titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity
atlas-iac/docs/hermes_webui_release.md
Hermes Agent 083005e44f fix: verify served Hermes PWA identity
2026-08-23 04:42:08 +00:00

2.6 KiB
Raw Blame History

Hermes WebUI release lane

Hermes WebUI has a release lane separate from hermes-agent-image. The lane builds dockerfiles/Dockerfile.hermes-webui from one exact reviewed main commit, publishes a unique immutable Harbor tag, independently verifies the Harbor digest, and renders a review-only Flux patch. It never writes Git and it never reconciles or restarts a workload.

Release sequence

  1. Merge and review all WebUI source, patch, theme, and PWA asset changes.
  2. Wait for Flux to complete both Harbor immutability Jobs and refresh Jenkins JCasC from reviewed main.
  3. Open the manual Jenkins job hermes-webui-image and set:
    • PUBLISH_IMAGE=true
    • EXPECTED_SOURCE_REVISION to the full 40-character main commit
    • CONFIRM_PUBLISH=PUBLISH HERMES WEBUI
  4. Retain the fingerprinted seven-file artifact set. In particular, compare hermes-webui-image.json with Harbor and review hermes-webui-image-update.patch.
  5. Apply that patch on a fresh branch and open a separate review. The patch is constrained to the webui container in:
    • StatefulSet/hermes-chat-tenant
    • Deployment/hermes
  6. Merge the digest-only review to let Flux roll out desired state. Do not use a manual kubectl set image, restart, or reconcile as a release substitute.

The release fails closed when the requested revision is not the checked-out origin/main, the unique Harbor tag already exists, the exact WebUI immutable tag policy is absent, Kaniko and Harbor disagree on the digest, either Flux workload changes identity/image shape, or the evidence archive is incomplete.

Harbor policy bootstrap has an intentional ordering dependency. The existing harbor-hermes-agent-immutability-ensure-1 Job grants the shared Jenkins publisher only the read-only immutable-tag:list permission; the WebUI policy Job creates and verifies the separate hermes-webui rule but does not edit the publisher robot. Flux must therefore complete the existing Hermes agent policy bootstrap before the WebUI Job and Jenkins release verification. This successor does not include a WebUI image digest: until its WebUI publisher job and policy are merged to main and bootstrapped, no image can be legitimately published and independently verified through this lane.

PWA identity source

The installed application uses the tracked canonical persona at dockerfiles/hermes-webui-assets/hermes-agent.ico. Provenance, the canonical SHA-256, and derivation details for the required 192px/512px PNGs are recorded beside the asset in SOURCE.md; the image build never reads an icon from a running coordinator.