Staging E2E for PR #32 surfaced a workspace boot failure: the deployed
image's hermes gateway never bound :8645, so adapter.setup()'s
/a2a/health probe got httpx.ConnectError and the workspace went
status=failed at ~498s.
Root cause is image-side install/discovery of the molecule-a2a plugin,
NOT the executor wire shape. Local scripts/e2e_full_chain.py runs
against a venv where I'd already installed the plugin manually — it
didn't catch the deployment-shape divergence.
Flip the default off to restore the legacy /v1/chat/completions
fallback (no session continuity, but works). Plugin path stays
opt-in via MOLECULE_A2A_PLATFORM_ENABLED=true so debugging can
continue per-workspace without rolling the whole image again.
Re-enabling will require:
- An image-build smoke test that verifies pip show
hermes-platform-molecule-a2a + hermes config show inside the
built container (filed separately)
- Verifying the molecule-a2a config stanza actually lands in
~/.hermes/config.yaml inside the running container
Tests updated: 37 pass. Plugin-path tests now opt-in via the helper's
default; default-detection test asserts the new chat_completions
fallback.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the synchronous /v1/chat/completions proxy with an async
plugin-path executor that earns single-session continuity for peer
agents.
Behavior:
- Default: POST each A2A turn to the in-container hermes plugin's
/a2a/inbound; await the agent reply via an aiohttp callback server
inside the executor. The plugin POSTs hermes's reply back to the
callback server, correlated by message_id, which resolves the
awaiting Future and emits on the A2A queue.
- Fallback: MOLECULE_A2A_PLATFORM_ENABLED=false reverts to the
legacy /v1/chat/completions transport — same behavior as before
this commit. Lets operators flip the path off if the plugin path
misbehaves in production.
Wire shape:
- Plugin's adapter.send(chat_id, content, reply_to, metadata)
becomes POST <callback_url> with the same fields.
- Correlation is by reply_to (= the inbound message_id), not by
chat_id — two in-flight messages on the same chat would race on
the latter.
- Optional MOLECULE_A2A_PLATFORM_SHARED_SECRET is sent on outbound
POSTs and required on inbound replies.
Tests: 36 unit tests, 98% combined coverage on adapter.py + executor.py.
Covers lifecycle (start/stop/idempotent), happy path (round-trip
through stub plugin), error paths (POST failure, reply timeout, late
delivery for unknown message_id, malformed JSON, missing fields),
auth (shared_secret enforcement both directions), fallback (chat
completions HTTP error, unreachable port, junk response shape), and
chat_id derivation precedence.
Real-LLM E2E remains gated on docker image republish + workspace
provisioning + LLM key — the unit tests bound the wire-shape risk
and the existing scripts/e2e_real_hermes_subprocess.py in
hermes-platform-molecule-a2a covers the plugin side end-to-end against
a real `hermes gateway run` subprocess.
