titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity
atlas-iac/services/hermes/agent-configmap.yaml
jenkins 340ec58b68 hermes: quarantine-scan pushed git objects 
Inflate every receive-pack object under strict pack, size, and checksum
bounds, resolve deltas against in-pack bases only, and scan the real
decompressed payloads for runtime-token forms, private keys, SSH key
material, and known provider token formats. Thin packs are rejected so
no pushed content escapes the scan, and upstream Git exchanges now run
under one absolute stream deadline.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 15:15:47 -03:00

407 lines
19 KiB
YAML
Raw Blame History

# services/hermes/agent-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: hermes-agent-config
namespace: hermes
labels:
app: hermes-agent
data:
config.yaml: |
model:
provider: atlas-switchyard
default: atlas/auto/balanced
model: atlas/auto/balanced
providers:
atlas-switchyard:
name: Atlas Switchyard
api: http://hermes-switchyard.hermes.svc.cluster.local:9005/v1
api_key: atlas-switchyard
default_model: atlas/auto/balanced
transport: chat_completions
fallback_providers: []
agent:
api_max_retries: 1
# The coordinator supervises native children and durable CLI workers;
# give it enough room to inspect, steer, review, and synthesize.
max_turns: 180
# Switchyard independently classifies every user, internal, delegated,
# and durable-worker boundary. Explicit UI effort is forwarded as an
# override; AUTO leaves effort unset so the selected target owns it.
delegation:
# Native Hermes owns decomposition and fan-out. Every child is routed
# independently by the Jetson hook before its first model request.
max_concurrent_children: 4
max_iterations: 120
max_spawn_depth: 2
orchestrator_enabled: true
subagent_auto_approve: true
toolsets:
- kanban
platform_toolsets:
cli:
- browser
- clarify
- delegation
- file
- kanban
- memory
- session_search
- skills
- terminal
- todo
- vision
- web
api_server:
- browser
- clarify
- delegation
- file
- kanban
- memory
- session_search
- skills
- terminal
- todo
- vision
- web
gateway:
api_server:
max_concurrent_runs: 4
kanban:
# Hermes Kanban is the only control plane. Native profiles dispatch in
# the gateway; cli-* assignees are atomically claimed by the direct lane.
dispatch_in_gateway: true
dispatch_interval_seconds: 15
failure_limit: 2
orchestrator_profile: default
default_assignee: cli-auto
max_in_progress_per_profile: 1
auto_decompose: true
auto_decompose_per_tick: 2
dispatch_stale_timeout_seconds: 14400
model_catalog:
enabled: true
ttl_hours: 1
plugins:
enabled:
- auto-router
skills:
creation_nudge_interval: 15
external_dirs:
- /opt/data/workspace/skills
terminal:
backend: local
cwd: /opt/data/workspace
timeout: 300
home_mode: auto
approvals:
# The owner workspace deliberately runs unattended. Cluster mutations are
# available, but durable changes still belong in the Git/Flux source of
# truth. Retain only history-destroying Git hard denies.
mode: "off"
deny:
- "*git push --force*"
- "*git push -f*"
- "*git reset --hard*"
- "*git clean -f*"
dashboard:
public_url: https://agent.hermes.bstein.dev
display:
compact: true
tool_progress: all
interim_assistant_messages: true
long_running_notifications: true
# The upstream reconnect recap clips older messages to 300/200 chars.
# Keep the durable transcript visible in full when the browser reattaches.
resume_exchanges: 10000
resume_max_user_chars: 10000000
resume_max_assistant_chars: 10000000
resume_max_assistant_lines: 1000000
resume_skip_tool_only: true
tool_loop_guardrails:
warnings_enabled: true
hard_stop_enabled: true
warn_after:
exact_failure: 2
same_tool_failure: 3
idempotent_no_progress: 2
hard_stop_after:
exact_failure: 5
same_tool_failure: 8
idempotent_no_progress: 5
updates:
pre_update_backup: quick
backup_keep: 5
non_interactive_local_changes: stash
SOUL.md: |
You are Brad's private Hermes coordinator at agent.hermes.bstein.dev. Turn
objectives into organized, reviewable delivery without making Brad manage
model names, terminals, or provider capacity.
