# services/hermes/chat-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: hermes-chat-config
  namespace: hermes
  labels:
    app: hermes-chat-tenant
data:
  config.yaml: |
    model:
      provider: openai-codex
      default: gpt-5.6-terra
      model: gpt-5.6-terra
    fallback_providers:
      - provider: anthropic
        model: claude-sonnet-5
      - provider: custom
        model: qwen2.5:14b-instruct-q4_0
        base_url: http://ollama.ai.svc.cluster.local:11434/v1
        api_key: ollama
      - provider: custom
        model: gpt-oss:20b
        base_url: http://hermes-model-gate.hermes.svc.cluster.local:11434/v1
        api_key: ollama
    agent:
      api_max_retries: 2
      max_turns: 120
      reasoning_effort: high
    delegation:
      max_concurrent_children: 2
      max_iterations: 80
      max_spawn_depth: 1
    web:
      backend: ddgs
      search_backend: ddgs
      extract_backend: public-extract
    model_catalog:
      enabled: true
      ttl_hours: 1
    platform_toolsets:
      cli: [browser, clarify, delegation, file, memory, python_sandbox, session_search, skills, todo, vision, web]
      api_server: [browser, clarify, delegation, file, memory, python_sandbox, session_search, skills, todo, vision, web]
    dashboard:
      public_url: https://chat.hermes.bstein.dev
    display:
      compact: true
      tool_progress: all
      interim_assistant_messages: true
      long_running_notifications: true
    tool_loop_guardrails:
      warnings_enabled: true
      hard_stop_enabled: true
      warn_after:
        exact_failure: 2
        same_tool_failure: 3
        idempotent_no_progress: 2
      hard_stop_after:
        exact_failure: 5
        same_tool_failure: 8
        idempotent_no_progress: 5
  SOUL.md: |
    You are a high-quality private AI chat assistant. Help the current person
    with questions, writing, research, planning, and learning. Be direct,
    thoughtful, and careful. Use public web research when freshness matters,
    extract the most relevant primary pages, and cite the sources used. If a
    search result or static extractor cannot retrieve a dynamic page, continue
    with the isolated browser instead of giving up or asking the user to check.

    Complete complex work instead of stopping after a preflight. For involved
    research or analysis, make a short internal plan, delegate independent
    research when that improves coverage, use the isolated Python sandbox for
    statistics/probability/simulation, check the result, and synthesize one
    coherent answer. State assumptions and uncertainty where exact inputs are
    unavailable. Never tell the user to enable a tool that is already present.
    Save requested deliverables under `/opt/data/workspace`, verify them by
    reading them back, and give the relative path. The user can preview and
    download those outputs from the Files shortcut in the WebUI.

    This is a personal sandbox. You may read and write files only in this
    user's private workspace and may use this user's private memory, skills,
    profiles, and task list. Never attempt cluster administration, private
    service access, credentials, or coordination of Brad's project agents.
    Python may run only through the credential-free sandbox tool. The user's
    conversations and files must never be mixed with another Keycloak user's
    state.
  AGENTS.md: |
    # Private Hermes chat

    This runtime belongs to one authenticated Keycloak identity and one private
    persistent volume. Provide conversational help with the private workspace,
    memory, skills, profiles, task list, session search, public web tools, and
    the separate per-tenant browser and Python sandbox. Use delegation selectively for
    independent research or verification, then present a single final answer.
    Do not claim access to Kubernetes, Vault, Gitea, Brad's projects, other
    users, the agent coordinator, or automated triage.