refactor(hermes): rename the owner agent host to worker.bstein.dev

Introduce worker.bstein.dev as the canonical hostname for the owner-only Hermes coordinator, previously agent.hermes.bstein.dev. The old host is deliberately kept alive. CoreDNS, both agent Ingresses and the hermes-sites certificate now serve BOTH names, so merging this cannot take away the endpoint the operator uses to reach the coordinator. Retiring agent.hermes.bstein.dev is a separate, separately scheduled change. No redirect middleware is added. What switches to the new host: - HERMES_DASHBOARD_PUBLIC_URL and the oauth2-proxy --redirect-url - the Keycloak hermes-agent-proxy rootUrl - operator docs, skills, the ZAP baseline target and the triage monitor default What stays dual-homed until retirement: - CoreDNS hosts entry, both agent Ingress rules, certificate SANs - API_SERVER_CORS_ORIGINS (now a comma-separated pair) - the Keycloak redirect URIs, web origins and post-logout origins, so a rollback only needs the oauth2-proxy --redirect-url reverted and does not require re-running the ensure job ensure_proxy_client now takes optional trailing legacy URLs; called with a single URL it emits the identical payload as before, so the chat and triage clients are unaffected. The ensure Job is bumped to -11 so Flux re-runs it; login on the new host fails until that Job completes. Because the session and CSRF cookies use the __Host- prefix they are bound to one origin, so a fresh login must start on worker.bstein.dev and existing sessions do not carry over -- re-login is required after rollout. Knowledge catalogs and diagrams regenerated with `make knowledge`.
2026-08-21 10:00:15 +00:00 · 2026-08-21 10:00:15 +00:00 · 92ec0c0297
commit 92ec0c0297
parent 26705c1f66
26 changed files with 239 additions and 32 deletions
--- a/infrastructure/core/coredns-custom.yaml
+++ b/infrastructure/core/coredns-custom.yaml
@ -47,6 +47,7 @@ data:
        192.168.22.9 tasks.bstein.dev
        192.168.22.9 triage.bstein.dev
        192.168.22.9 vault.bstein.dev
+        192.168.22.9 worker.bstein.dev
        fallthrough
      }
    }
--- a/knowledge/catalog/atlas-summary.json
+++ b/knowledge/catalog/atlas-summary.json
@ -1,7 +1,7 @@
 {
  "counts": {
    "helmrelease_host_hints": 23,
-    "http_endpoints": 61,
+    "http_endpoints": 63,
    "services": 98,
    "workloads": 130
  }
--- a/knowledge/catalog/atlas.json
+++ b/knowledge/catalog/atlas.json
@ -5510,6 +5510,46 @@
        "name": "wolf",
        "source": "game-stream"
      }
+    },
+    {
+      "host": "worker.bstein.dev",
+      "path": "/",
+      "backend": {
+        "namespace": "hermes",
+        "service": "oauth2-proxy-hermes-agent",
+        "port": "http",
+        "workloads": [
+          {
+            "kind": "Deployment",
+            "name": "hermes-agent"
+          }
+        ]
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "hermes-agent-dashboard",
+        "source": "hermes"
+      }
+    },
+    {
+      "host": "worker.bstein.dev",
+      "path": "/terminal",
+      "backend": {
+        "namespace": "hermes",
+        "service": "oauth2-proxy-hermes-agent",
+        "port": "http",
+        "workloads": [
+          {
+            "kind": "Deployment",
+            "name": "hermes-agent"
+          }
+        ]
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "hermes-agent-terminal",
+        "source": "hermes"
+      }
    }
  ],
  "helmrelease_host_hints": {
--- a/knowledge/catalog/atlas.yaml
+++ b/knowledge/catalog/atlas.yaml
@ -3585,6 +3585,28 @@ http_endpoints:
    kind: Ingress
    name: wolf
    source: game-stream
+- host: worker.bstein.dev
+  path: /
+  backend:
+    namespace: hermes
+    service: oauth2-proxy-hermes-agent
+    port: http
+    workloads: *id001
+  via:
+    kind: Ingress
+    name: hermes-agent-dashboard
+    source: hermes
+- host: worker.bstein.dev
+  path: /terminal
+  backend:
+    namespace: hermes
+    service: oauth2-proxy-hermes-agent
+    port: http
+    workloads: *id001
+  via:
+    kind: Ingress
+    name: hermes-agent-terminal
+    source: hermes
 helmrelease_host_hints:
  cert-manager:cert-manager/cert-manager:
  - atlas.bstein.dev
--- a/knowledge/catalog/runbooks.json
+++ b/knowledge/catalog/runbooks.json
--- a/knowledge/diagrams/atlas-http.mmd
+++ b/knowledge/diagrams/atlas-http.mmd
@ -194,6 +194,8 @@ flowchart LR
  host_wolf_bstein_dev --> svc_game_stream_oauth2_proxy_wolf
  wl_game_stream_oauth2_proxy_wolf["game-stream/oauth2-proxy-wolf (Deployment)"]
  svc_game_stream_oauth2_proxy_wolf --> wl_game_stream_oauth2_proxy_wolf
+  host_worker_bstein_dev["worker.bstein.dev"]
+  host_worker_bstein_dev --> svc_hermes_oauth2_proxy_hermes_agent

  subgraph bstein_dev_home[bstein-dev-home]
    svc_bstein_dev_home_bstein_dev_home_frontend
--- a/knowledge/runbooks/hermes-triage-demo.md
+++ b/knowledge/runbooks/hermes-triage-demo.md
@ -99,7 +99,7 @@ in-process call removed a whole pod launch from the critical path.
