docs: define Hermes-dispatched Codex workloads

[akua-agentos]

Summary

• adds the proposed Codex workload-dispatch decision record;
• makes Hermes the sole task, approval, retry, lifecycle and result-custody authority;
• defines two explicit runtime modes: disposable bounded Assignment Jobs and exclusive lease-bound interactive session workers;
• requires checkpointed, secret-free evidence before TTL/PVC/Pod cleanup and classifies unplanned Kubernetes termination as uncertain custody;
• rules out worker Kanban polling, worker-created workloads, shared cross-task state, heuristic session resume and exposed Codex control endpoints.

Scope

Documentation only. This PR does not introduce a scheduler, Job/Pod manifest, Kubernetes mutation, runtime behavior, Codex transport change, credential path, deployment, or automation enablement.

The future typed CodexWorkloadRunner remains a separate implementation and review effort.

Validation

• based on origin/main b2f632934e7f0664d4137b2d78a45f66ee13b1c6;
• git diff --check passed;
• exact Decision Record SHA-256: c872203073d30a7cf0ab0ea3ee72c8c0d9fc84e9375c580091c40f94cdb0d080;
• first independent documentation/security review requested corrections, which were applied:
  • retired the competing shared-worker production entry point in the local Hermes runbook;
  • made unplanned Kubernetes termination an explicit uncertain-custody event;
  • clarified the decision owner as Captain-approved First Mate;
• final independent review is required before merge.

No merge authority

Opening or approving this PR does not authorize merge, deployment, cluster changes, provider calls, or revenue automation changes.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	agentos-site	149e8eb	Commit Preview URL Branch Preview URL	Aug 12 2026, 06:40 PM