feat(install): add hermes-agent to brew manifest (operator 2026-05-27 Max-decided dependency)

full-ai-cluster/dev-cluster/SYNC-WAVES.md

@@ -38,7 +38,6 @@ ArgoCD App-of-Apps (after ArgoCD is up):
   Wave  10  hindsight                 needs PostgreSQL (bundled) + Vault secret for LLM key
   Wave  10  orleans                   needs CockroachDB + NATS up
   Wave  10  temporal                  needs CockroachDB up
-  Wave  20  hermes                    needs Vault secret for LLM key + Hindsight + OZ + Orleans
   Wave  30  gitlab / forgejo          source-of-truth services; come up last so all dependent
                                        observability + storage is ready
   Wave  50  ollama / vllm / deepseek-coder / qwen-coder   GPU model servers; manual-sync-only
@@ -61,10 +60,10 @@ ArgoCD App-of-Apps (after ArgoCD is up):
   exist when the workload reconciles.
 - **Data planes before consumers**: CockroachDB / NATS / Redis /
   Weaviate / PostgreSQL must be Ready before apps that connect.
-- **Apps with secret dependencies late**: Hermes pulls the LLM API
-  key from Vault via ESO. ESO must have synced the secret to a
-  k8s Secret object before Hermes pods start. Sync wave gives ESO
-  a head start.
+- **Apps with secret dependencies late**: agent-runtime workloads
+  pull LLM API keys from Vault via ESO. ESO must have synced the
+  secret to a k8s Secret object before pods start. Sync wave gives
+  ESO a head start.
 - **Source-of-truth services last**: GitLab + Forgejo (mutually
   exclusive, only one default-on) should come up after everything
   observability / storage / runtime is ready, so first-boot

full-ai-cluster/k8s/applications/hindsight/Application.yaml

@@ -1,9 +1,10 @@
-# Hindsight (vectorize-io) — agent persistent memory system for Hermes.
+# Hindsight (vectorize-io) — agent persistent memory system for any
+# in-cluster agent runtime that needs memory persistence.
 # Real chart wired: OCI Helm chart at ghcr.io/vectorize-io/charts/hindsight.
 #
-# Pairs with hermes/Application.yaml — Hermes' deployment.yaml
-# sets `HINDSIGHT_URL=http://hindsight.hindsight.svc.cluster.local`
-# which matches this Application's namespace + chart-default service name.
+# Consumer agents reach Hindsight via:
+#   HINDSIGHT_URL=http://hindsight.hindsight.svc.cluster.local
+# (matches this Application's namespace + chart-default service name).
 
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -35,8 +36,9 @@ spec:
 
         api:
           # LLM provider Hindsight uses for its own entity/relation
-          # extraction (separate from Hermes' LLM choice). Sourced
-          # from a Vault-backed ExternalSecret rather than hardcoded.
+          # extraction (separate from consumer-agent's LLM choice).
+          # Sourced from a Vault-backed ExternalSecret rather than
+          # hardcoded.
           llm:
             provider: groq   # change per maintainer preference
             existingSecret:

tools/setup/manifests/brew

@@ -13,3 +13,13 @@
 p7zip       # cascade #4 ISO content audit (7z list); also useful
             # for maintainers doing any iso/zip inspection locally
             # (`7z l ...`). Idempotent: brew install skips if present.
+
+# AI agent harness (operator 2026-05-27 — maintainer-decided
+# dependency; external vendor-agnostic tool from NousResearch):
+hermes-agent  # "Self-improving AI agent that creates skills from
+              # experience" (https://hermes-agent.nousresearch.com).
+              # Vendor-agnostic AI harness; MIT license; bottled
+              # binary via homebrew-core. Transitive deps auto-
+              # resolved by brew (see `brew info hermes-agent` for
+              # current list). Idempotent: brew install skips if
+              # present.