  `hermes-demo-test-<N>` (failed) and `hermes-demo-repair-<N>` (succeeded);
  both TTL-clean after 1 h.
 - Hermes side: the run appears in the dashboard at
-  `https://agent.hermes.bstein.dev` (session/run history).
+  `https://worker.bstein.dev` (session/run history).
 - Escalation path: alert `HermesTriageHumanRequired` in vmalert
  (`vmalert-atlas-availability` deployment, 1 m interval, `for: 2m`)
  fires to Alertmanager for any `human_required` incident. Gauges are
--- a/scripts/ops/hermes_triage_monitor.py
+++ b/scripts/ops/hermes_triage_monitor.py
@ -40,7 +40,7 @@ JENKINS = os.environ.get("JENKINS_URL", "https://ci.bstein.dev")
 GITEA = os.environ.get("GITEA_URL", "https://scm.bstein.dev")
 CODE_REPO_OWNER = os.environ.get("CODE_REPO_OWNER", "atlas")
 GRAFANA = os.environ.get("GRAFANA_URL", "https://metrics.bstein.dev")
-HERMES_UI = os.environ.get("HERMES_URL", "https://agent.hermes.bstein.dev")
+HERMES_UI = os.environ.get("HERMES_URL", "https://worker.bstein.dev")
 POLL_SECONDS = 6

 # `--filter <text>` restricts the monitor to incidents whose id contains that
--- a/services/comms/knowledge/catalog/atlas-summary.json
+++ b/services/comms/knowledge/catalog/atlas-summary.json
@ -1,7 +1,7 @@
 {
  "counts": {
    "helmrelease_host_hints": 23,
-    "http_endpoints": 61,
+    "http_endpoints": 63,
    "services": 98,
    "workloads": 130
  }
--- a/services/comms/knowledge/catalog/atlas.json
+++ b/services/comms/knowledge/catalog/atlas.json
@ -5510,6 +5510,46 @@
        "name": "wolf",
        "source": "game-stream"
      }
+    },
+    {
+      "host": "worker.bstein.dev",
+      "path": "/",
+      "backend": {
+        "namespace": "hermes",
+        "service": "oauth2-proxy-hermes-agent",
+        "port": "http",
+        "workloads": [
+          {
+            "kind": "Deployment",
+            "name": "hermes-agent"
+          }
+        ]
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "hermes-agent-dashboard",
+        "source": "hermes"
+      }
+    },
+    {
+      "host": "worker.bstein.dev",
+      "path": "/terminal",
+      "backend": {
+        "namespace": "hermes",
+        "service": "oauth2-proxy-hermes-agent",
+        "port": "http",
+        "workloads": [
+          {
+            "kind": "Deployment",
+            "name": "hermes-agent"
+          }
+        ]
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "hermes-agent-terminal",
+        "source": "hermes"
+      }
    }
  ],
  "helmrelease_host_hints": {
--- a/services/comms/knowledge/catalog/atlas.yaml
+++ b/services/comms/knowledge/catalog/atlas.yaml
@ -3585,6 +3585,28 @@ http_endpoints:
    kind: Ingress
    name: wolf
    source: game-stream
+- host: worker.bstein.dev
+  path: /
+  backend:
+    namespace: hermes
+    service: oauth2-proxy-hermes-agent
+    port: http
+    workloads: *id001
+  via:
+    kind: Ingress
+    name: hermes-agent-dashboard
+    source: hermes
+- host: worker.bstein.dev
+  path: /terminal
+  backend:
+    namespace: hermes
+    service: oauth2-proxy-hermes-agent
+    port: http
+    workloads: *id001
+  via:
+    kind: Ingress
+    name: hermes-agent-terminal
+    source: hermes
 helmrelease_host_hints:
  cert-manager:cert-manager/cert-manager:
  - atlas.bstein.dev
--- a/services/comms/knowledge/catalog/runbooks.json
+++ b/services/comms/knowledge/catalog/runbooks.json
