hermes: deploy verified release and roll broker code by content

clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml

@@ -1,19 +0,0 @@
-# clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: hermes-scm-broker-code
-  namespace: flux-system
-spec:
-  interval: 10m
-  path: ./services/hermes/scm-common
-  targetNamespace: hermes-scm
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  wait: true
-  timeout: 5m
-  dependsOn:
-    - name: hermes-scm-namespace

clusters/atlas/flux-system/applications/hermes-scm-broker/kustomization.yaml

@@ -24,4 +24,3 @@ spec:
     - name: vault
     - name: gitea
     - name: hermes-scm-namespace
-    - name: hermes-scm-broker-code

clusters/atlas/flux-system/applications/kustomization.yaml

@@ -29,7 +29,6 @@ resources:
   - ai-llm/kustomization.yaml
   - openclaw/kustomization.yaml
   - hermes-scm-namespace/kustomization.yaml
-  - hermes-scm-broker-code/kustomization.yaml
   - hermes/kustomization.yaml
   - hermes/image-automation.yaml
   - hermes-observer-rbac/kustomization.yaml

services/hermes-scm-broker/kustomization.yaml

@@ -5,9 +5,10 @@ namespace: hermes-scm
 resources:
   - task-branch-adoptions-configmap.yaml
   - task-ledger-pvc.yaml
+  - ../hermes/scm-common
   - service.yaml
   - deployment.yaml
   - networkpolicy.yaml
 images:
   - name: registry.bstein.dev/bstein/hermes-agent
-    digest: sha256:37ebf720c783ae908a602916ffccf88d43d205a157957f5dc4b487867aee45e7
+    digest: sha256:f998627ec39492e5686fb375c661004699374d847deb878e7f06e1c7e0f45946

services/hermes/kustomization.yaml

@@ -2,16 +2,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: hermes
-metadata:
-  annotations:
-    hermes.bstein.dev/agent-image-release-hold: "true"
-    hermes.bstein.dev/agent-image-release-hold-digest: "sha256:bebfe9c24cdd877ed2c16335027ccf393892161642756f54e8d12984eefdd903"
-    hermes.bstein.dev/agent-image-release-hold-minimum-source: "106ee8ce14aa67c3825fca6fb537a557b44ecd86"
-    hermes.bstein.dev/agent-image-release-hold-reason: "Hold the verified SQLite 3.51.3 runtime until the normal Hermes release includes it."
 images:
   - name: registry.bstein.dev/bstein/hermes-agent
-    # Hold this verified SQLite fix until the normal image release includes it.
-    digest: sha256:bebfe9c24cdd877ed2c16335027ccf393892161642756f54e8d12984eefdd903
+    digest: sha256:f998627ec39492e5686fb375c661004699374d847deb878e7f06e1c7e0f45946 # {"$imagepolicy": "hermes:hermes-agent-release:digest"}
 resources:
   - namespace.yaml
   - image.yaml

services/hermes/scm-common/kustomization.yaml

@@ -16,5 +16,3 @@ configMapGenerator:
       - scm_task_grants.py=scripts/scm_task_grants.py
       - scm_task_drafts.py=scripts/scm_task_drafts.py
       - scm_task_adoptions.py=scripts/scm_task_adoptions.py
-    options:
-      disableNameSuffixHash: true

testing/tests/test_hermes_chat_images.py

@@ -190,9 +190,11 @@ def test_chat_reasoning_uses_switchyard_without_owner_credentials():
             "atlas/auto/balanced",
             "atlas/auto/deep",
             "atlas/auto/maximum",
+            "atlas/manual/codex/auto",
             "atlas/manual/codex/luna",
             "atlas/manual/codex/terra",
             "atlas/manual/codex/sol",
+            "atlas/manual/claude/auto",
             "atlas/manual/claude/haiku",
             "atlas/manual/claude/fable",
             "atlas/manual/claude/sonnet",
@@ -234,7 +236,7 @@ def test_chat_reasoning_uses_switchyard_without_owner_credentials():
         statefulset["spec"]["template"]["metadata"]["annotations"][
             "ai.bstein.dev/config-rev"
         ]
-        == "20260816-telegram-topics"
+        == "20260913-provider-model-catalog-v2"
     )
     pod_spec = statefulset["spec"]["template"]["spec"]
     patch_init = next(

testing/tests/test_hermes_scm_broker_policy.py

@@ -169,16 +169,24 @@ def test_flux_bootstrap_has_no_agent_namespace_dependency_cycle():
         ROOT / "clusters/atlas/flux-system/applications/kustomization.yaml"
     ).read_text(encoding="utf-8")
     assert "hermes-scm-agent-code" not in applications
-
-    broker_code = yaml.safe_load(
+    assert "hermes-scm-broker-code" not in applications
+    broker_flux = yaml.safe_load(
         (
             ROOT
-            / "clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml"
+            / "clusters/atlas/flux-system/applications/hermes-scm-broker/kustomization.yaml"
         ).read_text(encoding="utf-8")
     )
-    assert broker_code["spec"]["path"] == "./services/hermes/scm-common"
-    assert broker_code["spec"]["targetNamespace"] == "hermes-scm"
-    assert broker_code["spec"]["dependsOn"] == [{"name": "hermes-scm-namespace"}]
+    assert {item["name"] for item in broker_flux["spec"]["dependsOn"]} == {
+        "vault", "gitea", "hermes-scm-namespace"
+    }
+    broker_kustomization = yaml.safe_load(
+        (ROOT / "services/hermes-scm-broker/kustomization.yaml").read_text(encoding="utf-8")
+    )
+    assert "../hermes/scm-common" in broker_kustomization["resources"]
+    scm_common = yaml.safe_load(
+        (ROOT / "services/hermes/scm-common/kustomization.yaml").read_text(encoding="utf-8")
+    )
+    assert "options" not in scm_common["configMapGenerator"][0]
 
 
 def test_gitea_bootstrap_enforces_human_review_without_overwriting_drift():