"""Core configuration and workload contracts for Hermes chat.""" from __future__ import annotations import importlib.util import sys from types import SimpleNamespace import yaml from testing.tests.test_hermes_chat_support import ( HERMES, ROOT, _documents, ) def test_chat_config_enables_real_research_compute_and_delegation(): configmap = _documents(HERMES / "chat-configmap.yaml")[0] config = yaml.safe_load(configmap["data"]["config.yaml"]) # AUTO leaves effort unset so the target chosen by Switchyard owns it. assert "reasoning_effort" not in config["agent"] assert config["model"]["model"] == "atlas/auto/fast" assert config["web"] == { "backend": "ddgs", "search_backend": "ddgs", "extract_backend": "public-extract", } assert config["delegation"]["max_concurrent_children"] == 2 assert config["delegation"]["max_iterations"] == 80 assert config["agent"]["max_turns"] == 120 assert config["tool_loop_guardrails"]["hard_stop_enabled"] is True for platform in ("cli", "api_server"): toolsets = config["platform_toolsets"][platform] assert "delegation" in toolsets assert "browser" in toolsets assert "python_sandbox" in toolsets assert "vision" in toolsets assert "web" in toolsets assert "image_gen" in toolsets assert "terminal" not in toolsets assert "code_execution" not in toolsets def test_agent_config_keeps_delegated_reviewers_from_owning_task_lifecycle(): configmap = _documents(HERMES / "agent-configmap.yaml")[0] instructions = configmap["data"]["AGENTS.md"] soul = configmap["data"]["SOUL.md"] config = yaml.safe_load(configmap["data"]["config.yaml"]) assert ( "Only the foreground durable worker owns its Kanban task lifecycle" in instructions ) assert "Never unblock and then complete" in instructions assert "gateway dispatcher can claim the transient" in instructions for platform in ("cli", "api_server"): assert "kanban" in config["platform_toolsets"][platform] assert "must never complete, block, unblock, reclaim" in instructions assert "task's final structured result itself" in instructions assert "Atlas organization has private visibility" in instructions assert "may be public or private" in instructions assert "do not infer a\nrepository's visibility" in instructions assert "brokered Git for clone, fetch" in instructions assert "client carries no repository credential" in instructions assert "Never call `kanban_show` without a known, non-empty task ID" in instructions assert "bounded ad-hoc inspection and acceptance checks may" in instructions assert "load implementation or TDD skills" in instructions assert "Never call `kanban_show` without\na known, non-empty task ID" in soul assert "must load a skill only when its workflow\nmaterially applies" in soul assert "no repository token is present in this pod" in soul assert "`scm.bstein.dev` is Forgejo/Gitea, not GitHub" in instructions assert "GitHub/`gh` skill for an Atlas remote" in instructions assert "load\n`$manage-atlas-pull-requests`" in instructions assert "Updates, merge,\napprove, close, delete, comments" in instructions assert "Leave every PR\nunmerged for Brad's review" in instructions assert "Use the Gitea pull-request merge endpoint" not in instructions assert "reconcile the open PR" not in instructions assert "use Flux reconciliation after" not in instructions assert "PR publication ends at the verified open draft" in instructions assert "JENKINS_BASE_URL" in instructions assert "Do not\nuse `git reset --hard`" in instructions rendered = (HERMES / "agent-deployment.yaml").read_text() assert 