From d66af9dbd456cd71cd6895a830e8af5d56ef2521 Mon Sep 17 00:00:00 2001 From: jenkins Date: Sun, 13 Sep 2026 18:44:33 -0500 Subject: [PATCH] hermes: deploy verified release and roll broker code by content --- .../hermes-scm-broker-code/kustomization.yaml | 19 ------------------ .../hermes-scm-broker/kustomization.yaml | 1 - .../applications/kustomization.yaml | 1 - services/hermes-scm-broker/kustomization.yaml | 3 ++- services/hermes/kustomization.yaml | 9 +-------- services/hermes/scm-common/kustomization.yaml | 2 -- testing/tests/test_hermes_chat_images.py | 4 +++- .../tests/test_hermes_scm_broker_policy.py | 20 +++++++++++++------ 8 files changed, 20 insertions(+), 39 deletions(-) delete mode 100644 clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml diff --git a/clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml b/clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml deleted file mode 100644 index 20ae82e2..00000000 --- a/clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml +++ /dev/null @@ -1,19 +0,0 @@ -# clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: hermes-scm-broker-code - namespace: flux-system -spec: - interval: 10m - path: ./services/hermes/scm-common - targetNamespace: hermes-scm - prune: true - sourceRef: - kind: GitRepository - name: flux-system - namespace: flux-system - wait: true - timeout: 5m - dependsOn: - - name: hermes-scm-namespace diff --git a/clusters/atlas/flux-system/applications/hermes-scm-broker/kustomization.yaml b/clusters/atlas/flux-system/applications/hermes-scm-broker/kustomization.yaml index 70b3989e..25b9b257 100644 --- a/clusters/atlas/flux-system/applications/hermes-scm-broker/kustomization.yaml +++ b/clusters/atlas/flux-system/applications/hermes-scm-broker/kustomization.yaml @@ -24,4 +24,3 @@ spec: - name: vault - name: gitea - name: hermes-scm-namespace - - name: hermes-scm-broker-code diff --git a/clusters/atlas/flux-system/applications/kustomization.yaml b/clusters/atlas/flux-system/applications/kustomization.yaml index d1ec51fd..95d88236 100644 --- a/clusters/atlas/flux-system/applications/kustomization.yaml +++ b/clusters/atlas/flux-system/applications/kustomization.yaml @@ -29,7 +29,6 @@ resources: - ai-llm/kustomization.yaml - openclaw/kustomization.yaml - hermes-scm-namespace/kustomization.yaml - - hermes-scm-broker-code/kustomization.yaml - hermes/kustomization.yaml - hermes/image-automation.yaml - hermes-observer-rbac/kustomization.yaml diff --git a/services/hermes-scm-broker/kustomization.yaml b/services/hermes-scm-broker/kustomization.yaml index 31778c6f..12e9851f 100644 --- a/services/hermes-scm-broker/kustomization.yaml +++ b/services/hermes-scm-broker/kustomization.yaml @@ -5,9 +5,10 @@ namespace: hermes-scm resources: - task-branch-adoptions-configmap.yaml - task-ledger-pvc.yaml + - ../hermes/scm-common - service.yaml - deployment.yaml - networkpolicy.yaml images: - name: registry.bstein.dev/bstein/hermes-agent - digest: sha256:37ebf720c783ae908a602916ffccf88d43d205a157957f5dc4b487867aee45e7 + digest: sha256:f998627ec39492e5686fb375c661004699374d847deb878e7f06e1c7e0f45946 diff --git a/services/hermes/kustomization.yaml b/services/hermes/kustomization.yaml index c4685cb9..da75eff9 100644 --- a/services/hermes/kustomization.yaml +++ b/services/hermes/kustomization.yaml @@ -2,16 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: hermes -metadata: - annotations: - hermes.bstein.dev/agent-image-release-hold: "true" - hermes.bstein.dev/agent-image-release-hold-digest: "sha256:bebfe9c24cdd877ed2c16335027ccf393892161642756f54e8d12984eefdd903" - hermes.bstein.dev/agent-image-release-hold-minimum-source: "106ee8ce14aa67c3825fca6fb537a557b44ecd86" - hermes.bstein.dev/agent-image-release-hold-reason: "Hold the verified SQLite 3.51.3 runtime until the normal Hermes release includes it." images: - name: registry.bstein.dev/bstein/hermes-agent - # Hold this verified SQLite fix until the normal image release includes it. - digest: sha256:bebfe9c24cdd877ed2c16335027ccf393892161642756f54e8d12984eefdd903 + digest: sha256:f998627ec39492e5686fb375c661004699374d847deb878e7f06e1c7e0f45946 # {"$imagepolicy": "hermes:hermes-agent-release:digest"} resources: - namespace.yaml - image.yaml diff --git a/services/hermes/scm-common/kustomization.yaml b/services/hermes/scm-common/kustomization.yaml index 7f3b65c4..0b3072e8 100644 --- a/services/hermes/scm-common/kustomization.yaml +++ b/services/hermes/scm-common/kustomization.yaml @@ -16,5 +16,3 @@ configMapGenerator: - scm_task_grants.py=scripts/scm_task_grants.py - scm_task_drafts.py=scripts/scm_task_drafts.py - scm_task_adoptions.py=scripts/scm_task_adoptions.py - options: - disableNameSuffixHash: true diff --git a/testing/tests/test_hermes_chat_images.py b/testing/tests/test_hermes_chat_images.py index 44dfa6a8..5eeeeff5 100644 --- a/testing/tests/test_hermes_chat_images.py +++ b/testing/tests/test_hermes_chat_images.py @@ -190,9 +190,11 @@ def test_chat_reasoning_uses_switchyard_without_owner_credentials(): "atlas/auto/balanced", "atlas/auto/deep", "atlas/auto/maximum", + "atlas/manual/codex/auto", "atlas/manual/codex/luna", "atlas/manual/codex/terra", "atlas/manual/codex/sol", + "atlas/manual/claude/auto", "atlas/manual/claude/haiku", "atlas/manual/claude/fable", "atlas/manual/claude/sonnet", @@ -234,7 +236,7 @@ def test_chat_reasoning_uses_switchyard_without_owner_credentials(): statefulset["spec"]["template"]["metadata"]["annotations"][ "ai.bstein.dev/config-rev" ] - == "20260816-telegram-topics" + == "20260913-provider-model-catalog-v2" ) pod_spec = statefulset["spec"]["template"]["spec"] patch_init = next( diff --git a/testing/tests/test_hermes_scm_broker_policy.py b/testing/tests/test_hermes_scm_broker_policy.py index bc71d003..6c3b4dc0 100644 --- a/testing/tests/test_hermes_scm_broker_policy.py +++ b/testing/tests/test_hermes_scm_broker_policy.py @@ -169,16 +169,24 @@ def test_flux_bootstrap_has_no_agent_namespace_dependency_cycle(): ROOT / "clusters/atlas/flux-system/applications/kustomization.yaml" ).read_text(encoding="utf-8") assert "hermes-scm-agent-code" not in applications - - broker_code = yaml.safe_load( + assert "hermes-scm-broker-code" not in applications + broker_flux = yaml.safe_load( ( ROOT - / "clusters/atlas/flux-system/applications/hermes-scm-broker-code/kustomization.yaml" + / "clusters/atlas/flux-system/applications/hermes-scm-broker/kustomization.yaml" ).read_text(encoding="utf-8") ) - assert broker_code["spec"]["path"] == "./services/hermes/scm-common" - assert broker_code["spec"]["targetNamespace"] == "hermes-scm" - assert broker_code["spec"]["dependsOn"] == [{"name": "hermes-scm-namespace"}] + assert {item["name"] for item in broker_flux["spec"]["dependsOn"]} == { + "vault", "gitea", "hermes-scm-namespace" + } + broker_kustomization = yaml.safe_load( + (ROOT / "services/hermes-scm-broker/kustomization.yaml").read_text(encoding="utf-8") + ) + assert "../hermes/scm-common" in broker_kustomization["resources"] + scm_common = yaml.safe_load( + (ROOT / "services/hermes/scm-common/kustomization.yaml").read_text(encoding="utf-8") + ) + assert "options" not in scm_common["configMapGenerator"][0] def test_gitea_bootstrap_enforces_human_review_without_overwriting_drift():