Agent stack build plans · № 4 · Hermes CI/CD healer

What you get

Not a dashboard — an absence of Tuesday-morning dread. Here’s the whole night, compressed.

The artifact this stack produces is a pull request with receipts: what failed, what the agent concluded from the logs, what it changed, and proof the tests pass in a clean container. Below is a static mock of one healed night — the thing worth showing your team before you build any of it (that’s prompt 5).

Overnight — repo acme/reportd · branch feat/date-ranges

02:14✗ workflow failed — test / unit (ubuntu-latest), run #4182, push by dana
02:14→ webhook delivered to /webhooks/ci-heal · X-Hub-Signature-256 valid
02:15→ agent fetched logs · gh run view 4182 --log-failed (payload carries no logs)
02:16→ docker sandbox up · clone, checkout feat/date-ranges, install deps
02:19diagnosis: parse_report() raises TypeError on reports with an empty end_date — introduced in 9f3c2ad
02:21✗ reproduced locally · pytest tests/test_parse.py — 2 failed
02:23✓ patch applied, suite green · pytest — 84 passed in 41s
02:24✓ PR opened · gh pr create → #413 · summary posted as a comment on run #4182
09:03you, with coffee: read the diff, request one rename, merge.

fix: guard empty end_date in parse_report() #413ci-heal

ci-heal/4182-date-ranges → feat/date-ranges · opened by hermes-bot

src/reportd/parse.py +7 −2 · tests untouched

Local run in sandbox: 84 passed, 0 failed · logs excerpted in PR body, secrets stripped

What’s real, what’s glue

Real Hermes: the webhook gateway on port 8644, HMAC validation of GitHub’s X-Hub-Signature-256, the route that turns a payload into a prompt, the hardened Docker terminal backend, and the github_comment / Telegram / Discord delivery targets for the report.
Glue the route’s prompt instructs: everything from 02:15 onward. The webhook payload does not contain job logs — the agent fetches them itself with the gh CLI through the terminal tool, and it opens the PR the same way. No magic; a well-written prompt driving real tools. The prompt is the artifact, and it’s on the prompts page.
Yours to provide: a server GitHub can reach, and a sandbox image with your toolchain in it (setup).

What you end up with, concretely

A ci-heal webhook route in ~/.hermes/config.yaml with a secret, a rate limit, and filters that keep it from chasing its own tail.
A Docker sandbox image with git, gh, and your test toolchain — the only place the agent touches your code.
A route prompt that fixes code, never tests, and never merges.
A fallback mode that’s valuable even when the fix fails: diagnosis delivered to Telegram or Discord — the documented Hermes use case this whole plan is an extension of.