titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

Hermes WebUI release lane v2 #48

Merged
bstein merged 4 commits from feature/t_8cbe6a55-hermes-webui-release-v2 into main 2026-08-23 12:19:10 +00:00
Conversation 1 Commits 4 Files Changed 25 +2743 -81
hermes-automation commented 2026-08-23 04:49:07 +00:00
Member
Copy Link

This draft supersedes #47 because #47 is immutable and its PWA manifest gate was tautological: it verified a tracked manifest copied into the image, not the manifest and icons actually served by upstream server.py. Please close #47 unmerged.

This successor replays the reviewed WebUI release lane on fresh main and fixes PWA verification. The image build now guards the exact pinned upstream manifest before replacement, boots the actual upstream server, requires branded Hermes JSON from /manifest.json, resolves and validates every served manifest icon as PNG, verifies the branded root HTML, and directly validates the 192px persona PNG.

Bootstrap limitation: no WebUI publisher/job/policy is on main, therefore no legitimate WebUI image digest is included. The existing Hermes agent Harbor policy bootstrap must first grant the shared publisher read-only immutable-tag:list; after this change is merged and Flux has completed both policy bootstraps, Jenkins can publish from an exact reviewed main revision and produce a separate digest-only review.

Validation: 180 focused brand, release, handsfree STT, voice, TTS, chat image, and chat runtime tests passed; relevant Ruff passed; kustomize built services/hermes (141 resources) and services/harbor (31 resources); the actual pinned server smoke passed all required HTTP checks; git diff --check passed.

No cluster or Flux mutation, workload change, image publication, reconciliation, or unverified digest pin is included. Human actions: review this draft, close #47 unmerged, merge only if approved, wait for Flux policy bootstrap, then run the manual WebUI publisher and review its digest patch separately.

This draft supersedes #47 because #47 is immutable and its PWA manifest gate was tautological: it verified a tracked manifest copied into the image, not the manifest and icons actually served by upstream server.py. Please close #47 unmerged. This successor replays the reviewed WebUI release lane on fresh main and fixes PWA verification. The image build now guards the exact pinned upstream manifest before replacement, boots the actual upstream server, requires branded Hermes JSON from /manifest.json, resolves and validates every served manifest icon as PNG, verifies the branded root HTML, and directly validates the 192px persona PNG. Bootstrap limitation: no WebUI publisher/job/policy is on main, therefore no legitimate WebUI image digest is included. The existing Hermes agent Harbor policy bootstrap must first grant the shared publisher read-only immutable-tag:list; after this change is merged and Flux has completed both policy bootstraps, Jenkins can publish from an exact reviewed main revision and produce a separate digest-only review. Validation: 180 focused brand, release, handsfree STT, voice, TTS, chat image, and chat runtime tests passed; relevant Ruff passed; kustomize built services/hermes (141 resources) and services/harbor (31 resources); the actual pinned server smoke passed all required HTTP checks; git diff --check passed. No cluster or Flux mutation, workload change, image publication, reconciliation, or unverified digest pin is included. Human actions: review this draft, close #47 unmerged, merge only if approved, wait for Flux policy bootstrap, then run the manual WebUI publisher and review its digest patch separately.
hermes-automation added 3 commits 2026-08-23 04:49:08 +00:00
bstein approved these changes 2026-08-23 12:18:47 +00:00
bstein changed title from WIP: Hermes WebUI release lane v2 to Hermes WebUI release lane v2 2026-08-23 12:18:53 +00:00
bstein added 1 commit 2026-08-23 12:19:01 +00:00
Merge branch 'main' into feature/t_8cbe6a55-hermes-webui-release-v2
Some checks failed
Tests / Declarative: Post Actions failed: 39, skipped: 19, passed: 2782
Details
58e1a29b2b
bstein merged commit ced9a24cd9 into main 2026-08-23 12:19:10 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
bstein
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
atlas-reconciler bstein hermes-automation
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: titan/atlas-iac#48
No description provided.
Delete Branch "feature/t_8cbe6a55-hermes-webui-release-v2"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?