Hermes Agent b2cca91b6b hermes: derive the oauth2-proxy callback from the request host ...

Restoring the legacy chat/triage hosts is not enough on its own: both
proxies pinned --redirect-url to the renamed host, and oauth2-proxy
returns that value verbatim whenever it carries a host
(getOAuthRedirectURI short-circuits on redirectURL.Host != ""). A login
started on a legacy host would therefore send the browser to the
canonical host's callback, while the CSRF cookie stays behind: it is
issued with the __Host- prefix, which forbids a Domain attribute and
pins it to the exact origin. The callback lands without it and fails as
"unable to find a valid CSRF token".

Drop the host from both callback URLs so oauth2-proxy builds them from
the request host instead. For the renamed hosts the derived value is
byte-identical to the pinned one, so their behaviour is unchanged; the
legacy hosts now complete a login on the host the user actually visited.
Derivation reads X-Forwarded-Host only behind a trusted reverse proxy,
which both deployments already declare, and Keycloak still matches the
result against the redirect URIs registered by the ensure script.

The agent proxy keeps its pinned callback: it serves one host.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-21 09:09:54 +00:00

..

data

hermes: close the review-role gaps found reviewing PR 22

2026-08-17 17:27:11 +00:00

conftest.py

Merge remote-tracking branch 'origin/feature/hermes-distributed-worker-pool' into feature/hermes-full-handoff-acceptance

2026-08-18 06:28:18 -03:00

test_atlas_ai_dashboard.py

monitoring(ai): add provider quota operations dashboard

2026-08-16 05:13:20 -03:00

test_hermes_agent_layout.py

Merge origin/main (#14 + #16) into PR #15 decomposition reliability

2026-08-18 00:42:53 -03:00

test_hermes_agent_runtime_patches.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_ai_usage_codex.py

hermes: split AI usage exporter engines

2026-08-17 15:33:56 +00:00

test_hermes_ai_usage_exporter_coverage.py

hermes: split AI usage exporter engines

2026-08-17 15:33:56 +00:00

test_hermes_ai_usage_exporter.py

hermes: split AI usage exporter engines

2026-08-17 15:33:56 +00:00

test_hermes_auto_router.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_chat_images.py

Merge PR 15 (CLI lane decomposition) on top of PR 14 (Atlas SCM broker)

2026-08-17 16:29:29 +00:00

test_hermes_chat_local_runtime.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_chat_provider_auth.py

Merge PR 15 (CLI lane decomposition) on top of PR 14 (Atlas SCM broker)

2026-08-17 16:29:29 +00:00

test_hermes_chat_provider_runtime.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_chat_quality.py

hermes: surface a friendly "Automatic" routing label

2026-08-18 06:55:51 -03:00

test_hermes_chat_routing_runtime.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_chat_session_continuity.py

fix(hermes): poll the session contract the chat tenants actually serve

2026-08-20 18:14:55 +00:00

test_hermes_chat_smoothness.py

hermes: harden chat continuity and activity

2026-08-17 14:39:21 +00:00

test_hermes_chat_support.py

Merge PR 15 (CLI lane decomposition) on top of PR 14 (Atlas SCM broker)

2026-08-17 16:29:29 +00:00

test_hermes_claude_broker.py

hermes: keep provider lanes available under load

2026-08-15 22:15:40 -03:00

test_hermes_cli_capabilities.py

Merge remote-tracking branch 'origin/feature/hermes-review-goal-semantics' into feature/hermes-distributed-worker-pool

2026-08-18 01:43:39 -03:00

test_hermes_cli_dispatch_runtime.py

hermes: reconcile pool tests and staging hygiene with the train API

2026-08-18 02:00:19 -03:00

test_hermes_cli_dispatch.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_durability.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_evidence_edges.py

Merge remote-tracking branch 'origin/feature/hermes-review-goal-semantics' into feature/hermes-distributed-worker-pool

2026-08-18 01:43:39 -03:00

test_hermes_cli_execution_edges.py

hermes: reconcile pool tests and staging hygiene with the train API

2026-08-18 02:00:19 -03:00

test_hermes_cli_fallback.py

Merge remote-tracking branch 'origin/feature/hermes-review-goal-semantics' into feature/hermes-distributed-worker-pool