--- a/services/comms/knowledge/diagrams/atlas-http.mmd
+++ b/services/comms/knowledge/diagrams/atlas-http.mmd
@ -194,6 +194,8 @@ flowchart LR
  host_wolf_bstein_dev --> svc_game_stream_oauth2_proxy_wolf
  wl_game_stream_oauth2_proxy_wolf["game-stream/oauth2-proxy-wolf (Deployment)"]
  svc_game_stream_oauth2_proxy_wolf --> wl_game_stream_oauth2_proxy_wolf
+  host_worker_bstein_dev["worker.bstein.dev"]
+  host_worker_bstein_dev --> svc_hermes_oauth2_proxy_hermes_agent

  subgraph bstein_dev_home[bstein-dev-home]
    svc_bstein_dev_home_bstein_dev_home_frontend
--- a/services/comms/knowledge/runbooks/hermes-triage-demo.md
+++ b/services/comms/knowledge/runbooks/hermes-triage-demo.md
@ -99,7 +99,7 @@ in-process call removed a whole pod launch from the critical path.
  `hermes-demo-test-<N>` (failed) and `hermes-demo-repair-<N>` (succeeded);
  both TTL-clean after 1 h.
 - Hermes side: the run appears in the dashboard at
-  `https://agent.hermes.bstein.dev` (session/run history).
+  `https://worker.bstein.dev` (session/run history).
 - Escalation path: alert `HermesTriageHumanRequired` in vmalert
  (`vmalert-atlas-availability` deployment, 1 m interval, `for: 2m`)
  fires to Alertmanager for any `human_required` incident. Gauges are
--- a/services/hermes/NOTES.md
+++ b/services/hermes/NOTES.md
@ -5,7 +5,7 @@ This is the mental model and demonstration script for the operator instance at
 consumer instance at `chat.bstein.dev` is intentionally separate and is not the
 place to perform infrastructure triage.

-`agent.hermes.bstein.dev` is the owner-only engineering control plane. Its root
+`worker.bstein.dev` is the owner-only engineering control plane. Its root
 serves the stock Hermes dashboard, including embedded chat/TUI and the native
 sessions, files, models, logs, Kanban, skills, plugins, MCP, profiles, and
 configuration surfaces. `/terminal/` remains the raw full-screen TUI. The
@ -143,7 +143,7 @@ off. The final TypeScript build, Python compile, and source assertions remain
 mandatory, so an omitted or drifted replay fails before any image can pass
 release verification.

-From agent.hermes, trigger that one fixed job with:
+From worker.bstein.dev, trigger that one fixed job with:

 ```sh
 jenkins_image_build_trigger.py '<reviewed full main commit>'
--- a/services/hermes/agent-certificate.yaml
+++ b/services/hermes/agent-certificate.yaml
@ -10,6 +10,9 @@ spec:
    kind: ClusterIssuer
    name: letsencrypt
  dnsNames:
+    # worker.bstein.dev is the canonical owner-agent host. agent.hermes.bstein.dev
+    # stays on the certificate until the old host is retired in a separate change.
    - agent.hermes.bstein.dev
    - chat.bstein.dev
    - triage.bstein.dev
+    - worker.bstein.dev
--- a/services/hermes/agent-configmap.yaml
+++ b/services/hermes/agent-configmap.yaml
@ -142,7 +142,7 @@ data:
        - "*git clean -f*"

    dashboard:
-      public_url: https://agent.hermes.bstein.dev
+      public_url: https://worker.bstein.dev

    display:
      compact: true
@ -174,7 +174,7 @@ data:
      backup_keep: 5
      non_interactive_local_changes: stash
  SOUL.md: |
-    You are Brad's private Hermes coordinator at agent.hermes.bstein.dev. Turn
+    You are Brad's private Hermes coordinator at worker.bstein.dev. Turn
    objectives into organized, reviewable delivery without making Brad manage
    model names, terminals, or provider capacity.

