Summary

The providers-entry validator in hermes_cli/config.py:2187-2191 has a _KNOWN_KEYS set that's out of sync with both the documented config example and the runtime code: it warns on request_timeout_seconds and stale_timeout_seconds as "unknown config keys ignored" even though those are valid keys read by hermes_cli/timeouts.py.

Net effect: the keys still work at runtime (the validator only warns, doesn't strip), but every CLI invocation prints noisy warnings for any user who follows the documented example.

Reproduction

~/.hermes/config.yaml:

providers:
  my-endpoint:
    api: "http://localhost:8080/v1"
    default_model: "some-model"
    transport: "openai"
    request_timeout_seconds: 600   # documented in cli-config.yaml.example
    stale_timeout_seconds: 900

Run any hermes command. Observed in stderr:

WARNING hermes_cli.config: providers.my-endpoint: unknown config keys ignored: request_timeout_seconds, stale_timeout_seconds

Evidence the keys are valid

1. Runtime reads them — hermes_cli/timeouts.py:40 reads provider_config.get("request_timeout_seconds") and :69 reads provider_config.get("stale_timeout_seconds"). They're functional and applied to the OpenAI client.

2. Example file documents them — cli-config.yaml.example (top-level providers: section) shows:

   providers:
     ollama-local:
       request_timeout_seconds: 300
       stale_timeout_seconds: 900

3. The warning source — hermes_cli/config.py:2187-2191:

   _KNOWN_KEYS = {
       "name", "api", "url", "base_url", "api_key", "key_env",
       "api_mode", "transport", "model", "default_model", "models",
       "context_length", "rate_limit_delay",
   }

   Neither timeout key is in the set, so they fall through to the unknown branch at line 2200.

Suggested fix

One-line addition to _KNOWN_KEYS:

_KNOWN_KEYS = {
    "name", "api", "url", "base_url", "api_key", "key_env",
    "api_mode", "transport", "model", "default_model", "models",
    "context_length", "rate_limit_delay",
    "request_timeout_seconds", "stale_timeout_seconds",
}

A regression test could verify that providers config containing those keys parses without warnings (assert no caplog records at WARNING level for the providers normalizer).

Environment

• Hermes Agent v0.11.0 (2026.4.23)
• Python 3.11.14
• Linux / Ubuntu

(Filed as a separate issue from #16767 because the runtime impact is purely cosmetic / log-noise — the keys functionally work today.)