2026-08-18 01:43:39 -03:00

test_hermes_cli_finalization_authority.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_finalization_edges.py

hermes: close lane branch coverage gaps

2026-08-17 15:03:59 -03:00

test_hermes_cli_finalization.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_foundation_coverage.py

hermes: close lane branch coverage gaps

2026-08-17 15:03:59 -03:00

test_hermes_cli_goal_execution.py

hermes: test quota gating, cooldown recovery, and failover policy

2026-08-17 20:31:12 -03:00

test_hermes_cli_lane_goal.py

Merge remote-tracking branch 'origin/feature/hermes-cli-auto-quota-routing' into feature/hermes-review-goal-semantics

2026-08-18 01:18:06 -03:00

test_hermes_cli_lane_metrics.py

hermes: test quota gating, cooldown recovery, and failover policy

2026-08-17 20:31:12 -03:00

test_hermes_cli_lane_routing.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_lanes_access.py

Merge remote-tracking branch 'origin/fix/hermes-result-decomposition-reliability' into feature/hermes-cli-auto-quota-routing

2026-08-18 00:57:54 -03:00

test_hermes_cli_lanes_support.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_cli_lanes_toolchain.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_cli_matrix_capabilities.py

hermes: close lane branch coverage gaps

2026-08-17 15:03:59 -03:00

test_hermes_cli_provenance.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_provider_edges.py

Merge remote-tracking branch 'origin/feature/hermes-review-goal-semantics' into feature/hermes-distributed-worker-pool

2026-08-18 01:43:39 -03:00

test_hermes_cli_provider_health.py

hermes: test quota gating, cooldown recovery, and failover policy

2026-08-17 20:31:12 -03:00

test_hermes_cli_provider_sessions.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_quarantine_edges.py

hermes: gate mixed image lane APIs

2026-08-17 08:16:35 -03:00

test_hermes_cli_quarantine.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_quota_failover.py

hermes: align capacity gate with auth classifier

2026-08-17 20:46:00 -03:00

test_hermes_cli_quota_gating.py

hermes: test quota gating, cooldown recovery, and failover policy

2026-08-17 20:31:12 -03:00

test_hermes_cli_records_edges.py

Merge remote-tracking branch 'origin/feature/hermes-review-goal-semantics' into feature/hermes-distributed-worker-pool

2026-08-18 01:43:39 -03:00

test_hermes_cli_recovery_edges.py

hermes: close lane branch coverage gaps

2026-08-17 15:03:59 -03:00

test_hermes_cli_retention_edges.py

hermes: close lane branch coverage gaps

2026-08-17 15:03:59 -03:00

test_hermes_cli_retention.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_review_contract.py

hermes: close the review-role gaps found reviewing PR 22

2026-08-17 17:27:11 +00:00

test_hermes_cli_review_corpus.py

hermes: close the review-role gaps found reviewing PR 22

2026-08-17 17:27:11 +00:00

test_hermes_cli_review_goal.py

hermes: close the review-role gaps found reviewing PR 22

2026-08-17 17:27:11 +00:00

test_hermes_cli_review_lane.py

Merge remote-tracking branch 'origin/feature/hermes-cli-auto-quota-routing' into feature/hermes-review-goal-semantics

2026-08-18 01:18:06 -03:00

test_hermes_cli_review_roles.py

hermes: close the review-role gaps found reviewing PR 22

2026-08-17 17:27:11 +00:00

test_hermes_cli_router_outage.py

hermes: align capacity gate with auth classifier

2026-08-17 20:46:00 -03:00

test_hermes_cli_routing.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_run_identity.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_staging.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_cli_support.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_hermes_coordinator_cassandra.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_coordinator_coverage.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_coordinator_support.py

Merge PR 15 (CLI lane decomposition) on top of PR 14 (Atlas SCM broker)

2026-08-17 16:29:29 +00:00

test_hermes_coordinator.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_deadline_http.py

hermes: bound SCM control calls with hard deadlines

2026-08-17 15:15:35 -03:00

test_hermes_deadline_stream.py

hermes: bound streaming git DNS resolution

2026-08-17 20:37:30 -03:00

test_hermes_execution_pool_assignment.py

fix(hermes): allow two direct CLI lane workers

2026-08-21 07:11:55 +00:00

test_hermes_execution_pool_coordinator_v2.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_dispatch_v2.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_isolation.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_manifests.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_mediator.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_placement.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_project.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_protocol_v2.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_recovery.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_scm_tampering.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_submission.py

hermes: reconcile pool tests and staging hygiene with the train API

2026-08-18 02:00:19 -03:00

test_hermes_execution_pool_support.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_worker_execute.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool_worker_v2.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_execution_pool.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