@ -408,7 +408,7 @@ data:
  START-HERE.md: |
    # Agent Hermes

-    The authenticated root of agent.hermes.bstein.dev opens Hermes' stock
+    The authenticated root of worker.bstein.dev opens Hermes' stock
    dashboard with embedded chat/TUI, sessions, files, models, logs, Kanban,
    skills, plugins, MCP, profiles, and configuration. `/terminal/` opens the
    raw full-screen Hermes TUI. Give Hermes
--- a/services/hermes/agent-deployment.yaml
+++ b/services/hermes/agent-deployment.yaml
@ -624,14 +624,15 @@ spec:
            - {name: HERMES_DASHBOARD_HOST, value: 127.0.0.1}
            - {name: HERMES_DASHBOARD_PORT, value: "9119"}
            - {name: HERMES_DASHBOARD_FILES_ROOT, value: /opt/data/workspace}
-            - {name: HERMES_DASHBOARD_PUBLIC_URL, value: https://agent.hermes.bstein.dev}
+            - {name: HERMES_DASHBOARD_PUBLIC_URL, value: https://worker.bstein.dev}
            - {name: HERMES_TUI_AGENT_INIT_TIMEOUT_S, value: "180"}
            - {name: HERMES_STREAM_STALE_TIMEOUT, value: "600"}
            - {name: HERMES_API_CALL_STALE_TIMEOUT, value: "600"}
            - {name: API_SERVER_ENABLED, value: "true"}
            - {name: API_SERVER_HOST, value: 0.0.0.0}
            - {name: API_SERVER_PORT, value: "8642"}
-            - {name: API_SERVER_CORS_ORIGINS, value: https://agent.hermes.bstein.dev}
+            # Comma-separated; the legacy origin stays until agent.hermes.bstein.dev is retired.
+            - {name: API_SERVER_CORS_ORIGINS, value: "https://worker.bstein.dev,https://agent.hermes.bstein.dev"}
            - {name: HERMES_MEDIA_DELIVERY_STRICT, value: "1"}
            - {name: HERMES_MEDIA_ALLOW_DIRS, value: /opt/data/workspace}
            - {name: HERMES_AUTO_ROUTER_PROFILE, value: agent}
@ -694,7 +695,11 @@ spec:
          args:
            - --provider=oidc
            - --config=/vault/secrets/oidc-config
-            - --redirect-url=https://agent.hermes.bstein.dev/oauth2/callback
+            # Single canonical callback. The __Host- cookie prefix below binds both
+            # the session and the CSRF cookie to one host, so a fresh login must be
+            # started on worker.bstein.dev; agent.hermes.bstein.dev keeps serving
+            # already-authenticated sessions until it is retired separately.
+            - --redirect-url=https://worker.bstein.dev/oauth2/callback
            - --oidc-issuer-url=https://sso.bstein.dev/realms/atlas
            - --user-id-claim=sub
            - --oidc-groups-claim=groups
--- a/services/hermes/agent-ingress.yaml
+++ b/services/hermes/agent-ingress.yaml
@ -6,8 +6,10 @@ metadata:
  namespace: hermes
 spec:
  redirectRegex:
-    regex: ^https://agent\.hermes\.bstein\.dev/terminal$
-    replacement: https://agent.hermes.bstein.dev/terminal/
+    # Host-preserving so the trailing-slash fixup works on both the canonical
+    # worker.bstein.dev and the legacy agent.hermes.bstein.dev host.
+    regex: ^https://(worker\.bstein\.dev|agent\.hermes\.bstein\.dev)/terminal$
+    replacement: https://${1}/terminal/
    permanent: false
 ---
 apiVersion: traefik.io/v1alpha1
@ -33,9 +35,21 @@ spec:
  ingressClassName: traefik
  tls:
    - hosts:
+        - worker.bstein.dev
        - agent.hermes.bstein.dev
      secretName: hermes-sites-tls
  rules:
+    - host: worker.bstein.dev
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy-hermes-agent
+                port:
+                  name: http
+    # Legacy host, served unchanged until it is retired in a separate change.
