fix: migrate stranded hermes build context into services/ + drop dashboard local key default

[AlienWalker1995]

Closes two deferred audit items and corrects a services/ reorg miss.

1. Dashboard gateway-key default (fail-closed)

services/v1-parity/dashboard/app.py derived the model-gateway key with a guessable "local" fallback:

MODEL_GATEWAY_API_KEY = os.environ.get("MODEL_GATEWAY_API_KEY", os.environ.get("LITELLM_MASTER_KEY", "local")).strip()

Now:

MODEL_GATEWAY_API_KEY = (os.environ.get("MODEL_GATEWAY_API_KEY") or os.environ.get("LITELLM_MASTER_KEY", "")).strip()

The key is always injected in practice; if genuinely unset it must be empty (fail-closed), never authenticate as local. Grep confirmed this was the only such default in the dashboard.

2. Migrate the stranded hermes build context (external was wrong)

The hermes agent was declared build: {external: true} — "built out-of-band, no in-repo Dockerfile". That was false: a real multi-stage Dockerfile + full build context lived at the top-level hermes/, which the services/ reorg never migrated.

• git mv the whole context (Dockerfile, entrypoint.sh, ops_client.py, spa-patches.mjs, .dockerignore, plugins/, seed/) into services/hermes/ next to its existing agent.yaml + README.md. History preserved (renames R98–R100). Orphaned untracked __pycache__ cleaned; empty hermes/ removed.
• services/hermes/agent.yaml: removed the build: {external: true} block + out-of-band comments. Hermes now resolves to its co-located services/hermes/ context (the resolver default), so no explicit build: is needed. image stays omitted (→ agent-hermes convention); CMD/entrypoint/user comments kept.
• openai-agent stays external: true — it genuinely has no in-repo dir; that flag is correct.

3. Test update

tests/substrate/test_build_contexts.py: new test_hermes_resolves_to_its_in_repo_context asserts ordo/agent-hermes → services/hermes + a real Dockerfile; dropped hermes from the external-exemption (openai-agent kept). tests/test_hermes_ops_client.py now loads ops_client.py from the new path.

4. Live refs fixed

.gitattributes (eol rule), docs/hermes-agent.md (build recipe/SHA-pin), docs/runbooks/bounded-hermes.md, docs/runbooks/secrets.md, architecture tree, services/hermes/README.md build recipe, and the ops-router __init__.py self-reference — all repointed to services/hermes/. docs/history/** left as historical record.

Validation

• Render byte-identical: docker-compose.yml sha 6450f3f0 (unchanged) — removing the metadata-only external flag + moving the context does not touch render (build is never emitted into compose).
• Build from new home: docker build -f services/hermes/Dockerfile services/hermes succeeded (COPYs resolve post-move); throwaway image removed, live ordo/agent-hermes:latest untouched.
• ruff clean, pytest 565 passed / 4 skipped (fable catalog entry stashed during the run, restored after).

🤖 Generated with Claude Code