277 lines
11 KiB
YAML
277 lines
11 KiB
YAML
# services/hermes/agent-configmap.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: hermes-agent-config
|
|
namespace: hermes
|
|
labels:
|
|
app: hermes-agent
|
|
data:
|
|
config.yaml: |
|
|
model:
|
|
provider: openai-codex
|
|
default: gpt-5.6-terra
|
|
model: gpt-5.6-terra
|
|
|
|
fallback_providers:
|
|
- provider: anthropic
|
|
model: claude-sonnet-5
|
|
- provider: custom
|
|
model: qwen2.5:14b-instruct-q4_0
|
|
base_url: http://ollama.ai.svc.cluster.local:11434/v1
|
|
api_key: ollama
|
|
- provider: custom
|
|
model: gpt-oss:20b
|
|
base_url: http://hermes-model-gate.hermes.svc.cluster.local:11434/v1
|
|
api_key: ollama
|
|
|
|
agent:
|
|
api_max_retries: 1
|
|
# The coordinator supervises native children and durable CLI workers;
|
|
# give it enough room to inspect, steer, review, and synthesize.
|
|
max_turns: 180
|
|
reasoning_effort: medium
|
|
|
|
delegation:
|
|
# Native Hermes owns decomposition and fan-out. Every child is routed
|
|
# independently by the Jetson hook before its first model request.
|
|
max_concurrent_children: 4
|
|
max_iterations: 120
|
|
max_spawn_depth: 2
|
|
orchestrator_enabled: true
|
|
subagent_auto_approve: true
|
|
|
|
toolsets:
|
|
- kanban
|
|
|
|
platform_toolsets:
|
|
cli:
|
|
- browser
|
|
- clarify
|
|
- delegation
|
|
- file
|
|
- memory
|
|
- session_search
|
|
- skills
|
|
- terminal
|
|
- todo
|
|
- vision
|
|
- web
|
|
api_server:
|
|
- browser
|
|
- clarify
|
|
- delegation
|
|
- file
|
|
- memory
|
|
- session_search
|
|
- skills
|
|
- terminal
|
|
- todo
|
|
- vision
|
|
- web
|
|
|
|
gateway:
|
|
api_server:
|
|
max_concurrent_runs: 4
|
|
|
|
kanban:
|
|
# The board is authoritative state; Herdr, invoked by the coordinator,
|
|
# owns worker execution so a task cannot launch twice.
|
|
dispatch_in_gateway: false
|
|
dispatch_interval_seconds: 15
|
|
failure_limit: 2
|
|
orchestrator_profile: default
|
|
default_assignee: codex-medium
|
|
max_in_progress_per_profile: 1
|
|
auto_decompose: true
|
|
auto_decompose_per_tick: 2
|
|
dispatch_stale_timeout_seconds: 14400
|
|
|
|
model_catalog:
|
|
enabled: true
|
|
ttl_hours: 1
|
|
|
|
plugins:
|
|
enabled:
|
|
- herdr-agent-state
|
|
- auto-router
|
|
|
|
skills:
|
|
creation_nudge_interval: 15
|
|
external_dirs:
|
|
- /opt/data/workspace/skills
|
|
|
|
terminal:
|
|
backend: local
|
|
cwd: /opt/data/workspace
|
|
timeout: 300
|
|
home_mode: auto
|
|
|
|
approvals:
|
|
# This owner-only workspace is already bounded by non-root execution,
|
|
# repository scope, and read-only cluster RBAC. Keep routine engineering
|
|
# work non-interactive while retaining explicit hard denies below.
|
|
mode: "off"
|
|
deny:
|
|
- "*kubectl apply*"
|
|
- "*kubectl delete*"
|
|
- "*kubectl patch*"
|
|
- "*kubectl scale*"
|
|
- "*kubectl exec*"
|
|
- "*kubectl port-forward*"
|
|
- "*flux reconcile*"
|
|
- "*flux suspend*"
|
|
- "*flux resume*"
|
|
- "*vault kv*"
|
|
- "*git push --force*"
|
|
- "*git push -f*"
|
|
- "*git reset --hard*"
|
|
- "*git clean -f*"
|
|
|
|
dashboard:
|
|
public_url: https://agent.hermes.bstein.dev
|
|
|
|
display:
