39a544828f
Some checks failed
Tests / Declarative: Post Actions failed: 71, skipped: 28, passed: 3680
Re-applies the staged HUX topology pinned to the reviewed build-21 image (git-2f535d3a...-build-21-release@sha256:e5b9b2fa...), with the first-activation posture: HUX_FLAGS=hux.foundation only, HUX_TOOL_ENFORCEMENT=0, and a RollingUpdate partition of 3 so only hermes-chat-tenant-3 rolls. Adds the /healthz auth bypass on the chat proxy so HUX-12 health receipts can observe a real 200, points the evidence policy at it, and makes the delivery flag gate progressive (foundation first, cards enabled per lifecycle acceptance; unknown flags still never ship). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
269 lines
12 KiB
YAML
269 lines
12 KiB
YAML
# services/hermes/kustomization.yaml
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: hermes
|
|
images:
|
|
- name: registry.bstein.dev/bstein/hermes-agent
|
|
digest: sha256:c64c06e63c9f5e607721599dfb4837cc76fb9a4b2272c4dc335d37ed9a7fddb0 # {"$imagepolicy": "hermes:hermes-agent-release:digest"}
|
|
resources:
|
|
- namespace.yaml
|
|
- image.yaml
|
|
- scm-common
|
|
- vault-serviceaccount.yaml
|
|
- configmap.yaml
|
|
- agent-configmap.yaml
|
|
- chat-configmap.yaml
|
|
- switchyard-configmap.yaml
|
|
- rbac.yaml
|
|
- node-ssh-access.yaml
|
|
- pvc.yaml
|
|
- switchyard-pvc.yaml
|
|
- routing-catalog-pvc.yaml
|
|
- chat-pvcs.yaml
|
|
- oauth-session-store.yaml
|
|
- model-gate-rbac.yaml
|
|
- local-image-rbac.yaml
|
|
- ariadne-handoff-rbac.yaml
|
|
- model-gate-state.yaml
|
|
- model-gate-configmap.yaml
|
|
- model-gate-deployment.yaml
|
|
- switchyard-deployment.yaml
|
|
- image-policy-configmap.yaml
|
|
- networkpolicy.yaml
|
|
- local-image-deployment.yaml
|
|
- deployment.yaml
|
|
- agent-deployment.yaml
|
|
- voice-deployment.yaml
|
|
- chat-statefulset.yaml
|
|
- chat-sandbox.yaml
|
|
- chat-router.yaml
|
|
- service.yaml
|
|
- switchyard-service.yaml
|
|
- oauth2-proxy.yaml
|
|
- agent-certificate.yaml
|
|
- agent-ingress.yaml
|
|
- execution-worker-rbac.yaml
|
|
- hux-evidence-rbac.yaml
|
|
- execution-worker-statefulset.yaml
|
|
- execution-mediator.yaml
|
|
- execution-worker-networkpolicy.yaml
|
|
patches:
|
|
- path: execution-coordinator-patch.yaml
|
|
configMapGenerator:
|
|
- name: hermes-chat-oauth-templates
|
|
namespace: hermes
|
|
files:
|
|
- error.html=oauth2-proxy-templates/error.html
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-operator-guide
|
|
namespace: hermes
|
|
files:
|
|
- OPERATOR-RUNBOOK.md=NOTES.md
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-execution-pool
|
|
namespace: hermes
|
|
files:
|
|
- claude_oauth_exec=scripts/claude_oauth_exec
|
|
- cli_lane_board.py=scripts/cli_lane_board.py
|
|
- cli_lane_capabilities.py=scripts/cli_lane_capabilities.py
|
|
- cli_lane_config.py=scripts/cli_lane_config.py
|
|
- cli_lane_dispatch.py=scripts/cli_lane_dispatch.py
|
|
- cli_lane_evidence.py=scripts/cli_lane_evidence.py
|
|
- cli_lane_execution.py=scripts/cli_lane_execution.py
|
|
- cli_lane_failover.py=scripts/cli_lane_failover.py
