# services/hermes/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: hermes
metadata:
  annotations:
    hermes.bstein.dev/agent-image-release-hold: "true"
    hermes.bstein.dev/agent-image-release-hold-digest: "sha256:bebfe9c24cdd877ed2c16335027ccf393892161642756f54e8d12984eefdd903"
    hermes.bstein.dev/agent-image-release-hold-minimum-source: "106ee8ce14aa67c3825fca6fb537a557b44ecd86"
    hermes.bstein.dev/agent-image-release-hold-reason: "Hold the verified SQLite 3.51.3 runtime until the normal Hermes release includes it."
images:
  - name: registry.bstein.dev/bstein/hermes-agent
    # Hold this verified SQLite fix until the normal image release includes it.
    digest: sha256:bebfe9c24cdd877ed2c16335027ccf393892161642756f54e8d12984eefdd903
resources:
  - namespace.yaml
  - image.yaml
  - scm-common
  - vault-serviceaccount.yaml
  - configmap.yaml
  - agent-configmap.yaml
  - chat-configmap.yaml
  - switchyard-configmap.yaml
  - rbac.yaml
  - node-ssh-access.yaml
  - pvc.yaml
  - switchyard-pvc.yaml
  - routing-catalog-pvc.yaml
  - chat-pvcs.yaml
  - oauth-session-store.yaml
  - model-gate-rbac.yaml
  - local-image-rbac.yaml
  - ariadne-handoff-rbac.yaml
  - model-gate-state.yaml
  - model-gate-configmap.yaml
  - model-gate-deployment.yaml
  - switchyard-deployment.yaml
  - image-policy-configmap.yaml
  - networkpolicy.yaml
  - local-image-deployment.yaml
  - deployment.yaml
  - agent-deployment.yaml
  - voice-deployment.yaml
  - chat-statefulset.yaml
  - chat-sandbox.yaml
  - chat-router.yaml
  - service.yaml
  - switchyard-service.yaml
  - oauth2-proxy.yaml
  - agent-certificate.yaml
  - agent-ingress.yaml
  - execution-worker-rbac.yaml
  - hux-evidence-rbac.yaml
  - chat-cluster-read-rbac.yaml
  - execution-worker-statefulset.yaml
  - execution-mediator.yaml
  - execution-worker-networkpolicy.yaml
patches:
  - path: execution-coordinator-patch.yaml
configMapGenerator:
  - name: hermes-chat-oauth-templates
    namespace: hermes
    files:
      - error.html=oauth2-proxy-templates/error.html
    options:
      disableNameSuffixHash: true
  - name: hermes-operator-guide
    namespace: hermes
    files:
      - OPERATOR-RUNBOOK.md=NOTES.md
    options:
      disableNameSuffixHash: true
  - name: hermes-execution-pool
    namespace: hermes
    files:
      - claude_oauth_exec=scripts/claude_oauth_exec
      - cli_lane_board.py=scripts/cli_lane_board.py
      - cli_lane_capabilities.py=scripts/cli_lane_capabilities.py
      - cli_lane_config.py=scripts/cli_lane_config.py
      - cli_lane_dispatch.py=scripts/cli_lane_dispatch.py
      - cli_lane_evidence.py=scripts/cli_lane_evidence.py
      - cli_lane_execution.py=scripts/cli_lane_execution.py
      - cli_lane_failover.py=scripts/cli_lane_failover.py
      - cli_lane_files.py=scripts/cli_lane_files.py
      - cli_lane_finalization.py=scripts/cli_lane_finalization.py
      - cli_lane_goal.py=scripts/cli_lane_goal.py
      - cli_lane_health.py=scripts/cli_lane_health.py
      - cli_lane_metrics.py=scripts/cli_lane_metrics.py
      - cli_lane_prompt.py=scripts/cli_lane_prompt.py
      - cli_lane_provider.py=scripts/cli_lane_provider.py
      - cli_lane_quarantine.py=scripts/cli_lane_quarantine.py
      - cli_lane_quota.py=scripts/cli_lane_quota.py
      - cli_lane_records.py=scripts/cli_lane_records.py
      - cli_lane_recovery.py=scripts/cli_lane_recovery.py
      - cli_lane_retention.py=scripts/cli_lane_retention.py
      - cli_lane_route_quality.py=scripts/cli_lane_route_quality.py
      - cli_lane_routing.py=scripts/cli_lane_routing.py
      - cli_lane_runner.py=scripts/cli_lane_runner.py
      - routing_catalog.py=scripts/routing_catalog.py
