    stage = _load("stage_runtime_access")
+    vault = tmp_path / "vault"
+    runtime = tmp_path / "runtime"
+    vault.mkdir()
+    runtime.mkdir()
+    (vault / "credential").write_text("not-json\n", encoding="utf-8")
+    monkeypatch.setattr(stage, "VAULT_ROOT", vault)
+    monkeypatch.setattr(stage.os, "chown", lambda *_args: None)
+    destination = runtime / "credential.json"
+
+    try:
+        stage._validated_json("credential", destination, ("token",))
+    except json.JSONDecodeError:
+        pass
+    else:
+        raise AssertionError("invalid credential JSON should fail staging")
+
+    assert not destination.exists()
+
+
+def test_runtime_refresh_sync_uses_cas_and_preserves_other_fields(
+    tmp_path: Path, monkeypatch
+):
+    sync = _load("sync_runtime_credentials")
+    claude = tmp_path / "claude.json"
+    codex = tmp_path / "codex.json"
+    claude.write_text(
+        json.dumps({"claudeAiOauth": {"refreshToken": "new-claude"}}),
+        encoding="utf-8",
+    )
+    codex.write_text(
+        json.dumps({"tokens": {"refresh_token": "new-codex"}}),
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(
+        sync,
+        "CREDENTIALS",
+        {
+            "claude_credentials_json": (
+                claude,
+                ("claudeAiOauth", "refreshToken"),
+            ),
+            "codex_auth_json": (codex, ("tokens", "refresh_token")),
+        },
+    )
+    writes = []
+
+    def request(method, path, payload=None, *, token=""):
+        assert token == "vault-token"
+        if method == "GET":
+            return {
+                "data": {
+                    "data": {
+                        "claude_credentials_json": "old",
+                        "codex_auth_json": "old",
+                        "agent_api_key": "preserve-me",
+                    },
+                    "metadata": {"version": 7},
+                }
+            }
+        writes.append((path, payload))
+        return {}
+
+    monkeypatch.setattr(sync, "_request", request)
+
+    assert sync.sync_once("vault-token") == [
+        "claude_credentials_json",
+        "codex_auth_json",
+    ]
+    assert writes[0][1]["options"] == {"cas": 7}
+    assert writes[0][1]["data"]["agent_api_key"] == "preserve-me"
+
+
+def test_subprocess_patches_strip_and_redact_runtime_credentials(tmp_path: Path):
+    boundary = _load("patch_subprocess_secret_boundary")
+    process = _load("patch_process_output_redaction")
+    local_source = tmp_path / "local.py"
+    local_output = tmp_path / "patched-local.py"
+    local_source.write_text("prefix\n" + boundary.BEFORE + "suffix\n", encoding="utf-8")
+    boundary.patch(local_source, local_output)
+    patched_local = local_output.read_text(encoding="utf-8")
+    for name in (
+        "API_SERVER_KEY",
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "GITEA_TOKEN",
+        "HERMES_IMAGE_BROKER_KEY",
+    ):
+        assert f'"{name}"' in patched_local
+
+    process_source = tmp_path / "process.py"
+    process_output = tmp_path / "patched-process.py"
+    process_source.write_text(
+        "prefix\n" + process.BEFORE + "suffix\n", encoding="utf-8"
+    )
+    process.patch(process_source, process_output)
+    assert "code_file=False" in process_output.read_text(encoding="utf-8")
+
+
+def test_manifests_never_seed_access_material_into_persistent_env():
+    agent = yaml.safe_load((HERMES / "agent-deployment.yaml").read_text())
+    chat = yaml.safe_load((HERMES / "chat-statefulset.yaml").read_text())
+    triage = yaml.safe_load((HERMES / "deployment.yaml").read_text())
+    for workload in (agent, chat, triage):
+        pod = workload["spec"]["template"]["spec"]
+        runtime = next(item for item in pod["volumes"] if item["name"] == "runtime-access")
+        assert runtime["emptyDir"]["medium"] == "Memory"
+        assert not any(item["name"] == "provider-auth" for item in pod["volumes"])
+        init = next(item for item in pod["initContainers"] if item["name"] == "init-config")
+        command = init["command"][2]
+        for key in (
+            "ANTHROPIC_API_KEY",