test_hermes_git_pack_objects.py

hermes: quarantine-scan pushed git objects

2026-08-17 15:15:47 -03:00

test_hermes_gitea_branch_coverage.py

gitea: require literal branch protection rules

2026-08-17 15:15:35 -03:00

test_hermes_gitea_internal_coverage.py

hermes: bound SCM control calls with hard deadlines

2026-08-17 15:15:35 -03:00

test_hermes_gitea_pr_client.py

hermes: source handoff forge evidence through the scm broker

2026-08-18 18:21:38 -03:00

test_hermes_gitea_pr_creation.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_gitea_pr_dlp.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_gitea_pr_integration.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_gitea_pr_postconditions.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_gitea_support.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_handoff_acceptance_armed.py

fix(hermes): close full-handoff acceptance blockers

2026-08-17 13:11:34 +00:00

test_hermes_handoff_acceptance.py

hermes: source handoff forge evidence through the scm broker

2026-08-18 18:21:38 -03:00

test_hermes_handoff_catalog.py

fix(hermes): close full-handoff acceptance blockers

2026-08-17 13:11:34 +00:00

test_hermes_handoff_ephemeral.py

fix(hermes): close the zero-evidence fail-open in absence checks

2026-08-17 16:24:37 +00:00

test_hermes_handoff_evaluators.py

hermes: accept merged lineage in handoff acceptance

2026-08-18 16:28:25 -03:00

test_hermes_handoff_exec.py

hermes: source handoff forge evidence through the scm broker

2026-08-18 18:21:38 -03:00

test_hermes_handoff_json_rules.py

fix(hermes): close full-handoff acceptance blockers

2026-08-17 13:11:34 +00:00

test_hermes_handoff_model.py

fix(hermes): close full-handoff acceptance blockers

2026-08-17 13:11:34 +00:00

test_hermes_handoff_mutation_gate.py

fix(hermes): close the zero-evidence fail-open in absence checks

2026-08-17 16:24:37 +00:00

test_hermes_handoff_policy.py

hermes: source handoff forge evidence through the scm broker

2026-08-18 18:21:38 -03:00

test_hermes_handoff_redaction.py

fix(hermes): close full-handoff acceptance blockers

2026-08-17 13:11:34 +00:00

test_hermes_handoff_rules.py

hermes: source handoff forge evidence through the scm broker

2026-08-18 18:21:38 -03:00

test_hermes_handoff_run.py

fix(hermes): close the zero-evidence fail-open in absence checks

2026-08-17 16:24:37 +00:00

test_hermes_handoff_support.py

fix(hermes): close full-handoff acceptance blockers

2026-08-17 13:11:34 +00:00

test_hermes_handoff_zero_evidence.py

fix(hermes): close the zero-evidence fail-open in absence checks

2026-08-17 16:24:37 +00:00

test_hermes_image_builder_adversarial.py

hermes: add daemonless agent image release lane

2026-08-17 08:25:52 -03:00

test_hermes_image_builder_branch_edges.py

hermes: close release-lane branch coverage gaps

2026-08-17 15:10:17 -03:00

test_hermes_image_builder_coverage.py

hermes: add daemonless agent image release lane

2026-08-17 08:25:52 -03:00

test_hermes_image_builder_fresh_review.py

hermes: add daemonless agent image release lane

2026-08-17 08:25:52 -03:00

test_hermes_image_builder_harbor.py

hermes: add daemonless agent image release lane

2026-08-17 08:25:52 -03:00

test_hermes_image_builder_vault.py

Merge origin/main (#16 image-builder) into hermes-safe-gitea-pr

2026-08-17 21:07:06 -03:00

test_hermes_image_builder.py

hermes: add daemonless agent image release lane

2026-08-17 08:25:52 -03:00

test_hermes_kanban_recovery.py

hermes: recover stale kanban status pages

2026-08-16 04:49:02 -03:00

test_hermes_kanban_supervisor_policy.py

hermes: make supervisor terminal emissions idempotent across ticks

2026-08-18 06:51:36 -03:00

test_hermes_kanban_supervisor.py

hermes: make supervisor terminal emissions idempotent across ticks

2026-08-18 06:51:36 -03:00

test_hermes_main_wrapper.py

hermes: load tool credentials before s6

2026-08-15 03:44:00 -03:00

test_hermes_model_gate.py

hermes: preserve Switchyard response content

2026-08-11 23:12:43 -03:00

test_hermes_node_account_hardening.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_node_account_io.py