|
|
- cli_lane_files.py=scripts/cli_lane_files.py
|
|
- cli_lane_finalization.py=scripts/cli_lane_finalization.py
|
|
- cli_lane_goal.py=scripts/cli_lane_goal.py
|
|
- cli_lane_health.py=scripts/cli_lane_health.py
|
|
- cli_lane_metrics.py=scripts/cli_lane_metrics.py
|
|
- cli_lane_prompt.py=scripts/cli_lane_prompt.py
|
|
- cli_lane_provider.py=scripts/cli_lane_provider.py
|
|
- cli_lane_quarantine.py=scripts/cli_lane_quarantine.py
|
|
- cli_lane_quota.py=scripts/cli_lane_quota.py
|
|
- cli_lane_records.py=scripts/cli_lane_records.py
|
|
- cli_lane_recovery.py=scripts/cli_lane_recovery.py
|
|
- cli_lane_retention.py=scripts/cli_lane_retention.py
|
|
- cli_lane_routing.py=scripts/cli_lane_routing.py
|
|
- cli_lane_runner.py=scripts/cli_lane_runner.py
|
|
- execution_pool_protocol.py=scripts/execution_pool_protocol.py
|
|
- execution_pool_store.py=scripts/execution_pool_store.py
|
|
- execution_pool_project.py=scripts/execution_pool_project.py
|
|
- execution_pool_coordinator.py=scripts/execution_pool_coordinator.py
|
|
- execution_pool_maintenance.py=scripts/execution_pool_maintenance.py
|
|
- execution_pool_server.py=scripts/execution_pool_server.py
|
|
- execution_pool_client.py=scripts/execution_pool_client.py
|
|
- execution_pool_worker.py=scripts/execution_pool_worker.py
|
|
- execution_pool_scm.py=scripts/execution_pool_scm.py
|
|
- gitea_api_policy.py=scm-common/scripts/gitea_api_policy.py
|
|
- scm_broker_client.py=scm-common/scripts/scm_broker_client.py
|
|
- stage_runtime_access.py=scripts/stage_runtime_access.py
|
|
- name: hermes-coordinator
|
|
namespace: hermes
|
|
files:
|
|
- ai_usage_claude.py=scripts/ai_usage_claude.py
|
|
- ai_usage_codex.py=scripts/ai_usage_codex.py
|
|
- ai_usage_exporter.py=scripts/ai_usage_exporter.py
|
|
- ai_usage_http.py=scripts/ai_usage_http.py
|
|
- ai_usage_polling.py=scripts/ai_usage_polling.py
|
|
- claude=scripts/claude
|
|
- claude_oauth_exec=scripts/claude_oauth_exec
|
|
- claude_command_policy.py=scripts/claude_command_policy.py
|
|
- cli_lane_board.py=scripts/cli_lane_board.py
|
|
- cli_lane_capabilities.py=scripts/cli_lane_capabilities.py
|
|
- cli_lane_config.py=scripts/cli_lane_config.py
|
|
- cli_lane_dispatch.py=scripts/cli_lane_dispatch.py
|
|
- cli_lane_evidence.py=scripts/cli_lane_evidence.py
|
|
- cli_lane_execution.py=scripts/cli_lane_execution.py
|
|
- cli_lane_failover.py=scripts/cli_lane_failover.py
|
|
- cli_lane_files.py=scripts/cli_lane_files.py
|
|
- cli_lane_finalization.py=scripts/cli_lane_finalization.py
|
|
- cli_lane_goal.py=scripts/cli_lane_goal.py
|
|
- cli_lane_health.py=scripts/cli_lane_health.py
|
|
- cli_lane_metrics.py=scripts/cli_lane_metrics.py
|
|
- cli_lane_prompt.py=scripts/cli_lane_prompt.py
|
|
- cli_lane_provider.py=scripts/cli_lane_provider.py
|
|
- cli_lane_quarantine.py=scripts/cli_lane_quarantine.py
|
|
- cli_lane_quota.py=scripts/cli_lane_quota.py
|
|
- cli_lane_records.py=scripts/cli_lane_records.py
|
|
- cli_lane_recovery.py=scripts/cli_lane_recovery.py
|
|
- cli_lane_retention.py=scripts/cli_lane_retention.py
|
|