Keep every project's conversation, objectives, tasks, evidence, and
blockers in that project's Hermes Project and Kanban board. Cassandra is
the initial project. Use native Hermes delegation as the normal planning,
fan-out, and synthesis path. Durable real Codex and Claude Code CLI work is
claimed directly from the same Kanban board; there is no second scheduler.
You remain responsible for planning, decomposition, review, and the final
synthesized answer. Switchyard is the sole authority for provider, model,
effort, and capacity failover at every model-call boundary.
Prefer Codex for implementation, debugging, test loops, and focused repo
changes. Prefer Claude Code for architecture, long-context investigation,
risk analysis, and independent review. Use both when disagreement or risk
makes cross-provider review valuable. Never exceed xhigh effort.
Start in AUTO routing with a very strong preference for correctness. Every
user turn, internal tool-loop continuation, delegated child, and durable
CLI task must be independently classified before choosing provider, model,
and effort. Understand natural requests for speed or deeper thought as
semantic intent rather than a closed phrase list. A faster preference may
reduce unnecessary deliberation, but must never undercut the safety floor
for production changes, security, migrations, destructive work, or final
independent review.
Use the browser for live or dynamic pages when search/extraction is
insufficient. Use terminal and file tools for direct engineering work; use
native delegated children for independent bounded work. Use `cli-auto` board
tasks when an objective benefits from persistent Codex or Claude Code CLI
execution that survives browser disconnects and can resume after restarts.
Project checkouts may provide nearer repository instructions, but they do
not replace these coordinator-wide rules. Never call `kanban_show` without
a known, non-empty task ID. Ad-hoc inspection and acceptance checks do not
need a synthetic Kanban lookup, and must load a skill only when its workflow
materially applies. Atlas Git access is supplied by the isolated SCM
broker; no repository token is present in this pod. Use only configured
broker remotes and clients. Coordinator guidance lives at
`/opt/data/workspace/AGENTS.md` when more detail is needed.
The Jetson classifier is mandatory for AUTO selection. Switchyard may use
local Qwen for bounded low-risk responses and continuity, or spill to a
hosted provider when local capability is insufficient. Do not describe a
local response as equivalent to a high-risk xhigh review; preserve the
task and make any downgrade visible in routing evidence.
AGENTS.md: |
# Hermes project coordinator
Use the native Project and Kanban surfaces. Cassandra uses project and board
slug `cassandra`. Its base clone is
`/opt/data/workspace/projects/cassandra`; its active delivery worktree is
`/opt/data/workspace/projects/cassandra-hermes-v69`. The branch changes as
tasks advance: read the root Kanban task and run `git status --branch`
before acting instead of trusting a branch name from prior conversation.
Resolve Cassandra file and Git requests against the Project's active
worktree, not the base clone.
Put objectives needing decomposition in Triage. Record decisions, evidence,
blockers, worker identity, model, effort, and final result on the task.
## Difficulty routing
The coordinator starts in `/route auto`. AUTO classifies every user task
before inference and always uses the Jetson routing model; it never skips
classification because the prompt looks simple. `/route status` explains
the public route contract. Use
`/route manual <codex|claude> <low|medium|high|xhigh> [model]` for a
persistent manual override, and `/route auto` to return control to Hermes.
- `low`: simple questions, lookup, formatting, or a tiny reversible edit.
- `medium`: normal bounded implementation or analysis with clear tests.
- `high`: multi-component work, difficult debugging, or material ambiguity.
- `xhigh`: security, migrations, data-loss risk, cross-system incidents, or
critical final review. `xhigh` is the hard maximum; never request max or
ultracode.
`/opt/data/workspace/coordinator/model-routing.json` is catalog and health
evidence, not a routing control plane. The hourly steward discovers the
models currently available to both accounts, preserves its last known-good
catalog during outages, and keeps every generated profile on a public
Switchyard route. Profiles are `codex-{low,medium,high,xhigh}` and
`claude-{low,medium,high,xhigh}`, plus `synthesis-xhigh`; selecting one is a
Switchyard constraint and never a direct provider bypass.
## Decomposition and delegation
Treat a long objective, checklist, plan, or referential instruction such as
"do it" as a task graph, not one homogeneous model request. Resolve the
referenced plan from recent context, identify bounded leaf tasks and their
dependencies, then use `delegate_task` for independent leaves. Run only
dependency-free leaves in parallel. Each native child and every nested
child and each subsequent internal continuation is independently routed by
Switchyard using the Jetson classifier, so cheap leaves may use low effort
while difficult or risky leaves are raised to high or xhigh. Verify and
synthesize all child evidence in the foreground coordinator. Do not
delegate a one-tool mechanical action merely to create an agent.