      - provider_model_catalog.py=scripts/provider_model_catalog.py
      - model_evaluation_evidence.py=scripts/model_evaluation_evidence.py
      - execution_pool_protocol.py=scripts/execution_pool_protocol.py
      - execution_pool_store.py=scripts/execution_pool_store.py
      - execution_pool_project.py=scripts/execution_pool_project.py
      - execution_pool_coordinator.py=scripts/execution_pool_coordinator.py
      - execution_pool_maintenance.py=scripts/execution_pool_maintenance.py
      - execution_pool_server.py=scripts/execution_pool_server.py
      - execution_pool_client.py=scripts/execution_pool_client.py
      - execution_pool_worker.py=scripts/execution_pool_worker.py
      - execution_pool_resume.py=scripts/execution_pool_resume.py
      - execution_pool_scm.py=scripts/execution_pool_scm.py
      - supervisor_lineage.py=scripts/supervisor_lineage.py
      - supervisor_state.py=scripts/supervisor_state.py
      - publication_retry.py=scripts/publication_retry.py
      - scm_resume_bootstrap.py=scripts/scm_resume_bootstrap.py
      - bootstrap_soteria_publication_retry.py=scripts/bootstrap_soteria_publication_retry.py
      - seed_legacy_scm_roots.py=scripts/seed_legacy_scm_roots.py
      - deadline_http.py=scm-common/scripts/deadline_http.py
      - gitea_api_policy.py=scm-common/scripts/gitea_api_policy.py
      - scm_broker_client.py=scm-common/scripts/scm_broker_client.py
      - scm_task_grants.py=scm-common/scripts/scm_task_grants.py
      - scm_task_drafts.py=scm-common/scripts/scm_task_drafts.py
      - scm_task_adoptions.py=scm-common/scripts/scm_task_adoptions.py
      - stage_runtime_access.py=scripts/stage_runtime_access.py
  - name: hermes-coordinator
    namespace: hermes
    files:
      - ai_usage_claude.py=scripts/ai_usage_claude.py
      - ai_usage_codex.py=scripts/ai_usage_codex.py
      - ai_usage_exporter.py=scripts/ai_usage_exporter.py
      - ai_usage_http.py=scripts/ai_usage_http.py
      - ai_usage_polling.py=scripts/ai_usage_polling.py
      - claude=scripts/claude
      - claude_oauth_exec=scripts/claude_oauth_exec
      - claude_command_policy.py=scripts/claude_command_policy.py
      - cli_lane_board.py=scripts/cli_lane_board.py
      - cli_lane_capabilities.py=scripts/cli_lane_capabilities.py
      - cli_lane_config.py=scripts/cli_lane_config.py
      - cli_lane_dispatch.py=scripts/cli_lane_dispatch.py
      - cli_lane_evidence.py=scripts/cli_lane_evidence.py
      - cli_lane_execution.py=scripts/cli_lane_execution.py
      - cli_lane_failover.py=scripts/cli_lane_failover.py
      - cli_lane_files.py=scripts/cli_lane_files.py
      - cli_lane_finalization.py=scripts/cli_lane_finalization.py
      - cli_lane_goal.py=scripts/cli_lane_goal.py
      - cli_lane_health.py=scripts/cli_lane_health.py
      - cli_lane_metrics.py=scripts/cli_lane_metrics.py
      - cli_lane_prompt.py=scripts/cli_lane_prompt.py
      - cli_lane_provider.py=scripts/cli_lane_provider.py
      - cli_lane_quarantine.py=scripts/cli_lane_quarantine.py
      - cli_lane_quota.py=scripts/cli_lane_quota.py
      - cli_lane_records.py=scripts/cli_lane_records.py
      - cli_lane_recovery.py=scripts/cli_lane_recovery.py
      - cli_lane_retention.py=scripts/cli_lane_retention.py
      - cli_lane_route_quality.py=scripts/cli_lane_route_quality.py
      - cli_lane_routing.py=scripts/cli_lane_routing.py
      - cli_lane_runner.py=scripts/cli_lane_runner.py
      - codex=scripts/codex
      - configure_agent_clients.py=scripts/configure_agent_clients.py
      - codex_broker.py=scripts/codex_broker.py
      - classifier_broker.py=scripts/classifier_broker.py