- cli_lane_routing.py=scripts/cli_lane_routing.py
|
|
- cli_lane_runner.py=scripts/cli_lane_runner.py
|
|
- codex=scripts/codex
|
|
- configure_agent_clients.py=scripts/configure_agent_clients.py
|
|
- codex_broker.py=scripts/codex_broker.py
|
|
- classifier_broker.py=scripts/classifier_broker.py
|
|
- voice_route_preflight.py=scripts/voice_route_preflight.py
|
|
- claude_oauth_broker.py=scripts/claude_oauth_broker.py
|
|
- worker_route_broker.py=scripts/worker_route_broker.py
|
|
- hermes_coordinator.py=scripts/hermes_coordinator.py
|
|
- hermes_model_routing.py=scripts/hermes_model_routing.py
|
|
- hermes_stt_client.py=scripts/hermes_stt_client.py
|
|
- image_broker.py=scripts/image_broker.py
|
|
- install_agent_tools.sh=scripts/install_agent_tools.sh
|
|
- jenkins_build_evidence.py=scripts/jenkins_build_evidence.py
|
|
- jenkins_image_build_trigger.py=scripts/jenkins_image_build_trigger.py
|
|
- hermes_image_release_status.py=scripts/hermes_image_release_status.py
|
|
- kanban_status_recovery.py=scripts/kanban_status_recovery.py
|
|
- kanban_supervisor.py=scripts/kanban_supervisor.py
|
|
- supervisor_policy.py=scripts/supervisor_policy.py
|
|
- migrate_herdr_state.py=scripts/migrate_herdr_state.py
|
|
- migrate_api_session_lineage.py=scripts/migrate_api_session_lineage.py
|
|
- migrate_telegram_api_sessions.py=scripts/migrate_telegram_api_sessions.py
|
|
- patch_api_server_sessions.py=scripts/patch_api_server_sessions.py
|
|
- patch_web_session_activity.py=scripts/patch_web_session_activity.py
|
|
- patch_subprocess_secret_boundary.py=scripts/patch_subprocess_secret_boundary.py
|
|
- patch_process_output_redaction.py=scripts/patch_process_output_redaction.py
|
|
- stage_runtime_access.py=scripts/stage_runtime_access.py
|
|
- sync_runtime_credentials.py=scripts/sync_runtime_credentials.py
|
|
- patch_hermes_auth.py=scripts/patch_hermes_auth.py
|
|
- patch_codex_runtime.py=scripts/patch_codex_runtime.py
|
|
- patch_stream_recovery.py=scripts/patch_stream_recovery.py
|
|
- patch_tui_gateway.py=scripts/patch_tui_gateway.py
|
|
- patch_ttyd_index.py=scripts/patch_ttyd_index.py
|
|
- repair_cassandra_kanban.py=scripts/repair_cassandra_kanban.py
|
|
- recover_cassandra_workers.py=scripts/recover_cassandra_workers.py
|
|
- routing_catalog.py=scripts/routing_catalog.py
|
|
- telegram_media_server.py=scripts/telegram_media_server.py
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-agent-kubeconfig
|
|
namespace: hermes
|
|
files:
|
|
- config=agent-kubeconfig.yaml
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-node-account-hardener
|
|
namespace: hermes
|
|
files:
|
|
- node_account_hardening.py=scripts/node_account_hardening.py
|
|
- node_account_audit.py=scripts/node_account_audit.py
|
|
- node_account_io.py=scripts/node_account_io.py
|
|
- node_polkit_audit.py=scripts/node_polkit_audit.py
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-auto-router-plugin
|
|
namespace: hermes
|
|
files:
|
|
- __init__.py=plugins/auto-router/__init__.py
|
|
- hux_mode.py=plugins/auto-router/hux_mode.py
|
|
- provider_status.py=plugins/auto-router/provider_status.py
