PENDING: feat(hermes-agent): add tenant-aware Hermes operations dashboard #676

Parent epic: #668
Depends on: #670, #672, #673, #674, #675

Context

Operators need one AWCMS-Mini surface for fleet governance, health, Telegram policy, capability bindings, AWCMS-originated runs, approvals, usage estimates, and incidents. It must complement—not clone—the native Hermes dashboard and must display unknown/unverified states honestly.

Objective

Add /admin/hermes and /admin/hermes/{agentId} using existing admin layout, design tokens, i18n, accessibility, and permission patterns.

Dashboard scope

Fleet KPIs

• registered/enabled agents;
• healthy/degraded/unreachable/unknown;
• active sessions and running-agent counts when provided by /health/detailed;
• Telegram configured/verified/mismatch/unknown;
• pending workflow approvals;
• AWCMS-originated run success/failure/timeout/unknown for 24h/7d/30d;
• usage/cost estimate with provenance label;
• active incidents and last health collection.

Fleet table

• name/profile/tenant/purpose/environment;
• operator deployment reference;
• configured provider/model/fallback;
• endpoint classification;
• health/latency/last heartbeat;
• Telegram policy summary;
• capability count/risk summary;
• recent run status;
• accessible filters, search, pagination, and explicit empty/loading/error states.

Agent detail

• identity/config summary;
• endpoint/readiness signals;
• safe resource/health fields;
• model configured vs advertised;
• Telegram principals/chats/topics and verification status;
• module capability bindings;
• AWCMS-originated runs and workflow tasks;
• usage rollups/budget status when available;
• safe incidents/audit timeline;
• operator link to native Hermes dashboard only when explicitly configured, opened separately with noopener noreferrer.

UX/security requirements

• Panel-level permission gates match API guards.
• All mutations call real APIs; no privileged page shortcut.
• Anti-double-submit and confirmation/reason for high-risk changes.
• Never render tokens, authorization headers, raw prompts/responses, memory, attachments, or full upstream errors.
• Unknown and unverified are not shown as healthy/verified.
• No iframe/native-dashboard credential sharing.
• EN + ID runtime i18n; WCAG 2.1 AA-aware keyboard, focus, status, and contrast behavior.

Acceptance criteria

• Tenant users see only agents authorized for their tenant.
• KPIs have defined source/provenance and time window.
• Dashboard degrades safely when one or all Hermes endpoints fail.
• Upstream session-history limitations are disclosed in the UI/help.
• Secret and sensitive-data rendering tests pass.
• Filters, pagination, error, empty, loading, and stale-data states work.
• Real-browser E2E covers permissions, health failure, Telegram unknown state, approval flow, and mobile layout.
• UI strings are translated in EN and ID.
• Module navigation/README/docs and a changeset are updated.
• bun run test:e2e and bun run check pass.

Out of scope

• Reimplementing or embedding the native Hermes dashboard.
• Full Telegram/Hermes conversation browser.
• Container lifecycle controls.