      - voice_route_preflight.py=scripts/voice_route_preflight.py
      - claude_oauth_broker.py=scripts/claude_oauth_broker.py
      - worker_route_broker.py=scripts/worker_route_broker.py
      - hermes_coordinator.py=scripts/hermes_coordinator.py
      - hermes_model_routing.py=scripts/hermes_model_routing.py
      - provider_model_catalog.py=scripts/provider_model_catalog.py
      - model_capability_evaluator.py=scripts/model_capability_evaluator.py
      - model_evaluation_evidence.py=scripts/model_evaluation_evidence.py
      - model_catalog_refresh.py=scripts/model_catalog_refresh.py
      - provider_model_discovery.py=scripts/provider_model_discovery.py
      - claude_model_discovery.py=scripts/claude_model_discovery.py
      - hermes_stt_client.py=scripts/hermes_stt_client.py
      - image_broker.py=scripts/image_broker.py
      - install_agent_tools.sh=scripts/install_agent_tools.sh
      - jenkins_build_evidence.py=scripts/jenkins_build_evidence.py
      - jenkins_image_build_trigger.py=scripts/jenkins_image_build_trigger.py
      - hermes_image_release_status.py=scripts/hermes_image_release_status.py
      - kanban_status_recovery.py=scripts/kanban_status_recovery.py
      - kanban_supervisor.py=scripts/kanban_supervisor.py
      - kanban_continue_pr.py=scripts/kanban_continue_pr.py
      - supervisor_policy.py=scripts/supervisor_policy.py
      - supervisor_lineage.py=scripts/supervisor_lineage.py
      - supervisor_state.py=scripts/supervisor_state.py
      - publication_retry.py=scripts/publication_retry.py
      - scm_resume_bootstrap.py=scripts/scm_resume_bootstrap.py
      - deadline_http.py=scm-common/scripts/deadline_http.py
      - gitea_api_policy.py=scm-common/scripts/gitea_api_policy.py
      - scm_broker_client.py=scm-common/scripts/scm_broker_client.py
      - migrate_herdr_state.py=scripts/migrate_herdr_state.py
      - migrate_api_session_lineage.py=scripts/migrate_api_session_lineage.py
      - migrate_telegram_api_sessions.py=scripts/migrate_telegram_api_sessions.py
      - patch_api_server_sessions.py=scripts/patch_api_server_sessions.py
      - patch_web_session_activity.py=scripts/patch_web_session_activity.py
      - patch_subprocess_secret_boundary.py=scripts/patch_subprocess_secret_boundary.py
      - patch_process_output_redaction.py=scripts/patch_process_output_redaction.py
      - stage_runtime_access.py=scripts/stage_runtime_access.py
      - sync_runtime_credentials.py=scripts/sync_runtime_credentials.py
      - patch_hermes_auth.py=scripts/patch_hermes_auth.py
      - patch_codex_runtime.py=scripts/patch_codex_runtime.py
      - patch_stream_recovery.py=scripts/patch_stream_recovery.py
      - patch_tui_gateway.py=scripts/patch_tui_gateway.py
      - patch_ttyd_index.py=scripts/patch_ttyd_index.py
      - repair_cassandra_kanban.py=scripts/repair_cassandra_kanban.py
      - recover_soteria_kanban.py=scripts/recover_soteria_kanban.py
      - recover_cassandra_workers.py=scripts/recover_cassandra_workers.py
      - routing_catalog.py=scripts/routing_catalog.py
      - telegram_media_server.py=scripts/telegram_media_server.py
    options:
      disableNameSuffixHash: true
  - name: hermes-agent-kubeconfig
    namespace: hermes
    files:
      - config=agent-kubeconfig.yaml
    options:
      disableNameSuffixHash: true
  - name: hermes-node-account-hardener
    namespace: hermes
    files:
      - node_account_hardening.py=scripts/node_account_hardening.py
      - node_account_audit.py=scripts/node_account_audit.py
      - node_account_io.py=scripts/node_account_io.py
      - node_polkit_audit.py=scripts/node_polkit_audit.py
    options:
      disableNameSuffixHash: true
