PENDING: docs(hermes-agent): define control-plane architecture, deployment topology, ADR, and threat model #669

Parent epic: #668

Context

Hermes Agent is a Python runtime with profiles, tools, memory, messaging gateways, and an authenticated API server. AWCMS-Mini is a Bun-only Astro modular monolith. Before adding schema or connectivity, the trust boundary and supported control surface must be explicit.

Objective

Define the architecture, threat model, data classification, AI impact assessment, and operational boundary for integrating external Hermes services without embedding or reimplementing them.

Scope

• Add an ADR for AWCMS-Mini-as-control-plane / Hermes-as-external-runtime.
• Document online-only activation and why offline/LAN default remains unaffected.
• Define supported interfaces: documented Hermes health/API-server endpoints and explicitly configured event/webhook contracts.
• Define unsupported interfaces: Hermes SQLite/profile-file access, private dashboard APIs, Docker socket, arbitrary host shell.
• Document single-profile and multi-profile topologies for Coolify/systemd/container deployments.
• Define tenant ownership, profile ownership, endpoint trust, module capability, approval, and audit boundaries.
• Classify provider credentials, prompts, responses, memory, attachments, Telegram identifiers, health telemetry, usage estimates, and audit metadata.
• Model threats including SSRF/DNS rebinding, credential exfiltration, prompt injection, excessive agency, tool abuse, cross-tenant access, replay, webhook forgery, indirect prompt injection, data poisoning, resource exhaustion, and unsafe model output.
• Define retention and data-minimization defaults.
• Add AI impact/risk assessment mapped to ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 42005, ISO/IEC 27001/27002/27005/27017/27018/27701, OWASP LLM Top 10, UU PDP, PP 71/2019, and the current UU ITE.
• Record that cross-border provider use requires an organizational privacy/processor assessment before sensitive production data is enabled.

Required decisions

• Hermes remains a separately versioned service.
• MiMo-V2.5-Pro is a configurable default, not a permanent hard dependency.
• No raw secret or unrestricted prompt/response logging.
• No high-impact autonomous action without capability policy and human approval.
• No health/NIK/specific personal data is sent by default.
• Native Hermes dashboard may be linked as a separate operator surface but is not iframe-embedded or cloned.

Deliverables

• New ADR under docs/adr/.
• Hermes integration architecture and threat-model document under docs/awcms-mini/hermes-agent/.
• Data-flow and trust-boundary diagrams.
• Risk register with owner, treatment, evidence, and residual-risk fields.
• Traceability from epic requirements to planned child issues.

Acceptance criteria

• Architecture clearly preserves the Bun-only application rule.
• All network/data/identity trust boundaries are documented.
• Full-online gate and offline/LAN non-impact are explicit.
• Threat model covers tenant isolation, provider, Telegram, tool execution, and model risks.
• Data classification and default retention rules are defined.
• Upstream API/session-history limitations are documented honestly.
• Compliance mapping is implementation-oriented, not a certification claim.
• Docs pass bun run check:docs and bun run check.

Out of scope

• Runtime implementation.
• Provisioning a Hermes server.
• Legal certification or formal legal opinion.