feat(agent): add bounded auto and cold fast modes

[100yenadmin]

What does this PR do?

Reimplements bounded auto and cold policies for the existing fast mode on current main.

Mode	Request behavior
normal	Normal provider tier for every request.
cold	Fast during the opening window of the first logical-session turn only.
auto	Fast during the opening window of every user turn.
fast	Fast for every request.

The opening window defaults to 60 seconds and is configurable with agent.fast_auto_on_seconds. The policy starts at conversation ingress and is revalidated immediately before every provider dispatch, including streaming, non-streaming, retries, tool-loop continuations, iteration-limit summaries, and final managed-stream callbacks after Relay processing.

cold derives eligibility from persisted logical-session transcript activity. Explicitly empty or system-only history remains eligible; prior user, assistant, or tool activity does not.

Only request-local provider metadata changes. Conversation messages, prompts, tool schemas, and persisted request overrides remain unchanged for prompt-cache stability. Existing normal and fast behavior is preserved.

Dynamic OpenAI Priority Processing is emitted only for confirmed native OpenAI or exact ChatGPT Codex provider/host/API-mode identities. Custom, compatible, and lookalike endpoints fail closed. Anthropic keeps its existing native-endpoint gate.

CLI, messaging gateway, TUI, and Desktop surfaces preserve and display all four exact modes. The Desktop session-create contract sends the exact service_tier while retaining the legacy fast field for older gateway compatibility.

Supersedes #64786.

Fixes #64785.

Validation

• Initial implementation head:
  • 420 focused Python tests passed.
  • changed-file Ruff passed.
  • strict API validation passed.
  • Windows footgun scan passed.
  • git diff --check passed.
• Current exact head 68db2d4b64451c446bf02ae515972c6a4ca3f3f5, rebased onto c581ad402e942c8ab5ce7eb0be325b33061d17bb:
  • 327 affected auto-fast, CLI, provider-parity, and run-agent tests passed after the review fixes and rebase.
  • changed-file Ruff passed.
  • git diff --check passed.
  • deterministic final-Relay-boundary tests cover OpenAI, Anthropic, and Bedrock cutoff expiry.
  • native OpenAI/ChatGPT Codex allow tests and custom/lookalike endpoint denial tests passed.
• Local TypeScript checks were not run because this fresh worktree has no Node dependency install; repository CI is the required UI typecheck gate.

Review and CI gates

• Independent runtime/cost review and the final rebase-delta review passed for exact head 68db2d4b64451c446bf02ae515972c6a4ca3f3f5, including request-local policy state, final provider-boundary cutoff enforcement, unsupported endpoint denial, persisted-history cold eligibility, prompt/tool/message stability, and exact CLI/gateway/TUI/Desktop mode preservation.
• Exact-head GitHub Actions CI is still blocked with action_required; an upstream maintainer must approve the external-fork workflow before CI can run.

Scope

This PR is source, focused-test, and independent-review evidence only. It does not claim CI pass, merge, release, deployment, installed-runtime, paid-provider canary, or customer-runtime proof.

[100yenadmin]

P1 managed-stream cutoff finding — Fixed in 5579f28e17f95fc2db4130b15c7843f55bb4bc95.

Every final managed provider stream factory now revalidates dynamic fast metadata immediately before OpenAI, Anthropic, or Bedrock client dispatch, after Relay supplies its final kwargs. Deterministic regressions cross the 60-second cutoff inside Relay and prove stale priority/speed metadata is absent at each final callback.

[100yenadmin]

P2 custom OpenAI-compatible endpoint finding — Fixed in 5579f28e17f95fc2db4130b15c7843f55bb4bc95.

Dynamic OpenAI Priority Processing now fails closed unless runtime identity is an exact supported native pairing: direct OpenAI provider plus api.openai.com, or Codex provider plus exact chatgpt.com/chat.openai.com, with the matching API mode. Regressions prove custom hosts, hostname lookalikes, and path spoofs do not receive service_tier=priority, while confirmed native behavior remains enabled.

[100yenadmin]

Exact-head independent runtime/cost review passed for 5579f28e17f95fc2db4130b15c7843f55bb4bc95.

The review confirmed both prior findings are fixed:

• OpenAI, Anthropic, and Bedrock managed-stream factories revalidate after Relay supplies final kwargs and immediately before provider dispatch; deterministic tests cross the cutoff at that boundary.
• Dynamic OpenAI priority metadata is limited to exact native OpenAI or ChatGPT Codex provider/host/API-mode identities; custom and lookalike endpoints fail closed.

The delta also preserves request-local copying, static normal/fast behavior, prompt/tool/message stability, summary behavior, persisted-history cold eligibility, and exact UI/session mode state.

Current-head affected validation: 306 tests passed; changed-file Ruff and git diff --check passed.

