feat(hermes): Phase 1 — multi-provider registry (15 providers, 26 tests, back-compat preserved) by HongmingWang-Rabbit · Pull Request #208 · EnterOS-AI/enter-os-core

HongmingWang-Rabbit · 2026-04-15T18:15:01Z

Why

The Hermes adapter (PR 2) only supported Nous Portal + OpenRouter. CEO directive 2026-04-15: "once current works are cleared, I want you to focus on supporting hermes agent, right now it doesnt take too much providers... it does have many providers options including anthropic openai qwen xAI etc". This PR is Phase 1 of that expansion.

What this adds

15 providers, all reachable via their OpenAI-compat endpoint:

Group	Providers
PR 2 baseline (unchanged)	nous_portal, openrouter
Frontier commercial	openai, anthropic, xai, gemini
Chinese	qwen, glm, kimi, minimax, deepseek
OSS/alt	groq, together, fireworks, mistral

Every provider has a ProviderConfig entry with: canonical name, env var aliases, base URL, default model, docs pointer. Adding another provider is a 5-line addition to PROVIDERS + one line in RESOLUTION_ORDER.

Files

workspace-template/adapters/hermes/providers.py (new, 220 LOC) — registry + resolve_provider()
workspace-template/adapters/hermes/executor.py (refactored, -61 +74) — create_executor() delegates all key/URL/model resolution to the registry. New provider= and model= kwargs.
workspace-template/tests/test_hermes_providers.py (new, 26 tests) — registry invariants, back-compat checks, parametrized auto-detect for every env var, error-path coverage

Back-compat (critical)

Scenario	PR 2 behavior	This PR
`create_executor(hermes_api_key=\"x\")`	Nous Portal	Nous Portal (unchanged)
`HERMES_API_KEY=x` + auto-detect	Nous Portal	Nous Portal (unchanged)
`OPENROUTER_API_KEY=x` + auto-detect	OpenRouter	OpenRouter (unchanged)

The two PR-2 env vars are now the first two entries in RESOLUTION_ORDER, so nothing existing breaks.

What's NOT in this PR (Phase 2)

Native Anthropic Messages API path (for better tool calling + vision)
Native Gemini generateContent API path (for vision + Google tools)
Streaming support across all providers
Per-provider model overrides in config.yaml (workspace-level)
Integration tests with real API keys (gated on env)

All Phase 2 items are scoped in project_hermes_multi_provider.md.

Test plan

26/26 unit tests pass locally (pytest tests/test_hermes_providers.py)
CI on the self-hosted macOS arm64 runner (waiting for chore(ci): migrate all jobs to self-hosted macOS arm64 runner #186 to land)
Smoke test: set QWEN_API_KEY on one workspace, verify Technical Researcher successfully hits Alibaba DashScope
Dogfood across 2-3 roles to validate the registry covers real-world usage

Why now

This was queued behind "current works". Blocking items have merged (#159 orchestrator/worker split landed, #110 + #119 landed earlier this session). Only #186 (CI migration) and my parallel #205 (idle loop) are open. Phase 1 can ship cleanly without waiting for them.

Memory: project_hermes_multi_provider.md (full phased plan)
docs/ecosystem-watch.md → ### Hermes Agent (Research Lead's eco-watch catalogued the provider list that shaped this registry)
feat(workspace): add idle-loop reflection pattern (Hermes/Letta shape, opt-in, ~90 LOC) #205 (feat/workspace-idle-loop — complementary platform change shipping in parallel)

…ompat preserved) Ships the first half of the queued Hermes adapter expansion. PR 2 only supported Nous Portal + OpenRouter; this adds 13 more providers reachable via OpenAI-compat endpoints. Native SDK paths for Anthropic + Gemini are Phase 2 (better tool-calling + vision fidelity). ## What's new **`workspace-template/adapters/hermes/providers.py`** (new file, 220 LOC): - ``ProviderConfig`` dataclass: name, env vars, base URL, default model, auth scheme, docs - ``PROVIDERS`` dict with 15 entries across 4 groups: - PR 2 baseline: nous_portal, openrouter - Frontier commercial: openai, anthropic, xai, gemini - Chinese providers: qwen, glm, kimi, minimax, deepseek - OSS/alt: groq, together, fireworks, mistral - ``RESOLUTION_ORDER`` tuple: priority for auto-detect (back-compat first, then commercial, then Chinese, then OSS/alt) - ``resolve_provider(explicit=None)`` -> (ProviderConfig, api_key) - With explicit name: routes to that provider, raises if env var empty - Without: walks RESOLUTION_ORDER, first env-var-set provider wins **`workspace-template/adapters/hermes/executor.py`** (refactored): - `create_executor(hermes_api_key=None, provider=None, model=None)` now has three parameters: - `hermes_api_key`: PR 2 back-compat — routes to Nous Portal - `provider`: canonical short name from the registry (e.g. "anthropic") - `model`: optional override of the provider's default model - Delegates all resolution to `providers.resolve_provider()` — no more hardcoded URLs or env var lookups in the executor itself - `HermesA2AExecutor.__init__` no longer has Nous-specific defaults; callers pass base_url + model explicitly (which create_executor always does) **`workspace-template/tests/test_hermes_providers.py`** (new file, 26 tests): - Registry shape invariants (count >= 15, no duplicates, every config valid) - PR 2 back-compat: HERMES_API_KEY / OPENROUTER_API_KEY still route correctly - Auto-detect for every provider in the registry (parametrized — guards against typos in env var lists) - Explicit `provider=` bypass of auto-detect - Error cases: unknown provider, explicit-but-empty, auto-detect-with-no-env - All 26 tests pass locally in 0.08s ## Back-compat guarantees | Scenario | PR 2 behavior | This PR behavior | |---|---|---| | `create_executor(hermes_api_key="x")` | Nous Portal | Nous Portal (unchanged) | | `HERMES_API_KEY=x` env, auto-detect | Nous Portal | Nous Portal (unchanged) | | `OPENROUTER_API_KEY=x` env, auto-detect | OpenRouter | OpenRouter (unchanged) | | Both env + explicit hermes_api_key param | Nous Portal (param wins) | Nous Portal (param wins, unchanged) | Nothing existing can break. New callers gain access to 13 more providers. ## What's NOT in this PR (Phase 2) - **Native Anthropic Messages API path** — better tool calling, vision, extended thinking. Requires pulling in `anthropic` SDK. ~50 LOC. - **Native Gemini generateContent path** — for vision + google tools. Requires `google-genai` SDK. ~50 LOC. - **Streaming support across all providers** — current executor is non-streaming (single chat.completions.create call). Streaming works with openai.AsyncOpenAI but hasn't been wired to the A2A event queue path. ~30 LOC. - **Per-provider model overrides in config.yaml** — Phase 1 uses the registry's default_model. Phase 2 adds a `hermes: { provider: qwen, model: qwen3-coder-plus }` block in the workspace config. - **`.env.example` updates** — not critical since the registry itself documents every env var via the `env_vars` field, but nice-to-have. ## Related - Queued memory: `project_hermes_multi_provider.md` - CEO directive 2026-04-15: *"once current works are cleared, I want you to focus on supporting hermes agent, right now it doesnt take too much providers"* - `docs/ecosystem-watch.md` → `### Hermes Agent` — Research Lead's eco-watch entry listed "Nous Portal, OpenRouter, GLM, Kimi, MiniMax, OpenAI, …" which shaped this registry's initial set ## Test plan - [x] Unit tests: 26/26 pass locally (pytest) - [ ] CI will run on the self-hosted macOS arm64 runner - [ ] Smoke test in a real workspace: set QWEN_API_KEY and verify Technical Researcher actually hits Alibaba DashScope successfully - [ ] Integration test per provider with real API keys (gated on env, skip when not set — Phase 2 CI addition)