'git config --global user.name "Hermes Agent"' in rendered assert 'git config --global user.email "hermes@bstein.dev"' in rendered def test_agent_image_completes_parked_kanban_tasks_atomically(): dockerfile = (ROOT / "dockerfiles" / "Dockerfile.hermes-agent").read_text() assert ( "AND status IN ('running', 'ready', 'blocked', 'scheduled')" in dockerfile ) assert ( "Atomically mark running, ready, blocked, or scheduled tasks done" in dockerfile ) assert "kind IN ('created', 'blocked', 'unblocked')" in dockerfile assert "payload.get(\"status\") == \"blocked\"" in dockerfile assert "hermes-kanban-blocked-regression.py" in dockerfile def test_sandbox_shares_only_the_tenant_workspace_without_credentials(): sandbox_docs = _documents(HERMES / "chat-sandbox.yaml") deployments = [doc for doc in sandbox_docs if doc["kind"] == "Deployment"] assert len(deployments) == 8 for ordinal, deployment in enumerate(deployments): pod_spec = deployment["spec"]["template"]["spec"] container = pod_spec["containers"][0] assert pod_spec["automountServiceAccountToken"] is False assert container["securityContext"]["readOnlyRootFilesystem"] is True assert container["securityContext"]["runAsNonRoot"] is True assert container["securityContext"]["runAsGroup"] == 10000 assert not container.get("env") assert {mount["mountPath"] for mount in container["volumeMounts"]} == { "/tmp", "/workspace", "/opt/data/workspace", } workspace_volume = next( item for item in pod_spec["volumes"] if item["name"] == "workspace" ) assert workspace_volume["persistentVolumeClaim"]["claimName"] == ( f"workspace-hermes-chat-tenant-{ordinal}" ) statefulset = _documents(HERMES / "chat-statefulset.yaml")[0] templates = statefulset["spec"]["volumeClaimTemplates"] workspace = next(item for item in templates if item["metadata"]["name"] == "workspace") assert workspace["spec"]["resources"]["requests"]["storage"] == "10Gi" assert workspace["spec"]["accessModes"] == ["ReadWriteMany"] pod_spec = statefulset["spec"]["template"]["spec"] hermes = next(item for item in pod_spec["containers"] if item["name"] == "hermes") startup = hermes["args"][0] assert "hermes-chat-sandbox-${ordinal}.hermes-chat-sandbox" in startup assert any( mount["name"] == "workspace" and mount["mountPath"] == "/opt/data/workspace" for mount in hermes["volumeMounts"] ) policies = _documents(HERMES / "networkpolicy.yaml") deny = next( item for item in policies if item["metadata"]["name"] == "hermes-chat-sandbox-deny" ) assert deny["spec"]["ingress"] == [] assert deny["spec"]["egress"] == [] for ordinal in range(4): policy = next( item for item in policies if item["metadata"]["name"] == f"hermes-chat-sandbox-tenant-{ordinal}" ) assert policy["spec"]["podSelector"]["matchLabels"][ "ai.bstein.dev/tenant-ordinal" ] == str(ordinal) source = policy["spec"]["ingress"][0]["from"][0]["podSelector"][ "matchLabels" ] assert source["statefulset.kubernetes.io/pod-name"] == ( f"hermes-chat-tenant-{ordinal}" ) def test_gateway_image_honors_ui_model_and_caps_reasoning(): dockerfile = (ROOT / "dockerfiles" / "Dockerfile.hermes-agent").read_text() assert ( "FROM harbor-core.harbor.svc.cluster.local/mirror/hermes-agent@sha256:" "9c841866021c54c4596849f6135717e8a4d52ba510b7f52c50aef1de1a283973" ) in dockerfile assert "_resolve_request_route" in dockerfile assert 'allowed_providers = {"atlas-switchyard"}' in dockerfile assert 'reasoning_effort=body.get("reasoning_effort")' in dockerfile assert 'reasoning_config = {"enabled": True, "effort": "xhigh"}' in dockerfile assert "ddgs==9.14.4" in dockerfile assert "specific not in _LEGACY_WEB_BACKENDS" in dockerfile assert '"pre_internal_route"' in dockerfile assert "pre_internal_route hook failed" in dockerfile assert '"pre_subagent_route"' in dockerfile assert "pre_subagent_route hook failed" in dockerfile assert "agent._hermes_explicit_model_pick = bool" in dockerfile assert "agent._hermes_oneshot = True" in dockerfile assert 'getattr(parent_agent, "_hermes_oneshot", False)' in dockerfile assert 'var != "CLAUDE_CODE_OAUTH_TOKEN"' in dockerfile assert '"source": "managed_claude_code_subscription"' in dockerfile assert '"name": "Claude Code subscription (Switchyard)"' in dockerfile assert "Anthropic API / direct OAuth (not used by Switchyard)" in dockerfile assert "scheduleTerminalPaint" in dockerfile assert "sessionTree.childrenByParent" in dockerfile assert "SessionActivityPanel" in dockerfile assert "include_children=${includeChildren}" in dockerfile assert "_dashboard_session_is_active" in dockerfile assert 'searchParams.get("lineage_root") || resumeParam' in dockerfile assert "followActiveLineage" in dockerfile assert 'next.delete("lineage_root")' in dockerfile activity = ( ROOT / "dockerfiles" / "hermes-session-activity-panel.tsx" ).read_text() assert "Live worker activity" in activity assert "api.getSessionMessages" in activity assert "aria-live=\"polite\"" in activity assert "role=\"log\"" in activity assert "aria-busy={running && messages.length === 0}" in activity assert 'detail.source !== "api_server"' not in activity assert "Poll-backed transcript; terminal rendering is not required." in activity assert "DEFAULT_VISIBLE_MESSAGES = 250" in activity assert "current + DEFAULT_VISIBLE_MESSAGES" in activity assert 'Show up to{" "}' in activity assert "Math.min(" in activity assert "visibleMessages.map" in activity assert "response.total_messages" in activity assert "visibleLimit)," in activity assert "function displayText(value: unknown)" in activity assert "open && (" in activity assert 'document.getElementById("hermes-resume-bootstrap")?.remove()' in activity assert 'id="hermes-resume-bootstrap"' in dockerfile assert 'role="status"' in dockerfile assert 'aria-busy="true"' in dockerfile assert "Opening Hermes worker activity…" in dockerfile assert 'params.has("resume")' in dockerfile assert "Open Telegram setup" in dockerfile def test_telegram_router_local_build_defaults_to_cluster_architecture(): dockerfile = ( ROOT / "dockerfiles" / "Dockerfile.hermes-chat-router" ).read_text(encoding="utf-8") assert "ARG TARGETOS=linux" in dockerfile assert "ARG TARGETARCH=arm64" in dockerfile assert "GOOS=${TARGETOS} GOARCH=${TARGETARCH}" in dockerfile def test_chat_oauth_allows_stale_service_worker_retirement(): documents = _documents(HERMES / "oauth2-proxy.yaml") deployment = next( document for document in documents if document["kind"] == "Deployment" and document["metadata"]["name"] == "oauth2-proxy-hermes-chat" ) args = deployment["spec"]["template"]["spec"]["containers"][0]["args"] assert "--skip-auth-route=GET=^/sw[.]js([?].*)?