refactor(hermes): rename the owner agent host to worker.bstein.dev

Introduce worker.bstein.dev as the canonical hostname for the owner-only
Hermes coordinator, previously agent.hermes.bstein.dev.

The old host is deliberately kept alive. CoreDNS, both agent Ingresses and
the hermes-sites certificate now serve BOTH names, so merging this cannot
take away the endpoint the operator uses to reach the coordinator. Retiring
agent.hermes.bstein.dev is a separate, separately scheduled change. No
redirect middleware is added.

What switches to the new host:
- HERMES_DASHBOARD_PUBLIC_URL and the oauth2-proxy --redirect-url
- the Keycloak hermes-agent-proxy rootUrl
- operator docs, skills, the ZAP baseline target and the triage monitor default

What stays dual-homed until retirement:
- CoreDNS hosts entry, both agent Ingress rules, certificate SANs
- API_SERVER_CORS_ORIGINS (now a comma-separated pair)
- the Keycloak redirect URIs, web origins and post-logout origins, so a
  rollback only needs the oauth2-proxy --redirect-url reverted and does not
  require re-running the ensure job

ensure_proxy_client now takes optional trailing legacy URLs; called with a
single URL it emits the identical payload as before, so the chat and triage
clients are unaffected. The ensure Job is bumped to -11 so Flux re-runs it;
login on the new host fails until that Job completes.

Because the session and CSRF cookies use the __Host- prefix they are bound to
one origin, so a fresh login must start on worker.bstein.dev and existing
sessions do not carry over -- re-login is required after rollout.

Knowledge catalogs and diagrams regenerated with `make knowledge`.

infrastructure/core/coredns-custom.yaml

@@ -47,6 +47,7 @@ data:
         192.168.22.9 tasks.bstein.dev
         192.168.22.9 triage.bstein.dev
         192.168.22.9 vault.bstein.dev
+        192.168.22.9 worker.bstein.dev
         fallthrough
       }
     }

knowledge/catalog/atlas-summary.json

@@ -1,7 +1,7 @@
 {
   "counts": {
     "helmrelease_host_hints": 23,
-    "http_endpoints": 61,
+    "http_endpoints": 63,
     "services": 98,
     "workloads": 130
   }

knowledge/catalog/atlas.json

@@ -5510,6 +5510,46 @@
         "name": "wolf",
         "source": "game-stream"
       }
+    },
+    {
+      "host": "worker.bstein.dev",
+      "path": "/",
+      "backend": {
+        "namespace": "hermes",
+        "service": "oauth2-proxy-hermes-agent",
+        "port": "http",
+        "workloads": [
+          {
+            "kind": "Deployment",
+            "name": "hermes-agent"
+          }
+        ]
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "hermes-agent-dashboard",
+        "source": "hermes"
+      }
+    },
+    {
+      "host": "worker.bstein.dev",
+      "path": "/terminal",
+      "backend": {
+        "namespace": "hermes",
+        "service": "oauth2-proxy-hermes-agent",
+        "port": "http",
+        "workloads": [
+          {
+            "kind": "Deployment",
+            "name": "hermes-agent"
+          }
+        ]
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "hermes-agent-terminal",
+        "source": "hermes"
+      }
     }
   ],
   "helmrelease_host_hints": {

knowledge/catalog/atlas.yaml

@@ -3585,6 +3585,28 @@ http_endpoints:
     kind: Ingress
     name: wolf
     source: game-stream
+- host: worker.bstein.dev
+  path: /
+  backend:
+    namespace: hermes
+    service: oauth2-proxy-hermes-agent
+    port: http
+    workloads: *id001
+  via:
+    kind: Ingress
+    name: hermes-agent-dashboard
+    source: hermes
+- host: worker.bstein.dev
+  path: /terminal
+  backend:
+    namespace: hermes
+    service: oauth2-proxy-hermes-agent
+    port: http
+    workloads: *id001
+  via:
+    kind: Ingress
+    name: hermes-agent-terminal
+    source: hermes
 helmrelease_host_hints:
   cert-manager:cert-manager/cert-manager:
   - atlas.bstein.dev

