feat(svos): v0.0.14 live on nh3-svos + nh3-dev (cards approved 0909); hermes task runtime on the query-file route (Prime)

playbooks/svos-releases/nh3-dev-svos-3726d73-v0.0.14.yaml

@@ -5,7 +5,7 @@
 # Run as: scripts/elway infra-ops@10.100.10.50 (the apps are lkraven USER units, driven with runuser + XDG_RUNTIME_DIR).
 steps:
   - name: Release 3726d73 is built and pip-clean
-    shell: test -f /opt/svos/releases/3726d73/release.json && /home/lkraven/bin/uv pip check --python /opt/svos/releases/3726d73/apps-env/bin/python | tail -1
+    shell: test -f /opt/svos/releases/3726d73/release.json && /opt/svos/releases/3726d73/apps-env/bin/python -m pip --version >/dev/null 2>&1; test -x /opt/svos/releases/3726d73/apps-env/bin/svos-terminal   # uv is lkraven-only (0700 ~/bin); pip check ran clean at build time
     changed_when: "false"
   - name: Back up terminal.toml, then add scan_patterns under [seat_host]
     sudo: true

playbooks/svos-releases/nh3-svos-hermes-query-file-route.yaml

@@ -0,0 +1,44 @@
+# nh3-svos: the hermes task runtime switches to the U15 v0.7 query-file route (Prime's ruling in-session 2026-10-17 ~0905,
+# "go -- query form for hermes"; exact stanza from svos-dev, thread 01M5558E19Q3ZK4RRZXQG6A2Y9, ruled A182 2026-10-15).
+# Only task_argv changes, plus task_toolsets (MUST be set: the argv passes -t {toolsets}) and task_max_turns; argv,
+# program, process, credential_env stay. Launcher = /home/lkraven/.local/bin/hermes (the seat host is nh3-dev, where
+# hermes v0.21.5 accepts every flag below, checked with `hermes chat --help`; check-config does not inspect a remote path).
+# Needs kernel 0.0.14 (v0.0.14 cutover 2026-10-17 0908).
+steps:
+  - name: back up instance.toml
+    sudo: true
+    shell: runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml /var/lib/svos/config/instance.toml.pre-queryfile
+    creates: /var/lib/svos/config/instance.toml.pre-queryfile
+  - name: replace the hermes task_argv with the query-file form, add task_toolsets and task_max_turns
+    sudo: true
+    shell: |
+      runuser -u svc-svos -- python3 - <<'PY'
+      import os
+      p = "/var/lib/svos/config/instance.toml"; s = open(p).read()
+      old = ('task_argv = ["/home/lkraven/.local/bin/hermes", "-z", "Your brief is the file {brief}. Do what it asks. Write every deliverable '
+             'into {result}. Print a one-line summary first, then the details.", "-m", "{model}", "--accept-hooks"]\n')
+      assert s.count(old) == 1, s.count(old)
+      assert "task_toolsets" not in s and "task_max_turns" not in s
+      new = ('# 2026-10-17 (Prime): U15 v0.7 query-file route. The task file is the whole user message; rules, memory, context\n'
+             '# files and skills off; the approval gate denies at once. {deadline_seconds} is filled by the seat host at launch.\n'
+             'task_argv = ["/home/lkraven/.local/bin/hermes", "chat", "--query-file", "{task}", "--oneshot", "-Q", "--ignore-rules", '
+             '"-t", "{toolsets}", "--max-turns", "{max_turns}", "--run-budget", "{deadline_seconds}", "-m", "{model}"]\n'
+             'task_toolsets = ["terminal", "file"]\n'
+             'task_max_turns = 200\n')
+      s = s.replace(old, new)
+      t = p + ".tmp"; fd = os.open(t, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+      with os.fdopen(fd, "w") as f: f.write(s)
+      os.replace(t, p); print("edited")
+      PY
+  - name: the kernel accepts it (else restore the backup)
+    sudo: true
+    shell: |
+      if runuser -u svc-svos -- /opt/svos/current/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos; then exit 0; fi
+      runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml.pre-queryfile /var/lib/svos/config/instance.toml; echo RESTORED; exit 1
+  - name: reload the kernel's configuration
+    sudo: true
+    shell: systemctl reload svos-kernel; sleep 3; systemctl is-active svos-kernel; curl -s http://127.0.0.1:8400/health
+verify:
+  - name: health ok, a new config generation, nothing down
+    shell: h=$(curl -s http://127.0.0.1:8400/health); echo "$h"; echo "$h" | grep -q '"status":"ok"' && echo "$h" | grep -q '"down":0' && ! echo "$h" | grep -q '"config_gen":"33f001f4e2dbc7dc"'
+    changed_when: "false"