feat(agents): hermes home-normalization + system-scope gateway (closes #437)#440
Open
thinmintdev wants to merge 6 commits into
Open
feat(agents): hermes home-normalization + system-scope gateway (closes #437)#440thinmintdev wants to merge 6 commits into
thinmintdev wants to merge 6 commits into
Conversation
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ay secrets drop-in (#437) - HERMES_HOME default -> /var/lib/hal0/.hermes everywhere (provisioner, override.conf, installer, wrappers, personas/shim) - canonical /usr/local/bin/hermes wrapper (no HERMES_HOME pin); hal0-hermes -> back-compat symlink - _phase_gateway_secrets_wire: system-scope /etc/systemd/system/hermes-gateway.service.d/10-hal0-secrets.conf (idempotent + daemon-reload) - reconcile stale status() test against W9 real-health contract (stub systemd/port probes; add live-unit guard test) - tests + docs Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…h install The provisioner only writes the secrets drop-in; the gateway main unit was never created on install, so Telegram/Discord never started on a fresh box. install.sh now runs hermes gateway install --system --run-as-user hal0 (HERMES_HOME unset so it bakes the ~/.hermes default), daemon-reloads to pick up the drop-in, and enables the unit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ate) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The override.conf shipped a web_dist path missing python3.12/site-packages/, so hal0-agent@hermes --skip-build could not find the dashboard dist and the unit crash-looped. Point at the real package location. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Runs Hermes entirely as the
hal0system user, out ofroot, on the normalized hermes default home, with the messaging gateway as a system-scope service.What changed
/var/lib/hal0/.hermeseverywhere (provisioner default,hal0-agent@hermesoverride.conf, installer script, both wrappers, personas/shim path refs).User=hal0—_phase_gateway_secrets_wirewrites the idempotent secrets drop-in to/etc/systemd/system/hermes-gateway.service.d/10-hal0-secrets.conf(surviveshermes gateway installregenerating the main.service). No linger, no/root.install.shnow runshermes gateway install --system --run-as-user hal0+enable --now(HERMES_HOME unset so the generator bakes the.hermesdefault), so a fresh install boots with Telegram/Discord connected./usr/local/bin/hermes(no HERMES_HOME pin);hal0-hermes→ back-compat symlink.HERMES_WEB_DISTto the real venv site-packages path (was crash-looping the dashboard with--skip-build).status()test against the W9 real-health contract (stub systemd/port probes + a live-unit guard test).docs/internal/).Live cutover
This box was cut over in-place 2026-06-03, preserving all state (37 sessions, kanban, memories): both services now run as
hal0on.hermes, telegram+discord connected, dashboard 200.Follow-ups (tracked, not in this PR)
EnvironmentFileinto the real/etc/systemd/system/...(patchesHERMES_SECRETS_ENVbut not the dropin path) — test-isolation fix./var/lib/hal0/agents/hermesretained pending an audit ofAGENTS_ROOT-based code (budget/personas/restart).Closes #437.