release: harden and publish Hermes Chutes Provider v0.1.5

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,73 @@
+name: Bug report
+description: Report reproducible behavior in the Hermes Chutes provider
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve this independent, unofficial integration.
+        Remove API keys, credentials, private prompts, and account data before submitting.
+  - type: textarea
+    id: summary
+    attributes:
+      label: Problem summary
+      description: What happened, and what did you expect instead?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+      description: Provide the smallest sequence that reproduces the problem.
+      placeholder: |
+        1. Configure...
+        2. Run...
+        3. Observe...
+    validations:
+      required: true
+  - type: dropdown
+    id: installation
+    attributes:
+      label: Installation route
+      options:
+        - Manual directory install from a release tag
+        - Development checkout from main
+        - Entry-point or native install under development
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: plugin-version
+    attributes:
+      label: Plugin version or commit
+      placeholder: v0.1.5 or a commit SHA
+    validations:
+      required: true
+  - type: input
+    id: hermes-version
+    attributes:
+      label: Hermes Agent version or commit
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Include Python version and operating system.
+      placeholder: Python 3.12 on Windows 11
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Sanitized logs
+      description: Include only relevant output after removing sensitive data.
+      render: shell
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Sensitive-data check
+      options:
+        - label: I removed API keys, credentials, private prompts, and account data.
+          required: true

.github/ISSUE_TEMPLATE/compatibility.yml

@@ -0,0 +1,53 @@
+name: Compatibility report
+description: Report a compatibility problem with a Hermes or Chutes change
+title: "[Compatibility]: "
+labels: ["compatibility"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form when the provider stops matching a released Hermes version or a documented Chutes API behavior.
+        Remove API keys, credentials, private prompts, and account data before submitting.
+  - type: dropdown
+    id: affected-system
+    attributes:
+      label: Affected system
+      options:
+        - Hermes Agent
+        - Chutes API or model catalog
+        - Both or unclear
+    validations:
+      required: true
+  - type: input
+    id: plugin-version
+    attributes:
+      label: Plugin version or commit
+      placeholder: v0.1.5 or a commit SHA
+    validations:
+      required: true
+  - type: input
+    id: upstream-version
+    attributes:
+      label: Hermes or Chutes version reference
+      description: Provide a release, commit, dated API behavior, or authoritative link.
+    validations:
+      required: true
+  - type: textarea
+    id: observed-behavior
+    attributes:
+      label: Observed compatibility problem
+      description: Explain the regression and provide minimal reproduction steps.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Sanitized evidence
+      description: Add relevant logs or links after removing sensitive data.
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Sensitive-data check
+      options:
+        - label: I removed API keys, credentials, private prompts, and account data.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,11 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Chutes Documentation
+  - name: Report a security vulnerability
+    url: https://github.com/TheStreamCode/hermes-chutes-provider/security/advisories/new
+    about: Send sensitive findings privately. Never include credentials in a public issue.
+  - name: Chutes documentation
     url: https://docs.chutes.ai
-    about: Official Chutes platform documentation
+    about: Consult official platform documentation; it does not support this unofficial integration.
+  - name: Hermes Agent support
+    url: https://github.com/NousResearch/hermes-agent/issues
+    about: Report issues that also occur without this provider to the Hermes Agent project.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,36 @@
+name: Feature request
+description: Suggest a focused improvement to the provider profile
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This repository is limited to the standalone Chutes provider profile for Hermes Agent.
+        Requests that require a custom transport or a Hermes core patch belong upstream.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or use case
+      description: What limitation are you trying to address?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed improvement
+      description: Describe the smallest provider-level change that would help.
+    validations:
+      required: true
+  - type: textarea
+    id: compatibility
+    attributes:
+      label: Compatibility considerations
+      description: Note any Hermes or Chutes version constraints and link authoritative sources.
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Scope check
+      options:
+        - label: This request can be implemented without patching Hermes Agent.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -5,6 +5,7 @@
 ## Validation
 
 - [ ] `python -m unittest discover -s tests -v`
+- [ ] Hermes integration passed locally or will be covered by CI
 - [ ] Wheel build completed when packaging changed
 
