vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(nh3-dev): record the Hermes Agent gateway sidecar on 127.0.0.1:8765

Browse Source 
Stood up hermes-gateway.service (user systemd, vendor 'hermes gateway
install') for SVOS/Miranda, which cut over from Worldtree to Hermes on
2026-09-11 and aborts at boot without it. Bearer key vaulted as
nh3-dev/hermes/api-server-key.

Notes the wide default tool surface: with no roster config the gateway
registers all 28 toolsets on the api_server platform, terminal and
code_execution included. Loopback bind plus the key are the only
containment until SVOS installs its svos_miranda plugin and the
platform_toolsets / disabled_toolsets roster is applied.
This commit is contained in:
Vuong Hoang
2026-09-14 12:25:03 -07:00
parent cd941f7bf9
commit d7e69ddaef
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/nh3-dev/README.md
+12
View File
@@ -20,6 +20,18 @@ local Bash already executes here — no SSH-to-self needed for non-privileged wo
behind Caddy; OSC52 clipboard shim). User systemd services under `~/.config`.
- **mead-hall** — Bifrost tool-provider sidecar (`:5173`), CI-deployed from
`vh/mead-hall`.
- **Hermes Agent gateway** — OpenAI-compatible agent API on `127.0.0.1:8765`
(`hermes-gateway.service`, user systemd, installed 2026-09-14 via `hermes
gateway install`). Runs the per-user install at `~/.hermes/hermes-agent`
(v0.21.1, `b88e677`); config in `~/.hermes/{.env,config.yaml}`. Stood up for
**SVOS/Miranda**, which replaced Worldtree with Hermes on 2026-09-11 and
cannot boot without it. Bearer auth is mandatory even on loopback — key
vaulted as `nh3-dev/hermes/api-server-key`. ⚠ The gateway registers Hermes's
**full** toolset by default (28 toolsets incl. `terminal`, `code_execution`,
`file`, `browser`); SVOS's security model is to strip all of them via
`platform_toolsets[api_server]` + `agent.disabled_toolsets` once its
`svos_miranda` plugin lands in `$HERMES_HOME/plugins/`. Until then the surface
is wide — loopback bind + key are the only containment.
- **bloom_music dev** — `~/development/bloom_music`; its `web/` test harness uses
Playwright headless Chromium for OSMD browser-geometry assertions.
- **The Booth** — ephemeral media drop board (`:8090`, `booth.service`), from