…ovider-registry

…follow-up) PR #205 shipped the workspace idle-loop mechanism (reflection-on-completion pattern from the Hermes/Letta research survey) but deliberately added NO default idle_prompt in org.yaml so rollout could be measured one workspace at a time before going team-wide. This is that first opt-in: Technical Researcher gets a backlog-pull + reflect idle prompt on a 10-minute cadence. ## Why TR first - Research-heavy role with a naturally bursty load — lots of idle time between the once-per-hour plugin curation cron fires - Non-user-facing (no canvas UI impact, no UX risk) - Already has a clear backlog shape: the plugin curation cron produces findings that could feed follow-up studies - Vision-free (no Playwright) so cost per idle tick is pure text ## What the idle_prompt does Three-step reflection, under 60s wall-clock, max 1 A2A send per tick: 1. **Backlog pull** — search_memory "research-backlog:technical-researcher" for any stashed research questions (from prior cron fires or Research Lead delegations). If found → delegate_task to Research Lead with a concrete deliverable spec, then commit_memory to remove the item from the backlog. 2. **Reflection fallback** — if backlog is empty, look at the last memory entry from the Hourly plugin curation cron. Does it surface a follow-up study worth doing? If yes → file a GH issue labeled `research` and commit_memory to put the question on the backlog for next tick. 3. **Idle-clean outcome** — if neither backlog nor reflection produced anything, write "tr-idle HH:MM — clean" to memory and stop. No busy work. Hard rules enforce: max 1 A2A per tick, skip step 1 if Research Lead busy, under 60s wall-clock, never re-run a cron's own prompt from inside the idle loop. ## Rollout plan - **This PR**: enables TR only via the `idle_prompt` + `idle_interval_seconds` fields added to its workspace entry in org.yaml. - **Next 24h**: measure activity_logs delta on TR vs baseline, count idle-fired delegations vs idle-clean outcomes, confirm Research Lead isn't being flooded. - **If green** (delegations land useful work, no flood): roll to Market Analyst + Competitive Intelligence in a follow-up PR. - **If noisy** (too many idle fires producing nothing): tune idle_interval up to 1200-1800s. ## Apply locally per feedback rule Per `feedback_apply_template_locally_too.md`: not waiting for merge. After pushing this PR I'll edit TR's live /configs/config.yaml to add the same idle_prompt + idle_interval_seconds fields, then restart ws-57e13b54-119 (Technical Researcher) so the new workspace-template binary picks up the idle loop immediately. Measurement clock starts from that restart. ## Related - #205 (mechanism) — just merged in this cycle (54eb8d7) - #208 Hermes Phase 1 — also just merged (381a3c8) - docs/ecosystem-watch.md → `### Hermes Agent` — reflection-on-completion pattern reference

