jenkins
4dd5d1fcf7
vault: scope Hermes task grants to the SCM broker
2026-09-13 14:26:54 -05:00
jenkins
8036101f0b
Merge remote-tracking branch 'origin/feature/hermes-review-goal-semantics' into feature/hermes-distributed-worker-pool
...
# Conflicts:
# scripts/tests/test_dashboards_render_atlas_drilldowns.py
# scripts/tests/test_dashboards_render_jobs.py
# services/hermes/scm-common/scripts/scm_broker.py
# services/hermes/scripts/cli_lane_dispatch.py
# services/hermes/scripts/cli_lane_execution.py
# testing/quality_contract.json
# testing/tests/test_hermes_agent_access.py
# testing/tests/test_hermes_agent_security.py
# testing/tests/test_hermes_chat_config.py
# testing/tests/test_hermes_chat_images.py
# testing/tests/test_hermes_chat_provider_auth.py
# testing/tests/test_hermes_chat_quality.py
# testing/tests/test_hermes_chat_support.py
# testing/tests/test_hermes_chat_voice.py
# testing/tests/test_hermes_cli_finalization_edges.py
# testing/tests/test_hermes_cli_foundation_coverage.py
# testing/tests/test_hermes_cli_lanes_configuration.py
# testing/tests/test_hermes_cli_recovery_edges.py
# testing/tests/test_hermes_cli_retention_edges.py
# testing/tests/test_hermes_coordinator.py
# testing/tests/test_hermes_coordinator_boards.py
# testing/tests/test_hermes_coordinator_support.py
2026-08-18 01:43:39 -03:00
jenkins
9d42ff33f5
Merge origin/main ( #16 image-builder) into hermes-safe-gitea-pr
...
Resolve 8 conflicts, uniting #16 's daemonless image-release lane with
#14 's SCM broker + node-audit boundary. Nothing dropped from either side.
- quality_coverage.py / test_quality_coverage_helpers.py: take main's
dual-metric gate (line+branch enforced per file at minimum_percent);
drop #14 's now-dead branch_tracked_files/minimum_branch_percent keys.
- quality_contract.json: union all lists (managed_modules, lint_paths,
coverage_sources, tracked_files, hygiene globs) so #14 's scm-broker,
git_pack_objects, receive_pack_scan, deadline_http and node_polkit_audit
are branch-checked alongside #16 's image-builder modules.
- Vault auth (vault_k8s_auth_configure.sh): coexist both role sets. Keep
#16 's hermes-switchyard split + hermes-jenkins-token-seed; keep #14 's
hermes-scm-broker role. Preserve #14 's security property: hermes-agent
no longer holds developer-gitea (broker role carries it).
- agent-deployment.yaml / stage_runtime_access.py: keep #16 's
jenkins-image-build-token injection/staging; keep #14 's removal of the
agent's gitea-token/gitea-username.
- Bump vault-k8s-auth-hermes job -9 -> -10 (and its health check + test)
so the merged auth config re-applies over any -9 already in-cluster.
- flux hermes dependsOn: union jenkins + hermes-scm-broker + observer-rbac.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 21:07:06 -03:00
Hermes Agent
7a55b259bf
hermes: add the fenced three-node distributed execution pool
...
Three fenced worker Pods claim Hermes Kanban runs through a coordinator that
owns every state transition, with per-ordinal HMAC authority, a mediated
broker-only SCM path, and durable per-ordinal workspaces.
Content is the reviewed head of PR #18 (689bcb6e) with PR 16's and PR 19's
contributions removed: they were merged in only to validate co-existence and are
not prerequisites, so this branch no longer carries them as ancestors. Only PR 14
and PR 15 remain, because the broker boundary and the cli_lane_* decomposition
are load-bearing for two of the fixed P0 boundaries.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 16:31:15 +00:00
jenkins
e8c26ecf85
hermes: add daemonless agent image release lane
2026-08-17 08:25:52 -03:00
jenkins
8c6e3acdac
hermes: isolate Atlas SCM write authority
2026-08-17 07:58:44 -03:00
jenkins
89b9f1a4c7
hermes: isolate runtime access and expose activity
2026-08-15 22:15:40 -03:00
jenkins
86298cb9dc
vault: isolate Hermes node access identity
2026-08-15 13:55:17 -03:00
jenkins
ce8c25ff32
vault: authorize Hermes node identity
2026-08-15 13:22:01 -03:00
jenkins
0afcb59285
vault: keep auth bootstrap on healthy workers
2026-08-13 18:51:37 -03:00
jenkins
07454be23a
vault: separate Gitea reconciler credentials
2026-08-13 18:46:47 -03:00
jenkins
0752ee0d6c
vault: add Hermes developer credential paths
2026-08-13 17:39:19 -03:00
jenkins
422f001a93
hermes: make Switchyard the routing authority
2026-08-11 20:22:26 -03:00
jenkins
8df3d3314c
hermes: add private image generation and repair xhigh fallback
2026-08-11 01:14:46 -03:00
jenkins
bb73efb285
feat(hermes): split chat agent and triage surfaces
2026-08-08 17:59:57 -03:00
jenkins
9965b34534
feat(hermes): take the Anthropic credential from Vault
...