$" in args assert "--custom-templates-dir=/etc/oauth2-proxy/templates" in args template = (HERMES / "oauth2-proxy-templates" / "error.html").read_text() assert 'http-equiv="refresh"' not in template assert "Unable to find a valid CSRF token" in template assert "expired or was already used" in template assert "sessionStorage" in template assert "Automatic recovery paused" in template assert "/start?rd=/" in template container = deployment["spec"]["template"]["spec"]["containers"][0] assert "v7.15.3@sha256:10a1165743a192e" in container["image"] assert "--cookie-csrf-per-request=true" in args assert "--cookie-csrf-per-request-limit=8" in args assert "--trusted-proxy-ip=10.42.0.0/16" in args assert "--api-route=^/api/" in args assert "--api-route=^/health$" in args assert "--cookie-expire=168h" in args assert "--cookie-refresh=19m" in args assert "--session-store-type=redis" in args assert any( arg.startswith("--redis-connection-url=redis://hermes-oauth-sessions.") for arg in args ) agent = _documents(HERMES / "agent-deployment.yaml")[0] agent_pod = agent["spec"]["template"]["spec"] agent_oauth = next( container for container in agent_pod["containers"] if container["name"] == "oauth2-proxy" ) assert "--custom-templates-dir=/etc/oauth2-proxy/templates" in agent_oauth["args"] assert { "name": "oauth-templates", "mountPath": "/etc/oauth2-proxy/templates", "readOnly": True, } in agent_oauth["volumeMounts"] agent_template_volume = next( volume for volume in agent_pod["volumes"] if volume["name"] == "oauth-templates" ) assert agent_template_volume["configMap"]["name"] == ( "hermes-chat-oauth-templates" ) def test_webui_recovers_auth_and_labels_session_scoped_controls(): dockerfile = (ROOT / "dockerfiles" / "Dockerfile.hermes-webui").read_text() assert "res.status===401||res.status===403" in dockerfile assert "window.location.assign('/oauth2/start?rd='" in dockerfile assert "childrenExpanded?'▾ ':'▸ '" in dockerfile assert "'atlas/auto/maximum': 'Automatic · Maximum'" in dockerfile assert "hermes-webui-telegram-project-patch.py" in dockerfile telegram_project_patch = ( ROOT / "dockerfiles" / "hermes-webui-telegram-project-patch.py" ).read_text() assert "TELEGRAM_PROJECT_NAME = 'Telegram'" in telegram_project_patch assert "session_key.startswith('telegram-topic-')" in telegram_project_patch router = (ROOT / "dockerfiles" / "hermes-webui-router.js").read_text() assert "'atlas/auto/fast':'Automatic · Fast'" in router assert "'atlas/manual/codex/sol':'Codex · SOL'" in router assert "'atlas/manual/claude/opus':'Claude · Opus'" in router assert "watchModelOptions('modelSelect')" in router assert "watchModelOptions('settingsModel')" in router def test_chat_voice_uses_private_jetson_services_and_shared_auto_route(): statefulset = _documents(HERMES / "chat-statefulset.yaml")[0] containers = statefulset["spec"]["template"]["spec"]["containers"] webui = next(item for item in containers if item["name"] == "webui") env = {item["name"]: item["value"] for item in webui["env"] if "value" in item} assert env["HERMES_STT_URL"] == ( "http://hermes-stt.hermes.svc.cluster.local:9000/v1/audio/transcriptions" ) assert env["HERMES_WEBUI_ATLAS_STT_STREAM_URL"] == ( "http://hermes-stt.hermes.svc.cluster.local:9000/v1/audio/transcriptions/stream" ) assert env["HERMES_WEBUI_ATLAS_TTS_URL"] == ( "http://hermes-tts.hermes.svc.cluster.local:9001/v1/audio/speech" ) assert env["HERMES_WEBUI_ATLAS_TTS_STREAM_URL"] == ( "http://hermes-tts.hermes.svc.cluster.local:9001/v1/audio/speech/stream" ) assert "hermes_stt_client.py" in env["HERMES_LOCAL_STT_COMMAND"] configmap = _documents(HERMES / "chat-configmap.yaml")[0] config = yaml.safe_load(configmap["data"]["config.yaml"]) assert config["stt"] == { "enabled": True, "provider": "local_command", "local": {"model": "small", "language": "auto"}, } dockerfile = (ROOT / "dockerfiles" / "Dockerfile.hermes-webui").read_text() assert "hermes-webui-atlas-patch.py" in dockerfile assert "hermes-webui-atlas-voice.js" in dockerfile voice_script = (ROOT / "dockerfiles" / "hermes-webui-atlas-voice.js").read_text() assert "/api/transcribe/capability" in voice_script assert "/api/transcribe" in voice_script assert "/api/tts" in voice_script assert "speakResponse(generation)" in voice_script assert "window._atlasAdaptiveChunks" in voice_script assert "preferredCut(firstSlice,40,52,60)" in voice_script assert "preferredCut(remaining,100,120,140)" in voice_script assert "hermes-atlas-voice-latency-v2" in voice_script assert "hermes-voice-silence-ms','1100'" in voice_script assert "const nextPrepared=next.then" in voice_script assert "At most one later synthesis request exists" in voice_script assert "restartSoon(turn.token,300)" in voice_script assert "constraints.voiceIsolation=true" in voice_script assert "highpass.frequency.value=140" in voice_script assert "Math.max(0.04,noiseFloor*2.4+0.006)" in voice_script assert "recorder.start();" in voice_script assert "recorder.start(250)" not in voice_script assert "function flushRetainedTail(turn)" in voice_script # folded interim tail is spoken, never dropped stt_server = (ROOT / "dockerfiles" / "hermes-jetson-stt-server.py").read_text() assert "def _repetitive_token" in stt_server assert '"compression_ratio_threshold": 2.0' in stt_server assert '"no_speech_threshold": 0.5' in stt_server def test_worker_webui_rollouts_do_not_repeat_completed_state_migration(): deployment = _documents(HERMES / "deployment.yaml")[0] pod_spec = deployment["spec"]["template"]["spec"] init = next( item for item in pod_spec["initContainers"] if item["name"] == "patch-api-server-sessions" ) assert pod_spec["securityContext"]["fsGroupChangePolicy"] == "OnRootMismatch" command = "\n".join(init["command"]) assert "patch_api_server_sessions.py" in command assert "migrate_api_session_lineage.py" not in command def test_voice_transcript_filter_removes_fan_hallucinations(monkeypatch): server_path = ROOT / "dockerfiles" / "hermes-jetson-stt-server.py" spec = importlib.util.spec_from_file_location("hermes_jetson_stt_server", server_path) assert spec and spec.loader module = importlib.util.module_from_spec(spec) monkeypatch.setitem(sys.modules, "cgi", SimpleNamespace()) monkeypatch.setitem( sys.modules, "torch", SimpleNamespace(cuda=SimpleNamespace(is_available=lambda: False)), ) monkeypatch.setitem(sys.modules, "whisper", SimpleNamespace()) spec.loader.exec_module(module) result = { "segments": [ { "text": " ththththththththth Testing.", "no_speech_prob": 0.12, "avg_logprob": -0.2, }, { "text": " background hum", "no_speech_prob": 0.82, "avg_logprob": -0.9, }, ] } assert module._clean_transcript(result) == "Testing." def test_voice_models_are_baked_and_runtime_has_no_public_egress(): stt_dockerfile = (ROOT / "dockerfiles" / "Dockerfile.hermes-jetson-stt").read_text() tts_dockerfile = (ROOT / "dockerfiles" / "Dockerfile.hermes-jetson-tts").read_text() assert "ADD --checksum=sha256:aff26ae4" in stt_dockerfile assert "ADD --checksum=sha256:9ecf7799" in stt_dockerfile assert "--chmod=0444" in stt_dockerfile assert "chmod 0555 /opt/models /opt/models/whisper" in stt_dockerfile assert "HERMES_STT_CACHE=/opt/models/whisper" in stt_dockerfile assert "ADD --checksum=sha256:4cabf7c3" in tts_dockerfile assert "ADD --checksum=sha256:db42b97d" in tts_dockerfile assert "ADD --checksum=sha256:b3a6e47b57b8c7fbe6a0ce2518161a50f59a9cdd8a50835c02cb02bdd6206c18" in tts_dockerfile assert "ADD --checksum=sha256:95a23eb4d42909d38df73bb9ac7f45f597dbfcde2d1bf9526fdeaf5466977d77" in