Hand over agents to the estate path #658

Activity

1. ExtraToast

   added

   type: choreMaintenance work without intended behavior change.Maintenance work without intended behavior change.

   area: platformPlatform, deployment, cluster, or runtime concern.Platform, deployment, cluster, or runtime concern.

   priority: P1High; important and should be handled in the current iteration.High; important and should be handled in the current iteration.

   status: blockedCannot move forward until an external dependency is resolved.Cannot move forward until an external dependency is resolved.

   on Oct 27, 2026
2. ExtraToast

   added a parent issue on Oct 27, 2026

   • Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project #373
3. ExtraToast commented on Oct 27, 2026

   

   ExtraToast

   on Oct 27, 2026

   ContributorAuthor

   More actions

   Resume here

   • State: not started. The body holds the Project's estate-file items, and Rewrite chapter 60 to rules, and write the handover and setup runbooks #381 holds the runbook steps.
   • Next step: once Republish delivery, _canary and _estate on 1.0.0 #380 is done and Rewrite chapter 60 to rules, and write the handover and setup runbooks #381's runbook is in, fill in the estate's project file from the worked example (the other session's example tickets, where the body names them). Then diff the render against fleet-infra's hand-written objects.
   • Blocked by: Republish delivery, _canary and _estate on 1.0.0 #380, Rewrite chapter 60 to rules, and write the handover and setup runbooks #381, and the handover before this one in Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project #373's order.
   • Decisions: in this ticket's body and in Rewrite chapter 60 to rules, and write the handover and setup runbooks #381's resume note, dated, including 2026-10-27's: Vault moves by raft snapshot and restore, observability starts fresh, Grafana goes in observability, and Garage's volume splits at handover.
   • Gotchas: keep every live claim name the body lists. A live handover step is the maintainer's go-ahead, never an agent's.
4. ExtraToast commented on Oct 29, 2026

   

   ExtraToast

   on Oct 29, 2026

   ContributorAuthor

   More actions

   #654 has landed (#698): the agents example now models what runs live. The estate's agents file copies spec/v1/examples/agents/ as it stands on main: hermes and kubernetes-mcp-server, with agents-api and agents-ui parked.

   Before this handover can run hermes and the MCP server as they run live, these RENDER-GAPS.md rows need deciding:

   • A Process cannot be given arguments, so hermes and kubernetes-mcp-server start without theirs #691: Process arguments (gateway run, --port=8080 --read-only)
   • An image that starts as root and drops to its own user cannot run under the one posture #692: hermes starts as root and drops to uid 10000
   • A config seeded onto a Process's volume by an init step has no declaration #693: the config hermes's init steps seed onto its volume
   • A writable path cannot be memory-backed or sized, so /dev/shm stays at the runtime default #695: a memory-backed /dev/shm

   The others (#694 grey-cloud host, #696 optional keys, #697 a host split by path) degrade it without stopping it.

   Two more things change with the example:

   • The worked Platform document admits agents/kubernetes-mcp-server in apiAccess.holders. A cluster-wide read is a privileged role, so it runs at the critical priority class.
   • hermes signs in against the estate's provider, not auth-api.
5. ExtraToast commented on Oct 29, 2026

   

   ExtraToast

   on Oct 29, 2026

   ContributorAuthor

   More actions

   #380 is closed: delivery, _canary and _estate are on the 1.0 contract (evidence in #380 (comment)).
6. ExtraToast commented on Oct 29, 2026

   

   ExtraToast

   on Oct 29, 2026

   ContributorAuthor

   More actions

   The agents handover is prepared: four draft pull requests, nothing merged. Validated and composed with deploy-kit 1.2.0, the version the estate's toolkit.yml pins; 1.3.0 renders the same objects plus two external-check ConfigMaps.

