hermes-cred-as-sturdy

Phase 2 (state). Foundation for hermes-mcp-as-sealed and any cap that needs cross-session persistence.

Hermes signature

/Users/bob/i/hermes-agent/agent/credential_pool.py + hermes_cli/auth.py

PROVIDER_REGISTRY            # provider → key-shape, base-url, refresh path
read_credential_pool() / write_credential_pool()
_load_provider_state() / _save_provider_state()
# Codex tokens: _import_codex_cli_tokens, _codex_access_token_is_expiring
# Locking: _auth_store_lock (threading.Lock around the file)

run_agent.py:5128,5155 — _rotate_credential / _swap_credential mid-conversation.

Authority pattern: bearer-key-in-memory. Pool is a list of (provider, key, status, ttl) tuples. Rotation = pick the next non-rate-limited entry. Persistence = JSON file with file-lock. The agent process holds raw API keys in memory; any tool that imports credential_pool can read them.