Nous proxy deployment contract

Public VanillaCore deployment contract for the upstream Hermes Agent Nous subscription proxy.

This repository contains only generic Kubernetes deployment resources:

• a pinned Hermes Agent proxy image;
• a dedicated persistent volume for OAuth/refresh state;
• a ClusterIP Service; and
• runtime health and security settings that do not depend on a specific cluster topology.

Ingress, NetworkPolicies, storage classes, provider wiring, and cluster-specific service identities belong in an environment repository. No internal hostnames, addresses, namespaces, or issuer assumptions are part of this project.

This is not a fork of Hermes Agent. Source fixes belong upstream or in a deliberate fork later.

Render and apply

kubectl kustomize .
kubectl apply -k .

The environment that owns the deployment must define the network boundary and provide the cluster-specific storage policy. OAuth state is runtime state and must never be copied into Git or another pod.