    - host: agent.hermes.bstein.dev
      http:
        paths:
@ -60,9 +74,21 @@ spec:
  ingressClassName: traefik
  tls:
    - hosts:
+        - worker.bstein.dev
        - agent.hermes.bstein.dev
      secretName: hermes-sites-tls
  rules:
+    - host: worker.bstein.dev
+      http:
+        paths:
+          - path: /terminal
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy-hermes-agent
+                port:
+                  name: http
+    # Legacy host, served unchanged until it is retired in a separate change.
    - host: agent.hermes.bstein.dev
      http:
        paths:
@ -90,6 +116,7 @@ spec:
        - agent.hermes.bstein.dev
        - chat.bstein.dev
        - triage.bstein.dev
+        - worker.bstein.dev
      secretName: hermes-sites-tls
  rules:
    - host: chat.bstein.dev
--- a/services/hermes/configmap.yaml
+++ b/services/hermes/configmap.yaml
@ -113,7 +113,7 @@ data:

    This is the dedicated triage appliance at triage.bstein.dev. Keep
    automated Ariadne intake and testing conversations here. Project delivery
-    and coding orchestration belong to agent.hermes.bstein.dev; general user
+    and coding orchestration belong to worker.bstein.dev; general user
    chat belongs to chat.bstein.dev.

    Start in AUTO routing with a careful, intelligence-biased posture. Every
--- a/services/hermes/skills/master-hermes-on-atlas/references/architecture.md
+++ b/services/hermes/skills/master-hermes-on-atlas/references/architecture.md
@ -8,7 +8,7 @@ asserting health, placement, ownership, or current model availability.
 | Surface | Purpose | Identity boundary | State and permissions |
 | --- | --- | --- | --- |
 | `triage.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints |
-| `agent.hermes.bstein.dev` | Brad's project coordinator | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace and separate PVC; native Hermes delegates bounded work while Herdr preserves real Codex and Claude Code CLI sessions when needed |
+| `worker.bstein.dev` | Brad's project coordinator | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace and separate PVC; native Hermes delegates bounded work while Herdr preserves real Codex and Claude Code CLI sessions when needed |
 | `chat.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access |

 The instances do not share conversation state, credentials, profiles, skills
--- a/services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml
+++ b/services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml
@ -3,7 +3,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: hermes-access-oidc-client-ensure-10
+  name: hermes-access-oidc-client-ensure-11
  namespace: sso
 spec:
  backoffLimit: 3
--- a/services/keycloak/scripts/hermes_access_oidc_ensure.sh
+++ b/services/keycloak/scripts/hermes_access_oidc_ensure.sh
@ -80,15 +80,25 @@ if [ -z "${vault_token}" ] || [ "${vault_token}" = "null" ]; then
  exit 1
 fi

+# Usage: ensure_proxy_client <client_id> <canonical_url> <vault_path> [legacy_url...]
+# Any legacy URLs are registered alongside the canonical one so that a host
+# rename can be rolled back by reverting the proxy's --redirect-url alone,
+# without re-running this job. rootUrl always tracks the canonical host.
 ensure_proxy_client() {
  client_id="$1"
  public_url="$2"
  vault_path="$3"
-  payload="$(jq -nc \
+  shift 3
+  origin_lines="${public_url}"
+  for legacy_url in "$@"; do
+    origin_lines="${origin_lines}
+${legacy_url}"
+  done
+  payload="$(printf '%s\n' "${origin_lines}" | jq -Rsc \
    --arg client_id "${client_id}" \
-    --arg redirect_uri "${public_url}/oauth2/callback" \
    --arg web_origin "${public_url}" \
-    '{
+    '(split("\n") | map(select(length > 0))) as $origins
+    | {
      clientId:$client_id,
      name:$client_id,
      enabled:true,
@ -98,13 +108,13 @@ ensure_proxy_client() {
      implicitFlowEnabled:false,
      directAccessGrantsEnabled:false,
      serviceAccountsEnabled:false,
-      redirectUris:[$redirect_uri],
-      webOrigins:[$web_origin],
+      redirectUris:($origins | map(. + "/oauth2/callback")),
+      webOrigins:$origins,
      rootUrl:$web_origin,
      baseUrl:"/",
