Ben 8446c15706 docs(chronos): pin hop-1 auth to the hosted-agent bootstrap token ... The wire contract said hop 1 uses "the agent's existing Nous Portal access token" but didn't name WHICH of an agent's two identities that is. A hosted agent never holds an `agent:{instanceId}` OAuth client (that shape is minted only by the interactive dashboard auth-code grant); its own outbound portal calls use the bootstrap-session token (client `hermes-cli-vps`) planted in auth.json on first boot. NAS must resolve the instance id from either an `agent:{id}` client OR the bootstrap session (AgentInstance.bootstrapSessionId), not gate on `agent:*` alone — which 403'd every real hosted-agent provision in prod. Documents the NAS-side fix (resolveAgentCronInstanceId) so the contract and the implementation agree.		2026-06-24 20:57:43 +10:00
..
design	docs(profile): update clone-from references	2026-06-13 07:33:58 -07:00
kanban	feat(kanban): gate notifier watcher on dispatch_in_gateway	2026-06-01 20:30:24 -07:00
middleware	fix(middleware): preserve translated downstream failures	2026-06-06 09:26:18 -07:00
observability	feat(observability): observer-grade telemetry hooks + NeMo-Relay plugin	2026-06-03 06:36:46 -07:00
plans	fix(gateway): recover partial Telegram overflow streams	2026-06-10 15:09:35 -07:00
security	docs(security): add network egress isolation guide for Docker deployments (#26385)	2026-05-29 14:09:10 +10:00
chronos-managed-cron-contract.md	docs(chronos): pin hop-1 auth to the hosted-agent bootstrap token	2026-06-24 20:57:43 +10:00
hermes-kanban-v1-spec.pdf	feat(kanban): durable multi-profile collaboration board (#17805)	2026-04-30 13:36:47 -07:00
rca-ssl-cacert-post-git-pull.md	fix(ssl): align guard docs and escape hatch	2026-06-13 21:14:32 -07:00
relay-connector-contract.md	feat(relay): terminal 4401 (opt-out) → clean "Relay disabled" state	2026-06-24 18:43:01 +10:00
session-lifecycle.md	docs: session lifecycle documentation	2026-06-20 23:23:47 -07:00