   In merge order:

   1. JorisJonkers-dev/fleet-infra#559: mark agents-system (both copies) and the claims hermes-data, claude-credentials and codex-credentials never to be pruned. Also set the three volumes to Retain by hand. Before the window.
   2. JorisJonkers-dev/fleet-infra#560: orphan the Project. apps-agents and apps-stateless mark everything they apply, and apps-agents stops pruning. In the window, step 1.
   3. JorisJonkers-dev/fleet-infra#561: drop the manifests and flux-system/apps-agents, whose name the estate's unit shares. hermes's routes move to apps-edge. Its NetworkPolicy moves to apps-stateless and stays enforced, now also admitting kubernetes-mcp-server-primary. In the window, step 2.
   4. feat: hand the agents Project over to the estate path estate#258: the estate file, the Platform additions, the ledger flip, and docs/runbooks/agents-handover.md with the full render-against-live diff. In the window, step 3, after the old hermes is scaled to 0.

   Each fleet-infra PR was test-merged with #531 and with mail's #546 to #549. The conflicts with #531 are mechanical, and each PR body lists them.

   Open blockers:

   • D1, a maintainer decision: which hermes config.yaml ships. The estate is public, so it carries a stand-in, and the seeded Asset overwrites the live config on every start. Unless the live file ships, hermes loses its model aliases, its provider_routing.only, its system prompt and four MCP servers. The live file holds no secret.
   • D4, memory: hermes's request rises from 1Gi to 3Gi. enschede-gtx-960m-1 fits it by 48Mi. The recommendation is to delete the retired auth-bootstrap pod first.
   • D2: the stale /opt/data/.env is moved aside after the flip.
   • D3: agents-api and agents-ui stay parked, as the example has them.
   • Signing in: the estate's Platform document names no sign-in provider, so hermes keeps signing in against auth-api as live, without the example's client block.
   • Before the flip: the utility handover (Hand over utility to the estate path #657); pre-check 6, which reads that /opt/data is owned by uid 10000, because local-path applies no fsGroup.
   • No Vault write is needed. Every key is optional, and the three that are used are present (key names only, from the synced Secret).
   • RENDER-GAPS A8 (A skills sync that fetches sources onto a Process's volume before it starts has no declaration #706) stays open: hermes runs with its bundled skills.
7. ExtraToast

   added a commit that references this issue on Oct 30, 2026

   feat(agents): seed hermes with its live config

   ...

   de4fc08
8. ExtraToast commented on Oct 30, 2026

   

   ExtraToast

   on Oct 30, 2026

   ContributorAuthor

   More actions

   D1 is done: estate#258 now ships hermes's live config. platform/agents/config/hermes/config.yaml is fleet-infra's live config.yaml (the hermes-config ConfigMap on main at 38715a3, identical to the cluster's). The only change is its three @VAR@ markers, rewritten as ${GITHUB_PAT}, ${HINDSIGHT_API_TOKEN} and ${OVERLEAF_SESSION}.

   • No secret value: those three markers are its only credentials, and gitleaks finds nothing. Each of the three reaches hermes through env/hermes/base.env.
   • Revalidated on deploy-kit 1.3.0, after merging the estate's main:
     • CI validate: accepted (112 read);
     • the release matrix through Publish Fragment v0.38.0's pack.sh: every entry accepted;
     • a local composition: composed 20 artifacts, with the seeded ConfigMap hermes-config-yaml-868e18008f byte-identical to the file.
   • Two side effects, left as they are:
     • the file still names /opt/data/skills-vendored, so hermes keeps reading the last old-path skills sync, frozen (A8, A skills sync that fetches sources onto a Process's volume before it starts has no declaration #706);
     • its playwright, drawio and overleaf MCP servers run through npx under a read-only root, which is a new proof step.
   • fleet-infra#559 is merged. fleet-infra#561 now has main merged in, with Record that a Project owns every object it delivers #555's edge-system admissions carried into the moved hermes policy.

   D4, the memory margin, stays open for the maintainer. All PRs remain drafts.
9. ExtraToast

   removed

   status: blockedCannot move forward until an external dependency is resolved.Cannot move forward until an external dependency is resolved.

   on Oct 30, 2026
10. ExtraToast commented on Oct 30, 2026

    

    ExtraToast

    on Oct 30, 2026

    ContributorAuthor

    More actions

    Not planned: agents is deprecated and will not be handed over (maintainer's decision, 2026-10-30). estate#265 takes it off the handover ledger; estate#258 and fleet-infra#560/#561 are closed. fleet-infra#559's prune marks and Retain volumes stay, and are harmless.
11. ExtraToast

    closed this as not plannedon Oct 30, 2026