|
|
compact: true
|
|
tool_progress: all
|
|
interim_assistant_messages: true
|
|
long_running_notifications: true
|
|
# The upstream reconnect recap clips older messages to 300/200 chars.
|
|
# Keep the durable transcript visible in full when the browser reattaches.
|
|
resume_exchanges: 10000
|
|
resume_max_user_chars: 10000000
|
|
resume_max_assistant_chars: 10000000
|
|
resume_max_assistant_lines: 1000000
|
|
resume_skip_tool_only: true
|
|
|
|
tool_loop_guardrails:
|
|
warnings_enabled: true
|
|
hard_stop_enabled: true
|
|
warn_after:
|
|
exact_failure: 2
|
|
same_tool_failure: 3
|
|
idempotent_no_progress: 2
|
|
hard_stop_after:
|
|
exact_failure: 5
|
|
same_tool_failure: 8
|
|
idempotent_no_progress: 5
|
|
|
|
updates:
|
|
pre_update_backup: quick
|
|
backup_keep: 5
|
|
non_interactive_local_changes: stash
|
|
SOUL.md: |
|
|
You are Brad's private Hermes coordinator at agent.hermes.bstein.dev. Turn
|
|
objectives into organized, reviewable delivery without making Brad manage
|
|
model names, terminals, or provider capacity.
|
|
|
|
Keep every project's conversation, objectives, tasks, evidence, and
|
|
blockers in that project's Hermes Project and Kanban board. Cassandra is
|
|
the initial project. Use native Hermes delegation as the normal planning,
|
|
fan-out, and synthesis path. Use Herdr only as a hidden durability adapter
|
|
when work specifically benefits from a persistent real Codex or Claude Code
|
|
CLI session. You remain responsible for planning, routing, fallback, review,
|
|
and the final synthesized answer.
|
|
|
|
Prefer Codex for implementation, debugging, test loops, and focused repo
|
|
changes. Prefer Claude Code for architecture, long-context investigation,
|
|
risk analysis, and independent review. Use both when disagreement or risk
|
|
makes cross-provider review valuable. Never exceed xhigh effort.
|
|
|
|
Use the browser for live or dynamic pages when search/extraction is
|
|
insufficient. Use terminal and file tools for direct engineering work; use
|
|
native delegated children for independent bounded work. Use Herdr workers
|
|
only when an objective benefits from persistent Codex or Claude Code CLI
|
|
execution or a long-lived CLI session that can be resumed later.
|
|
|
|
Local Jetson inference is the first provider-independent fallback. Use it
|
|
for bounded classification, summaries, and continuity when hosted capacity
|
|
is constrained. Do not silently treat a local fallback as equivalent to a
|
|
high-risk xhigh review; disclose the downgrade and preserve the task.
|
|
AGENTS.md: |
|
|
# Hermes project coordinator
|
|
|
|
Use the native Project and Kanban surfaces. Cassandra uses project and board
|
|
slug `cassandra` with workspace `/opt/data/workspace/projects/cassandra`.
|
|
Put objectives needing decomposition in Triage. Record decisions, evidence,
|
|
blockers, worker identity, model, effort, and final result on the task.
|
|
|
|
## Difficulty routing
|
|
|
|
The coordinator starts in `/route auto`. AUTO classifies every user task
|
|
before inference, uses the Jetson routing model when it answers within the
|
|
latency budget, and falls back to deterministic policy without delaying the
|
|
conversation. `/route status` explains the live selection. Use
|
|
`/route manual <codex|claude> <low|medium|high|xhigh> [model]` for a
|
|
persistent manual override, and `/route auto` to return control to Hermes.
|
|
|
|
- `low`: simple questions, lookup, formatting, or a tiny reversible edit.
|
|
- `medium`: normal bounded implementation or analysis with clear tests.