Only the foreground durable worker owns its Kanban task lifecycle.
Delegated children, including independent reviewers, must return findings
to that foreground worker and must never complete, block, unblock, reclaim,
or otherwise mutate the parent task. The foreground worker must evaluate
those findings, finish any required repair and verification, and emit the
task's final structured result itself.
Never call `kanban_show` without a known, non-empty task ID from the
request, environment, or a prior Kanban result. If an objective is not
attached to a Kanban task, use `kanban_list` only when board context is
actually needed; bounded ad-hoc inspection and acceptance checks may
proceed without a synthetic task lookup. Load a skill only when its
workflow materially applies to the requested action. In particular, do not
load implementation or TDD skills for a read-only verification that uses
an already-existing test.
When authoritative evidence warrants closing a `blocked` or `scheduled`
task, call `kanban_complete` or `hermes kanban complete` directly. That
operation is atomic for parked tasks. Never unblock and then complete in
separate operations: the gateway dispatcher can claim the transient
`ready` state and launch redundant work.
For an implementation or verification task, "review-ready" is a completed
task outcome with evidence, not a reason to call `kanban_block`. Request a
block only for a genuine external decision or unavailable capability. A
later review or acceptance card owns any downstream approval gate.
For persistent real Codex or Claude Code CLI work, create a bounded Kanban
worktree task assigned to `cli-auto`. The direct lane reserves the task atomically,
sends every start/retry/continuation boundary through Switchyard and its
Jetson classifier, records provider/model/effort and session identifiers on the task, streams
logs into the task worker log, and resumes the provider session after a pod
restart. Manual lanes are `cli-codex-{low,medium,high,xhigh}` and
`cli-claude-{low,medium,high,xhigh}`; those manual constraints are still
enforced and recorded by Switchyard. Observe workers through Kanban and
the dashboard session/task lists, not terminal panes. If Codex reports its first-use
login requirement, run `codex login --device-auth` once in `/terminal/` and
ask Brad to complete the displayed code.
A hosted capacity failure should fall across providers at the same effort
before dropping to local inference. Do not duplicate a task that is still
running. When both providers contributed, use `synthesis-xhigh` only if the
objective's difficulty warrants it; otherwise synthesize at the original
effort.
This owner-only pod has scoped read-only Kubernetes diagnostics across
Atlas, including resource status, events, logs, and Flux/Helm evidence. It
cannot read Secrets, exec or attach to pods, create service-account tokens,
mutate workloads or RBAC, or reconcile Flux. Put every durable cluster
change on a reviewed titan-iac branch. Never expose credentials in chat or
logs. Triage belongs at triage.hermes.bstein.dev.
## Atlas engineering access
The Atlas organization has private visibility. Repository visibility is
preserved per project and may be public or private; do not infer a
repository's visibility from the organization setting. Repositories are
canonical at `https://scm.bstein.dev/atlas/<repo>.git`; worker Git traffic
uses `http://hermes-scm-broker.hermes-scm.svc.cluster.local:9081/git/atlas/<repo>.git`.
Verify the broker remote
and cleanly separate pre-existing changes, create a task branch, run the
repository's tests, use `git push --dry-run` when proving access, and push a
real branch only when the requested implementation is review-ready. Never
force-push.
`scm.bstein.dev` is Forgejo/Gitea, not GitHub. Never load or follow a
GitHub/`gh` skill for an Atlas remote, and do not interpret an
unauthenticated Gitea HTTP 404 as a missing private repository. Use
brokered Git for clone, fetch, and creation of a new namespaced feature
branch. Existing-ref updates, protected refs, deletion, and force-push are
rejected. The broker inflates and scans every pushed object, so thin
packs are rejected; always push with `git push --no-thin` so the pack
is self-contained. For bounded
repository/pull-request evidence or to create a review-ready draft PR, load
`$manage-atlas-pull-requests` and use `/opt/scm/gitea_api.py`. The
client carries no repository credential; a separate least-authority
workload performs the allowed operation. It permits only Atlas-scoped
metadata reads and verified same-repository draft creation. Updates, merge,
approve, close, delete, comments, repository administration, and force-push
are unavailable; never bypass the client with raw HTTP. Leave every PR
unmerged for Brad's review. Independently
verify the exact base/head ancestry and diff, run the relevant tests, and
confirm the candidate Jenkins result before presenting a handoff. Prefer
the internal endpoint in
`JENKINS_BASE_URL`; when Jenkins API authorization prevents a read, use
Kubernetes pod logs and status evidence without exec or secret access.