knowledge/diagrams/atlas-http.mmd

@@ -194,6 +194,8 @@ flowchart LR
   host_wolf_bstein_dev --> svc_game_stream_oauth2_proxy_wolf
   wl_game_stream_oauth2_proxy_wolf["game-stream/oauth2-proxy-wolf (Deployment)"]
   svc_game_stream_oauth2_proxy_wolf --> wl_game_stream_oauth2_proxy_wolf
+  host_worker_bstein_dev["worker.bstein.dev"]
+  host_worker_bstein_dev --> svc_hermes_oauth2_proxy_hermes_agent
 
   subgraph bstein_dev_home[bstein-dev-home]
     svc_bstein_dev_home_bstein_dev_home_frontend

knowledge/runbooks/hermes-triage-demo.md

@@ -99,7 +99,7 @@ in-process call removed a whole pod launch from the critical path.
   `hermes-demo-test-<N>` (failed) and `hermes-demo-repair-<N>` (succeeded);
   both TTL-clean after 1 h.
 - Hermes side: the run appears in the dashboard at
-  `https://agent.hermes.bstein.dev` (session/run history).
+  `https://worker.bstein.dev` (session/run history).
 - Escalation path: alert `HermesTriageHumanRequired` in vmalert
   (`vmalert-atlas-availability` deployment, 1 m interval, `for: 2m`)
   fires to Alertmanager for any `human_required` incident. Gauges are

scripts/ops/hermes_triage_monitor.py

@@ -40,7 +40,7 @@ JENKINS = os.environ.get("JENKINS_URL", "https://ci.bstein.dev")
 GITEA = os.environ.get("GITEA_URL", "https://scm.bstein.dev")
 CODE_REPO_OWNER = os.environ.get("CODE_REPO_OWNER", "atlas")
 GRAFANA = os.environ.get("GRAFANA_URL", "https://metrics.bstein.dev")
-HERMES_UI = os.environ.get("HERMES_URL", "https://agent.hermes.bstein.dev")
+HERMES_UI = os.environ.get("HERMES_URL", "https://worker.bstein.dev")
 POLL_SECONDS = 6
 
 # `--filter <text>` restricts the monitor to incidents whose id contains that

services/comms/knowledge/catalog/atlas-summary.json

@@ -1,7 +1,7 @@
 {
   "counts": {
     "helmrelease_host_hints": 23,
-    "http_endpoints": 61,
+    "http_endpoints": 63,
     "services": 98,
     "workloads": 130
   }

services/comms/knowledge/catalog/atlas.json

@@ -5510,6 +5510,46 @@
         "name": "wolf",
         "source": "game-stream"
       }
+    },
+    {
+      "host": "worker.bstein.dev",
+      "path": "/",
+      "backend": {
+        "namespace": "hermes",
+        "service": "oauth2-proxy-hermes-agent",
+        "port": "http",
+        "workloads": [
+          {
+            "kind": "Deployment",
+            "name": "hermes-agent"
+          }
+        ]
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "hermes-agent-dashboard",
+        "source": "hermes"
+      }
+    },
+    {
+      "host": "worker.bstein.dev",
+      "path": "/terminal",
+      "backend": {
+        "namespace": "hermes",
+        "service": "oauth2-proxy-hermes-agent",
+        "port": "http",
+        "workloads": [
+          {
+            "kind": "Deployment",
+            "name": "hermes-agent"
+          }
+        ]
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "hermes-agent-terminal",
+        "source": "hermes"
+      }
     }
   ],
   "helmrelease_host_hints": {

services/comms/knowledge/catalog/atlas.yaml

@@ -3585,6 +3585,28 @@ http_endpoints:
     kind: Ingress
     name: wolf
     source: game-stream
+- host: worker.bstein.dev
+  path: /
+  backend:
+    namespace: hermes
+    service: oauth2-proxy-hermes-agent
+    port: http
+    workloads: *id001
+  via:
+    kind: Ingress
+    name: hermes-agent-dashboard
+    source: hermes
+- host: worker.bstein.dev
+  path: /terminal
+  backend:
+    namespace: hermes
+    service: oauth2-proxy-hermes-agent
+    port: http
+    workloads: *id001
+  via:
+    kind: Ingress
+    name: hermes-agent-terminal
+    source: hermes
 helmrelease_host_hints:
   cert-manager:cert-manager/cert-manager:
   - atlas.bstein.dev

