fix(serviceoffer-controller): render Hermes config from the Agent CR + hash-skip to stop the resync-wipe

[bussyjd]

Closes #727.

Makes the Agent CR the source of truth for per-agent Hermes config and stops the controller rewriting it on every reconcile/restart — the recurring wipe that reverts an agent's LLM provider, MCP wiring, and turn cap (and recently took a paying endpoint down with a 502 after an upgrade).

Changes

A — Additive CR fields + render passthrough (b7b1bf4)

• AgentSpec gains optional modelProvider, mcpServers, maxTurns, disabledToolsets (new MCPServer type). model string is untouched — no CRD version bump, no conversion.
• renderHermesConfig now honors them: non-custom providers omit the litellm base_url/api_key; an mcp_servers: block is emitted from spec.mcpServers; turns/toolsets fall back to today's literals.
• When all new fields are unset the rendered config is byte-identical to the prior template (golden test TestRenderHermesConfig_UnsetFieldsByteIdentical) — zero change for existing agents.
• CRD schema + zz_generated.deepcopy.go regenerated via controller-gen.

B — Hash-skip (9a347d4)

• buildAgentConfigMap stamps obol.org/hermes-config-hash (sha256 of the rendered config.yaml) on the ConfigMap.
• provisionAgent gets the live ConfigMap and, when the freshly-rendered desired hash equals the stored annotation, skips the apply. The decision is purely desiredHash == storedAnnotation (pure function hermesConfigDecision), never desired-vs-live-content — so operator edits are not treated as drift to revert. Because the annotation lives on the persistent ConfigMap, the skip survives controller restarts, which is what ends the every-obol stack up re-provision.

C — ConfigDrift status condition (9a347d4)

• When skipping, if the live ConfigMap content differs from the last-rendered hash (an out-of-band edit), a ConfigDrift condition is set instead of silently clobbering. This is the safety net for B (which deliberately stops self-healing drift).

Scope is limited to the hermes-config ConfigMap; every other manifest applies exactly as before.

Tests

New agent_confighash_test.go: table test of hermesConfigDecision (nil / match+no-drift / match+drift / mismatch / absent-annotation), plus fake-client integration tests proving skip preserves resourceVersion, stale/absent annotation applies + stamps, and drift sets the condition without clobbering. agent_render_test.go adds the byte-identical golden + override cases. go build ./..., full serviceoffercontroller + monetizeapi suites, and go vet are green.

Validated live on silvernuc3

Built + deployed this controller, applied the CRD, moved the paying hyperliquid-analyst agent's grok+xai-oauth+MCP config into its CR, then:

• Controller reconcile renders grok + mcp_servers + max_turns: 300 from the CR and stamps the hash.
• Forced a controller restart (the exact scenario that used to wipe): ConfigMap resourceVersion unchanged (skip) — config preserved.
• Agent completes end-to-end on grok; Ready=True, ConfigDrift=False(InSync), offer Ready, 402 gate healthy.

Migration / compatibility

Fully additive. modelProvider defaults to custom, so existing agents render identically until an operator opts in by setting the new CR fields. The regenerated CRD is additive (existing CRs remain valid).

https://claude.ai/code/session_01VquWN9UMaSHH7MHGcG8bw1