jenkins
9d42ff33f5
Merge origin/main ( #16 image-builder) into hermes-safe-gitea-pr
...
Resolve 8 conflicts, uniting #16 's daemonless image-release lane with
#14 's SCM broker + node-audit boundary. Nothing dropped from either side.
- quality_coverage.py / test_quality_coverage_helpers.py: take main's
dual-metric gate (line+branch enforced per file at minimum_percent);
drop #14 's now-dead branch_tracked_files/minimum_branch_percent keys.
- quality_contract.json: union all lists (managed_modules, lint_paths,
coverage_sources, tracked_files, hygiene globs) so #14 's scm-broker,
git_pack_objects, receive_pack_scan, deadline_http and node_polkit_audit
are branch-checked alongside #16 's image-builder modules.
- Vault auth (vault_k8s_auth_configure.sh): coexist both role sets. Keep
#16 's hermes-switchyard split + hermes-jenkins-token-seed; keep #14 's
hermes-scm-broker role. Preserve #14 's security property: hermes-agent
no longer holds developer-gitea (broker role carries it).
- agent-deployment.yaml / stage_runtime_access.py: keep #16 's
jenkins-image-build-token injection/staging; keep #14 's removal of the
agent's gitea-token/gitea-username.
- Bump vault-k8s-auth-hermes job -9 -> -10 (and its health check + test)
so the merged auth config re-applies over any -9 already in-cluster.
- flux hermes dependsOn: union jenkins + hermes-scm-broker + observer-rbac.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 21:07:06 -03:00
jenkins
b8f2163af0
hermes: prove sudo and polkit denial closed
...
Expand sudoers User_Alias chains so aliases, wildcards, netgroups, and
undefined names cannot smuggle authority to the Hermes account, and
require polkit grants to scope through exact literal identity
comparisons: computed strings, bracket lookups, subject aliasing,
operator-built values, and unconditional or wildcard grants fail closed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 15:15:47 -03:00
jenkins
e8c26ecf85
hermes: add daemonless agent image release lane
2026-08-17 08:25:52 -03:00
jenkins
8c6e3acdac
hermes: isolate Atlas SCM write authority
2026-08-17 07:58:44 -03:00
jenkins
762784da6b
hermes: bound Atlas pull request client
2026-08-17 07:22:26 -03:00
jenkins
0dd6ea0f02
hermes: add durable Telegram topics
2026-08-16 15:59:09 -03:00
jenkins
1527fd1af0
hermes: enforce goal completion evidence
2026-08-16 11:11:38 -03:00
jenkins
c7ac16d206
hermes: harden Atlas forge workflow
2026-08-16 07:59:35 -03:00
jenkins
612cefad23
monitoring(ai): add provider quota operations dashboard
2026-08-16 05:13:20 -03:00
jenkins
012e5fc2ba
hermes: recover stale kanban status pages
2026-08-16 04:49:02 -03:00
jenkins
4bab6130bc
hermes: close parked kanban tasks atomically
2026-08-16 04:31:00 -03:00
jenkins
7d284871e8
hermes: show activity during dashboard bootstrap
2026-08-16 03:33:41 -03:00
jenkins
9bc47f9ce3
hermes: keep durable worker activity visible
2026-08-16 01:20:08 -03:00
jenkins
1d2d386aeb
hermes: pin ARM64 runtime images
2026-08-15 22:32:08 -03:00
jenkins
c646bb264e
hermes: pin live recovery images
2026-08-15 22:15:40 -03:00
jenkins
89b9f1a4c7
hermes: isolate runtime access and expose activity
2026-08-15 22:15:40 -03:00
jenkins
de426607bd
hermes: roll live activity and Vault access image
2026-08-15 14:03:55 -03:00
jenkins
2ae88973be
hermes: add audited Atlas operator access
2026-08-15 13:22:01 -03:00
jenkins
29eeb1ebf8
hermes: recover workers after pod restart
2026-08-15 07:07:21 -03:00
jenkins
846c890527
hermes: load tool credentials before s6
2026-08-15 03:44:00 -03:00
jenkins
f7492defdd
hermes: recover Kanban and tool execution
2026-08-15 03:35:26 -03:00
jenkins
c21203b7ea
hermes: deliver generated media to Telegram
2026-08-15 00:34:08 -03:00
jenkins
9fa7612cd4
hermes: restore terminal rendering and worker lineage
2026-08-13 02:49:41 -03:00
jenkins
811201561e
hermes: roll out subscription status correction
2026-08-13 00:22:55 -03:00
jenkins
c11408258c
hermes: restore native provider routing
2026-08-12 23:08:21 -03:00
jenkins
d8566f007f
hermes: recover interrupted provider streams
2026-08-12 10:41:47 -03:00
jenkins
521f9f0b1b
hermes: bound local routing context
2026-08-12 09:40:20 -03:00
jenkins
49a0e2eb49
hermes: expose provider pool status
2026-08-12 02:23:31 -03:00
jenkins
422f001a93
hermes: make Switchyard the routing authority
2026-08-11 20:22:26 -03:00
jenkins
88f764a7c8
hermes: add automatic hosted and local image routes
2026-08-11 05:20:18 -03:00
jenkins
1e07d4c256
hermes: broker isolated chat through Codex
2026-08-11 03:15:34 -03:00
jenkins
b58afef655
hermes: deploy arm64 dashboard auth recovery
2026-08-11 02:48:31 -03:00
jenkins
388abff7c4
hermes: prewarm arm64 agent image
2026-08-11 02:46:29 -03:00
jenkins
436c9605bf
hermes: stabilize oauth sessions and enable images
2026-08-11 01:51:30 -03:00
jenkins
8df3d3314c
hermes: add private image generation and repair xhigh fallback
2026-08-11 01:14:46 -03:00
jenkins
bbb926526e
hermes(agent): route native Codex through CLI runtime
2026-08-10 22:39:51 -03:00
jenkins
94ea0253c4
hermes(agent): restore stock dashboard reliability
2026-08-10 21:09:06 -03:00
jenkins
f2a3616476
hermes: grant owner agent union access
2026-08-10 17:05:14 -03:00
jenkins
c817f3cef7
hermes(agent): replace HERDR with native CLI lanes
2026-08-10 16:31:06 -03:00
jenkins
379d2ea52e
fix(hermes): run coding workers unattended
2026-08-10 02:15:34 -03:00
jenkins
4d029f85b7
feat(hermes): add private voice and isolated workflows
2026-08-10 00:43:10 -03:00
jenkins
d5d70c0020
fix(hermes): make browser terminal copy reliable
2026-08-09 15:52:06 -03:00
jenkins
d71624410a
fix(hermes): provision Cassandra diagnostics
2026-08-09 14:38:51 -03:00
jenkins
fc99d114a3
fix(hermes): route new agent tabs
2026-08-09 14:08:45 -03:00
jenkins
772f05ac2e
security(hermes): canary current oauth proxy
2026-08-09 13:40:58 -03:00
jenkins
9bdcddad7c
feat(hermes): add Jetson-assisted auto routing
2026-08-09 02:42:30 -03:00
jenkins
639ac031a8
feat(hermes): strengthen isolated chat reasoning
2026-08-08 23:25:16 -03:00
jenkins
5bb04b37c7
fix(hermes): restore isolated user features
2026-08-08 21:28:33 -03:00
jenkins
04b42b1208
fix(hermes): harden non-root startup
2026-08-08 18:17:30 -03:00
jenkins
bb73efb285
feat(hermes): split chat agent and triage surfaces
2026-08-08 17:59:57 -03:00