services/comms/knowledge/diagrams/atlas-http.mmd

@@ -194,6 +194,8 @@ flowchart LR
   host_wolf_bstein_dev --> svc_game_stream_oauth2_proxy_wolf
   wl_game_stream_oauth2_proxy_wolf["game-stream/oauth2-proxy-wolf (Deployment)"]
   svc_game_stream_oauth2_proxy_wolf --> wl_game_stream_oauth2_proxy_wolf
+  host_worker_bstein_dev["worker.bstein.dev"]
+  host_worker_bstein_dev --> svc_hermes_oauth2_proxy_hermes_agent
 
   subgraph bstein_dev_home[bstein-dev-home]
     svc_bstein_dev_home_bstein_dev_home_frontend

services/comms/knowledge/runbooks/hermes-triage-demo.md

@@ -99,7 +99,7 @@ in-process call removed a whole pod launch from the critical path.
   `hermes-demo-test-<N>` (failed) and `hermes-demo-repair-<N>` (succeeded);
   both TTL-clean after 1 h.
 - Hermes side: the run appears in the dashboard at
-  `https://agent.hermes.bstein.dev` (session/run history).
+  `https://worker.bstein.dev` (session/run history).
 - Escalation path: alert `HermesTriageHumanRequired` in vmalert
   (`vmalert-atlas-availability` deployment, 1 m interval, `for: 2m`)
   fires to Alertmanager for any `human_required` incident. Gauges are

services/hermes/NOTES.md

@@ -5,7 +5,7 @@ This is the mental model and demonstration script for the operator instance at
 consumer instance at `chat.bstein.dev` is intentionally separate and is not the
 place to perform infrastructure triage.
 
-`agent.hermes.bstein.dev` is the owner-only engineering control plane. Its root
+`worker.bstein.dev` is the owner-only engineering control plane. Its root
 serves the stock Hermes dashboard, including embedded chat/TUI and the native
 sessions, files, models, logs, Kanban, skills, plugins, MCP, profiles, and
 configuration surfaces. `/terminal/` remains the raw full-screen TUI. The
@@ -143,7 +143,7 @@ off. The final TypeScript build, Python compile, and source assertions remain
 mandatory, so an omitted or drifted replay fails before any image can pass
 release verification.
 
