docs(hermes-chaos): update routing, browser/VNC, wiki governance (2026-08-17)

agents/hermes-chaos.md

@@ -3,11 +3,11 @@ title: Hermes Chaos
 type: system
 status: active
 created: 2026-08-15
-updated: 2026-08-15
+updated: 2026-08-17
-verified_on: 2026-08-08
+verified_on: 2026-08-17
 confidence: high
 tags: [hermes, chaos, ct450, experimental, agent]
-sources: [live-probe, phase-one-review]
+sources: [live-probe, config-inspection]
 ---
 
 # Hermes Chaos
@@ -21,15 +21,39 @@ Experimental Hermes instance for testing new configurations, skills, themes, mod
 - **Container:** LXC CT450 (`hermesagent`)
 - **Tailscale IP:** `100.98.205.112`
 - **Hostname:** `hermesagent`
-- **Software:** przbadu/hermes-ui (Vite web app for browser use)
+- **Software:** hermes-ui (Vite web app for browser use, port 5174)
+- **Memory:** CPU-only container (no GPU) — self-hosted VRAM models are off the table
 
 ## Current State
 
 - **Status:** Active (experimental)
-- **Hermes UI:** przbadu/hermes-ui running on CT450
+- **Soul:** Chaos — the unhinged raccoon 🦝 (SOUL.md beat-bank variant, updated 2026-08-01)
 - **Duplicate cron jobs:** 11 paused (no post-pause execution records since 2026-08-01)
 - **Production counterparts:** CT460 has 11 enabled jobs with successful latest runs
 
+## Providers & Routing
+
+- **Default model:** `deepseek-flash-mix` via `custom:omniroute` (`http://100.88.81.19:20128/v1`, key via `$HERMES_CUSTOM_100_88_81_19_20128_API_KEY`)
+- **Fallback chain** (fixed 2026-08-15 — OmniRoute fallback entries removed, they were non-functional):
+  1. `kilo-stepfun-step-3_7-flash-free` via `litellm_4000`
+  2. `nvidia/nemotron-3-ultra:free` via `nous`
+  3. `auto` via `custom` at `https://freellmapi.com/v1`
+- **Important:** `fallback_providers` must stay a YAML list — `hermes config set` writes strings, which silently disables the whole chain (`_iter_fallback_entries` returns `[]` for strings). Edit via the `hermes fallback` command or direct YAML edit.
+- See [[systems/model-providers]] for full breakdown.
+
+## Browser & Desktop Access
+
+- **Browser engine:** `camofox` on port 9377 (config: `engine: camofox`). Does **not** expose raw CDP on 9222 — do not point `cdp_url` at 9222 or browser tools fail with connection refused.
+- **VNC desktop:** `camofox-vnc.service` (user unit) on Xvfb `:127`, RFB 5901, localhost-only no-auth. View at `hermesagent.kangaroo-eel.ts.net/vnc.html`.
+- **CDP endpoint for typed-browser ops:** bind via `cua_browser_prepare`/`cua_browser_state` on the Camofox window; legacy `browser_navigate` works for plain navigation.
+- See [[systems/browser-backend]] for browser architecture.
+
+## Web UIs (do not conflate)
+
+- **WebUI:** port 8787 (Python/vanilla JS)
+- **hermes-ui:** port 5174 (Vite/React desktop-style renderer, proxies to gateway 9119)
+- These are separate projects. Deployment of hermes-ui is done via CX-dump + tar through the PVE host.
+
 ## Phase One Review (2026-08-08)
 
 Phase One seven-day review completed and independently live-verified:
@@ -43,6 +67,7 @@ Phase One seven-day review completed and independently live-verified:
 - **Do not promote changes to production without explicit approval.** Chaos is for testing.
 - **Duplicate cron jobs are paused.** Do not re-enable without approval.
 - **Separate state.** Memory, skills, and config are independent from CT460.
+- **Wiki governance:** write only to this section (`agents/hermes-chaos.md`); never hand-edit auto-generated pages like [[systems/skills-index]].
 
 ## Relationship to Production
 
@@ -50,11 +75,5 @@ Hermes Chaos (CT450) and Hermes Production (CT460) are separate Hermes instances
 - Separate configs
 - Separate skills
 - Separate cron jobs
-- Separate memory state
+- Separate memory state (Chaos runs Hindsight, bank `hermes-clean`; production runs Mnemosyne)
-- Separate Tailscale identities
+- Separate Tailscale
-
-## Related
-
-- [[agents/hermes-production]] — The production instance
-- [[infrastructure/hosts]] — Host inventory
-- [[systems/hermes-agent]] — Hermes Agent system details