hermes: fit owner pod on healthy workers

services/hermes/agent-deployment.yaml

@@ -687,7 +687,7 @@ spec:
             seccompProfile:
               type: RuntimeDefault
           resources:
-            requests: {cpu: 150m, memory: 384Mi}
+            requests: {cpu: 125m, memory: 320Mi}
             limits: {cpu: "3", memory: 6Gi}
         - name: oauth2-proxy
           image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561
@@ -857,7 +857,7 @@ spec:
             seccompProfile:
               type: RuntimeDefault
           resources:
-            requests: {cpu: 25m, memory: 48Mi}
+            requests: {cpu: 25m, memory: 32Mi}
             limits: {cpu: 500m, memory: 512Mi}
         - name: cli-lane-runner
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
@@ -915,7 +915,7 @@ spec:
             timeoutSeconds: 5
             failureThreshold: 3
           resources:
-            requests: {cpu: 25m, memory: 128Mi}
+            requests: {cpu: 25m, memory: 96Mi}
             limits: {cpu: "2", memory: 6Gi}
         - name: model-steward
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
@@ -944,7 +944,7 @@ spec:
             - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
             - {name: routing-catalog, mountPath: /routing-catalog}
           resources:
-            requests: {cpu: 25m, memory: 48Mi}
+            requests: {cpu: 25m, memory: 32Mi}
             limits: {cpu: 250m, memory: 512Mi}
         - name: kanban-supervisor
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
@@ -975,7 +975,7 @@ spec:
             - {name: coordinator, mountPath: /opt/coordinator, readOnly: true}
             - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
           resources:
-            requests: {cpu: 10m, memory: 48Mi}
+            requests: {cpu: 10m, memory: 32Mi}
             limits: {cpu: 250m, memory: 256Mi}
         - name: credential-sync
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107

services/hermes/execution-coordinator-patch.yaml

@@ -59,7 +59,7 @@ spec:
             initialDelaySeconds: 30
             periodSeconds: 30
           resources:
-            requests: {cpu: 50m, memory: 96Mi}
+            requests: {cpu: 50m, memory: 64Mi}
             limits: {cpu: 500m, memory: 512Mi}
       volumes:
         - name: execution-pool-code

testing/tests/test_hermes_agent_layout.py

@@ -134,7 +134,7 @@ def test_cli_lane_reserves_cpu_headroom_for_ui_and_auth():
 
     assert environment["HERMES_CLI_LANE_CONCURRENCY"] == "2"
     assert lane["resources"] == {
-        "requests": {"cpu": "25m", "memory": "128Mi"},
+        "requests": {"cpu": "25m", "memory": "96Mi"},
         "limits": {"cpu": "2", "memory": "6Gi"},
     }
 
@@ -163,8 +163,8 @@ def test_agent_avoids_unhealthy_nodes_and_stays_on_storage_workers():
 
     hermes = next(item for item in pod["containers"] if item["name"] == "hermes")
     assert hermes["resources"]["requests"] == {
-        "cpu": "150m",
-        "memory": "384Mi",
+        "cpu": "125m",
+        "memory": "320Mi",
     }
 
     node_labels = (