…ht sweep Captures ~27 PRs merged across both repos this session: security hardening cluster (#94/#99/#106/#110/#119/#162/#155/#167/#185/#200/#203/ #209/#233), data-integrity fixes (#212/#224/#236), CI runner migration (#186), platform/scheduler reliability (#95/#149/#207/#206), workspace runtime features (#205/#208/#198/#216/#225/#235/#231), code-review follow-ups (#228/#232). Updated counts: 816 Go (+70), 1180 Python (+40), 453 vitest (unchanged — UI/a11y patches), 97 jest (unchanged). CLAUDE.md additions: - Idle Loop section (#205) under Architectural Patterns - Admin auth middleware variants section linking docs/runbooks/admin-auth.md - Migration runner section explaining the .down.sql filter (#212) - Per-route auth notes in the API table (PATCH field-whitelist, CanvasOrBearer on PUT /canvas/viewport, AdminAuth on bundles/events/templates-import/ approvals-pending/admin-liveness) - Database section updated with workspace_auth_tokens auto-revoke (#110), scheduler.error_detail surfacing (#206), workspace_schedules.last_status 'skipped' state (#207) PLAN.md additions: - New Recently launched (overnight sweep) section with full PR/issue index - Phase status updated (B–G now complete, H partial) - Live infrastructure deltas (migration fix, token rotation, legal pages) - Outstanding items consolidated Edit-history file expanded from the tick-9 stub to a full session record covering malware cleanup, CI runner migration, security cluster, data integrity, infra/feature/code-review batches, and outstanding user actions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Completes the Hermes adapter's native-SDK plan for the provider that gains the most from leaving OpenAI-compat: Anthropic. OpenAI-compat works fine for plain text turns on every provider (Phase 1 covered that with one code path for all 15 providers), but Anthropic's Messages API has first-class tool use, vision content blocks, and extended thinking that the OpenAI-compat shim strips or mis-translates. Rather than ship all native SDK paths in one PR (Anthropic + Gemini + future), this lands Anthropic only (Phase 2a). Gemini is Phase 2b, shipping after a production measurement window on Phase 2a. ## Design Providers now dispatch by `auth_scheme` field. Phase 1 added the field but every provider used `"openai"`. Phase 2 flips `anthropic` to `"anthropic"` and wires a second inference path keyed on that: - `HermesA2AExecutor._do_openai_compat(task_text)` — existing path, handles 14 of 15 providers (Nous Portal, OpenRouter, OpenAI, xAI, Gemini, Qwen, GLM, Kimi, MiniMax, DeepSeek, Groq, Together, Fireworks, Mistral) - `HermesA2AExecutor._do_anthropic_native(task_text)` — NEW, uses the official `anthropic` Python SDK's `AsyncAnthropic().messages.create(...)` - `HermesA2AExecutor._do_inference(task_text)` — dispatches by `self.provider_cfg.auth_scheme` Unknown schemes fall back to OpenAI-compat with a logged warning, so future provider additions don't crash if a native SDK path ships late. ## Fail-loud on missing SDK `_do_anthropic_native` raises a clear `RuntimeError` with install instructions if the `anthropic` package is missing at runtime: Hermes anthropic native path requires the `anthropic` package. Install in the workspace image with `pip install anthropic>=0.39.0` or set HERMES provider=openrouter to route Claude models through OpenRouter's OpenAI-compat shim instead. This is intentional: silent fallback would mask fidelity loss (tool_use blocks become plain text, vision gets stripped). Loud failure is better. `requirements.txt` adds `anthropic>=0.39.0` so the package is baked into the workspace-template image build path. Operators building custom workspace images without anthropic installed get the loud error. ## Back-compat - `create_executor(hermes_api_key="x")` → still routes to Nous Portal (`auth_scheme="openai"`), unchanged - `HERMES_API_KEY` env var → still first in RESOLUTION_ORDER - `OPENROUTER_API_KEY` env var → still second - All 14 OpenAI-compat providers unchanged — they take the same code path as before - ONLY `anthropic` provider changes behavior: it now uses the native Messages API instead of the `/v1/chat/completions` compat shim ## Constructor signature change `HermesA2AExecutor.__init__` now takes `provider_cfg: ProviderConfig` instead of separate `api_key + base_url + model`. The three fields are derived from `provider_cfg` + an optional model override. This is a breaking change for any external caller building an executor directly, but the only documented public entry point is `create_executor()`, which is updated in the same commit to pass the cfg through. ## Test coverage `workspace-template/tests/test_hermes_phase2_dispatch.py` — 7 new tests: 1. `test_anthropic_entry_has_anthropic_scheme` — registry flip 2. `test_all_other_providers_still_openai_scheme` — regression guard 3. `test_dispatch_openai_scheme_calls_openai_compat` — happy path 4. `test_dispatch_anthropic_scheme_calls_anthropic_native` — happy path 5. `test_dispatch_unknown_scheme_falls_back_to_openai_compat` — forward compat 6. `test_anthropic_native_raises_clear_error_when_sdk_missing` — fail-loud 7. `test_create_executor_passes_provider_cfg` — constructor wiring All pass locally (pytest tests/test_hermes_phase2_dispatch.py -v, 0.04s). Phase 1 tests unchanged: `test_hermes_providers.py` 26/26 pass, no regressions. ## What's NOT in this PR (Phase 2b) - Gemini native `generateContent` path (`auth_scheme="gemini"`) - Streaming support across both native paths (`astream_messages`, `streamGenerateContent`) - Tool calling on the anthropic native path (the `tools` + `tool_use` blocks) - Vision content blocks (image_url → anthropic image blocks) - Extended thinking parameter passthrough All scoped in `project_hermes_multi_provider.md`. Phase 2a is the minimum viable native Anthropic dispatch — single-turn text in, text out, no tools. ## Related - Phase 1 baseline (already in main): #208 — provider registry + OpenAI-compat path - Queued memory: `project_hermes_multi_provider.md` — full phased plan - Triggering directive: CEO 2026-04-15 — "once current works are cleared, focus on supporting hermes agent"

…h path Completes Hermes Phase 2 by adding the second native SDK path: Google Gemini via the official `google-genai` Python SDK. Stacked on top of Phase 2a (feat/hermes-phase2-native-sdks) which introduced the dispatch infra + the anthropic native path. ## What's new in this PR 1. `providers.py`: flip `gemini` entry to `auth_scheme="gemini"` and update `base_url` from the OpenAI-compat endpoint (`/v1beta/openai`) to the bare host (`https://generativelanguage.googleapis.com`) which the native SDK uses. 2. `executor.py`: new method `_do_gemini_native(task_text)` that uses `google.genai.Client().aio.models.generate_content(...)`. Dispatch table in `_do_inference` now routes `"gemini"` → `_do_gemini_native`. Same fail-loud semantics as `_do_anthropic_native` — missing SDK raises a clear RuntimeError with install instructions. 3. `requirements.txt`: add `google-genai>=1.0.0`. 4. `test_hermes_phase2_dispatch.py`: +3 tests - `test_gemini_entry_has_gemini_scheme` — registry flip + base URL validated - `test_dispatch_gemini_scheme_calls_gemini_native` — dispatch runs gemini native, not openai-compat or anthropic-native - `test_gemini_native_raises_clear_error_when_sdk_missing` — fail-loud on missing `google-genai` package Plus updated existing dispatch tests to mock `_do_gemini_native` alongside the other paths so "no cross-calls" assertions stay tight. All 36 tests pass locally (10 Phase 2 dispatch + 26 Phase 1 registry): pytest tests/test_hermes_phase2_dispatch.py tests/test_hermes_providers.py 36 passed in 0.07s ## Dispatch table after this PR auth_scheme="openai" → _do_openai_compat (13 providers) auth_scheme="anthropic" → _do_anthropic_native (1 provider, Phase 2a) auth_scheme="gemini" → _do_gemini_native (1 provider, Phase 2b) ← NEW <unknown> → _do_openai_compat + warning (forward-compat) ## Back-compat - All 13 openai-scheme providers unchanged - `hermes_api_key` / `HERMES_API_KEY` / `OPENROUTER_API_KEY` paths unchanged - Only `gemini` provider changes behavior: now uses native generateContent instead of the `/v1beta/openai` compat shim - Existing Gemini callers setting `GEMINI_API_KEY` get the native path automatically — no caller changes needed ## What's NOT in this PR (future phases) - Streaming support (`astream_messages` / `streamGenerateContent` stream variants) for either native path - Tool calling / function calling on native paths - Vision content blocks (image_url → anthropic image blocks; image_url → gemini inline_data with base64 + mime_type) - Extended thinking (anthropic) / thinking config (gemini) - System instructions pass-through on the gemini native path Phase 2c/2d will layer these on. This PR is the minimum-viable native dispatch — single-turn text in, text out — same shape as Phase 2a. ## Stacking This PR targets `feat/hermes-phase2-native-sdks` (Phase 2a) as its base branch, NOT main, so the diff shows only the Gemini-specific additions. When Phase 2a merges to main, GitHub auto-rebases this PR onto the new main head. If reviewer prefers a single combined PR, close #240 and land this one instead — the commits on feat/hermes-phase2-native-sdks are already included in this branch's history. ## Related - #240 Phase 2a (parent branch) - #208 Phase 1 (registry + openai-compat path — already in main) - `project_hermes_multi_provider.md` queued memory — Phase 2 was the next item, this PR completes it - `docs/ecosystem-watch.md` → `### Hermes Agent` — Research Lead's eco-watch entry that catalogued Hermes's native provider list and shaped the original Phase 2 scope

