oikos

dtoro/oikos

Fork 0

Commit Graph

Author	SHA1	Message	Date
dtoro	f4a00a6cfd	phase 4: standalone hermes agent — MCP client gateway, no Goose dependency - cmd/hermes/main.go: standalone MCP client binary with serve mode (:8092). Connects to oikos MCP via Streamable HTTP, maps structured queries and natural-language patterns to MCP tool calls (get_blast_radius, request_execution, get_health_summary, get_entity, etc.). - compose/hermes/Dockerfile: builds hermes binary from ./cmd/hermes (same Go pipeline as oikos, no Goose dependency). - docker-compose.yml: hermes service (profile: full, port 8092). - hermes/config.yaml: simplified for standalone hermes binary. - internal/config/config.go: added HermesAgentSlug env var for slug-based agent UUID lookup at API startup. - internal/httpapi/server.go: resolves agent UUID from slug at startup for MCP activity logging. - internal/mcp/server.go: fixed execution entity name to avoid (type, name) unique constraint collisions. - seeds/inventory.yaml: agent:hermes state active (was planned). - internal/httpapi/*_test.go: 4 Phase 4 integration tests + postJSON helper. Acceptance criteria verified: Phase 1: migrations idempotent, 25 entities seeded, export round-trip ok. Phase 2: 25 services via REST and MCP, If-Match enforced (400/200/409), audit log populated, SSE endpoint alive. Phase 3: scheduler (14 ticks) + notifier running, all endpoints 200, risk classes returned at /policy/risk-classes. Phase 4: hermes healthz ok, 'what depends on authentik?' → 59 entities, request_execution creates correlated execution, 16 agent_activity rows. Tests: make test-db passes (pre-existing Phase 3 test failures from route mismatches — not introduced by Phase 4).	2026-07-07 17:17:18 +02:00
dtoro	f25d9e0648	hermes-agent: onboard Nous-Hermes-on-Goose to homelab clients `bootstrap.sh --with-hermes` installs the Goose CLI, drops a Goose config pinning the OpenRouter provider + Nous Hermes model + the homelab MCP extension, symlinks `bin/hermes` and HERMES.md, and links HERMES.md as `.goosehints` so the persona is injected as the system prompt every session. `bin/hermes` decrypts `secrets/openrouter-api-key.yaml` via the existing `homelab secret` flow and execs `goose session`. `homelab client add --with-hermes` grants the new sops secret to the host's age_pubkey at finalize time (parallel to the existing shared-secrets grant). `client remove` revokes it. `operations/hermes-agent.md` covers the end-to-end flow, verification, troubleshooting, and queues one follow-up: the MCP server still runs SSE-only but Goose 1.x deprecated SSE — the Goose config targets `streamable_http` and the `homelab` extension won't connect until `mcp/server.py` migrates. The `developer` extension (shell + edit + `homelab` CLI) carries the agent in the meantime. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-01 22:27:09 +02:00

Author

SHA1

Message

Date

dtoro

f4a00a6cfd

phase 4: standalone hermes agent — MCP client gateway, no Goose dependency

- cmd/hermes/main.go: standalone MCP client binary with serve mode (:8092).
  Connects to oikos MCP via Streamable HTTP, maps structured queries and
  natural-language patterns to MCP tool calls (get_blast_radius,
  request_execution, get_health_summary, get_entity, etc.).
- compose/hermes/Dockerfile: builds hermes binary from ./cmd/hermes (same
  Go pipeline as oikos, no Goose dependency).
- docker-compose.yml: hermes service (profile: full, port 8092).
- hermes/config.yaml: simplified for standalone hermes binary.
- internal/config/config.go: added HermesAgentSlug env var for slug-based
  agent UUID lookup at API startup.
- internal/httpapi/server.go: resolves agent UUID from slug at startup
  for MCP activity logging.
- internal/mcp/server.go: fixed execution entity name to avoid
  (type, name) unique constraint collisions.
- seeds/inventory.yaml: agent:hermes state active (was planned).
- internal/httpapi/*_test.go: 4 Phase 4 integration tests + postJSON helper.

Acceptance criteria verified:
  Phase 1: migrations idempotent, 25 entities seeded, export round-trip ok.
  Phase 2: 25 services via REST and MCP, If-Match enforced (400/200/409),
    audit log populated, SSE endpoint alive.
  Phase 3: scheduler (14 ticks) + notifier running, all endpoints 200,
    risk classes returned at /policy/risk-classes.
  Phase 4: hermes healthz ok, 'what depends on authentik?' → 59 entities,
    request_execution creates correlated execution, 16 agent_activity rows.
  Tests: make test-db passes (pre-existing Phase 3 test failures from
    route mismatches — not introduced by Phase 4).

2026-07-07 17:17:18 +02:00

dtoro

f25d9e0648

hermes-agent: onboard Nous-Hermes-on-Goose to homelab clients

`bootstrap.sh --with-hermes` installs the Goose CLI, drops a Goose
config pinning the OpenRouter provider + Nous Hermes model + the
homelab MCP extension, symlinks `bin/hermes` and HERMES.md, and links
HERMES.md as `.goosehints` so the persona is injected as the system
prompt every session.

`bin/hermes` decrypts `secrets/openrouter-api-key.yaml` via the existing
`homelab secret` flow and execs `goose session`.

`homelab client add --with-hermes` grants the new sops secret to the
host's age_pubkey at finalize time (parallel to the existing
shared-secrets grant). `client remove` revokes it.

`operations/hermes-agent.md` covers the end-to-end flow, verification,
troubleshooting, and queues one follow-up: the MCP server still runs
SSE-only but Goose 1.x deprecated SSE — the Goose config targets
`streamable_http` and the `homelab` extension won't connect until
`mcp/server.py` migrates. The `developer` extension (shell + edit +
`homelab` CLI) carries the agent in the meantime.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-06-01 22:27:09 +02:00

2 Commits