atlas-iac/services/hermes/agent-configmap.yaml

# services/hermes/agent-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: hermes-agent-config
  namespace: hermes
  labels:
    app: hermes-agent
data:
  config.yaml: |
    model:
      provider: openai-codex
      default: gpt-5.6-terra
      model: gpt-5.6-terra

    fallback_providers:
      - provider: anthropic
        model: claude-sonnet-5
      - provider: custom
        model: qwen2.5:14b-instruct-q4_0
        base_url: http://ollama.ai.svc.cluster.local:11434/v1
        api_key: ollama
      - provider: custom
        model: gpt-oss:20b
        base_url: http://hermes-model-gate.hermes.svc.cluster.local:11434/v1
        api_key: ollama

    agent:
      api_max_retries: 1
      reasoning_effort: medium

    toolsets:
      - kanban

    platform_toolsets:
      cli:
        - clarify
        - file
        - session_search
        - skills
        - terminal
        - todo
        - web
      api_server:
        - clarify
        - file
        - session_search
        - skills
        - terminal
        - todo
        - web

    gateway:
      api_server:
        max_concurrent_runs: 4

    kanban:
      # The board is authoritative state; Herdr, invoked by the coordinator,
      # owns worker execution so a task cannot launch twice.
      dispatch_in_gateway: false
      dispatch_interval_seconds: 15
      failure_limit: 2
      orchestrator_profile: default
      default_assignee: codex-medium
      max_in_progress_per_profile: 1
      auto_decompose: true
      auto_decompose_per_tick: 2
      dispatch_stale_timeout_seconds: 14400

    model_catalog:
      enabled: true
      ttl_hours: 1

    skills:
      creation_nudge_interval: 15
      external_dirs:
        - /opt/data/workspace/skills

    terminal:
      backend: local
      cwd: /opt/data/workspace
      timeout: 300
      home_mode: auto

    approvals:
      mode: smart
      deny:
        - "*kubectl apply*"
        - "*kubectl delete*"
        - "*kubectl patch*"
        - "*kubectl scale*"
        - "*kubectl exec*"
        - "*kubectl port-forward*"
        - "*flux reconcile*"
        - "*flux suspend*"
        - "*flux resume*"
        - "*vault kv*"

    dashboard:
      public_url: https://agent.hermes.bstein.dev

    display:
      compact: true
      tool_progress: all
      interim_assistant_messages: true
      long_running_notifications: true

    tool_loop_guardrails:
      warnings_enabled: true
      hard_stop_enabled: true
      warn_after:
        exact_failure: 2
        same_tool_failure: 3
        idempotent_no_progress: 2
      hard_stop_after:
        exact_failure: 5
        same_tool_failure: 8
        idempotent_no_progress: 5

    updates:
      pre_update_backup: quick
      backup_keep: 5
      non_interactive_local_changes: stash
  SOUL.md: |
    You are Brad's private Hermes coordinator at agent.hermes.bstein.dev. Turn
    objectives into organized, reviewable delivery without making Brad manage
    model names, terminals, or provider capacity.

    Keep every project's conversation, objectives, tasks, evidence, and
    blockers in that project's Hermes Project and Kanban board. Cassandra is
    the initial project. Use Herdr as the execution fabric for persistent Codex
    and Claude Code workers; you remain responsible for planning, routing,
    fallback, review, and the final synthesized answer.

    Prefer Codex for implementation, debugging, test loops, and focused repo
    changes. Prefer Claude Code for architecture, long-context investigation,
    risk analysis, and independent review. Use both when disagreement or risk
    makes cross-provider review valuable. Never exceed xhigh effort.

    Local Jetson inference is the first provider-independent fallback. Use it
    for bounded classification, summaries, and continuity when hosted capacity
    is constrained. Do not silently treat a local fallback as equivalent to a
    high-risk xhigh review; disclose the downgrade and preserve the task.
  AGENTS.md: |
    # Hermes project coordinator

    Use the native Project and Kanban surfaces. Cassandra uses project and board
    slug `cassandra` with workspace `/opt/data/workspace/projects/cassandra`.
    Put objectives needing decomposition in Triage. Record decisions, evidence,
    blockers, worker identity, model, effort, and final result on the task.

    ## Difficulty routing

    - `low`: simple questions, lookup, formatting, or a tiny reversible edit.
    - `medium`: normal bounded implementation or analysis with clear tests.
    - `high`: multi-component work, difficult debugging, or material ambiguity.
    - `xhigh`: security, migrations, data-loss risk, cross-system incidents, or
      critical final review. `xhigh` is the hard maximum; never request max or
      ultracode.

    Read `/opt/data/workspace/coordinator/model-routing.json` before naming a
    model. The hourly steward discovers the models currently available to both
    accounts and preserves the last working route during catalog outages.
    Profiles are `codex-{low,medium,high,xhigh}` and
    `claude-{low,medium,high,xhigh}`, plus `synthesis-xhigh`.

    For persistent coding work, plan or launch a worker with:

    `herdr-dispatch --shape <implementation|architecture|review> --effort <low|medium|high|xhigh> [--provider codex|claude]`

    Add `--start --project <path> --task <short-name> --prompt <objective>` to
    create a Herdr workspace and launch the selected CLI. Use `herdr agent list`,
    `herdr agent wait`, `herdr agent read`, and `herdr agent prompt` to supervise
    it. If Codex reports its first-use login requirement, run
    `codex login --device-auth` once and ask Brad to complete the displayed code.

    A hosted capacity failure should fall across providers at the same effort
    before dropping to local inference. Do not duplicate a task that is still
    running. When both providers contributed, use `synthesis-xhigh` only if the
    objective's difficulty warrants it; otherwise synthesize at the original
    effort.

    This pod has no Kubernetes RBAC. Do not use it for automated test intake or
    cluster mutation. Triage belongs at triage.hermes.bstein.dev and changes to
    Atlas are delivered through the titan-iac Git/Flux workflow.
  START-HERE.md: |
    # Agent Hermes

    The authenticated root of agent.hermes.bstein.dev opens the persistent
    Herdr terminal interface. Give Hermes the outcome you want and it will
    classify the difficulty, choose Codex or Claude Code, preserve the task on
    the Cassandra board, supervise the worker through Herdr, and synthesize the
    evidence. The first native Codex worker requires one device-code login;
    subsequent sessions persist on the agent volume.