-From agent.hermes, trigger that one fixed job with:
+From worker.bstein.dev, trigger that one fixed job with:
 
 ```sh
 jenkins_image_build_trigger.py '<reviewed full main commit>'

services/hermes/agent-certificate.yaml

@@ -10,6 +10,9 @@ spec:
     kind: ClusterIssuer
     name: letsencrypt
   dnsNames:
+    # worker.bstein.dev is the canonical owner-agent host. agent.hermes.bstein.dev
+    # stays on the certificate until the old host is retired in a separate change.
     - agent.hermes.bstein.dev
     - chat.bstein.dev
     - triage.bstein.dev
+    - worker.bstein.dev

services/hermes/agent-configmap.yaml

@@ -142,7 +142,7 @@ data:
         - "*git clean -f*"
 
     dashboard:
-      public_url: https://agent.hermes.bstein.dev
+      public_url: https://worker.bstein.dev
 
     display:
       compact: true
@@ -174,7 +174,7 @@ data:
       backup_keep: 5
       non_interactive_local_changes: stash
   SOUL.md: |
-    You are Brad's private Hermes coordinator at agent.hermes.bstein.dev. Turn
+    You are Brad's private Hermes coordinator at worker.bstein.dev. Turn
     objectives into organized, reviewable delivery without making Brad manage
     model names, terminals, or provider capacity.
 
@@ -408,7 +408,7 @@ data:
   START-HERE.md: |
     # Agent Hermes
 
-    The authenticated root of agent.hermes.bstein.dev opens Hermes' stock
+    The authenticated root of worker.bstein.dev opens Hermes' stock
     dashboard with embedded chat/TUI, sessions, files, models, logs, Kanban,
     skills, plugins, MCP, profiles, and configuration. `/terminal/` opens the
     raw full-screen Hermes TUI. Give Hermes

services/hermes/agent-deployment.yaml

@@ -624,14 +624,15 @@ spec:
             - {name: HERMES_DASHBOARD_HOST, value: 127.0.0.1}
             - {name: HERMES_DASHBOARD_PORT, value: "9119"}
             - {name: HERMES_DASHBOARD_FILES_ROOT, value: /opt/data/workspace}
-            - {name: HERMES_DASHBOARD_PUBLIC_URL, value: https://agent.hermes.bstein.dev}
+            - {name: HERMES_DASHBOARD_PUBLIC_URL, value: https://worker.bstein.dev}
             - {name: HERMES_TUI_AGENT_INIT_TIMEOUT_S, value: "180"}
             - {name: HERMES_STREAM_STALE_TIMEOUT, value: "600"}
             - {name: HERMES_API_CALL_STALE_TIMEOUT, value: "600"}
             - {name: API_SERVER_ENABLED, value: "true"}
             - {name: API_SERVER_HOST, value: 0.0.0.0}
             - {name: API_SERVER_PORT, value: "8642"}
-            - {name: API_SERVER_CORS_ORIGINS, value: https://agent.hermes.bstein.dev}
+            # Comma-separated; the legacy origin stays until agent.hermes.bstein.dev is retired.
+            - {name: API_SERVER_CORS_ORIGINS, value: "https://worker.bstein.dev,https://agent.hermes.bstein.dev"}
             - {name: HERMES_MEDIA_DELIVERY_STRICT, value: "1"}
             - {name: HERMES_MEDIA_ALLOW_DIRS, value: /opt/data/workspace}
             - {name: HERMES_AUTO_ROUTER_PROFILE, value: agent}
@@ -694,7 +695,11 @@ spec:
           args:
             - --provider=oidc
             - --config=/vault/secrets/oidc-config
-            - --redirect-url=https://agent.hermes.bstein.dev/oauth2/callback
+            # Single canonical callback. The __Host- cookie prefix below binds both
+            # the session and the CSRF cookie to one host, so a fresh login must be
+            # started on worker.bstein.dev; agent.hermes.bstein.dev keeps serving
+            # already-authenticated sessions until it is retired separately.
+            - --redirect-url=https://worker.bstein.dev/oauth2/callback
             - --oidc-issuer-url=https://sso.bstein.dev/realms/atlas
             - --user-id-claim=sub
             - --oidc-groups-claim=groups

services/hermes/agent-ingress.yaml

@@ -6,8 +6,10 @@ metadata:
   namespace: hermes
 spec:
   redirectRegex:
-    regex: ^https://agent\.hermes\.bstein\.dev/terminal$
+    # Host-preserving so the trailing-slash fixup works on both the canonical
-    replacement: https://agent.hermes.bstein.dev/terminal/
+    # worker.bstein.dev and the legacy agent.hermes.bstein.dev host.
+    regex: ^https://(worker\.bstein\.dev|agent\.hermes\.bstein\.dev)/terminal$
+    replacement: https://${1}/terminal/
     permanent: false