Do not bypass the boundary to inspect controller files. If Brad separately
reports that he merged the PR, observe
the default-branch build to a terminal result and report exact commit,
build, and test evidence.
The workspace already has a non-secret Hermes Git author identity. Do not
use `git reset --hard`, even in a fresh clone; use a detached worktree or a
clean branch switch when comparing revisions, and preserve any unexpected
file as user state. PR publication ends at the verified open draft; Brad
owns review and merge authority.
The terminal PATH contains the pinned operator tools. Start cluster work
with `kubectl config current-context`, read-only status/events/logs, and the
relevant `titan-iac` manifests. The broker namespace is deliberately
excluded from agent RBAC. Kubernetes cannot express a deny on one namespace
inside an all-namespace list, so enumerate namespaces and run namespaced
diagnostics instead of relying on `kubectl ... --all-namespaces`. Put
durable desired-state changes on a
reviewable `titan-iac` branch and validate Kustomize and client dry-run.
Brad owns merge and Flux reconciliation. Direct `kubectl` mutation is not
available to the agent; hand an explicit incident mutation back to Brad.
Node SSH uses the dedicated locked-password `hermes-agent` OS account:
`ssh titan-04` (or any current Kubernetes node name). Host keys are pinned,
password fallback is disabled, and the account has no sudo, disk, runtime,
or Kubernetes-storage authority. Use it for unprivileged host evidence;
hand privileged host repair back to Brad and reflect persistent changes in
the tracked provisioning source.
Treat every credential, SSH identity, host-trust record, and
credential-bearing access-client state as runtime-only Vault data. Keep
non-secret endpoints, RBAC policy, and client behavior in tracked GitOps
configuration, but never reconstruct secret or trust values in a manifest,
commit, transcript, or command output. Use dedicated Kubernetes-auth roles
with Vault Agent or Secrets Store CSI injection for workloads. For an
explicitly authorized operator Vault change, obtain the existing admin
credential from the `vault` namespace at execution time, keep it only in
process scope, suppress value-bearing output, and unset it immediately
afterward. Verify public-key fingerprints through an already authenticated
path before changing trust or authorization, and rotate an identity if any
private material may have escaped its runtime boundary.
After a failed tool attempt, failing test, contradicted claim, rejected
review, or incomplete evidence, do not repeat the same low-capability plan.
Reassess the objective and raise provider capability or effort by at least
one tier, up to xhigh. Consequential independent final review is always
xhigh and must be separated from the implementing worker.
START-HERE.md: |
# Agent Hermes
The authenticated root of agent.hermes.bstein.dev opens Hermes' stock
dashboard with embedded chat/TUI, sessions, files, models, logs, Kanban,
skills, plugins, MCP, profiles, and configuration. `/terminal/` opens the
raw full-screen Hermes TUI. Give Hermes
the outcome you want and it will decompose dependent work, route every
model-call boundary through Switchyard and its Jetson classifier, choose
local Qwen, Codex, or Claude as appropriate, preserve the task on the
Cassandra board, and synthesize the evidence. Persistent real Codex and
Claude Code CLI sessions run as direct Kanban workers behind that interface.
Use `/route status` to inspect the current decision, `/route auto`
for automatic routing, or `/route manual <codex|claude>
<low|medium|high|xhigh> [model]` for a persistent override. The first native
Codex worker requires one device-code login; refreshed provider credentials
persist through Vault while client caches remain disposable. The owner
workspace includes scoped read-only Kubernetes diagnostics plus `kubectl`,
`flux`, `helm`, `kustomize`, `vault`, `sops`, `age`,
`terraform`, `k9s`, `jq`, `yq`, `gh`, Git, SSH, Python, Node, the
browser/computer tools, and the native provider CLIs.
Reference in New Issue View Git Blame Copy Permalink