tts_dockerfile assert "ADD --checksum=sha256:8ff38212d23da300bbe3705c645e6e5b9475f0bfde01558eb17813e22acaaaaa" in tts_dockerfile assert "ADD --checksum=sha256:c2ec28bb38e2b59e93b959b3e40348c1afebbd272f30fed5d41205d08e98a9d7" in tts_dockerfile assert "ADD --checksum=sha256:3ef40a71ea63852cd8ab7e6fa7d2ecdcfa67a0b47c9c48e3f10e02ee02083ea0" in tts_dockerfile assert "ADD --checksum=sha256:1afc81f703c0e4cb3b4d7c0dca096b8b54a98806807f0170cf5eb5557723c12d" in tts_dockerfile assert tts_dockerfile.count("--chmod=0444") == 12 assert "/opt/models/piper/en_US-amy-medium.onnx" in tts_dockerfile assert "/opt/models/piper/ru_RU-irina-medium.onnx" in tts_dockerfile assert "/opt/models/piper/es_MX-claude-high.onnx" in tts_dockerfile assert "chmod 0555 /opt/models /opt/models/piper" in tts_dockerfile assert "HERMES_TTS_CACHE=/opt/models/piper" in tts_dockerfile assert "HERMES_TTS_VOICE=en_US-amy-medium" in tts_dockerfile tts_server = (ROOT / "dockerfiles" / "hermes-jetson-tts-server.py").read_text() assert "download_voice" not in tts_server assert "baked Piper voice is missing" in tts_server assert "session_options.intra_op_num_threads = threads" in tts_server assert 'LANGUAGE_VOICE_MAP = {' in tts_server assert '"en": "en_US-amy-medium"' in tts_server assert '"ru": "ru_RU-irina-medium"' in tts_server assert '"es": "es_MX-claude-high"' in tts_server policies = _documents(HERMES / "networkpolicy.yaml") voice_policy = next( item for item in policies if item["metadata"]["name"] == "hermes-private-voice" ) assert voice_policy["spec"]["policyTypes"] == ["Ingress", "Egress"] assert not any( "ipBlock" in destination for rule in voice_policy["spec"]["egress"] for destination in rule.get("to", []) ) def test_voice_workloads_have_deliberate_xavier_placement(): documents = _documents(HERMES / "voice-deployment.yaml") deployments = { item["metadata"]["name"]: item for item in documents if item["kind"] == "Deployment" } stt = deployments["hermes-stt"]["spec"]["template"]["spec"] tts = deployments["hermes-tts"]["spec"]["template"]["spec"] assert "@sha256:" in stt["containers"][0]["image"] assert "@sha256:" in tts["containers"][0]["image"] assert stt["nodeSelector"] == {"kubernetes.io/hostname": "titan-21"} assert tts["nodeSelector"] == {"kubernetes.io/hostname": "titan-21"} assert stt["automountServiceAccountToken"] is False assert tts["automountServiceAccountToken"] is False assert stt["enableServiceLinks"] is False assert tts["enableServiceLinks"] is False assert stt["runtimeClassName"] == "nvidia" assert stt["securityContext"]["supplementalGroups"] == [44] stt_resources = stt["containers"][0]["resources"] stt_env = { item["name"]: item["value"] for item in stt["containers"][0]["env"] } assert stt_env["NVIDIA_DRIVER_CAPABILITIES"] == "compute,utility" assert stt_resources["requests"]["nvidia.com/gpu.shared"] == 1 assert stt_resources["limits"]["nvidia.com/gpu.shared"] == 1 assert "nvidia.com/gpu.shared" not in tts["containers"][0]["resources"]["requests"] tts_env = { item["name"]: item["value"] for item in tts["containers"][0]["env"] } # Keep the deployment neutral so the old and new immutable images can # cross one Flux rollout safely; each image owns its compatible default. assert "HERMES_TTS_VOICE" not in tts_env assert tts_env["HERMES_TTS_ONNX_THREADS"] == "4" assert tts["containers"][0]["resources"]["limits"]["cpu"] == "4" assert all("hostPath" not in volume for volume in stt["volumes"]) assert all("hostPath" not in volume for volume in tts["volumes"])