Completes the Phase 2 scope by keeping conversation turns as turns across all three dispatch paths. Pre-2c, history was flattened into a single user message via shared_runtime.build_task_text, which worked as a fallback but lost the model's native multi-turn awareness (role attribution, instruction-following on mid-conversation corrections, system-prompt grounding against prior turns). Phase 2a + 2b shipped the dispatch infrastructure + per-provider native paths. This PR uses them properly. ## What's new - **`_history_to_openai_messages(user_message, history)`** (static) — maps A2A `(role, text)` tuples to OpenAI Chat Completions `[{"role":"user"|"assistant","content":str}]`. Roles: `human`→`user`, `ai`→`assistant`. Current turn appended as the final user message. - **`_history_to_anthropic_messages`** (static) — identical wire shape to OpenAI for text-only turns, so it delegates. Phase 2d tool_use/vision blocks will diverge here. - **`_history_to_gemini_contents`** (static) — Gemini uses a different shape: `role="user"|"model"` (NOT "assistant") and text wrapped in `parts=[{"text":...}]`. Delegates to none of the others. - **`_do_openai_compat(user_message, history=None)`** — accepts history, builds messages via `_history_to_openai_messages`. Back-compat: pass `history=None` to get the old single-turn behavior. - **`_do_anthropic_native(user_message, history=None)`** — same signature change, calls `_history_to_anthropic_messages`. Still uses `anthropic.AsyncAnthropic().messages.create()`, just with proper multi-turn. - **`_do_gemini_native(user_message, history=None)`** — same pattern, calls `_history_to_gemini_contents`, passes to Gemini's `generate_content(contents=...)`. - **`_do_inference(user_message, history=None)`** — new signature, dispatches by auth_scheme as before, passes both args through. - **`execute()`** — no longer calls `build_task_text`. Calls `extract_history(context)` directly and forwards to `_do_inference`. Removes the `build_task_text` import (not needed in this file anymore). ## Tests Existing 7 dispatch tests updated for the new `(user_message, history)` signature — they assert the path is called with `("hello", None)` since they pass no history. 5 NEW tests: - `test_history_to_openai_messages_empty_history` — empty history degrades to single user message (back-compat) - `test_history_to_openai_messages_multi_turn` — round-trip of a 3-turn history + current turn - `test_history_to_anthropic_messages_same_as_openai` — cross-check that anthropic path produces identical wire shape for text-only - `test_history_to_gemini_contents_uses_model_role_and_parts_wrapper` — verifies the Gemini-specific role mapping (`ai`→`model`) + parts wrapper - `test_dispatch_passes_history_through` — end-to-end: _do_inference forwards history to the chosen provider path All 41 tests pass (15 Phase 2 dispatch + 26 Phase 1 registry): pytest tests/test_hermes_phase2_dispatch.py tests/test_hermes_providers.py 41 passed in 0.07s ## Back-compat - No public API changes to `create_executor()`. Callers that hit `execute()` via A2A get the new multi-turn behavior automatically via `extract_history(context)`. - Callers that passed an empty history list (or None) get the same single-turn behavior as pre-2c. - The `build_task_text` helper in shared_runtime is unchanged — other adapters (AutoGen, LangGraph) that use it keep working. Only Hermes bypasses it now. ## What's NOT in this PR (Phase 2d) - Tool calling / function calling on native paths (anthropic `tools=`, gemini `tools=Tool(function_declarations=[...])`) - Vision content blocks (image_url → anthropic `{type:"image", source: {type:"base64",...}}` / gemini `{inline_data:{mime_type,data}}`) - System instructions pass-through (anthropic `system=`, gemini `system_instruction=`) - Streaming (`astream_messages` / `streamGenerateContent` stream variants) - Extended thinking (anthropic `thinking={"type":"enabled"}`) / Gemini thinking config Phase 2c is the **multi-turn upgrade**. Tool + vision + streaming are Phase 2d, scoped in project_hermes_multi_provider.md. ## Related - #240 Phase 2a (native Anthropic dispatch — in main) - #255 Phase 2b (native Gemini dispatch — in main) - Phase 1 (#208 — provider registry baseline, in main) - `project_hermes_multi_provider.md` queued memory - CEO 2026-04-15: "focus on supporting hermes agent"

