jenkins 9d42ff33f5 Merge origin/main (#16 image-builder) into hermes-safe-gitea-pr ...

Resolve 8 conflicts, uniting #16's daemonless image-release lane with
#14's SCM broker + node-audit boundary. Nothing dropped from either side.

- quality_coverage.py / test_quality_coverage_helpers.py: take main's
  dual-metric gate (line+branch enforced per file at minimum_percent);
  drop #14's now-dead branch_tracked_files/minimum_branch_percent keys.
- quality_contract.json: union all lists (managed_modules, lint_paths,
  coverage_sources, tracked_files, hygiene globs) so #14's scm-broker,
  git_pack_objects, receive_pack_scan, deadline_http and node_polkit_audit
  are branch-checked alongside #16's image-builder modules.
- Vault auth (vault_k8s_auth_configure.sh): coexist both role sets. Keep
  #16's hermes-switchyard split + hermes-jenkins-token-seed; keep #14's
  hermes-scm-broker role. Preserve #14's security property: hermes-agent
  no longer holds developer-gitea (broker role carries it).
- agent-deployment.yaml / stage_runtime_access.py: keep #16's
  jenkins-image-build-token injection/staging; keep #14's removal of the
  agent's gitea-token/gitea-username.
- Bump vault-k8s-auth-hermes job -9 -> -10 (and its health check + test)
  so the merged auth config re-applies over any -9 already in-cluster.
- flux hermes dependsOn: union jenkins + hermes-scm-broker + observer-rbac.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-17 21:07:06 -03:00

..

ai_usage_exporter.py

monitoring(ai): add provider quota operations dashboard

2026-08-16 05:13:20 -03:00

classifier_broker.py

hermes: sanitize classifier tool history

2026-08-15 13:35:31 -03:00

claude

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

claude_command_policy.py

hermes: grant owner agent union access

2026-08-10 17:05:14 -03:00

claude_oauth_broker.py

hermes: avoid unavailable worker providers

2026-08-16 09:19:23 -03:00

cli_lane_goal.py

hermes: widen local goal judge timeout

2026-08-16 13:29:10 -03:00

cli_lane_runner.py

hermes: retain native auth failure health

2026-08-16 13:47:19 -03:00

codex

fix(hermes): run coding workers unattended

2026-08-10 02:15:34 -03:00

codex_broker.py

hermes: harden routed vision normalization

2026-08-16 07:24:20 -03:00

configure_agent_clients.py

hermes(agent): validate Codex owner runtime

2026-08-10 22:54:26 -03:00

hermes_coordinator.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

hermes_model_routing.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

hermes_stt_client.py

perf(hermes): use conversational Whisper default

2026-08-10 01:30:50 -03:00

image_broker.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

install_agent_tools.sh

hermes: install pinned Go toolchain

2026-08-16 05:38:01 -03:00

jenkins_build_evidence.py

hermes: streamline forge evidence tools

2026-08-16 08:21:33 -03:00

jenkins_image_build_trigger.py

hermes: add daemonless agent image release lane

2026-08-17 08:25:52 -03:00

kanban_status_recovery.py

hermes: recover stale kanban status pages

2026-08-16 04:49:02 -03:00

migrate_api_session_lineage.py

hermes: close stale API worker sessions

2026-08-15 14:20:12 -03:00

migrate_herdr_state.py

hermes(agent): replace HERDR with native CLI lanes

2026-08-10 16:31:06 -03:00

migrate_telegram_api_sessions.py

hermes: add durable Telegram topics

2026-08-16 15:59:09 -03:00

node_account_audit.py

hermes: audit every sudo include spelling

2026-08-17 20:37:30 -03:00

node_account_hardening.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

node_account_io.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

node_polkit_audit.py

hermes: reject regex literals in polkit grants

2026-08-17 20:37:30 -03:00

patch_api_server_sessions.py

hermes: add durable Telegram topics

2026-08-16 15:59:09 -03:00

patch_codex_runtime.py

hermes: restore native provider routing

2026-08-12 23:08:21 -03:00

patch_hermes_auth.py

feat(hermes): split chat agent and triage surfaces

2026-08-08 17:59:57 -03:00

patch_process_output_redaction.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

patch_stream_recovery.py

hermes: recover interrupted provider streams

2026-08-12 10:41:47 -03:00

patch_subprocess_secret_boundary.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

patch_ttyd_index.py

fix(hermes): recover browser terminal sessions

2026-08-09 16:12:00 -03:00

patch_tui_gateway.py

hermes(agent): restore stock dashboard reliability

2026-08-10 21:09:06 -03:00

patch_web_session_activity.py

hermes: scope stale activity lineage

2026-08-16 02:51:33 -03:00

recover_cassandra_workers.py

hermes: recover workers after pod restart

2026-08-15 07:07:21 -03:00

repair_cassandra_kanban.py

hermes: recover stale kanban status pages

2026-08-16 04:49:02 -03:00

routing_catalog.py

hermes: restore native provider routing

2026-08-12 23:08:21 -03:00

stage_runtime_access.py

Merge origin/main (#16 image-builder) into hermes-safe-gitea-pr

2026-08-17 21:07:06 -03:00

sync_runtime_credentials.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

telegram_media_server.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

worker_route_broker.py

hermes: expose Switchyard worker health

2026-08-11 22:38:05 -03:00