feat(agents): add provider smoke and reviewed ship lane

[Ghenghis]

Summary

This PR tightens the Hermes Agent co-developer workbench around real provider truth and reviewed shipping actions.

• adds a live provider smoke endpoint for MiniMax and DeepSeek using the same bounded OpenAI-compatible chat path used by coding/review passes
• exposes Agent tab smoke buttons that return pass/blocked state from private backend env without leaking secrets
• adds reviewed patch apply, gate, branch, stage, commit, push, and PR controls to the Agent Code Workbench
• documents the real current blocker in ROADMAP and the E2E truth/proof plan: both configured private provider keys are rejected live with HTTP 401

Truth / Proof

• MiniMax smoke route: returns blocked, HTTP 401 redacted, evidence recorded
• DeepSeek smoke route: returns blocked, HTTP 401 redacted, evidence recorded
• reviewed patch apply route: fails closed with HTTP 422 on malformed proposal id
• Hermes evidence chain: verified intact after provider smoke evidence
• MCP evidence: ev_d98ccd32203b51a9

Validation

• python -m py_compile 03_implementation\\src\\hermes3d\\services\\code_history.py 03_implementation\\src\\hermes3d\\api\\routes\\code_operator.py 03_implementation\\src\\hermes3d\\api\\routes\\agents.py
• npm run lint in 03_implementation/ui
• python 03_implementation\\scripts\\scan_active_ui_no_fake.py
• git diff --check
• FastAPI POST /api/code-operator/providers/smoke route smoke for MiniMax and DeepSeek
• FastAPI POST /api/code-operator/patch/apply-reviewed fail-closed validation
• pre-push fast test subset: 39 tests passed

Remaining Blocker

The provider endpoints are wired, but the configured MiniMax and DeepSeek private keys in G:/private/.env are rejected by the live providers. Do not mark Hermes Agents ready for provider-backed coding until both live smoke buttons pass.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cebe2b53-1f51-4058-a2eb-c06d134539c5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/provider-smoke-workbench

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request expands the Hermes Agent co-developer runtime by implementing live provider smoke tests and manual shipping controls in the Agent Code Workbench. Key additions include backend routes for provider auth verification, reviewed patch application, and git operations (branch, stage, commit, push, PR), along with corresponding UI updates in the Agents tab. A feedback point was raised regarding the provider smoke test, noting that it should explicitly verify the content of the provider's response to ensure it matches the expected smoke token, preventing false positives from quota or account warnings.

[gemini-code-assist]

The provider smoke test should verify that the assistant's response actually contains the expected smoke token (HERMES3D_PROVIDER_SMOKE_OK). Some providers might return a 200 OK status with an error message or unexpected content in the body (e.g., account warnings or quota notices), which would currently be recorded as a 'pass' status if the request itself doesn't throw an exception.

Suggested change

	try:
	response = _call_provider_chat(
	provider,
	[
	{"role": "system", "content": "You are a provider health probe. Reply with exactly: HERMES3D_PROVIDER_SMOKE_OK"},
	{"role": "user", "content": "Return the exact smoke token and no secrets."},
	],
	temperature=0.0,
	max_tokens=256,
	)
	except RuntimeError as exc:
	try:
	response = _call_provider_chat(
	provider,
	[
	{"role": "system", "content": "You are a provider health probe. Reply with exactly: HERMES3D_PROVIDER_SMOKE_OK"},
	{"role": "user", "content": "Return the exact smoke token and no secrets."},
	],
	temperature=0.0,
	max_tokens=256,
	)
	if response["content"].strip() != "HERMES3D_PROVIDER_SMOKE_OK":
	raise RuntimeError(f"Provider smoke failed: unexpected response content: {response['content'][:100]}")

[Ghenghis]

Runtime freshness update added in 57514a7.

Proof from live API after restart:

• /api/system/runtime-identity returns fresh=true
• branch: codex/provider-smoke-workbench
• commit: 57514a775053
• dirty: false
• required Agent Workbench routes: 6/6, missing []

Gates rerun:

• python -m py_compile on changed backend routes: PASS
• npm run lint: PASS
• python 03_implementation/scripts/scan_active_ui_no_fake.py: PASS
• FastAPI TestClient /api/system/runtime-identity + /api/code-operator/e2e/readiness: PASS
• Live MiniMax/DeepSeek provider smoke reaches providers and fails closed on redacted HTTP 401 auth blockers
• pre-push fast subset: 39 tests PASS

This closes the stale-backend confusion path: if the running API is old, the Agents tab now shows exactly which required routes are missing instead of making Hermes Agents look vaguely broken.