…ch paths The Hermes adapter never read /configs/system-prompt.md. Any role that switched to runtime: hermes was silently losing its role identity because the system prompt wasn't passed to the model. This PR fixes that by: 1. HermesA2AExecutor.__init__ takes new optional `config_path` kwarg 2. `create_executor(config_path=...)` forwards to the constructor 3. `adapter.py` passes `config.config_path` through from AdapterConfig 4. `execute()` reads system-prompt.md via executor_helpers.get_system_prompt (hot-reload-capable — reads on every turn, not just at startup) 5. `_do_inference(user_message, history, system_prompt)` — new arg threads through the dispatch to each native path 6. Each path uses the provider's NATIVE system field: - OpenAI-compat: prepends `{"role":"system", "content":...}` to messages - Anthropic: top-level `system=` kwarg (NOT in messages — Anthropic requires system at the top level) - Gemini: `config=GenerateContentConfig(system_instruction=...)` ## Phase scoreboard - 2a (in main) — native Anthropic dispatch infra - 2b (in main) — native Gemini dispatch - 2c (in main) — multi-turn history on all paths - **2d-i (this PR)** — system prompts on all paths - 2d-ii (future) — tool calling on native paths - 2d-iii (future) — vision content blocks on native paths - 2d-iv (future) — streaming ## Test coverage 46/46 tests pass (20 Phase 2 dispatch + 26 Phase 1 registry): - Existing dispatch tests updated to assert the 3-arg call shape `("hello", None, None)` — history + system_prompt both None - 4 new tests: - `dispatch_passes_system_prompt_to_anthropic` — happy path, third arg flows - `dispatch_passes_system_prompt_to_gemini` — happy path - `dispatch_passes_system_prompt_to_openai` — happy path - `executor_accepts_config_path_kwarg` — constructor stores config_path - `create_executor_forwards_config_path` — both back-compat and registry resolution paths forward config_path through to the executor ## Back-compat - `config_path=None` (default) → execute() skips system-prompt injection, same behavior as pre-2d-i - Workspaces with `runtime: hermes` but no `/configs/system-prompt.md` file get `system_prompt=None` (get_system_prompt returns fallback), same as before - The 13 OpenAI-compat providers work identically — system_prompt just adds a leading message, which every OpenAI-compat endpoint already supports - Anthropic + Gemini previously got zero system context; now they get the same system prompt the workspace's system-prompt.md carries ## Why this matters Before this PR: if someone flipped a workspace from `runtime: claude-code` to `runtime: hermes`, the agent would act generically (no role identity, no project conventions, no CLAUDE.md context) because the Hermes executor never looked at system-prompt.md. That's a silent correctness regression the test suite wouldn't catch because none of our live workspaces use the hermes runtime today. With this PR: Hermes workspaces get the same system prompt injection as Claude-code workspaces, making the `runtime: hermes` switch a true drop-in alternative. ## Related - #267 Phase 2c (multi-turn history — in main) - #255 Phase 2b (gemini native — in main) - #240 Phase 2a (anthropic native — in main) - #208 Phase 1 (provider registry — in main) - project_hermes_multi_provider.md — Phase 2d-i was the next queued item

…registry feat(hermes): Phase 1 — multi-provider registry (15 providers, 26 tests, back-compat preserved)

…follow-up) PR #205 shipped the workspace idle-loop mechanism (reflection-on-completion pattern from the Hermes/Letta research survey) but deliberately added NO default idle_prompt in org.yaml so rollout could be measured one workspace at a time before going team-wide. This is that first opt-in: Technical Researcher gets a backlog-pull + reflect idle prompt on a 10-minute cadence. ## Why TR first - Research-heavy role with a naturally bursty load — lots of idle time between the once-per-hour plugin curation cron fires - Non-user-facing (no canvas UI impact, no UX risk) - Already has a clear backlog shape: the plugin curation cron produces findings that could feed follow-up studies - Vision-free (no Playwright) so cost per idle tick is pure text ## What the idle_prompt does Three-step reflection, under 60s wall-clock, max 1 A2A send per tick: 1. **Backlog pull** — search_memory "research-backlog:technical-researcher" for any stashed research questions (from prior cron fires or Research Lead delegations). If found → delegate_task to Research Lead with a concrete deliverable spec, then commit_memory to remove the item from the backlog. 2. **Reflection fallback** — if backlog is empty, look at the last memory entry from the Hourly plugin curation cron. Does it surface a follow-up study worth doing? If yes → file a GH issue labeled `research` and commit_memory to put the question on the backlog for next tick. 3. **Idle-clean outcome** — if neither backlog nor reflection produced anything, write "tr-idle HH:MM — clean" to memory and stop. No busy work. Hard rules enforce: max 1 A2A per tick, skip step 1 if Research Lead busy, under 60s wall-clock, never re-run a cron's own prompt from inside the idle loop. ## Rollout plan - **This PR**: enables TR only via the `idle_prompt` + `idle_interval_seconds` fields added to its workspace entry in org.yaml. - **Next 24h**: measure activity_logs delta on TR vs baseline, count idle-fired delegations vs idle-clean outcomes, confirm Research Lead isn't being flooded. - **If green** (delegations land useful work, no flood): roll to Market Analyst + Competitive Intelligence in a follow-up PR. - **If noisy** (too many idle fires producing nothing): tune idle_interval up to 1200-1800s. ## Apply locally per feedback rule Per `feedback_apply_template_locally_too.md`: not waiting for merge. After pushing this PR I'll edit TR's live /configs/config.yaml to add the same idle_prompt + idle_interval_seconds fields, then restart ws-57e13b54-119 (Technical Researcher) so the new workspace-template binary picks up the idle loop immediately. Measurement clock starts from that restart. ## Related - #205 (mechanism) — just merged in this cycle (7f11328) - #208 Hermes Phase 1 — also just merged (be53a33) - docs/ecosystem-watch.md → `### Hermes Agent` — reflection-on-completion pattern reference