 ---
 apiVersion: traefik.io/v1alpha1
@@ -33,9 +35,21 @@ spec:
   ingressClassName: traefik
   tls:
     - hosts:
+        - worker.bstein.dev
         - agent.hermes.bstein.dev
       secretName: hermes-sites-tls
   rules:
+    - host: worker.bstein.dev
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy-hermes-agent
+                port:
+                  name: http
+    # Legacy host, served unchanged until it is retired in a separate change.
     - host: agent.hermes.bstein.dev
       http:
         paths:
@@ -60,9 +74,21 @@ spec:
   ingressClassName: traefik
   tls:
     - hosts:
+        - worker.bstein.dev
         - agent.hermes.bstein.dev
       secretName: hermes-sites-tls
   rules:
+    - host: worker.bstein.dev
+      http:
+        paths:
+          - path: /terminal
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy-hermes-agent
+                port:
+                  name: http
+    # Legacy host, served unchanged until it is retired in a separate change.
     - host: agent.hermes.bstein.dev
       http:
         paths:
@@ -90,6 +116,7 @@ spec:
         - agent.hermes.bstein.dev
         - chat.bstein.dev
         - triage.bstein.dev
+        - worker.bstein.dev
       secretName: hermes-sites-tls
   rules:
     - host: chat.bstein.dev

services/hermes/configmap.yaml

@@ -113,7 +113,7 @@ data:
 
     This is the dedicated triage appliance at triage.bstein.dev. Keep
     automated Ariadne intake and testing conversations here. Project delivery
-    and coding orchestration belong to agent.hermes.bstein.dev; general user
+    and coding orchestration belong to worker.bstein.dev; general user
     chat belongs to chat.bstein.dev.
 
     Start in AUTO routing with a careful, intelligence-biased posture. Every

services/hermes/skills/master-hermes-on-atlas/references/architecture.md

@@ -8,7 +8,7 @@ asserting health, placement, ownership, or current model availability.
 | Surface | Purpose | Identity boundary | State and permissions |
 | --- | --- | --- | --- |
 | `triage.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints |
-| `agent.hermes.bstein.dev` | Brad's project coordinator | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace and separate PVC; native Hermes delegates bounded work while Herdr preserves real Codex and Claude Code CLI sessions when needed |
+| `worker.bstein.dev` | Brad's project coordinator | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace and separate PVC; native Hermes delegates bounded work while Herdr preserves real Codex and Claude Code CLI sessions when needed |
 | `chat.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access |
 
 The instances do not share conversation state, credentials, profiles, skills

services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml

@@ -3,7 +3,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: hermes-access-oidc-client-ensure-10
+  name: hermes-access-oidc-client-ensure-11
   namespace: sso
 spec:
   backoffLimit: 3

services/keycloak/scripts/hermes_access_oidc_ensure.sh

@@ -80,15 +80,25 @@ if [ -z "${vault_token}" ] || [ "${vault_token}" = "null" ]; then
   exit 1
 fi
 
+# Usage: ensure_proxy_client <client_id> <canonical_url> <vault_path> [legacy_url...]
+# Any legacy URLs are registered alongside the canonical one so that a host
+# rename can be rolled back by reverting the proxy's --redirect-url alone,
+# without re-running this job. rootUrl always tracks the canonical host.
 ensure_proxy_client() {
   client_id="$1"
   public_url="$2"
   vault_path="$3"
-  payload="$(jq -nc \
+  shift 3
+  origin_lines="${public_url}"
+  for legacy_url in "$@"; do
+    origin_lines="${origin_lines}
+${legacy_url}"
+  done
+  payload="$(printf '%s\n' "${origin_lines}" | jq -Rsc \
     --arg client_id "${client_id}" \
-    --arg redirect_uri "${public_url}/oauth2/callback" \
     --arg web_origin "${public_url}" \
-    '{
+    '(split("\n") | map(select(length > 0))) as $origins
+    | {
       clientId:$client_id,
       name:$client_id,
       enabled:true,
@@ -98,13 +108,13 @@ ensure_proxy_client() {
       implicitFlowEnabled:false,
       directAccessGrantsEnabled:false,
       serviceAccountsEnabled:false,