hermes: read node access keys through CSI symlinks

2026-08-18 16:28:25 -03:00

test_hermes_node_account_privilege_audit.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

test_hermes_node_account_support.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_node_acl_coverage.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_node_audit_coverage.py

hermes: audit every sudo include spelling

2026-08-17 20:37:30 -03:00

test_hermes_node_hardening_coverage.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_node_io_coverage.py

hermes: read node access keys through CSI symlinks

2026-08-18 16:28:25 -03:00

test_hermes_node_polkit_identity.py

hermes: reject regex literals in polkit grants

2026-08-17 20:37:30 -03:00

test_hermes_node_sudo_alias_audit.py

hermes: prove sudo and polkit denial closed

2026-08-17 15:15:47 -03:00

test_hermes_public_host_continuity.py

hermes: derive the oauth2-proxy callback from the request host

2026-08-21 09:09:54 +00:00

test_hermes_receive_pack_scan.py

hermes: quarantine-scan pushed git objects

2026-08-17 15:15:47 -03:00

test_hermes_runtime_access.py

hermes: reconcile pool tests and staging hygiene with the train API

2026-08-18 02:00:19 -03:00

test_hermes_runtime_evidence.py

hermes: reconcile pool tests and staging hygiene with the train API

2026-08-18 02:00:19 -03:00

test_hermes_runtime_stage_coverage.py

hermes: reconcile pool tests and staging hygiene with the train API

2026-08-18 02:00:19 -03:00

test_hermes_scm_broker_client_coverage.py

hermes: bound SCM control calls with hard deadlines

2026-08-17 15:15:35 -03:00

test_hermes_scm_broker_handler_coverage.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_scm_broker_internal_coverage.py

hermes: quarantine-scan pushed git objects

2026-08-17 15:15:47 -03:00

test_hermes_scm_broker_policy.py

gitea: require literal branch protection rules

2026-08-17 15:15:35 -03:00

test_hermes_scm_broker_streaming.py

hermes: quarantine-scan pushed git objects

2026-08-17 15:15:47 -03:00

test_hermes_scm_broker_support.py

hermes: quarantine-scan pushed git objects

2026-08-17 15:15:47 -03:00

test_hermes_scm_broker.py

hermes: reconcile pool tests and staging hygiene with the train API

2026-08-18 02:00:19 -03:00

test_hermes_scm_server_coverage.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

test_hermes_telegram_media_server.py

hermes: deliver generated media to Telegram

2026-08-15 00:34:08 -03:00

test_hermes_voice_instrument.py

feat(hermes-voice): add conversation state instrument

2026-08-20 23:13:51 +00:00

test_hermes_worker_recovery.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

test_jetson_tegrastats_exporter.py

fix(monitoring): retain short Jetson GPU activity

2026-08-09 14:38:51 -03:00

test_publish_test_metrics_paths.py

monitoring(testing): link test metrics to build artifacts

2026-04-21 11:39:13 -03:00

test_publish_test_metrics_quality.py

refactor: restructure services layout, retire oceanus, add aether scaffolding

2026-08-05 16:21:36 -03:00

test_publish_test_metrics.py

refactor: restructure services layout, retire oceanus, add aether scaffolding

2026-08-05 16:21:36 -03:00

test_quality_contract.py

Merge remote-tracking branch 'origin/feature/hermes-distributed-worker-pool' into feature/hermes-full-handoff-acceptance

2026-08-18 06:28:18 -03:00

test_quality_coverage_helpers.py

Merge remote-tracking branch 'origin/feature/hermes-distributed-worker-pool' into feature/hermes-full-handoff-acceptance

2026-08-18 06:28:18 -03:00

test_quality_gate_helpers.py

test(titan-iac): raise quality gate coverage for quality runner

2026-04-20 15:29:46 -03:00

test_quality_gate.py

hermes: enforce per-file branch coverage in the quality gate

2026-08-17 15:10:17 -03:00

test_quality_hygiene_helpers.py

hermes: lift remaining tracked modules to the branch floor

2026-08-17 15:10:17 -03:00

test_repo_structure.py

refactor: restructure services layout, retire oceanus, add aether scaffolding

2026-08-05 16:21:36 -03:00

test_semgrep_report.py

Merge remote-tracking branch 'origin/feature/hermes-distributed-worker-pool' into feature/hermes-full-handoff-acceptance

2026-08-18 06:28:18 -03:00

test_supply_chain_report.py

refactor: restructure services layout, retire oceanus, add aether scaffolding

2026-08-05 16:21:36 -03:00