Add a case-scoped Hermes agent drawer governed through Muster

[jusso-dev]

Outcome

Analysts can work with restricted Hermes security agents from inside a Kelpie case without turning Kelpie into a general chat product or duplicating Hermes, Slack, or Muster.

Product boundary

• Slack remains the primary collaboration and proactive-chat surface.
• Hermes owns the agent loop, models, sessions, streaming, skills, delegation and general memory.
• Muster MCP owns organisation scope, capabilities, policy, approvals, connector governance, evidence and audit.
• Kelpie owns cases and provides a contextual agent surface.
• Vercel Chat SDK is not required: it is primarily a cross-platform bot adapter and would overlap Hermes. The Kelpie web client may use Vercel AI SDK React primitives or a small SSE client against Hermes' documented APIs.

Dependency

Do not implement until the authenticated Hermes-native Muster MCP vertical slice in jusso-dev/Muster#72 is complete and its identity, tenant-scope and read-only Kelpie contracts are verified.

Architecture

Kelpie browser
    -> authenticated Kelpie server route
    -> restricted Hermes API Server profile
    -> governed Muster MCP tools
    -> organisation-scoped Kelpie API

The browser must never receive a Hermes API key, Muster credential, connector secret, organisation mapping or unrestricted tool access.

First slice

Add a case-scoped Ask an agent drawer to the Kelpie case workspace:

• Select an allowed Hermes security role/skill bundle such as Jessie, Alfie or Parker.
• Start or resume a Hermes session linked to the current case.
• Stream assistant text, tool lifecycle, cancellation and bounded errors using Hermes Sessions/Runs SSE APIs.
• Present citations and Muster evidence references separately from narrative text.
• Show read-only investigation behavior first.
• Display consequential operations only as Muster-governed proposals or pending approvals.
• Preserve exact case and organisation scope server-side.

Kelpie stores only linkage and audit metadata such as case ID, Hermes session ID, Muster investigation ID, selected agent/profile, initiating user and timestamps. Hermes remains authoritative for the transcript. Muster/Kelpie remain authoritative for findings, evidence, approvals and actions.

Security requirements

• Use a dedicated restricted Hermes profile; do not expose general terminal, filesystem, arbitrary network or unrelated personal tools.
• Kelpie authenticates its user and resolves organisation, case access and allowed agent server-side before calling Hermes.
• Never trust model-supplied case ID, organisation ID, identity, capability or approval state.
• Use a server-to-server Hermes credential held only by Kelpie's backend or secret store.
• Treat all case content, connector output and agent output as untrusted data, not instructions.
• Redact secrets before persistence, logs and SSE delivery.
• Apply rate, concurrency, input-size, output-size and session limits per organisation/user.
• A generic Hermes run approval must never substitute for an authoritative Muster approval.
• Cross-tenant session lookup must fail without revealing whether the session exists.

Acceptance criteria

• A user with case access can open the drawer and complete a streamed read-only agent turn.
• A user without case access cannot create, read, resume or infer the linked Hermes session.
• The Kelpie browser never receives the Hermes or Muster server credential.
• Case and organisation scope are derived server-side and cannot be changed through prompt/input fields.
• The restricted Hermes profile exposes only the intended Muster/security capabilities.
• Tool progress, cancellation, reconnect and terminal success/failure states render accessibly.
• One linked session can be resumed from the same case without duplicating tool effects.
• Kelpie stores linkage/audit metadata but not a second authoritative transcript.
• Citations and evidence references survive rendering and link only to authorised Kelpie/Muster records.
• A dangerous requested operation becomes a Muster proposal/approval and cannot execute through a direct or generic Hermes path.
• Tests cover identity mapping, tenant isolation, case authorization, credential non-disclosure, prompt injection, oversized content, SSE reconnect, cancellation and duplicate submission.
• Mocked, local, deployed and live-verified behavior are reported separately.

Explicit non-goals

• Rebuilding Slack channels, mentions, reactions, team messaging or notifications.
• Mirroring every Slack transcript into Kelpie.
• Perfect cross-surface Slack/Kelpie session handoff in the first release.
• Building an agent runtime or model gateway in Kelpie.
• Calling model providers directly from Kelpie.
• Allowing arbitrary tools, MCP servers or frontend-supplied system authority.

Follow-up after the case-scoped slice

Only after identity and session ownership are proven should we consider a global Kelpie Agents page for recent sessions and an explicit, audited “continue in Kelpie” handoff from Slack.