…ht sweep Captures ~27 PRs merged across both repos this session: security hardening cluster (#94/#99/#106/#110/#119/#162/#155/#167/#185/#200/#203/ #209/#233), data-integrity fixes (#212/#224/#236), CI runner migration (#186), platform/scheduler reliability (#95/#149/#207/#206), workspace runtime features (#205/#208/#198/#216/#225/#235/#231), code-review follow-ups (#228/#232). Updated counts: 816 Go (+70), 1180 Python (+40), 453 vitest (unchanged — UI/a11y patches), 97 jest (unchanged). CLAUDE.md additions: - Idle Loop section (#205) under Architectural Patterns - Admin auth middleware variants section linking docs/runbooks/admin-auth.md - Migration runner section explaining the .down.sql filter (#212) - Per-route auth notes in the API table (PATCH field-whitelist, CanvasOrBearer on PUT /canvas/viewport, AdminAuth on bundles/events/templates-import/ approvals-pending/admin-liveness) - Database section updated with workspace_auth_tokens auto-revoke (#110), scheduler.error_detail surfacing (#206), workspace_schedules.last_status 'skipped' state (#207) PLAN.md additions: - New Recently launched (overnight sweep) section with full PR/issue index - Phase status updated (B–G now complete, H partial) - Live infrastructure deltas (migration fix, token rotation, legal pages) - Outstanding items consolidated Edit-history file expanded from the tick-9 stub to a full session record covering malware cleanup, CI runner migration, security cluster, data integrity, infra/feature/code-review batches, and outstanding user actions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Completes the Hermes adapter's native-SDK plan for the provider that gains the most from leaving OpenAI-compat: Anthropic. OpenAI-compat works fine for plain text turns on every provider (Phase 1 covered that with one code path for all 15 providers), but Anthropic's Messages API has first-class tool use, vision content blocks, and extended thinking that the OpenAI-compat shim strips or mis-translates. Rather than ship all native SDK paths in one PR (Anthropic + Gemini + future), this lands Anthropic only (Phase 2a). Gemini is Phase 2b, shipping after a production measurement window on Phase 2a. ## Design Providers now dispatch by `auth_scheme` field. Phase 1 added the field but every provider used `"openai"`. Phase 2 flips `anthropic` to `"anthropic"` and wires a second inference path keyed on that: - `HermesA2AExecutor._do_openai_compat(task_text)` — existing path, handles 14 of 15 providers (Nous Portal, OpenRouter, OpenAI, xAI, Gemini, Qwen, GLM, Kimi, MiniMax, DeepSeek, Groq, Together, Fireworks, Mistral) - `HermesA2AExecutor._do_anthropic_native(task_text)` — NEW, uses the official `anthropic` Python SDK's `AsyncAnthropic().messages.create(...)` - `HermesA2AExecutor._do_inference(task_text)` — dispatches by `self.provider_cfg.auth_scheme` Unknown schemes fall back to OpenAI-compat with a logged warning, so future provider additions don't crash if a native SDK path ships late. ## Fail-loud on missing SDK `_do_anthropic_native` raises a clear `RuntimeError` with install instructions if the `anthropic` package is missing at runtime: Hermes anthropic native path requires the `anthropic` package. Install in the workspace image with `pip install anthropic>=0.39.0` or set HERMES provider=openrouter to route Claude models through OpenRouter's OpenAI-compat shim instead. This is intentional: silent fallback would mask fidelity loss (tool_use blocks become plain text, vision gets stripped). Loud failure is better. `requirements.txt` adds `anthropic>=0.39.0` so the package is baked into the workspace-template image build path. Operators building custom workspace images without anthropic installed get the loud error. ## Back-compat - `create_executor(hermes_api_key="x")` → still routes to Nous Portal (`auth_scheme="openai"`), unchanged - `HERMES_API_KEY` env var → still first in RESOLUTION_ORDER - `OPENROUTER_API_KEY` env var → still second - All 14 OpenAI-compat providers unchanged — they take the same code path as before - ONLY `anthropic` provider changes behavior: it now uses the native Messages API instead of the `/v1/chat/completions` compat shim ## Constructor signature change `HermesA2AExecutor.__init__` now takes `provider_cfg: ProviderConfig` instead of separate `api_key + base_url + model`. The three fields are derived from `provider_cfg` + an optional model override. This is a breaking change for any external caller building an executor directly, but the only documented public entry point is `create_executor()`, which is updated in the same commit to pass the cfg through. ## Test coverage `workspace-template/tests/test_hermes_phase2_dispatch.py` — 7 new tests: 1. `test_anthropic_entry_has_anthropic_scheme` — registry flip 2. `test_all_other_providers_still_openai_scheme` — regression guard 3. `test_dispatch_openai_scheme_calls_openai_compat` — happy path 4. `test_dispatch_anthropic_scheme_calls_anthropic_native` — happy path 5. `test_dispatch_unknown_scheme_falls_back_to_openai_compat` — forward compat 6. `test_anthropic_native_raises_clear_error_when_sdk_missing` — fail-loud 7. `test_create_executor_passes_provider_cfg` — constructor wiring All pass locally (pytest tests/test_hermes_phase2_dispatch.py -v, 0.04s). Phase 1 tests unchanged: `test_hermes_providers.py` 26/26 pass, no regressions. ## What's NOT in this PR (Phase 2b) - Gemini native `generateContent` path (`auth_scheme="gemini"`) - Streaming support across both native paths (`astream_messages`, `streamGenerateContent`) - Tool calling on the anthropic native path (the `tools` + `tool_use` blocks) - Vision content blocks (image_url → anthropic image blocks) - Extended thinking parameter passthrough All scoped in `project_hermes_multi_provider.md`. Phase 2a is the minimum viable native Anthropic dispatch — single-turn text in, text out, no tools. ## Related - Phase 1 baseline (already in main): #208 — provider registry + OpenAI-compat path - Queued memory: `project_hermes_multi_provider.md` — full phased plan - Triggering directive: CEO 2026-04-15 — "once current works are cleared, focus on supporting hermes agent"