      attributes:{
        "pkce.code.challenge.method":"S256",
-        "post.logout.redirect.uris":$web_origin,
+        "post.logout.redirect.uris":($origins | join("##")),
        "access.token.lifespan":"1200"
      }
    }')"
@ -328,7 +338,7 @@ ensure_telegram_config() {

 ensure_hermes_owner
 ensure_proxy_client "hermes-chat-proxy" "https://chat.bstein.dev" "hermes/chat-oidc"
-ensure_proxy_client "hermes-agent-proxy" "https://agent.hermes.bstein.dev" "hermes/agent-oidc"
+ensure_proxy_client "hermes-agent-proxy" "https://worker.bstein.dev" "hermes/agent-oidc" "https://agent.hermes.bstein.dev"
 ensure_proxy_client "hermes-triage-proxy" "https://triage.bstein.dev" "hermes/triage-oidc"
 ensure_service_account_client "hermes-automation" "hermes/developer-keycloak"
 ensure_telegram_config
--- a/services/quality/zap-baseline-configmap.yaml
+++ b/services/quality/zap-baseline-configmap.yaml
@ -26,7 +26,7 @@ data:
    https://budget.bstein.dev
    https://money.bstein.dev
    https://health.bstein.dev
-    https://agent.hermes.bstein.dev
+    https://worker.bstein.dev
    https://chat.bstein.dev
    https://triage.bstein.dev
    https://cassandra.bstein.dev
--- a/testing/tests/test_hermes_agent_runtime_patches.py
+++ b/testing/tests/test_hermes_agent_runtime_patches.py
@ -63,7 +63,7 @@ def test_owner_agent_installs_the_pinned_operator_toolchain():
    assert 'chmod 0644 "${profile_file}"' in init_command


-def test_owner_agent_uses_only_the_canonical_hostname():
+def test_owner_agent_uses_the_canonical_hostname():
    paths = [
        HERMES / "agent-configmap.yaml",
        HERMES / "agent-deployment.yaml",
@ -73,7 +73,40 @@ def test_owner_agent_uses_only_the_canonical_hostname():
    for path in paths:
        content = path.read_text()
        assert "agent.bstein.dev" not in content
-        assert "agent.hermes.bstein.dev" in content
+        assert "worker.bstein.dev" in content
+
+
+def test_legacy_owner_host_stays_served_until_it_is_retired_separately():
+    """The rename must not cut off the host the operator reaches Hermes on.
+
+    ``agent.hermes.bstein.dev`` keeps resolving, routing and validating TLS
+    until it is retired in its own change, so rolling the rename back never
+    needs more than reverting the oauth2-proxy callback.
+    """
+    legacy = "agent.hermes.bstein.dev"
+    canonical = "worker.bstein.dev"
+
+    coredns = (
+        Path(__file__).parents[2] / "infrastructure/core/coredns-custom.yaml"
+    ).read_text()
+    assert f"192.168.22.9 {legacy}" in coredns
+    assert f"192.168.22.9 {canonical}" in coredns
+
+    certificate = yaml.safe_load((HERMES / "agent-certificate.yaml").read_text())
+    assert {legacy, canonical} <= set(certificate["spec"]["dnsNames"])
+
+    ingresses = [
+        doc
+        for doc in yaml.safe_load_all((HERMES / "agent-ingress.yaml").read_text())
+        if doc
+        and doc.get("kind") == "Ingress"
+        and doc["metadata"]["name"].startswith("hermes-agent-")
+    ]
+    assert len(ingresses) == 2
+    for ingress in ingresses:
+        assert {legacy, canonical} <= {rule["host"] for rule in ingress["spec"]["rules"]}
+        for tls in ingress["spec"]["tls"]:
+            assert {legacy, canonical} <= set(tls["hosts"])


 def test_agent_reconnect_retains_complete_history_and_long_tool_budget():
--- a/testing/tests/test_hermes_cli_lanes_toolchain.py
+++ b/testing/tests/test_hermes_cli_lanes_toolchain.py
@ -122,7 +122,7 @@ def test_owner_agent_installs_the_pinned_operator_toolchain():
    assert 'chmod 0644 "${profile_file}"' in init_command


-def test_owner_agent_uses_only_the_canonical_hostname():
+def test_owner_agent_uses_the_canonical_hostname():
    paths = [
        HERMES / "agent-configmap.yaml",
        HERMES / "agent-deployment.yaml",
@ -132,7 +132,7 @@ def test_owner_agent_uses_only_the_canonical_hostname():
    for path in paths:
        content = path.read_text()
        assert "agent.bstein.dev" not in content
-        assert "agent.hermes.bstein.dev" in content
+        assert "worker.bstein.dev" in content


 def test_agent_reconnect_retains_complete_history_and_long_tool_budget():