VPS Agent Parallel Runtime Setup Report

Date: 2026-05-22 VPS: contabo Mission: Hermes Agent + Kilo Code CLI runtime with OpenRouter via Google Secret Manager, tmux, git worktrees, logs, patches.

Step 0 - Foundation

Sources read:

• .claude/skills/incomex-rules.md
• knowledge/dev/ssot/operating-rules.md via search_knowledge("operating rules SSOT"): OR v7.58, 2026-05-01.
• knowledge/dev/laws/constitution.md via search_knowledge("hiến pháp v4.0 constitution"): current KB result is Constitution v4.6.3.
• knowledge/dev/ssot/vps/vps-operating-rules.md and knowledge/dev/ssot/vps/vps-architecture.md via mission-related KB search.
• Official Hermes docs: https://hermes-agent.nousresearch.com/docs/getting-started/quickstart/, https://hermes-agent.nousresearch.com/docs/reference/cli-commands.
• Official Kilo docs: https://kilo.ai/docs/code-with-ai/platforms/cli, https://kilo.ai/docs/code-with-ai/agents/custom-models.

3 câu Tuyên ngôn:

• Vĩnh viễn: key runtime qua Secret Manager helper, wrappers/worktrees dùng chung cho mọi job/model thay vì cấu hình tay từng lần.
• Nhầm được không: wrappers validate job name, bắt buộc worktree riêng, không chứa key plaintext; Kilo config dùng {env:OPENROUTER_API_KEY}.
• 100% tự động: agent-openrouter-models, agent-new-worktree, agent-run-hermes, agent-run-kilo, agent-status, agent-review-patches, agent-tmux-start-demo.

Step 1-2 - Design

Scope is VPS tooling, not PG/Directus/Nuxt schema. DOT/schema gates: N/A because no database or Nuxt business logic was changed.

Design:

• Secret source: Google Secret Manager secret openrouter-api-key-main.
• Helper: /usr/local/bin/get-openrouter-key, no cache, chmod 700.
• Runtime injection only: OPENROUTER_API_KEY="$(get-openrouter-key)".
• Isolation: /root/agent-runs/{logs,patches,worktrees} and one branch/worktree per job.
• No push, no merge, no real agent modifying task.

Step 3-4 - Implementation

Remote codex-vps exec could not run because Codex on VPS returned OpenAI API 401 Unauthorized. Setup was completed by direct SSH commands on VPS.

Evidence:

Remote codex-vps exec: unexpected status 401 Unauthorized: Missing bearer or basic authentication

Installed and created:

• Hermes Agent: /usr/local/bin/hermes
• Kilo Code CLI: /usr/bin/kilo
• Helper: /usr/local/bin/get-openrouter-key
• Scripts: /usr/local/bin/agent-openrouter-models, agent-new-worktree, agent-run-hermes, agent-run-kilo, agent-tmux-start-demo, agent-status, agent-review-patches
• README: /root/agent-runs/README.md
• Kilo config: /root/.config/kilo/opencode.json with env reference only.
• Model profiles: /root/.config/agent-runs/openrouter-model-profiles.json

Step 5 - Verify Output

VPS state:

Linux vmi3080463 6.8.0-90-generic #91-Ubuntu SMP PREEMPT_DYNAMIC Tue Nov 18 14:14:30 UTC 2025 x86_64 GNU/Linux
Ubuntu 24.04.4 LTS
SHELL=/bin/bash

Secret Manager:

GCP project: github-chatgpt-ggcloud
Secret exists: openrouter-api-key-main
Secret latest access masked: sk-or-v1-****475f
Helper path: /usr/local/bin/get-openrouter-key
Helper chmod: 700 /usr/local/bin/get-openrouter-key
Helper masked test: sk-or-v1-****475f

Hermes:

Hermes binary: /usr/local/bin/hermes
Hermes Agent v0.14.0 (2026.5.16)
Project: /usr/local/lib/hermes-agent
Python: 3.11.15
OpenAI SDK: 2.24.0

Kilo:

Kilo binary: /usr/bin/kilo
Kilo version: 7.3.1

OpenRouter:

OpenRouter /models count: 358
Selected model_fast_free_or_low_cost: baidu/cobuddy:free
Selected model_reasoning: nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free
Selected model_coding: qwen/qwen3.7-max

Worktrees:

/opt/incomex                              2f9e310 [feat/s177-sprint1-round-a]
/root/agent-runs/worktrees/codex-gemini   2f9e310 [agent/codex-gemini]
/root/agent-runs/worktrees/hermes-qwen    2f9e310 [agent/hermes-qwen]
/root/agent-runs/worktrees/kilo-deepseek  2f9e310 [agent/kilo-deepseek]

tmux:

agents: 3 windows (created Fri May 22 04:49:31 2026)

Security scan:

grep -R "sk-or-v1-[A-Za-z0-9_]" /usr/local/bin/agent-* /root/.config/kilo/opencode.json /root/.config/agent-runs/openrouter-model-profiles.json /root/agent-runs/README.md
<no output>

Step 6 - Report / Handoff

VPS report:

• /root/agent-runs/setup-report-20260522T024432Z.md
• /root/agent-runs/logs/20260522T024432Z-setup.log

Local report:

• knowledge/current-state/reports/20260522-vps-agent-parallel-runtime-setup.md

Useful commands:

agent-openrouter-models
agent-tmux-start-demo
tmux a -t agents
agent-run-hermes hermes-qwen <model> "<task>"
agent-run-kilo kilo-deepseek <model> "<task>"
agent-status
agent-review-patches

Rollback:

tmux kill-session -t agents
git -C /opt/incomex worktree remove /root/agent-runs/worktrees/<name>
git -C /opt/incomex branch -D agent/<name>
rm /usr/local/bin/agent-openrouter-models /usr/local/bin/agent-new-worktree /usr/local/bin/agent-run-hermes /usr/local/bin/agent-run-kilo /usr/local/bin/agent-tmux-start-demo /usr/local/bin/agent-status /usr/local/bin/agent-review-patches

Caveats:

• No real modifying agent task was run.
• Initial apt install attempted npm and hit NodeSource/Ubuntu package conflict, but existing /usr/bin/npm worked and Kilo installed successfully.
• Hermes official installer installed optional browser/ffmpeg dependencies as part of its official flow.