…h path Completes Hermes Phase 2 by adding the second native SDK path: Google Gemini via the official `google-genai` Python SDK. Stacked on top of Phase 2a (feat/hermes-phase2-native-sdks) which introduced the dispatch infra + the anthropic native path. ## What's new in this PR 1. `providers.py`: flip `gemini` entry to `auth_scheme="gemini"` and update `base_url` from the OpenAI-compat endpoint (`/v1beta/openai`) to the bare host (`https://generativelanguage.googleapis.com`) which the native SDK uses. 2. `executor.py`: new method `_do_gemini_native(task_text)` that uses `google.genai.Client().aio.models.generate_content(...)`. Dispatch table in `_do_inference` now routes `"gemini"` → `_do_gemini_native`. Same fail-loud semantics as `_do_anthropic_native` — missing SDK raises a clear RuntimeError with install instructions. 3. `requirements.txt`: add `google-genai>=1.0.0`. 4. `test_hermes_phase2_dispatch.py`: +3 tests - `test_gemini_entry_has_gemini_scheme` — registry flip + base URL validated - `test_dispatch_gemini_scheme_calls_gemini_native` — dispatch runs gemini native, not openai-compat or anthropic-native - `test_gemini_native_raises_clear_error_when_sdk_missing` — fail-loud on missing `google-genai` package Plus updated existing dispatch tests to mock `_do_gemini_native` alongside the other paths so "no cross-calls" assertions stay tight. All 36 tests pass locally (10 Phase 2 dispatch + 26 Phase 1 registry): pytest tests/test_hermes_phase2_dispatch.py tests/test_hermes_providers.py 36 passed in 0.07s ## Dispatch table after this PR auth_scheme="openai" → _do_openai_compat (13 providers) auth_scheme="anthropic" → _do_anthropic_native (1 provider, Phase 2a) auth_scheme="gemini" → _do_gemini_native (1 provider, Phase 2b) ← NEW <unknown> → _do_openai_compat + warning (forward-compat) ## Back-compat - All 13 openai-scheme providers unchanged - `hermes_api_key` / `HERMES_API_KEY` / `OPENROUTER_API_KEY` paths unchanged - Only `gemini` provider changes behavior: now uses native generateContent instead of the `/v1beta/openai` compat shim - Existing Gemini callers setting `GEMINI_API_KEY` get the native path automatically — no caller changes needed ## What's NOT in this PR (future phases) - Streaming support (`astream_messages` / `streamGenerateContent` stream variants) for either native path - Tool calling / function calling on native paths - Vision content blocks (image_url → anthropic image blocks; image_url → gemini inline_data with base64 + mime_type) - Extended thinking (anthropic) / thinking config (gemini) - System instructions pass-through on the gemini native path Phase 2c/2d will layer these on. This PR is the minimum-viable native dispatch — single-turn text in, text out — same shape as Phase 2a. ## Stacking This PR targets `feat/hermes-phase2-native-sdks` (Phase 2a) as its base branch, NOT main, so the diff shows only the Gemini-specific additions. When Phase 2a merges to main, GitHub auto-rebases this PR onto the new main head. If reviewer prefers a single combined PR, close #240 and land this one instead — the commits on feat/hermes-phase2-native-sdks are already included in this branch's history. ## Related - #240 Phase 2a (parent branch) - #208 Phase 1 (registry + openai-compat path — already in main) - `project_hermes_multi_provider.md` queued memory — Phase 2 was the next item, this PR completes it - `docs/ecosystem-watch.md` → `### Hermes Agent` — Research Lead's eco-watch entry that catalogued Hermes's native provider list and shaped the original Phase 2 scope

Completes the Phase 2 scope by keeping conversation turns as turns across all three dispatch paths. Pre-2c, history was flattened into a single user message via shared_runtime.build_task_text, which worked as a fallback but lost the model's native multi-turn awareness (role attribution, instruction-following on mid-conversation corrections, system-prompt grounding against prior turns). Phase 2a + 2b shipped the dispatch infrastructure + per-provider native paths. This PR uses them properly. ## What's new - **`_history_to_openai_messages(user_message, history)`** (static) — maps A2A `(role, text)` tuples to OpenAI Chat Completions `[{"role":"user"|"assistant","content":str}]`. Roles: `human`→`user`, `ai`→`assistant`. Current turn appended as the final user message. - **`_history_to_anthropic_messages`** (static) — identical wire shape to OpenAI for text-only turns, so it delegates. Phase 2d tool_use/vision blocks will diverge here. - **`_history_to_gemini_contents`** (static) — Gemini uses a different shape: `role="user"|"model"` (NOT "assistant") and text wrapped in `parts=[{"text":...}]`. Delegates to none of the others. - **`_do_openai_compat(user_message, history=None)`** — accepts history, builds messages via `_history_to_openai_messages`. Back-compat: pass `history=None` to get the old single-turn behavior. - **`_do_anthropic_native(user_message, history=None)`** — same signature change, calls `_history_to_anthropic_messages`. Still uses `anthropic.AsyncAnthropic().messages.create()`, just with proper multi-turn. - **`_do_gemini_native(user_message, history=None)`** — same pattern, calls `_history_to_gemini_contents`, passes to Gemini's `generate_content(contents=...)`. - **`_do_inference(user_message, history=None)`** — new signature, dispatches by auth_scheme as before, passes both args through. - **`execute()`** — no longer calls `build_task_text`. Calls `extract_history(context)` directly and forwards to `_do_inference`. Removes the `build_task_text` import (not needed in this file anymore). ## Tests Existing 7 dispatch tests updated for the new `(user_message, history)` signature — they assert the path is called with `("hello", None)` since they pass no history. 5 NEW tests: - `test_history_to_openai_messages_empty_history` — empty history degrades to single user message (back-compat) - `test_history_to_openai_messages_multi_turn` — round-trip of a 3-turn history + current turn - `test_history_to_anthropic_messages_same_as_openai` — cross-check that anthropic path produces identical wire shape for text-only - `test_history_to_gemini_contents_uses_model_role_and_parts_wrapper` — verifies the Gemini-specific role mapping (`ai`→`model`) + parts wrapper - `test_dispatch_passes_history_through` — end-to-end: _do_inference forwards history to the chosen provider path All 41 tests pass (15 Phase 2 dispatch + 26 Phase 1 registry): pytest tests/test_hermes_phase2_dispatch.py tests/test_hermes_providers.py 41 passed in 0.07s ## Back-compat - No public API changes to `create_executor()`. Callers that hit `execute()` via A2A get the new multi-turn behavior automatically via `extract_history(context)`. - Callers that passed an empty history list (or None) get the same single-turn behavior as pre-2c. - The `build_task_text` helper in shared_runtime is unchanged — other adapters (AutoGen, LangGraph) that use it keep working. Only Hermes bypasses it now. ## What's NOT in this PR (Phase 2d) - Tool calling / function calling on native paths (anthropic `tools=`, gemini `tools=Tool(function_declarations=[...])`) - Vision content blocks (image_url → anthropic `{type:"image", source: {type:"base64",...}}` / gemini `{inline_data:{mime_type,data}}`) - System instructions pass-through (anthropic `system=`, gemini `system_instruction=`) - Streaming (`astream_messages` / `streamGenerateContent` stream variants) - Extended thinking (anthropic `thinking={"type":"enabled"}`) / Gemini thinking config Phase 2c is the **multi-turn upgrade**. Tool + vision + streaming are Phase 2d, scoped in project_hermes_multi_provider.md. ## Related - #240 Phase 2a (native Anthropic dispatch — in main) - #255 Phase 2b (native Gemini dispatch — in main) - Phase 1 (#208 — provider registry baseline, in main) - `project_hermes_multi_provider.md` queued memory - CEO 2026-04-15: "focus on supporting hermes agent"