+            "API_SERVER_KEY",
+            "CLAUDE_API_KEY",
+            "CLAUDE_CODE_OAUTH_TOKEN",
+            "GITEA_TOKEN",
+            "HERMES_IMAGE_BROKER_KEY",
+            "OPENAI_API_KEY",
+        ):
+            assert f"printf '{key}=" not in command
+            assert f"upsert_env {key}" not in command
+
+    annotations = agent["spec"]["template"]["metadata"]["annotations"]
+    agent_runtime = next(
+        item
+        for item in agent["spec"]["template"]["spec"]["volumes"]
+        if item["name"] == "runtime-access"
+    )
+    assert agent_runtime["emptyDir"] == {
+        "medium": "Memory",
+        "sizeLimit": "128Mi",
+    }
+    assert "vault.hashicorp.com/agent-inject-secret-anthropic-token" not in annotations
+    assert annotations["vault.hashicorp.com/agent-inject-secret-claude-credentials"] == (
+        "kv/data/atlas/hermes/agent-tokens"
+    )
+    assert annotations["vault.hashicorp.com/agent-inject-secret-codex-auth"] == (
+        "kv/data/atlas/hermes/agent-tokens"
+    )
+    credential_sync = next(
+        item
+        for item in agent["spec"]["template"]["spec"]["containers"]
+        if item["name"] == "credential-sync"
+    )
+    assert {
+        (item["mountPath"], item.get("subPath"))
+        for item in credential_sync["volumeMounts"]
+        if item["name"] == "runtime-access"
+    } == {
+        ("/runtime-access/claude", "claude"),
+        ("/runtime-access/codex", "codex"),
+    }
+    triage_annotations = triage["spec"]["template"]["metadata"]["annotations"]
+    assert "vault.hashicorp.com/agent-inject-secret-anthropic-token" not in (
+        triage_annotations
+    )
+    assert triage_annotations[
+        "vault.hashicorp.com/agent-inject-secret-triage-api-key"
+    ] == "kv/data/atlas/hermes/triage-api"
+    askpass = (SCRIPTS / "gitea_askpass.sh").read_text(encoding="utf-8")
+    assert "/runtime-access/gitea-token" in askpass
+    assert "GITEA_TOKEN" not in askpass
+
+
+def test_chat_media_reads_one_raw_runtime_secret(tmp_path: Path):
+    module = _load("telegram_media_server")
+    secret = tmp_path / "relay"
+    secret.write_text("relay-value\n", encoding="utf-8")
+    assert module.read_relay_key(secret) == "relay-value"
+
+
+def test_ariadne_receives_the_triage_key_directly_from_vault():
+    maintenance = ROOT / "services" / "maintenance" / "apps" / "ariadne-deployment.yaml"
+    deployment = yaml.safe_load(maintenance.read_text(encoding="utf-8"))
+    annotations = deployment["spec"]["template"]["metadata"]["annotations"]
+    template = annotations["vault.hashicorp.com/agent-inject-template-ariadne-env.sh"]
+    assert 'secret "kv/data/atlas/hermes/triage-api"' in template
+    assert 'export ARIADNE_HERMES_API_KEY="{{ .Data.data.api_key }}"' in template
+    assert 'secret "kv/data/atlas/hermes/developer-gitea"' in template
+    assert 'export ARIADNE_HERMES_GITEA_TOKEN="{{ .Data.data.token }}"' in template
+    container = deployment["spec"]["template"]["spec"]["containers"][0]
+    assert not any(item["name"] == "ARIADNE_HERMES_API_KEY" for item in container["env"])
+    assert not any(
+        item["name"] == "ARIADNE_HERMES_GITEA_TOKEN" for item in container["env"]
+    )
+
+    vault_policy = (
+        ROOT / "services" / "vault" / "scripts" / "vault_k8s_auth_configure.sh"
+    ).read_text(encoding="utf-8")
+    assert '"hermes/triage-oidc hermes/agent-tokens hermes/triage-api"' in vault_policy
+    assert 'hermes-credential-sync' in vault_policy
+    assert 'hermes/triage-api hermes/developer-gitea' in vault_policy
+
+
+def test_gitea_bootstrap_reuses_valid_vault_tokens():
+    bootstrap = (
+        ROOT / "services" / "gitea" / "scripts" / "gitea_atlas_identity_ensure.sh"
+    ).read_text(encoding="utf-8")
+
+    assert "vault_login\n\nreconciler_token=$(vault_read_field" in bootstrap
+    assert 'if ! token_is_valid "${reconciler_user}"' in bootstrap
+    assert 'if ! token_is_valid "${hermes_user}"' in bootstrap
+    assert bootstrap.count('generate_token "${reconciler_user}"') == 1
+    assert bootstrap.count('generate_token "${hermes_user}"') == 1