The Claude subscription OAuth token was created as a manual kubectl Secret in
the interest of demo time, with migration to Vault agreed as follow-up. The
value now lives at kv/atlas/hermes/agent-tokens and is injected as a file.
The hermes role gains that path and binds the hermes-triage service account
the deployment actually runs as; it previously bound only hermes-vault. The
init container prefers the Vault file and falls back to the Secret, so this
can be rolled back by removing the annotations alone, and the Secret should be
deleted once Vault has been serving it for a while.
Vault was reachable all along without the operator credential: Ariadne already
holds a vault-admin Kubernetes auth role, which is how the value was written.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-06 12:14:52 -03:00
jenkins
5f4bdc6e7e
ai(hermes): add isolated user chat instance
2026-08-02 02:31:01 -03:00
jenkins
a666c6c0ad
Preserve Cassandra legacy BYOK during cutover
2026-07-25 08:17:53 -03:00
jenkins
b5dd4f5058
feat(cassandra): add parallel migration infrastructure
2026-07-25 00:20:01 -03:00
jenkins
c1bcea55d2
Deploy Cassandra 0.7.65 generator worker
2026-07-24 02:04:03 -03:00
jenkins
880736b4ff
agent: replace OpenClaw with Hermes
2026-07-21 21:02:44 -03:00
jenkins
af1868b06b
vault: upgrade to 1.21.4
2026-07-18 14:04:08 -03:00
jenkins
13b5a98685
vault: upgrade to 1.20.4
2026-07-18 13:58:22 -03:00
jenkins
29e6ee6775
vault: upgrade to 1.19.5
2026-07-18 13:51:27 -03:00
jenkins
b33d990c22
vault: upgrade to 1.18.5
2026-07-18 13:43:18 -03:00
jenkins
662629c6f9
vault: allow admin raft snapshots
2026-07-18 13:40:04 -03:00
jenkins
ff7c42bab5
vault: discourage public indexing
2026-07-18 11:38:42 -03:00
jenkins
86895a59d5
vault: tighten public response headers
2026-07-18 11:34:54 -03:00
jenkins
69d48c7441
vault: allow ui mount detail checks
2026-07-18 08:21:25 -03:00
jenkins
0544a3b542
vault: keep ui api available
2026-07-18 08:19:50 -03:00
jenkins
77455e6dd8
vault: harden public ingress
2026-07-18 03:34:17 -03:00
jenkins
4c37dc1a47
Deploy Veles 0.4.1 runtime support
2026-06-27 19:07:16 -03:00
jenkins
74ab9bc78b
gitea: wire Veles OIDC login
2026-06-20 14:08:18 -03:00
jenkins
1d20fb35d2
veles: stage atlas infrastructure
2026-06-09 00:46:46 -03:00
jenkins
5bec30bd30
game-stream: deploy Wolf foundation
2026-05-21 02:07:17 -03:00
jenkins
712b97f64b
agent(openclaw): expose oauth protected UI
2026-05-20 17:22:12 -03:00
jenkins
5b9ba5b514
vault: use http health probes
2026-05-19 17:25:56 -03:00
jenkins
a194b4c9c6
recovery(post-outage): restore jellyfin and maintenance sync
2026-05-05 06:31:09 -03:00
jenkins
1917ec3e1d
recovery(metis): use atlas kv node secrets
2026-04-24 17:29:58 -03:00
jenkins
5b150958a4
recovery(metis): seed per-node vault password slots
2026-04-24 17:24:37 -03:00
7b2cea7637
ci(jenkins): inject sonarqube token from vault
2026-04-21 19:43:08 -03:00
2540250ff3
vault(auth): allow maintenance soteria oidc secret path
2026-04-12 17:23:41 -03:00
deb52c424b
maintenance/vault: move Metis runtime secrets to Vault
2026-04-05 11:31:05 -03:00
0828f0cf9e
maintenance: inject metis SSH keys directly from Vault
2026-04-05 10:31:20 -03:00
e84399d0b1
maintenance: source metis SSH keys from Vault
2026-04-05 10:25:29 -03:00
5ae6c5d4fb
maintenance: remoteize metis build and flash
2026-03-31 20:42:35 -03:00
fdc80b9c0f
sso: route metis through dedicated oauth2 proxy
2026-03-31 17:32:19 -03:00
00c0375790
comms: add synapse admin ensure job
2026-01-27 04:48:44 -03:00
1b6fac86fb
vault: bootstrap k8s auth config with root token
2026-01-27 01:04:57 -03:00
6062e266aa
vault: allow ariadne to use vault-admin role
2026-01-26 22:26:13 -03:00