  - name: hermes-auto-router-plugin
    namespace: hermes
    files:
      - __init__.py=plugins/auto-router/__init__.py
      - hux_mode.py=plugins/auto-router/hux_mode.py
      - provider_status.py=plugins/auto-router/provider_status.py
      - plugin.yaml=plugins/auto-router/plugin.yaml
      - dashboard-manifest.json=plugins/auto-router/dashboard/manifest.json
      - dashboard-api.py=plugins/auto-router/dashboard/plugin_api.py
      - dashboard-index.js=plugins/auto-router/dashboard/dist/index.js
      - dashboard-style.css=plugins/auto-router/dashboard/dist/style.css
    options:
      disableNameSuffixHash: true
  - name: hermes-cluster-read-plugin
    namespace: hermes
    files:
      - __init__.py=plugins/cluster-read/__init__.py
      - plugin.yaml=plugins/cluster-read/plugin.yaml
    options:
      disableNameSuffixHash: true
  - name: hermes-hux-evidence-policy
    namespace: hermes
    files:
      - policy.json=hux-evidence-policy.json
    options:
      disableNameSuffixHash: true
  - name: hermes-hux-runtime-plugin
    namespace: hermes
    files:
      - __init__.py=plugins/hux-runtime/__init__.py
      - context_ids.py=plugins/hux-runtime/context_ids.py
      - emitters.py=plugins/hux-runtime/emitters.py
      - runtime.py=plugins/hux-runtime/runtime.py
      - tool_policy.py=plugins/hux-runtime/tool_policy.py
      - plugin.yaml=plugins/hux-runtime/plugin.yaml
      - hux-hook-init.py=plugins/hux-runtime/hux_hook/__init__.py
      - hux-hook-client.py=plugins/hux-runtime/hux_hook/client.py
      - hux-hook-hooks.py=plugins/hux-runtime/hux_hook/hooks.py
    options:
      disableNameSuffixHash: true
  - name: hermes-chat-image-plugin
    namespace: hermes
    files:
      - __init__.py=plugins/image-gen-broker/__init__.py
      - plugin.yaml=plugins/image-gen-broker/plugin.yaml
    options:
      disableNameSuffixHash: true
  - name: hermes-triage-skill
    namespace: hermes
    files:
      - SKILL.md=skills/triage-titan-test-failures/SKILL.md
      - openai.yaml=skills/triage-titan-test-failures/agents/openai.yaml
    options:
      disableNameSuffixHash: true
  - name: hermes-mastery-skill
    namespace: hermes
    files:
      - SKILL.md=skills/master-hermes-on-atlas/SKILL.md
      - openai.yaml=skills/master-hermes-on-atlas/agents/openai.yaml
      - architecture.md=skills/master-hermes-on-atlas/references/architecture.md
      - curriculum.md=skills/master-hermes-on-atlas/references/curriculum.md
      - incident-drills.md=skills/master-hermes-on-atlas/references/incident-drills.md
      - mastery-rubric.md=skills/master-hermes-on-atlas/references/mastery-rubric.md
      - two-hour-proof-sprint.md=skills/master-hermes-on-atlas/references/two-hour-proof-sprint.md
    options:
      disableNameSuffixHash: true
  - name: hermes-service-health-skill
    namespace: hermes
    files:
      - SKILL.md=skills/triage-atlas-service-health/SKILL.md
      - openai.yaml=skills/triage-atlas-service-health/agents/openai.yaml
      - service-map.md=skills/triage-atlas-service-health/references/service-map.md
    options:
      disableNameSuffixHash: true
  - name: hermes-alert-tuning-skill
    namespace: hermes
    files:
      - SKILL.md=skills/tune-atlas-alerts/SKILL.md
      - openai.yaml=skills/tune-atlas-alerts/agents/openai.yaml
      - alert-review.md=skills/tune-atlas-alerts/references/alert-review.md
    options:
      disableNameSuffixHash: true
  - name: hermes-atlas-pr-skill
    namespace: hermes
    files:
      - SKILL.md=skills/manage-atlas-pull-requests/SKILL.md
      - openai.yaml=skills/manage-atlas-pull-requests/agents/openai.yaml
    options:
      disableNameSuffixHash: true