# Hermes WebUI release lane

Hermes WebUI has a release lane separate from `hermes-agent-image`. The lane
builds `dockerfiles/Dockerfile.hermes-webui` from one exact reviewed `main`
commit, publishes a unique immutable Harbor tag, independently verifies the
Harbor digest, and renders a review-only Flux patch. It never writes Git and it
never reconciles or restarts a workload.

## Release sequence

1. Merge and review all WebUI source, patch, theme, and PWA asset changes.
2. Wait for Flux to complete both Harbor immutability Jobs and refresh Jenkins
   JCasC from reviewed `main`.
3. Open the manual Jenkins job `hermes-webui-image` and set:
   - `PUBLISH_IMAGE=true`
   - `EXPECTED_SOURCE_REVISION` to the full 40-character `main` commit
   - `CONFIRM_PUBLISH=PUBLISH HERMES WEBUI`
4. Retain the fingerprinted seven-file artifact set. In particular, compare
   `hermes-webui-image.json` with Harbor and review
   `hermes-webui-image-update.patch`.
5. Apply that patch on a fresh branch and open a separate review. The patch is
   constrained to the `webui` container in:
   - `StatefulSet/hermes-chat-tenant`
   - `Deployment/hermes`
6. Merge the digest-only review to let Flux roll out desired state. Do not use a
   manual `kubectl set image`, restart, or reconcile as a release substitute.

The release fails closed when the requested revision is not the checked-out
`origin/main`, the unique Harbor tag already exists, the exact WebUI immutable
tag policy is absent, Kaniko and Harbor disagree on the digest, either Flux
workload changes identity/image shape, or the evidence archive is incomplete.

Harbor policy bootstrap has an intentional ordering dependency. The existing
`harbor-hermes-agent-immutability-ensure-1` Job grants the shared Jenkins
publisher only the read-only `immutable-tag:list` permission; the WebUI policy
Job creates and verifies the separate `hermes-webui` rule but does not edit the
publisher robot. Flux must therefore complete the existing Hermes agent policy
bootstrap before the WebUI Job and Jenkins release verification. This successor
does not include a WebUI image digest: until its WebUI publisher job and policy
are merged to `main` and bootstrapped, no image can be legitimately published
and independently verified through this lane.

## PWA identity source

The installed application uses the tracked canonical persona at
`dockerfiles/hermes-webui-assets/hermes-agent.ico`. Provenance, the canonical
SHA-256, and derivation details for the required 192px/512px PNGs are recorded
beside the asset in `SOURCE.md`; the image build never reads an icon from a
running coordinator.