…ch paths The Hermes adapter never read /configs/system-prompt.md. Any role that switched to runtime: hermes was silently losing its role identity because the system prompt wasn't passed to the model. This PR fixes that by: 1. HermesA2AExecutor.__init__ takes new optional `config_path` kwarg 2. `create_executor(config_path=...)` forwards to the constructor 3. `adapter.py` passes `config.config_path` through from AdapterConfig 4. `execute()` reads system-prompt.md via executor_helpers.get_system_prompt (hot-reload-capable — reads on every turn, not just at startup) 5. `_do_inference(user_message, history, system_prompt)` — new arg threads through the dispatch to each native path 6. Each path uses the provider's NATIVE system field: - OpenAI-compat: prepends `{"role":"system", "content":...}` to messages - Anthropic: top-level `system=` kwarg (NOT in messages — Anthropic requires system at the top level) - Gemini: `config=GenerateContentConfig(system_instruction=...)` ## Phase scoreboard - 2a (in main) — native Anthropic dispatch infra - 2b (in main) — native Gemini dispatch - 2c (in main) — multi-turn history on all paths - **2d-i (this PR)** — system prompts on all paths - 2d-ii (future) — tool calling on native paths - 2d-iii (future) — vision content blocks on native paths - 2d-iv (future) — streaming ## Test coverage 46/46 tests pass (20 Phase 2 dispatch + 26 Phase 1 registry): - Existing dispatch tests updated to assert the 3-arg call shape `("hello", None, None)` — history + system_prompt both None - 4 new tests: - `dispatch_passes_system_prompt_to_anthropic` — happy path, third arg flows - `dispatch_passes_system_prompt_to_gemini` — happy path - `dispatch_passes_system_prompt_to_openai` — happy path - `executor_accepts_config_path_kwarg` — constructor stores config_path - `create_executor_forwards_config_path` — both back-compat and registry resolution paths forward config_path through to the executor ## Back-compat - `config_path=None` (default) → execute() skips system-prompt injection, same behavior as pre-2d-i - Workspaces with `runtime: hermes` but no `/configs/system-prompt.md` file get `system_prompt=None` (get_system_prompt returns fallback), same as before - The 13 OpenAI-compat providers work identically — system_prompt just adds a leading message, which every OpenAI-compat endpoint already supports - Anthropic + Gemini previously got zero system context; now they get the same system prompt the workspace's system-prompt.md carries ## Why this matters Before this PR: if someone flipped a workspace from `runtime: claude-code` to `runtime: hermes`, the agent would act generically (no role identity, no project conventions, no CLAUDE.md context) because the Hermes executor never looked at system-prompt.md. That's a silent correctness regression the test suite wouldn't catch because none of our live workspaces use the hermes runtime today. With this PR: Hermes workspaces get the same system prompt injection as Claude-code workspaces, making the `runtime: hermes` switch a true drop-in alternative. ## Related - #267 Phase 2c (multi-turn history — in main) - #255 Phase 2b (gemini native — in main) - #240 Phase 2a (anthropic native — in main) - #208 Phase 1 (provider registry — in main) - project_hermes_multi_provider.md — Phase 2d-i was the next queued item

HongmingWang-Rabbit and others added 3 commits April 15, 2026 11:14

Merge branch 'main' into feat/hermes-phase1-provider-registry

012a3c0

Merge remote-tracking branch 'origin/main' into feat/hermes-phase1-pr…

8430c1a

…ovider-registry

HongmingWang-Rabbit merged commit 381a3c8 into main Apr 15, 2026

HongmingWang-Rabbit mentioned this pull request Apr 15, 2026

chore(template): enable idle-loop pilot on Technical Researcher (#205 follow-up) #216

Merged

5 tasks

HongmingWang-Rabbit mentioned this pull request Apr 15, 2026

feat(hermes): Phase 2a — native Anthropic Messages API dispatch (auth_scheme='anthropic') #240

Merged

HongmingWang-Rabbit mentioned this pull request Apr 15, 2026

feat(hermes): Phase 2b — native Google Gemini generateContent dispatch path #255

Merged

HongmingWang-Rabbit mentioned this pull request Apr 15, 2026

feat(hermes): Phase 2c — multi-turn history passed natively to all dispatch paths #267

Merged

HongmingWang-Rabbit deleted the feat/hermes-phase1-provider-registry branch April 16, 2026 12:30

molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026

Merge pull request #208 from Molecule-AI/feat/hermes-phase1-provider-…

be53a33

…registry feat(hermes): Phase 1 — multi-provider registry (15 providers, 26 tests, back-compat preserved)

This was referenced May 3, 2026

feat(workspace): event_log module + EventLogConfig (#119 PR-2) #2548

Merged

feat(workspace): wire observability heartbeat + log_level into consumers (#119 PR-3a) #2551

Merged

Navigation Menu

Uh oh!

feat(hermes): Phase 1 — multi-provider registry (15 providers, 26 tests, back-compat preserved) - #208

feat(hermes): Phase 1 — multi-provider registry (15 providers, 26 tests, back-compat preserved)#208
HongmingWang-Rabbit merged 3 commits into
mainfrom
feat/hermes-phase1-provider-registry

HongmingWang-Rabbit commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

HongmingWang-Rabbit commented Apr 15, 2026

Why

What this adds

Files

Back-compat (critical)

What's NOT in this PR (Phase 2)

Test plan

Why now

Related

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant