{
  "schemaVersion": "1.0",
  "title": "Deploy the Hermes Agent connector",
  "description": "Use this guide to deploy one aip-host-hermes-agent instance for a fixed set of tenant-owned Hermes endpoints. The procedure proves host and endpoint readiness, introduces one protected read, and replaces or rolls back replicas without movin",
  "canonical": "https://getaip.org/docs/connectors/hermes-agent/operations/deployment",
  "route": "/docs/connectors/hermes-agent/operations/deployment",
  "source": "docs/connectors/hermes-agent/operations/deployment.md",
  "protocol": "Agent Interoperability Protocol",
  "protocolVersion": "1.0",
  "section": "Connectors",
  "documentType": "Connector",
  "language": "en",
  "downloads": {
    "md": "/docs/download/connectors/hermes-agent/operations/deployment.md",
    "txt": "/docs/download/connectors/hermes-agent/operations/deployment.txt",
    "json": "/docs/download/connectors/hermes-agent/operations/deployment.json",
    "pdf": "/docs/download/connectors/hermes-agent/operations/deployment.pdf"
  },
  "content": {
    "format": "text/markdown",
    "markdown": "---\ntitle: Deploy the Hermes Agent connector\ndescription: >-\n  Deploy one admitted Hermes Agent standalone host and replace its replicas\n  without changing the endpoint-set or tenant boundary\nkind: how-to\naudience: operator\nappliesTo: \"1.x\"\nwritingStandard: \"aip-docs/1.0\"\nlastReviewedRevision: \"97be86e9efedf07ecf1783b03800f683f107fb04\"\nconnector: hermes-agent\n---\n\n# Deploy the Hermes Agent connector\n\nUse this guide to deploy one `aip-host-hermes-agent` instance for a fixed set\nof tenant-owned Hermes endpoints. The procedure proves host and endpoint\nreadiness, introduces one protected read, and replaces or rolls back replicas\nwithout moving uncertain Actions to a new owner.\n\nComplete the common [connector fleet deployment](../../../guides/deploy-connector-fleet.md)\nfirst. This page adds the Hermes endpoint, operator, MCP, and rollout\ndecisions. The endpoint configuration and standalone host are distinct from\nthe Hermes API-server deployment itself.\n\n## Preserve one endpoint-set boundary\n\nOne connector instance owns one tenant and one immutable endpoint set. Each\nendpoint contributes 35 endpoint-qualified capabilities to the manifest.\nApplications call product-neutral `aipd`; the fleet gateway routes an admitted\nAction to this host's `/aip/v1/messages` endpoint.\n\nEvery overlapping replica for the instance must use:\n\n- the same tenant, membership, external-account boundary, endpoint set, and\n  admitted connector version;\n- the same durable PostgreSQL state;\n- a distinct pre-provisioned replica ID and signing seed;\n- endpoint credentials accepted by the same reviewed credential policy.\n\nThe endpoint file accepts up to 1,000 descriptors, but the common host rejects\nmore than 512 manifest capabilities. At 35 capabilities per endpoint, this\nrevision admits at most 14 endpoints in one standalone host. Treat 14 as a\nmanifest ceiling, not a throughput qualification.\n\n## 1. Freeze the deployment record\n\nRecord the following identities before starting the host:\n\n| Identity | Hermes deployment rule |\n|---|---|\n| Connector type and version | Match the admitted Hermes manifest and immutable artifact |\n| Instance ID | Represents one tenant-owned endpoint set |\n| Replica ID | Identifies one concrete process; never reuse it concurrently |\n| Tenant and membership | Match every endpoint descriptor and fleet binding |\n| External account | Name the stable Hermes deployment or endpoint set, normally with system `hermes_agent` |\n| Public endpoint | End in `/aip/v1/messages` and resolve to this replica |\n| Host DID and seed | Match the pre-provisioned replica identity |\n| Artifact digest | Identify the exact running bytes |\n| Manifest digest | Bind the normalized endpoint IDs and all 35-operation groups |\n| Configuration revision | Increase when deployment-owned configuration changes |\n| Credential revision | Identify the revision allowed for new route assignments |\n| Pinned Hermes revision | Identify the provider route and event contract reviewed for this release |\n\nChanging an endpoint ID changes capability IDs. Changing an endpoint URL or\ntenant changes routing or ownership. Admit either change as a reviewed\nmanifest and configuration update rather than editing a live replica in place.\n\n## 2. Prepare durable state and network paths\n\nProvision one durable PostgreSQL boundary for the connector instance. The\ncommon host stores Actions, results, approvals, streams, callbacks, and\nrecovery state there. The Hermes host also attaches its operator bindings and\ndelegated-result resolver to the same runtime stores.\n\nAllow only the required flows:\n\n| Direction | Peer and route | Purpose |\n|---|---|---|\n| Inbound | Fleet gateway to `/aip/v1/messages` | Signed manifest-pinned native AIP traffic |\n| Inbound, operator network | `/health`, `/ready`, `/metrics`, `/aip/v1/manifest` | Process and host observation |\n| Outbound | Connector lifecycle control endpoint | Signed registration, heartbeat, drain, and offline transitions |\n| Outbound | Connector PostgreSQL | Durable runtime and Hermes operator state |\n| Outbound | Every configured Hermes `base_url` | Fixed provider API routes |\n| Outbound, optional | Central callback endpoint | Signed stream and result delivery |\n\nUse TLS and reviewed service discovery across trust boundaries. The shared\nconnector-host CA config protects host, control-plane, and callback clients;\nthe Hermes connector's provider client uses the process or container trust\nstore instead. Install any private provider CA there explicitly.\n\nDo not expose observation routes to an untrusted network. Do not route\napplication traffic directly to the connector host or Hermes API server.\n\n## 3. Mount endpoint configuration and secrets\n\nSet the shared values from\n[Connector host configuration](../../../reference/connector-host-configuration.md),\nthen add the required endpoint file and optional operator-policy file:\n\n```text\nAIP_HERMES_ENDPOINTS_FILE=/etc/aip/hermes-endpoints.json\nAIP_HERMES_OPERATOR_POLICY_FILE=/etc/aip/hermes-operator-policy.json\n```\n\nThe endpoint file is a strict JSON array. A one-endpoint deployment can use:\n\n```json\n[\n  {\n    \"id\": \"primary\",\n    \"base_url\": \"https://hermes.internal.example\",\n    \"api_key_file\": \"/run/secrets/hermes-primary-token\",\n    \"display_name\": \"Primary Hermes\",\n    \"tenant_id\": \"tenant-acme\"\n  }\n]\n```\n\nThe process rejects an empty array, unknown descriptor fields, unsafe URLs,\nnormalized ID collisions, tenant mismatch, and unsafe secret files. Endpoint\nAPI keys are read once at startup. Replace the process after rotating one.\n\nMount these values as owner-controlled files:\n\n- PostgreSQL URL and the 32-byte Ed25519 signing seed;\n- each endpoint API key;\n- gateway and lifecycle DIDs when file-based configuration is selected;\n- the optional private CA and credential-revision policy;\n- the endpoint and optional operator-policy JSON documents.\n\nSecret readers reject symlinks, non-regular files, empty or oversized values,\nand group- or world-accessible Unix permissions. Keep token bytes out of the\nendpoint JSON, environment, image, logs, and admission package.\n\nOmitting the operator-policy file keeps first-class delegation disabled and\nuses the reviewed built-in operator policy. Do not enable delegation until\nboth capability and scope allowlists, durable approval verification, and the\ninside-Hermes AIP MCP path have been reviewed independently.\n\n## 4. Admit the exact artifact and endpoint set\n\nBuild and publish `aip-host-hermes-agent` through the release process, then pin\nthe image or binary by immutable digest. Verify that the manifest contains\nexactly 35 capabilities for every normalized endpoint ID and no unexpected\nendpoint.\n\nPre-provision the connector instance and each replica in the registry. The\nhost may register only its existing replica identity; it does not create its\nown registry object. Compare these values before admission:\n\n- type, version, instance, replica, tenant, and membership;\n- public endpoint, host DID, gateway DID, and trust domain;\n- artifact, manifest, and schema-bundle digests;\n- endpoint count and capability IDs;\n- region, zone, capacity class, config revision, and credential revision.\n\nKeep tenant bindings for chat, runs, sessions, jobs, operator execution, and\ndelegation disabled until a read-only canary has passed.\n\n## 5. Start and prove readiness\n\nThe reviewed host performs this sequence:\n\n1. parse shared and Hermes-specific arguments;\n2. read, normalize, and tenant-bind every endpoint descriptor;\n3. read endpoint keys and the optional operator policy;\n4. build and bind the immutable manifest to the host signer;\n5. open PostgreSQL and recover durable runtime state;\n6. attach operator profile state, approvals, Action queue, and lifecycle store;\n7. probe storage and `GET /health` on every Hermes endpoint;\n8. register the exact pre-provisioned replica and acquire its lease;\n9. start heartbeat renewal and serve the native host routes.\n\n`/health` proves only that the host process can answer. Require `/ready` to\nreport all four conditions:\n\n- the host is not draining;\n- the registry lease is current;\n- durable runtime storage is ready;\n- connector health is ready.\n\nHermes connector health calls unauthenticated `GET /health` on every configured\nendpoint. It proves that those routes were reachable within the health bound.\nIt does not prove endpoint Bearer authentication, model-provider readiness,\nMCP connectivity, protected routes, mutations, or operator execution.\n\nCompare `/aip/v1/manifest` with the admitted digest. Confirm that the registry\nshows the expected replica, endpoint, DID, topology, lease, and no unexpected\nactive assignment before enabling discovery.\n\n## 6. Introduce one protected read\n\nEnable only the intended tenant binding and one endpoint's low-risk discovery\ngroup. Through the authenticated fleet gateway:\n\n1. discover `cap:hermes_agent:<endpoint_id>:models` for the intended tenant;\n2. verify that another tenant cannot discover it;\n3. invoke it with a fresh Action ID;\n4. retain the route assignment, result, receipts, and redacted host evidence;\n5. confirm that the response came from the intended endpoint and credential.\n\nThe protected model-list call proves more than the readiness probe because it\nuses the endpoint Bearer token. It still does not qualify chat, streaming,\nruns, sessions, jobs, tools, or a configured model route.\n\nExpand one capability family at a time. Review its approval, idempotency,\ntimeout, data, and recovery contract before enabling mutations. Add AIP MCP\ninside Hermes and first-class delegation as separate changes with independent\nprincipals and evidence.\n\n## 7. Replace a replica without moving ownership\n\nFor a normal replacement:\n\n1. admit the new immutable artifact and a new replica identity;\n2. start it against the same PostgreSQL and endpoint-set boundary;\n3. require manifest parity, registration, a current lease, and `/ready`;\n4. route only the reviewed canary scope under fleet policy;\n5. compare protected reads, error rates, latency, leases, and endpoint evidence;\n6. reconcile every uncertain, active, approval-pending, or replica-pinned Action;\n7. terminate the old process with `SIGTERM` or `Ctrl-C`;\n8. require its drain and registry `offline` transition;\n9. expand the replacement only after the retained evidence passes review.\n\nNormal shutdown sets draining before asking the registry to drain. The host\nrejects new work, waits for in-flight requests up to its drain timeout, stops\nserving and heartbeats, and requests the offline transition. Set the platform\ntermination grace above that timeout plus network margin.\n\nDo not run two replicas with the same replica ID or signing seed. Do not point\noverlapping replicas at independent runtime databases.\n\n## Roll back without replaying uncertain work\n\nDisable the affected binding in a higher signed package revision before\nrestoring an earlier version. New discovery and assignments must stop, but\nprovider work already accepted by Hermes may continue.\n\nReconcile Actions against the replica and durable state that own their route.\nDrain the rejected version normally and retain its PostgreSQL state, operator\nbindings, event history, callback records, logs, and lifecycle evidence.\nRestore the earlier artifact together with its matching manifest, endpoint\nfile, operator policy, and admission record.\n\nNever retry an uncertain chat, run, session mutation, job mutation, operator\nstart, approval command, or stop through another replica merely because the\nrollback finished.\n\n## Resolve deployment failures\n\n| Symptom | Safe decision |\n|---|---|\n| Process exits before registration | Validate strict endpoint JSON, file bounds, tenant equality, URLs, identities, and complete grouped settings |\n| Manifest exceeds the host limit | Reduce the endpoint set; do not raise a nonexistent Hermes-specific ceiling |\n| Registration is rejected | Compare every admitted identity, digest, endpoint, revision, and topology value |\n| `/health` succeeds and `/ready` fails | Separate lease, drain, PostgreSQL, all-endpoint health, and registration evidence |\n| One endpoint keeps the host unready | Remove it through a reviewed manifest change or restore its health; do not hide the failed probe |\n| Protected read returns `401` or `403` | Replace the correct endpoint key and process; do not put a token in Action input |\n| Private provider CA is untrusted | Install it in the process trust store; the shared host CA setting does not configure this client |\n| Old replica accepts no new work | Check whether it is intentionally draining before restarting it |\n| Old replica never becomes offline | Keep new mutations paused and follow the host lifecycle recovery procedure |\n| Operator state is missing after replacement | Stop rollout and verify that both replicas use the same durable runtime stores |\n| Delegated result integrity fails | Preserve both records and fail closed; do not accept Hermes prose as a result |\n\n## Retain deployment evidence\n\nRetain one record with:\n\n- AIP, connector-host, and pinned Hermes revisions;\n- artifact, manifest, schema, endpoint-file, and operator-policy digests;\n- instance, replica, tenant, membership, endpoint, and external-account IDs;\n- host and peer DIDs, database identity, topology, and network policy;\n- configuration and credential revisions without secret values;\n- readiness response, registry lease, protected canary result, rollout decision,\n  drain result, and offline state.\n\nThis evidence applies only to the recorded artifact, endpoint set, credentials,\ntenant, and time window. It is not an all-capability or live-provider\nqualification.\n\n## Related documentation\n\n- [Deploy the connector fleet](../../../guides/deploy-connector-fleet.md)\n- [Connector host configuration](../../../reference/connector-host-configuration.md)\n- [Connector host lifecycle](../../../guides/connector-host-lifecycle.md)\n- [Hermes connector configuration](../reference/configuration.md)\n- [Hermes authentication and endpoints](../getting-started/authentication-and-endpoints.md)\n",
    "text": "Deploy the Hermes Agent connector\n\nUse this guide to deploy one aip-host-hermes-agent instance for a fixed set\nof tenant-owned Hermes endpoints. The procedure proves host and endpoint\nreadiness, introduces one protected read, and replaces or rolls back replicas\nwithout moving uncertain Actions to a new owner.\n\nComplete the common connector fleet deployment (../../../guides/deploy-connector-fleet.md)\nfirst. This page adds the Hermes endpoint, operator, MCP, and rollout\ndecisions. The endpoint configuration and standalone host are distinct from\nthe Hermes API-server deployment itself.\n\nPreserve one endpoint-set boundary\n\nOne connector instance owns one tenant and one immutable endpoint set. Each\nendpoint contributes 35 endpoint-qualified capabilities to the manifest.\nApplications call product-neutral aipd; the fleet gateway routes an admitted\nAction to this host's /aip/v1/messages endpoint.\n\nEvery overlapping replica for the instance must use:\n• the same tenant, membership, external-account boundary, endpoint set, and\n  admitted connector version;\n• the same durable PostgreSQL state;\n• a distinct pre-provisioned replica ID and signing seed;\n• endpoint credentials accepted by the same reviewed credential policy.\n\nThe endpoint file accepts up to 1,000 descriptors, but the common host rejects\nmore than 512 manifest capabilities. At 35 capabilities per endpoint, this\nrevision admits at most 14 endpoints in one standalone host. Treat 14 as a\nmanifest ceiling, not a throughput qualification.\n1. Freeze the deployment record\n\nRecord the following identities before starting the host:\n\n| Identity | Hermes deployment rule |\n\n| Connector type and version | Match the admitted Hermes manifest and immutable artifact |\n| Instance ID | Represents one tenant-owned endpoint set |\n| Replica ID | Identifies one concrete process; never reuse it concurrently |\n| Tenant and membership | Match every endpoint descriptor and fleet binding |\n| External account | Name the stable Hermes deployment or endpoint set, normally with system hermesagent |\n| Public endpoint | End in /aip/v1/messages and resolve to this replica |\n| Host DID and seed | Match the pre-provisioned replica identity |\n| Artifact digest | Identify the exact running bytes |\n| Manifest digest | Bind the normalized endpoint IDs and all 35-operation groups |\n| Configuration revision | Increase when deployment-owned configuration changes |\n| Credential revision | Identify the revision allowed for new route assignments |\n| Pinned Hermes revision | Identify the provider route and event contract reviewed for this release |\n\nChanging an endpoint ID changes capability IDs. Changing an endpoint URL or\ntenant changes routing or ownership. Admit either change as a reviewed\nmanifest and configuration update rather than editing a live replica in place.\n2. Prepare durable state and network paths\n\nProvision one durable PostgreSQL boundary for the connector instance. The\ncommon host stores Actions, results, approvals, streams, callbacks, and\nrecovery state there. The Hermes host also attaches its operator bindings and\ndelegated-result resolver to the same runtime stores.\n\nAllow only the required flows:\n\n| Direction | Peer and route | Purpose |\n\n| Inbound | Fleet gateway to /aip/v1/messages | Signed manifest-pinned native AIP traffic |\n| Inbound, operator network | /health, /ready, /metrics, /aip/v1/manifest | Process and host observation |\n| Outbound | Connector lifecycle control endpoint | Signed registration, heartbeat, drain, and offline transitions |\n| Outbound | Connector PostgreSQL | Durable runtime and Hermes operator state |\n| Outbound | Every configured Hermes baseurl | Fixed provider API routes |\n| Outbound, optional | Central callback endpoint | Signed stream and result delivery |\n\nUse TLS and reviewed service discovery across trust boundaries. The shared\nconnector-host CA config protects host, control-plane, and callback clients;\nthe Hermes connector's provider client uses the process or container trust\nstore instead. Install any private provider CA there explicitly.\n\nDo not expose observation routes to an untrusted network. Do not route\napplication traffic directly to the connector host or Hermes API server.\n3. Mount endpoint configuration and secrets\n\nSet the shared values from\nConnector host configuration (../../../reference/connector-host-configuration.md),\nthen add the required endpoint file and optional operator-policy file:\n\nAIPHERMESENDPOINTSFILE=/etc/aip/hermes-endpoints.json\nAIPHERMESOPERATORPOLICYFILE=/etc/aip/hermes-operator-policy.json\n\nThe endpoint file is a strict JSON array. A one-endpoint deployment can use:\n\n[\n  {\n    \"id\": \"primary\",\n    \"baseurl\": \"https://hermes.internal.example\",\n    \"apikeyfile\": \"/run/secrets/hermes-primary-token\",\n    \"displayname\": \"Primary Hermes\",\n    \"tenantid\": \"tenant-acme\"\n  }\n]\n\nThe process rejects an empty array, unknown descriptor fields, unsafe URLs,\nnormalized ID collisions, tenant mismatch, and unsafe secret files. Endpoint\nAPI keys are read once at startup. Replace the process after rotating one.\n\nMount these values as owner-controlled files:\n• PostgreSQL URL and the 32-byte Ed25519 signing seed;\n• each endpoint API key;\n• gateway and lifecycle DIDs when file-based configuration is selected;\n• the optional private CA and credential-revision policy;\n• the endpoint and optional operator-policy JSON documents.\n\nSecret readers reject symlinks, non-regular files, empty or oversized values,\nand group- or world-accessible Unix permissions. Keep token bytes out of the\nendpoint JSON, environment, image, logs, and admission package.\n\nOmitting the operator-policy file keeps first-class delegation disabled and\nuses the reviewed built-in operator policy. Do not enable delegation until\nboth capability and scope allowlists, durable approval verification, and the\ninside-Hermes AIP MCP path have been reviewed independently.\n4. Admit the exact artifact and endpoint set\n\nBuild and publish aip-host-hermes-agent through the release process, then pin\nthe image or binary by immutable digest. Verify that the manifest contains\nexactly 35 capabilities for every normalized endpoint ID and no unexpected\nendpoint.\n\nPre-provision the connector instance and each replica in the registry. The\nhost may register only its existing replica identity; it does not create its\nown registry object. Compare these values before admission:\n• type, version, instance, replica, tenant, and membership;\n• public endpoint, host DID, gateway DID, and trust domain;\n• artifact, manifest, and schema-bundle digests;\n• endpoint count and capability IDs;\n• region, zone, capacity class, config revision, and credential revision.\n\nKeep tenant bindings for chat, runs, sessions, jobs, operator execution, and\ndelegation disabled until a read-only canary has passed.\n5. Start and prove readiness\n\nThe reviewed host performs this sequence:\n1. parse shared and Hermes-specific arguments;\n2. read, normalize, and tenant-bind every endpoint descriptor;\n3. read endpoint keys and the optional operator policy;\n4. build and bind the immutable manifest to the host signer;\n5. open PostgreSQL and recover durable runtime state;\n6. attach operator profile state, approvals, Action queue, and lifecycle store;\n7. probe storage and GET /health on every Hermes endpoint;\n8. register the exact pre-provisioned replica and acquire its lease;\n9. start heartbeat renewal and serve the native host routes.\n\n/health proves only that the host process can answer. Require /ready to\nreport all four conditions:\n• the host is not draining;\n• the registry lease is current;\n• durable runtime storage is ready;\n• connector health is ready.\n\nHermes connector health calls unauthenticated GET /health on every configured\nendpoint. It proves that those routes were reachable within the health bound.\nIt does not prove endpoint Bearer authentication, model-provider readiness,\nMCP connectivity, protected routes, mutations, or operator execution.\n\nCompare /aip/v1/manifest with the admitted digest. Confirm that the registry\nshows the expected replica, endpoint, DID, topology, lease, and no unexpected\nactive assignment before enabling discovery.\n6. Introduce one protected read\n\nEnable only the intended tenant binding and one endpoint's low-risk discovery\ngroup. Through the authenticated fleet gateway:\n1. discover cap:hermesagent::models for the intended tenant;\n2. verify that another tenant cannot discover it;\n3. invoke it with a fresh Action ID;\n4. retain the route assignment, result, receipts, and redacted host evidence;\n5. confirm that the response came from the intended endpoint and credential.\n\nThe protected model-list call proves more than the readiness probe because it\nuses the endpoint Bearer token. It still does not qualify chat, streaming,\nruns, sessions, jobs, tools, or a configured model route.\n\nExpand one capability family at a time. Review its approval, idempotency,\ntimeout, data, and recovery contract before enabling mutations. Add AIP MCP\ninside Hermes and first-class delegation as separate changes with independent\nprincipals and evidence.\n7. Replace a replica without moving ownership\n\nFor a normal replacement:\n1. admit the new immutable artifact and a new replica identity;\n2. start it against the same PostgreSQL and endpoint-set boundary;\n3. require manifest parity, registration, a current lease, and /ready;\n4. route only the reviewed canary scope under fleet policy;\n5. compare protected reads, error rates, latency, leases, and endpoint evidence;\n6. reconcile every uncertain, active, approval-pending, or replica-pinned Action;\n7. terminate the old process with SIGTERM or Ctrl-C;\n8. require its drain and registry offline transition;\n9. expand the replacement only after the retained evidence passes review.\n\nNormal shutdown sets draining before asking the registry to drain. The host\nrejects new work, waits for in-flight requests up to its drain timeout, stops\nserving and heartbeats, and requests the offline transition. Set the platform\ntermination grace above that timeout plus network margin.\n\nDo not run two replicas with the same replica ID or signing seed. Do not point\noverlapping replicas at independent runtime databases.\n\nRoll back without replaying uncertain work\n\nDisable the affected binding in a higher signed package revision before\nrestoring an earlier version. New discovery and assignments must stop, but\nprovider work already accepted by Hermes may continue.\n\nReconcile Actions against the replica and durable state that own their route.\nDrain the rejected version normally and retain its PostgreSQL state, operator\nbindings, event history, callback records, logs, and lifecycle evidence.\nRestore the earlier artifact together with its matching manifest, endpoint\nfile, operator policy, and admission record.\n\nNever retry an uncertain chat, run, session mutation, job mutation, operator\nstart, approval command, or stop through another replica merely because the\nrollback finished.\n\nResolve deployment failures\n\n| Symptom | Safe decision |\n\n| Process exits before registration | Validate strict endpoint JSON, file bounds, tenant equality, URLs, identities, and complete grouped settings |\n| Manifest exceeds the host limit | Reduce the endpoint set; do not raise a nonexistent Hermes-specific ceiling |\n| Registration is rejected | Compare every admitted identity, digest, endpoint, revision, and topology value |\n| /health succeeds and /ready fails | Separate lease, drain, PostgreSQL, all-endpoint health, and registration evidence |\n| One endpoint keeps the host unready | Remove it through a reviewed manifest change or restore its health; do not hide the failed probe |\n| Protected read returns 401 or 403 | Replace the correct endpoint key and process; do not put a token in Action input |\n| Private provider CA is untrusted | Install it in the process trust store; the shared host CA setting does not configure this client |\n| Old replica accepts no new work | Check whether it is intentionally draining before restarting it |\n| Old replica never becomes offline | Keep new mutations paused and follow the host lifecycle recovery procedure |\n| Operator state is missing after replacement | Stop rollout and verify that both replicas use the same durable runtime stores |\n| Delegated result integrity fails | Preserve both records and fail closed; do not accept Hermes prose as a result |\n\nRetain deployment evidence\n\nRetain one record with:\n• AIP, connector-host, and pinned Hermes revisions;\n• artifact, manifest, schema, endpoint-file, and operator-policy digests;\n• instance, replica, tenant, membership, endpoint, and external-account IDs;\n• host and peer DIDs, database identity, topology, and network policy;\n• configuration and credential revisions without secret values;\n• readiness response, registry lease, protected canary result, rollout decision,\n  drain result, and offline state.\n\nThis evidence applies only to the recorded artifact, endpoint set, credentials,\ntenant, and time window. It is not an all-capability or live-provider\nqualification.\n\nRelated documentation\n• Deploy the connector fleet (../../../guides/deploy-connector-fleet.md)\n• Connector host configuration (../../../reference/connector-host-configuration.md)\n• Connector host lifecycle (../../../guides/connector-host-lifecycle.md)\n• Hermes connector configuration (../reference/configuration.md)\n• Hermes authentication and endpoints (../getting-started/authentication-and-endpoints.md)\n"
  },
  "integrity": {
    "algorithm": "sha256",
    "sourceDigest": "1e29292b7e2be5cf4e993e5d80d865c7b29cb7b85f708c740329aa9246f3f2d8"
  }
}