-      redirectUris:[$redirect_uri],
+      redirectUris:($origins | map(. + "/oauth2/callback")),
-      webOrigins:[$web_origin],
+      webOrigins:$origins,
       rootUrl:$web_origin,
       baseUrl:"/",
       attributes:{
         "pkce.code.challenge.method":"S256",
-        "post.logout.redirect.uris":$web_origin,
+        "post.logout.redirect.uris":($origins | join("##")),
         "access.token.lifespan":"1200"
       }
     }')"
@@ -328,7 +338,7 @@ ensure_telegram_config() {
 
 ensure_hermes_owner
 ensure_proxy_client "hermes-chat-proxy" "https://chat.bstein.dev" "hermes/chat-oidc"
-ensure_proxy_client "hermes-agent-proxy" "https://agent.hermes.bstein.dev" "hermes/agent-oidc"
+ensure_proxy_client "hermes-agent-proxy" "https://worker.bstein.dev" "hermes/agent-oidc" "https://agent.hermes.bstein.dev"
 ensure_proxy_client "hermes-triage-proxy" "https://triage.bstein.dev" "hermes/triage-oidc"
 ensure_service_account_client "hermes-automation" "hermes/developer-keycloak"
 ensure_telegram_config

services/quality/zap-baseline-configmap.yaml

@@ -26,7 +26,7 @@ data:
     https://budget.bstein.dev
     https://money.bstein.dev
     https://health.bstein.dev
-    https://agent.hermes.bstein.dev
+    https://worker.bstein.dev
     https://chat.bstein.dev
     https://triage.bstein.dev
     https://cassandra.bstein.dev

testing/tests/test_hermes_agent_runtime_patches.py

@@ -63,7 +63,7 @@ def test_owner_agent_installs_the_pinned_operator_toolchain():
     assert 'chmod 0644 "${profile_file}"' in init_command
 
 
-def test_owner_agent_uses_only_the_canonical_hostname():
+def test_owner_agent_uses_the_canonical_hostname():
     paths = [
         HERMES / "agent-configmap.yaml",
         HERMES / "agent-deployment.yaml",
@@ -73,7 +73,40 @@ def test_owner_agent_uses_only_the_canonical_hostname():
     for path in paths:
         content = path.read_text()
         assert "agent.bstein.dev" not in content
-        assert "agent.hermes.bstein.dev" in content
+        assert "worker.bstein.dev" in content
+
+
+def test_legacy_owner_host_stays_served_until_it_is_retired_separately():
+    """The rename must not cut off the host the operator reaches Hermes on.
+
+    ``agent.hermes.bstein.dev`` keeps resolving, routing and validating TLS
+    until it is retired in its own change, so rolling the rename back never
+    needs more than reverting the oauth2-proxy callback.
+    """
+    legacy = "agent.hermes.bstein.dev"
+    canonical = "worker.bstein.dev"
+
+    coredns = (
+        Path(__file__).parents[2] / "infrastructure/core/coredns-custom.yaml"
+    ).read_text()
+    assert f"192.168.22.9 {legacy}" in coredns
+    assert f"192.168.22.9 {canonical}" in coredns
+
+    certificate = yaml.safe_load((HERMES / "agent-certificate.yaml").read_text())
+    assert {legacy, canonical} <= set(certificate["spec"]["dnsNames"])
+
+    ingresses = [
+        doc
+        for doc in yaml.safe_load_all((HERMES / "agent-ingress.yaml").read_text())
+        if doc
+        and doc.get("kind") == "Ingress"
+        and doc["metadata"]["name"].startswith("hermes-agent-")
+    ]
+    assert len(ingresses) == 2
+    for ingress in ingresses:
+        assert {legacy, canonical} <= {rule["host"] for rule in ingress["spec"]["rules"]}
+        for tls in ingress["spec"]["tls"]:
+            assert {legacy, canonical} <= set(tls["hosts"])
 
 
 def test_agent_reconnect_retains_complete_history_and_long_tool_budget():

testing/tests/test_hermes_cli_lanes_toolchain.py

@@ -122,7 +122,7 @@ def test_owner_agent_installs_the_pinned_operator_toolchain():
     assert 'chmod 0644 "${profile_file}"' in init_command
 
 
-def test_owner_agent_uses_only_the_canonical_hostname():
+def test_owner_agent_uses_the_canonical_hostname():
     paths = [
         HERMES / "agent-configmap.yaml",
         HERMES / "agent-deployment.yaml",
@@ -132,7 +132,7 @@ def test_owner_agent_uses_only_the_canonical_hostname():
     for path in paths:
         content = path.read_text()
         assert "agent.bstein.dev" not in content
-        assert "agent.hermes.bstein.dev" in content
+        assert "worker.bstein.dev" in content
 
 
 def test_agent_reconnect_retains_complete_history_and_long_tool_budget():