|
|
- `high`: multi-component work, difficult debugging, or material ambiguity.
|
|
- `xhigh`: security, migrations, data-loss risk, cross-system incidents, or
|
|
critical final review. `xhigh` is the hard maximum; never request max or
|
|
ultracode.
|
|
|
|
Read `/opt/data/workspace/coordinator/model-routing.json` before naming a
|
|
model. The hourly steward discovers the models currently available to both
|
|
accounts and preserves the last working route during catalog outages.
|
|
Profiles are `codex-{low,medium,high,xhigh}` and
|
|
`claude-{low,medium,high,xhigh}`, plus `synthesis-xhigh`.
|
|
|
|
## Decomposition and delegation
|
|
|
|
Treat a long objective, checklist, plan, or referential instruction such as
|
|
"do it" as a task graph, not one homogeneous model request. Resolve the
|
|
referenced plan from recent context, identify bounded leaf tasks and their
|
|
dependencies, then use `delegate_task` for independent leaves. Run only
|
|
dependency-free leaves in parallel. Each native child and every nested
|
|
child is independently classified by the Jetson before its first model
|
|
request, so cheap leaves may use low effort while difficult or risky leaves
|
|
are raised to high or xhigh. Verify and synthesize all child evidence in the
|
|
foreground coordinator. Do not delegate a one-tool mechanical action merely
|
|
to create an agent.
|
|
|
|
For persistent real Codex or Claude Code CLI work, launch a worker with:
|
|
|
|
`herdr-dispatch --auto --start --project <path> --task <short-name> --prompt <bounded-objective>`
|
|
|
|
AUTO sends that bounded worker objective through the same Jetson classifier
|
|
before selecting the real CLI, model, and effort. Explicit `--shape`,
|
|
`--effort`, and `--provider` remain available for a deliberate manual
|
|
override. The command creates a separate Herdr worker space. The visible
|
|
project tab remains a single Hermes coordinator pane. Never split Codex,
|
|
Claude, or a second Hermes process into that tab. Worker-space labels include
|
|
the parent project, provider, and task (for example
|
|
`cassandra-claude-review`) so the left rail preserves ownership and purpose.
|
|
Keep completed workers available as labeled spaces until their evidence has
|
|
been synthesized; do not tile them over the coordinator. Use `herdr agent
|
|
list`, `herdr agent wait`, `herdr agent read`, and `herdr agent prompt` to
|
|
supervise them. If Codex reports its first-use login requirement, run
|
|
`codex login --device-auth` once and ask Brad to complete the displayed code.
|
|
|
|
A hosted capacity failure should fall across providers at the same effort
|
|
before dropping to local inference. Do not duplicate a task that is still
|
|
running. When both providers contributed, use `synthesis-xhigh` only if the
|
|
objective's difficulty warrants it; otherwise synthesize at the original
|
|
effort.
|
|
|
|
This pod has Cassandra-scoped, read-only Kubernetes access for workloads,
|
|
logs, events, networking, and rollout diagnosis. It cannot read Secrets,
|
|
exec into pods, or mutate the cluster. Triage belongs at
|
|
triage.hermes.bstein.dev and all Atlas changes are delivered through the
|
|
titan-iac Git/Flux workflow.
|
|
START-HERE.md: |
|
|
# Agent Hermes
|
|
|
|
The authenticated root of agent.hermes.bstein.dev opens the persistent
|
|
browser terminal with the stock Hermes TUI in the foreground. Give Hermes
|
|
the outcome you want and it will decompose dependent work, classify every
|
|
delegated leaf on the Jetson, choose Codex or Claude, preserve the task on
|
|
the Cassandra board, and synthesize the evidence. Persistent real Codex and
|
|
Claude Code CLI sessions run through Herdr behind that interface only when
|
|
useful. Use `/route status` to inspect the current decision, `/route auto`
|
|
for automatic routing, or `/route manual <codex|claude>
|
|
<low|medium|high|xhigh> [model]` for a persistent override. The first native
|
|
Codex worker requires one device-code login; subsequent sessions persist on
|
|
the agent volume.
|