Remaining gate: exact-head CI is action_required with zero jobs until an upstream maintainer approves the external-fork run: https://github.com/NousResearch/hermes-agent/actions/runs/30530979187

[100yenadmin]

Current-main refresh complete.

• Rebased base: c581ad402e942c8ab5ce7eb0be325b33061d17bb
• Rebased head: 68db2d4b64451c446bf02ae515972c6a4ca3f3f5
• Range-diff: reviewed fix commit is unchanged; the feature commit differs only where current main renamed the Desktop boolean handler from toggleFast to setFast, preserving both current-main behavior and the exact normal/fast/auto/cold control.
• Focused proof: 327 affected auto-fast, CLI, provider-parity, and run-agent tests passed; changed-file Ruff passed; git diff --check passed.
• Desktop dependencies are absent in this clean worktree, so the targeted Desktop execution remains owned by remote CI; no dependency installation was performed.

No merge, release, runtime, or CI-approval claim.

[100yenadmin]

Final rebase-delta review passed for exact head 68db2d4b64451c446bf02ae515972c6a4ca3f3f5 on base c581ad402e942c8ab5ce7eb0be325b33061d17bb.

Range-diff confirmed the runtime/cost review-fix commit is patch-identical. The feature patch differs only by the expected current-main Desktop API integration (toggleFast → setFast); the distinct Normal/Fast/Auto/Cold path remains intact. CLI parsing, final Relay-boundary revalidation, request-local identity propagation, and native OpenAI/ChatGPT Codex endpoint gates all retain their prior clearance.

Rebased-head validation: 327 focused tests passed; changed-file Ruff and git diff --check passed. Desktop execution remains CI-owned because Node dependencies are absent locally.

Remaining gate: exact-head CI is action_required with zero jobs until an upstream maintainer approves the external-fork run: https://github.com/NousResearch/hermes-agent/actions/runs/30531462424

[100yenadmin]

Current-main follow-up: after the exact rebase base c581ad402e942c8ab5ce7eb0be325b33061d17bb, main advanced to 9650f555d072d89f51b2c659360bc99799d4bc3c. The later delta touches none of this PR’s files, and GitHub reports this PR mergeable. No additional rebase is needed for that delta.

Remaining gate: exact-head CI is action_required until an upstream maintainer approves the external-fork run: https://github.com/NousResearch/hermes-agent/actions/runs/30531462424

[teknium1]

Thanks for the careful reimplementation across the agent and UI surfaces.

Current main still supports only normal/priority parsing in cli.py:398-406 and static override resolution in hermes_cli/cli_agent_setup_mixin.py:218-228, so the requested bounded policies remain needed. The PR adds the policy at agent/fast_mode.py, starts it at the agent/conversation_loop.py turn boundary, and revalidates metadata at provider dispatch in agent/chat_completion_helpers.py. The previously identified Codex summary gap from superseded #64786 is covered here by revalidation immediately before both direct summary dispatches.

No blocking defect was identified in the inspected diff. The PR is currently mergeable according to GitHub; external-fork CI remains unapproved.

Automated hermes-sweeper review.

[100yenadmin]

Like #83166, this PR is stale against current main and bundles five separable concerns, so I'm splitting it into single-concern PRs rather than pushing a 42-file rebase.

Slice 1 is up: #89960 — fix(models): fail closed on unverified fast-mode endpoints. It's the endpoint-verification piece, framed as a standalone fix (a first-party-shaped model name on a third-party proxy currently gets a fast-mode override sent at it). It also adds the Grok 4.6 fast-mode support that landed after this PR's original head.

Planned follow-ons: (2) idempotent Anthropic fast-mode kwargs helper, (3) the bounded-auto policy, (4) the cold-fast mode + identity threading that activates the slice-1 gate, (5) CLI/config surface. I'll file them in order as each is rebased and green, then close this omnibus once slice 1 lands or is cherry-picked. teknium — you'd marked this on the premise (current main still parses only normal/priority in ); the split is to get it under the review bar.

[100yenadmin]

Closing this omnibus — it's fully replaced by single-concern PRs on current main, each with its own tests, which is much easier to review than this 42-file diff:

• fix(models): fail closed on unverified fast-mode endpoints #89960 fix(models): fail closed on unverified fast-mode endpoints (+ the Grok 4.6 support that landed after this PR's original head)
• refactor(anthropic): extract idempotent fast-mode kwargs helper #89982 refactor(anthropic): extract idempotent fast-mode kwargs helper
• feat(agent): bounded auto and cold fast modes #89991 feat(agent): bounded auto and cold fast modes — the actual auto/cold policy + dispatch wiring (stacks on the two above)

The only part not yet re-filed is the user-facing surface (service_tier: auto/cold in config/CLI/UI), which I've deferred as a follow-up to #89991 rather than bundle into the feature. Nothing is lost by closing this; the three PRs above are the same work, current and green. Thanks for the earlier salvageability read — it's what prompted the split.