claude-botandClaude Opus 5.5
2a0a14fb25
SOUL.md comes from git (ConfigMap hermes-soul, subPath over the PVC copy): the stock persona plus the homelab's working rules distilled from Claude Code's global CLAUDE.md and feedback memory — wiki first, the verification ladder, the network/DNS/placement/secret design rules, operational change discipline and how to work with the owner. Claude Code harness specifics (Bash allowlisting, subagent sizing, worktrees, claude-bot identities) are left out. The homelab-wiki skill (ConfigMap hermes-skills, mounted at /opt/hermes-skills and registered via skills.external_dirs) wraps the wiki service API in a stdlib Python client, since the image has no bash or jq. Hermes calls the in-cluster service directly with its own API key, identity `hermes`: - apps/hermes/wiki -> Secret hermes-wiki, mounted as a file (optional, so the pod starts before it is seeded; reads are anonymous) - apps/ai/wiki-api-key-hermes -> Auth__ApiKeys__hermes on the wiki. A separate path rather than a field in apps/ai/wiki-api-keys, because claude-bot's OpenBao policy is write-only and a put on the shared path would drop the workstation key. - CNPs: hermes egress to ai/wiki:8080, wiki ingress from hermes - hermes added to the openbao ClusterSecretStore allowlist The built-in memory store (2200/1375 chars, agent-rewritten) is left to the agent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>