chore(hermes): remove the Hermes service from the platform #717

Merged

binjovi-bot merged 4 commits from feat/eradicate-hermes into trunk 2026-09-13 17:37:02 +00:00

Conversation 0 Commits 4 Files changed 39 +14 -852

sean commented 2026-09-13 17:08:55 +00:00

Owner

Copy link

Removes the Hermes email assistant from the platform.

Deleted

The whole infrastructure/hermes source: namespace, reader user, Argo CD
project and Application, OIDC registration, twelve SOPS secrets and the
state-required marker. Also its Flux Kustomization, its gitmirror repository
and push mirror, the sean.pm certificate, the pre-destruction backup guard
scripts/check-hermes-state-backup.sh, and tests/hermes-contract.sh and
tests/hermes-backup-guard.sh.

Edited

The sean.pm gateway listeners, the Cilium carve-out (back to the blanket
endpointSelector: {} it had before Hermes), the Binjovi legacy access lists,
the management grant list, and the guard expectations that counted these
entries.

The Binjovi Forgejo integration Job template is immutable and its SQL loses the
hermes repository row, so the Job moves to v28 and the fingerprint pin moves
with it.

Deliberately kept

kubernetes/flux/infrastructure/gitmirrors/README.md keeps its Hermes rows.
They are measurements in an open investigation into push-mirror deletion
behaviour -- the table says if you learn the real rule, replace this table --
not an active dependency.

The sean.pm DNS zone stays registered in the ExternalDNS domain filter and the
ACME issuer. The domain is yours and outlives the service; ExternalDNS runs
--policy=sync, so the sean.pm record itself is withdrawn automatically when
the HTTPRoute goes. Say the word and I will remove the zone too.

Ordering

Merge after binjovi-plans #297 and binjovi #1760. binjovi-plans pins the
seanfarm build policy to the two guards this change deletes, and binjovi
declares the Forgejo repository.

Out of band

The Gmail grant this served was revoked at Google before the secret was deleted.
POST /revoke returned 200 and a refresh now answers
invalid_grant / Token has been expired or revoked. The 1228 objects under the
hermes/ bucket prefix are deleted; cnpg-backups/ and vm-backups/ were
verified unchanged.

bash tests/check.sh passes.

https://claude.ai/code/session_01GfkEuwuvGSqGyXVuxwT7PA

Removes the Hermes email assistant from the platform. ### Deleted The whole `infrastructure/hermes` source: namespace, reader user, Argo CD project and Application, OIDC registration, twelve SOPS secrets and the `state-required` marker. Also its Flux Kustomization, its gitmirror repository and push mirror, the `sean.pm` certificate, the pre-destruction backup guard `scripts/check-hermes-state-backup.sh`, and `tests/hermes-contract.sh` and `tests/hermes-backup-guard.sh`. ### Edited The `sean.pm` gateway listeners, the Cilium carve-out (back to the blanket `endpointSelector: {}` it had before Hermes), the Binjovi legacy access lists, the management grant list, and the guard expectations that counted these entries. The Binjovi Forgejo integration Job template is immutable and its SQL loses the hermes repository row, so the Job moves to **v28** and the fingerprint pin moves with it. ### Deliberately kept `kubernetes/flux/infrastructure/gitmirrors/README.md` keeps its Hermes rows. They are measurements in an open investigation into push-mirror deletion behaviour -- the table says *if you learn the real rule, replace this table* -- not an active dependency. The `sean.pm` DNS zone stays registered in the ExternalDNS domain filter and the ACME issuer. The domain is yours and outlives the service; ExternalDNS runs `--policy=sync`, so the `sean.pm` record itself is withdrawn automatically when the HTTPRoute goes. Say the word and I will remove the zone too. ### Ordering Merge **after** binjovi-plans #297 and binjovi #1760. binjovi-plans pins the seanfarm build policy to the two guards this change deletes, and binjovi declares the Forgejo repository. ### Out of band The Gmail grant this served was revoked at Google before the secret was deleted. `POST /revoke` returned 200 and a refresh now answers `invalid_grant / Token has been expired or revoked`. The 1228 objects under the `hermes/` bucket prefix are deleted; `cnpg-backups/` and `vm-backups/` were verified unchanged. `bash tests/check.sh` passes. https://claude.ai/code/session_01GfkEuwuvGSqGyXVuxwT7PA

sean added 1 commit 2026-09-13 17:08:55 +00:00

chore(hermes): remove the Hermes service from the platform ... 7142447c3e

The Hermes email assistant is retired. This removes every seanfarm
declaration of it.