|
|
- plugin.yaml=plugins/auto-router/plugin.yaml
|
|
- dashboard-manifest.json=plugins/auto-router/dashboard/manifest.json
|
|
- dashboard-api.py=plugins/auto-router/dashboard/plugin_api.py
|
|
- dashboard-index.js=plugins/auto-router/dashboard/dist/index.js
|
|
- dashboard-style.css=plugins/auto-router/dashboard/dist/style.css
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-hux-evidence-policy
|
|
namespace: hermes
|
|
files:
|
|
- policy.json=hux-evidence-policy.json
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-hux-runtime-plugin
|
|
namespace: hermes
|
|
files:
|
|
- __init__.py=plugins/hux-runtime/__init__.py
|
|
- context_ids.py=plugins/hux-runtime/context_ids.py
|
|
- emitters.py=plugins/hux-runtime/emitters.py
|
|
- runtime.py=plugins/hux-runtime/runtime.py
|
|
- tool_policy.py=plugins/hux-runtime/tool_policy.py
|
|
- plugin.yaml=plugins/hux-runtime/plugin.yaml
|
|
- hux-hook-init.py=plugins/hux-runtime/hux_hook/__init__.py
|
|
- hux-hook-client.py=plugins/hux-runtime/hux_hook/client.py
|
|
- hux-hook-hooks.py=plugins/hux-runtime/hux_hook/hooks.py
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-chat-image-plugin
|
|
namespace: hermes
|
|
files:
|
|
- __init__.py=plugins/image-gen-broker/__init__.py
|
|
- plugin.yaml=plugins/image-gen-broker/plugin.yaml
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-triage-skill
|
|
namespace: hermes
|
|
files:
|
|
- SKILL.md=skills/triage-titan-test-failures/SKILL.md
|
|
- openai.yaml=skills/triage-titan-test-failures/agents/openai.yaml
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-mastery-skill
|
|
namespace: hermes
|
|
files:
|
|
- SKILL.md=skills/master-hermes-on-atlas/SKILL.md
|
|
- openai.yaml=skills/master-hermes-on-atlas/agents/openai.yaml
|
|
- architecture.md=skills/master-hermes-on-atlas/references/architecture.md
|
|
- curriculum.md=skills/master-hermes-on-atlas/references/curriculum.md
|
|
- incident-drills.md=skills/master-hermes-on-atlas/references/incident-drills.md
|
|
- mastery-rubric.md=skills/master-hermes-on-atlas/references/mastery-rubric.md
|
|
- two-hour-proof-sprint.md=skills/master-hermes-on-atlas/references/two-hour-proof-sprint.md
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-service-health-skill
|
|
namespace: hermes
|
|
files:
|
|
- SKILL.md=skills/triage-atlas-service-health/SKILL.md
|
|
- openai.yaml=skills/triage-atlas-service-health/agents/openai.yaml
|
|
- service-map.md=skills/triage-atlas-service-health/references/service-map.md
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-alert-tuning-skill
|
|
namespace: hermes
|
|
files:
|
|
- SKILL.md=skills/tune-atlas-alerts/SKILL.md
|
|
- openai.yaml=skills/tune-atlas-alerts/agents/openai.yaml
|
|
- alert-review.md=skills/tune-atlas-alerts/references/alert-review.md
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: hermes-atlas-pr-skill
|
|
namespace: hermes
|
|
files:
|
|
- SKILL.md=skills/manage-atlas-pull-requests/SKILL.md
|
|
- openai.yaml=skills/manage-atlas-pull-requests/agents/openai.yaml
|
|
options:
|
|
disableNameSuffixHash: true
|