# Hermes WebUI release lane

Hermes WebUI has a release lane separate from `hermes-agent-image`. The lane
builds `dockerfiles/Dockerfile.hermes-webui` from one exact reviewed `main`
commit, publishes a unique immutable Harbor tag, independently verifies the
Harbor digest, and renders a review-only Flux patch. It never writes Git and it
never reconciles or restarts a workload.

## Release sequence

1. Merge and review all WebUI source, patch, theme, and PWA asset changes.
2. Wait for Flux to complete both Harbor immutability Jobs and refresh Jenkins
   JCasC from reviewed `main`.
3. Open the manual Jenkins job `hermes-webui-image` and set:
   - `PUBLISH_IMAGE=true`
   - `EXPECTED_SOURCE_REVISION` to the full 40-character `main` commit
   - `CONFIRM_PUBLISH=PUBLISH HERMES WEBUI`
4. Retain the fingerprinted seven-file artifact set. In particular, compare
   `hermes-webui-image.json` with Harbor and review
   `hermes-webui-image-update.patch`.
5. Apply that patch on a fresh branch and open a separate review. The patch is
   constrained to the `webui` container in:
   - `StatefulSet/hermes-chat-tenant`
   - `Deployment/hermes`
6. Merge the digest-only review to let Flux roll out desired state. Do not use a
   manual `kubectl set image`, restart, or reconcile as a release substitute.

The release fails closed when the requested revision is not the checked-out
`origin/main`, the unique Harbor tag already exists, the exact WebUI immutable
tag policy is absent, Kaniko and Harbor disagree on the digest, either Flux
workload changes identity/image shape, or the evidence archive is incomplete.

## PWA identity source

The installed application uses the tracked canonical persona at
`dockerfiles/hermes-webui-assets/hermes-agent.ico`. Provenance, the canonical
SHA-256, and derivation details for the required 192px/512px PNGs are recorded
beside the asset in `SOURCE.md`; the image build never reads an icon from a
running coordinator.