Deleted: the whole infrastructure/hermes source (namespace, reader user,
Argo CD project and Application, OIDC registration, twelve SOPS secrets
and the state-required marker), its Flux Kustomization, its gitmirror
repository and push mirror, the sean.pm certificate, the pre-destruction
backup guard and its two guards.

Edited: the sean.pm gateway listeners, the Cilium carve-out (back to the
blanket endpointSelector it had before Hermes), the Binjovi legacy access
lists, the management grant list, and the guard expectations that counted
these entries.

The Binjovi Forgejo integration Job template is immutable and its SQL
loses the hermes repository row, so the Job moves to v28 and the
fingerprint pin moves with it.

The gitmirrors README keeps its Hermes rows. They are measurements in an
open investigation into push-mirror deletion, not an active dependency.

The Gmail grant this served was revoked at Google before the secret was
deleted; a refresh now answers invalid_grant.

Claude-Session: https://claude.ai/code/session_01GfkEuwuvGSqGyXVuxwT7PA

sean added 1 commit 2026-09-13 17:28:51 +00:00

chore: retrigger against the updated delivery catalog ... 7245287bb5

Build 4ada577e failed on the catalog, not on this change:

  binjovi-gitops-validate: selected render path does not exist:
  kubernetes/flux/infrastructure/hermes

It ran at 17:08:57 and binjovi-plans #297 merged at 17:09:18, so it
selected the old seanfarm policy, whose hermes-prerequisites group still
named a render path this change deletes. Twenty-one seconds is the whole
story; the ordering was right and the first build just beat it.

sean/binjovi-plans trunk now has four groups and no hermes render path,
so the selection is satisfiable. Nothing to fix here, so this commit is
empty and only moves the head so the webhook fires again.

Claude-Session: https://claude.ai/code/session_01GfkEuwuvGSqGyXVuxwT7PA

sean added 1 commit 2026-09-13 17:30:22 +00:00

chore: retrigger once the control plane serves the new catalog ... 46176c9c42

Build c7928ccc still selected the hermes-prerequisites group and failed
the same way, although sean/binjovi-plans trunk already had four groups
and no hermes render path. It started at 17:28:52, while binjovi was
mid-rollout from v0.1.727 to v0.1.728, so the agent that planned it was
still holding the previous catalog.

binjovi-production now reports v0.1.728 deployed, so the next selection
reads the current catalog.

Claude-Session: https://claude.ai/code/session_01GfkEuwuvGSqGyXVuxwT7PA

sean added 1 commit 2026-09-13 17:34:36 +00:00

chore: retrigger against the activated catalog ... 327cec5494

The three earlier failures were one cause, and it was not this branch.
binjovi-plans #297 merged but the control plane refused to activate the
bundle, because PlanSource.validate_additive/2 rejects a catalog that
drops a project unless the bundle declares it in retire_projects. The
refusal was silent: the release reported success and trunk read
correctly, while every seanfarm build kept selecting the retired
hermes-prerequisites group from the still-active old catalog.

binjovi-plans #301 adds the declaration and is released.

Claude-Session: https://claude.ai/code/session_01GfkEuwuvGSqGyXVuxwT7PA

binjovi-bot merged commit 327cec5494 into trunk 2026-09-13 17:37:02 +00:00

binjovi-bot deleted branch feat/eradicate-hermes 2026-09-13 17:37:03 +00:00

sean referenced this pull request 2026-09-13 17:56:13 +00:00

chore(hermes): remove the Google OAuth client secret #722

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!717

No description provided.