mosaicstack/stack
1
0
Fork 0
Code Issues 42 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

feat(gateway): register Hermes runtime provider #740

Merged
jason.woltje merged 2 commits from fix/tess-m4-runtime-reachability into main 2026-07-13 14:45:09 +00:00
Conversation 2 Commits 2 Files Changed 8 +399 -5
jason.woltje commented 2026-07-13 14:09:11 +00:00
Owner
Copy Link

Summary

  • register a concrete HermesRuntimeProvider in AGENT_RUNTIME_PROVIDER_REGISTRY during gateway bootstrap
  • add authenticated interaction route for the runtime transitional capability inventory
  • add concrete authenticated HTTPS Hermes HTTP transport, preserving path prefixes and full trusted scope
  • prove the live controller → service → registered provider matrix path

Verification

  • TURBO_FORCE=true pnpm typecheck
  • TURBO_FORCE=true pnpm lint
  • TURBO_FORCE=true pnpm format:check
  • TURBO_FORCE=true pnpm test
  • Codex code and security reviews

Part of M4-W wave 2 / #710.

## Summary - register a concrete `HermesRuntimeProvider` in `AGENT_RUNTIME_PROVIDER_REGISTRY` during gateway bootstrap - add authenticated interaction route for the runtime transitional capability inventory - add concrete authenticated HTTPS Hermes HTTP transport, preserving path prefixes and full trusted scope - prove the live controller → service → registered provider matrix path ## Verification - `TURBO_FORCE=true pnpm typecheck` - `TURBO_FORCE=true pnpm lint` - `TURBO_FORCE=true pnpm format:check` - `TURBO_FORCE=true pnpm test` - Codex code and security reviews Part of M4-W wave 2 / #710.
jason.woltje added 1 commit 2026-07-13 14:09:11 +00:00
feat(gateway): register Hermes runtime provider
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Details
127a69ea11
jason.woltje commented 2026-07-13 14:17:44 +00:00
Author
Owner
Copy Link

REQUEST CHANGES reviewer-of-record [W-jarvis:reviewer] head 127a69ea11

Verified at exact head 127a69ea11ccc36516c78c2007cbe52fbf63ad30; Woodpecker pipeline 1767 is green and apps/gateway/src/commands/command-authorization.service.ts is byte-identical to origin/main (hash a9f829e7ecec721c6c585fe0da56fb5d6a6441e9).

Blocker:

  • The required live guarded reachability proof is still missing. The new interaction.controller.test.ts calls controller.transitionalCapabilities(...) directly and manually constructs RuntimeProviderService(createGatewayRuntimeProviderRegistry(), ...). That does verify the factory can create a registry containing Hermes and that the controller method can delegate to the service, but it does not exercise a live GET /api/interaction/:agentName/transitional-capabilities request, Nest DI through AgentModule, or the AuthGuard request path. The M4-V failure was an empty injected runtime registry at gateway reachability time; this test can pass even if the actual guarded route/module wiring is broken.

Positive findings:

  • agent.module.ts does define createGatewayRuntimeProviderRegistry() and registers new HermesRuntimeProvider(new GatewayHermesRuntimeTransport()) for AGENT_RUNTIME_PROVIDER_REGISTRY.
  • GatewayHermesRuntimeTransport is a concrete HTTP transport, enforces HTTPS except loopback, preserves configured path prefixes, forwards actor/tenant/channel/correlation headers, and does not include token values in its own error messages.
  • No live creds or hardcoded Tess identity found in the diff; test-only token fixtures are synthetic.

Marker: ROR-740-REQUEST-CHANGES-127a69ea

REQUEST CHANGES reviewer-of-record [W-jarvis:reviewer] head 127a69ea11ccc36516c78c2007cbe52fbf63ad30 Verified at exact head `127a69ea11ccc36516c78c2007cbe52fbf63ad30`; Woodpecker pipeline `1767` is green and `apps/gateway/src/commands/command-authorization.service.ts` is byte-identical to `origin/main` (hash `a9f829e7ecec721c6c585fe0da56fb5d6a6441e9`). Blocker: - The required live guarded reachability proof is still missing. The new `interaction.controller.test.ts` calls `controller.transitionalCapabilities(...)` directly and manually constructs `RuntimeProviderService(createGatewayRuntimeProviderRegistry(), ...)`. That does verify the factory can create a registry containing Hermes and that the controller method can delegate to the service, but it does **not** exercise a live `GET /api/interaction/:agentName/transitional-capabilities` request, Nest DI through `AgentModule`, or the `AuthGuard` request path. The M4-V failure was an empty injected runtime registry at gateway reachability time; this test can pass even if the actual guarded route/module wiring is broken. Positive findings: - `agent.module.ts` does define `createGatewayRuntimeProviderRegistry()` and registers `new HermesRuntimeProvider(new GatewayHermesRuntimeTransport())` for `AGENT_RUNTIME_PROVIDER_REGISTRY`. - `GatewayHermesRuntimeTransport` is a concrete HTTP transport, enforces HTTPS except loopback, preserves configured path prefixes, forwards actor/tenant/channel/correlation headers, and does not include token values in its own error messages. - No live creds or hardcoded Tess identity found in the diff; test-only token fixtures are synthetic. Marker: ROR-740-REQUEST-CHANGES-127a69ea
jason.woltje added 1 commit 2026-07-13 14:25:57 +00:00
test(gateway): prove Hermes route reachability
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Details
a7e5d377e3
jason.woltje commented 2026-07-13 14:35:08 +00:00
Author
Owner
Copy Link

VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head a7e5d377e3

Reviewed exact live head a7e5d377e38b40275884a7df6ee35c55c5859e43; Woodpecker pipeline 1768 is SUCCESS for that commit.

Findings:

  • Prior blocker closed: apps/gateway/src/agent/hermes-runtime-reachability.e2e.test.ts boots a real Nest/Fastify app with AgentModule, exercises unauthenticated HTTP GET /api/interaction/Nova/transitional-capabilities?provider=runtime.hermes through real AuthGuard (401), then authenticated HTTP GET through the route/controller/service path (200) and returns all five Hermes transitional entries (kanban, skills, memory, tools, cron). The DI registry is also asserted to resolve runtime.hermes as HermesRuntimeProvider. Peripheral DB/queue-style dependencies are harness-replaced, but route/guard/DI/service/provider reachability is not mocked.
  • agent.module.ts provides AGENT_RUNTIME_PROVIDER_REGISTRY via createGatewayRuntimeProviderRegistry(), which registers new HermesRuntimeProvider(new GatewayHermesRuntimeTransport()); the injected registry is non-empty at bootstrap.
  • GatewayHermesRuntimeTransport is a concrete server-configured HTTP transport, preserves configured path prefixes, enforces HTTPS except loopback, forwards actor/tenant/channel/correlation headers, and does not include service token values in its own errors/logging.
  • apps/gateway/src/commands/command-authorization.service.ts is untouched/byte-identical to origin/main; hash confirmed a9f829e7ecec721c6c585fe0da56fb5d6a6441e9.
  • No live credentials or hardcoded Tess identity found in the diff; token strings are synthetic test fixtures.

No merge performed by reviewer.

Marker: ROR-740-VERIFIED-APPROVE-a7e5d377

VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head a7e5d377e38b40275884a7df6ee35c55c5859e43 Reviewed exact live head `a7e5d377e38b40275884a7df6ee35c55c5859e43`; Woodpecker pipeline `1768` is SUCCESS for that commit. Findings: - Prior blocker closed: `apps/gateway/src/agent/hermes-runtime-reachability.e2e.test.ts` boots a real Nest/Fastify app with `AgentModule`, exercises unauthenticated HTTP GET `/api/interaction/Nova/transitional-capabilities?provider=runtime.hermes` through real `AuthGuard` (401), then authenticated HTTP GET through the route/controller/service path (200) and returns all five Hermes transitional entries (`kanban`, `skills`, `memory`, `tools`, `cron`). The DI registry is also asserted to resolve `runtime.hermes` as `HermesRuntimeProvider`. Peripheral DB/queue-style dependencies are harness-replaced, but route/guard/DI/service/provider reachability is not mocked. - `agent.module.ts` provides `AGENT_RUNTIME_PROVIDER_REGISTRY` via `createGatewayRuntimeProviderRegistry()`, which registers `new HermesRuntimeProvider(new GatewayHermesRuntimeTransport())`; the injected registry is non-empty at bootstrap. - `GatewayHermesRuntimeTransport` is a concrete server-configured HTTP transport, preserves configured path prefixes, enforces HTTPS except loopback, forwards actor/tenant/channel/correlation headers, and does not include service token values in its own errors/logging. - `apps/gateway/src/commands/command-authorization.service.ts` is untouched/byte-identical to `origin/main`; hash confirmed `a9f829e7ecec721c6c585fe0da56fb5d6a6441e9`. - No live credentials or hardcoded Tess identity found in the diff; token strings are synthetic test fixtures. No merge performed by reviewer. Marker: ROR-740-VERIFIED-APPROVE-a7e5d377
jason.woltje merged commit b7b0f508e6 into main 2026-07-13 14:45:09 +00:00
jason.woltje deleted branch fix/tess-m4-runtime-reachability 2026-07-13 14:45:09 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#740
Delete Branch "fix/tess-m4-runtime-reachability"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?