 ## Compatibility and Security

.github/workflows/ci.yml

@@ -11,29 +11,35 @@ permissions:
 jobs:
   offline-tests:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       - run: python -m unittest discover -s tests -v
 
   hermes-integration:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: provider
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+          persist-credentials: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: NousResearch/hermes-agent
-          ref: 46e87b14fd6c943ef0d6671fb0d74c5dde5d4c6b
+          ref: 3c27eb6234bf91b8ceee9e9071591b31e9b148cb # v2026.8.3
           path: hermes-agent
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - run: python -m pip install --disable-pip-version-check -e hermes-agent

AGENTS.md

@@ -38,7 +38,7 @@ framing intact in every document you touch.
 | Build backend | `setuptools>=77` via `pyproject.toml` |
 | Package manager | `pip` (CI uses `python -m pip`); `uv` is fine locally but do not add a second lockfile or package manager to the repo |
 | Lockfile | none, and none is needed while `dependencies = []` |
-| CI | GitHub Actions, `.github/workflows/ci.yml`, plus CodeQL default setup |
+| CI | GitHub Actions, `.github/workflows/ci.yml` (3.11/3.12/3.13/3.14), plus CodeQL default setup |
 
 There is no lint, format, or type-check step configured. Do not introduce one as
 a drive-by change; the codebase is small and has a consistent internal style
@@ -121,6 +121,7 @@ Semantic versioning. A version bump must update **all** of these together:
 - `plugin.yaml` `version`
 - `hermes_chutes_provider/__init__.py` `__version__`
 - `CITATION.cff` `version` and `date-released`
+- the released tag in the README manual-install commands
 - a new `CHANGELOG.md` section with the real release date
 - `RELEASE_VERSION` and `RELEASE_DATE` in `tests/test_plugin_profile.py`
 
@@ -129,7 +130,8 @@ Semantic versioning. A version bump must update **all** of these together:
 ## Release procedure
 
 `main` is protected: linear history, no force pushes, required status checks
-`offline-tests (3.11)` and `offline-tests (3.13)`, and **one approving review**.
+`offline-tests (3.11)`, `offline-tests (3.14)`, `hermes-integration`, and
+`CodeQL`, enforced for administrators, plus **one approving review**.
 Therefore:
 
 1. Work on a branch, never directly on `main`.

CHANGELOG.md

@@ -2,6 +2,34 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.1.5] - 2026-08-09
+
+### Security
+
+- Bound live catalog responses to 8 MiB before decoding, so a misbehaving
+  endpoint cannot make the provider buffer an unbounded response.
+- Stop persisting GitHub credentials in CI checkouts and enforce commit-pinned
+  Actions through the offline contract.
+
+### Changed
+
+- Reject malformed catalog payload shapes while preserving an empty valid
+  catalog and the routing-alias fallback behavior.
+- Test Python 3.14 and refresh the pinned GitHub Actions and Hermes integration
+  revision to currently verified releases.
+- Install the released tag by default and document `main` as a development
+  checkout.
+- Present the current support and distribution status before installation
+  details and document the provider's relationship to Hermes' generic
+  transport.
+
+### Added
+
+- Regression coverage for older Hermes provider profiles, bounded catalog
+  reads, optional request metadata, and workflow pinning.
+- Structured bug, compatibility, and feature-request forms with explicit
+  credential-redaction guidance and a private security-reporting route.
+
 ## [0.1.4] - 2026-08-02
 
 ### Fixed

CITATION.cff

@@ -1,8 +1,8 @@
 cff-version: 1.2.0
 message: "If you use this software, please cite it as below."
 title: "Hermes Chutes Provider"
-version: 0.1.4
-date-released: "2026-08-02"
+version: 0.1.5
+date-released: "2026-08-09"
 url: "https://github.com/TheStreamCode/hermes-chutes-provider"
 repository-code: "https://github.com/TheStreamCode/hermes-chutes-provider"
 license: MIT

CONTRIBUTING.md

@@ -19,12 +19,21 @@ Run the offline test suite before opening a pull request:
 python -m unittest discover -s tests -v
 ```
 
-Changes to packaging should also build a wheel successfully:
+When a Hermes checkout is available, run the integration contract as well:
+
+```bash
+HERMES_SOURCE=/path/to/hermes-agent python -m unittest discover -s tests -v
+```
+
+Changes to packaging should build both release distributions and the CI wheel:
 
 ```bash
 python -m pip wheel . --no-deps
+python -m build
 ```
 
+No validation command may perform paid inference or use a real API key.
+
 ## Pull Requests
 
 Explain the behavior changed, the files affected, how the change was validated,