Release v1.3.1 - API credential and gateway lifecycle hardening · WolframRavenwolf/hermes-ha-addon

Highlights

Validate OpenAI-compatible API credentials before nginx or Hermes starts, without exposing rejected values.
Keep add-on-managed API, profile, multiplexing, and foreground-supervision settings authoritative across shared, profile, external-secret, and managed configuration sources.
Pin every gateway slot to its assigned Hermes profile so persisted interactive profile state cannot redirect or duplicate gateways.
Run each profile gateway under a dedicated Linux subreaper/process-group supervisor with a fail-fast durable FIFO logger, bounded cleanup, orphan reaping, readiness signaling, and overlap prevention.
Reject malformed environment records and unknown per-profile targets.
Correct API documentation: /v1/health is public liveness; /v1/models verifies Bearer authentication.

108 unit tests passed; 2 expected platform-specific tests skipped.
Shell syntax, Python syntax, YAML parsing, public-repository hygiene, and git diff --check passed.
A fresh isolated Home Assistant local DEV add-on was built from this exact candidate and tested on HAOS/Linux with Hermes Agent v0.20.0 (v2026.8.3).
Weak credentials failed before service startup without leakage.
Two profile gateways passed direct and nginx-routed health and authenticated API checks.
Container restart reused the shared install marker, resisted a poisoned sticky profile, replaced every old host process, and restored both profile gateways.
An isolated worker-slot termination produced the expected containment proof and restarted only that slot while the primary gateway remained healthy.
The DEV add-on, configuration, source, credential, and containers were removed afterward; the original stopped production add-on remained unchanged.

See the changelog for the complete details.