Small follow-up after reviewing the PR from a maintainer-readability angle:

• I added a user-facing README note for Anthropic WIF setup.
• I clarified that existing Anthropic API-key and OAuth setups continue to work unchanged; WIF is opt-in via hermes auth add anthropic --type wif / the new interactive auth choice.
• I documented that identity_token_file must be a short-lived runtime JWT, not a workflow YAML file.
• I also clarified the long-running runtime behavior: when Hermes rebuilds or re-resolves the Anthropic client, it preserves forced Bearer/WIF auth semantics instead of falling back to API-key semantics.

If maintainers want to test this against an Anthropic WIF setup, please ask me — I can share the safe GitHub Actions workflow shape and the exact issuer/audience/subject checks without exposing tokens or secrets.

Validation update on the Anthropic WIF PR:

• Local validation on the PR branch is still good:
  • python -m py_compile on the touched WIF/runtime files: OK
  • pytest tests/hermes_cli/test_auth_commands.py tests/hermes_cli/test_anthropic_provider_persistence.py tests/hermes_cli/test_runtime_provider_resolution.py -q -o addopts= → 166 passed
  • pytest tests/cli/test_cli_provider_resolution.py -q -o addopts= → 20 passed
• I pushed two follow-up fixes onto feat/anthropic-wif-auth:
  • 8cab890 fix: preserve anthropic WIF bearer flag in chat route
  • f876d6f fix: pass CLI target model into runtime resolution
• Live GitHub Actions WIF validation still shows a remaining Hermes CLI E2E problem:
  • latest run: 25422304109
  • URL: https://github.com/leprincep35700/hermes-agent/actions/runs/25422304109

What is now proven by the live run:

• GitHub OIDC mint succeeds
• Anthropic WIF resolution succeeds
• direct AIAgent(..., anthropic_force_bearer_auth=True) succeeds
• direct Anthropic message call succeeds (agent_direct_message_ok: True)
• the CLI regression fix does preserve anthropic_force_bearer_auth in the routed runtime and the CLI now passes target_model into provider resolution

What still fails:

• the Hermes auth WIF and chat E2E step is still red in GitHub Actions
• the latest diagnostics narrowed the remaining failure further: after a successful direct resolve_runtime_provider(requested="anthropic", target_model="claude-sonnet-4-5"), a subsequent HermesCLI._ensure_runtime_credentials() in the same CI step still returns HTTP Error 401: Unauthorized

So the original route-propagation bug was real and is now fixed locally, but there is still at least one more runtime-resolution / repeated-WIF-resolution issue left in the live CLI path before I can honestly call Hermes chat fully green end-to-end.

I’m leaving this update here so reviewers can see the exact validated boundary:

• WIF auth path to Anthropic: validated
• direct Hermes AIAgent path with forced bearer auth: validated
• full hermes chat CLI E2E in CI: not fully green yet

Quick status update from my side:

I moved this PR back to draft because I spent real Anthropic credits to test it end to end, and I want to keep the review state honest until the final Hermes CLI path is fully green.

What is validated so far:

• GitHub OIDC mint works
• Anthropic WIF exchange works
• direct Hermes AIAgent WIF calls work
• local targeted tests are green

What I just pushed:

• 1660a36 fix: cache anthropic WIF token exchange per assertion

Why this change:

• the live diagnostics strongly suggested that repeated WIF exchanges with the same short-lived GitHub OIDC assertion inside the same process were part of the remaining failure mode
• this patch reuses a still-valid exchanged Anthropic access token for the same assertion/config instead of immediately re-exchanging it again

Targeted verification I ran locally:

• pytest tests/agent/test_anthropic_adapter.py tests/cli/test_cli_provider_resolution.py tests/hermes_cli/test_runtime_provider_resolution.py -q -o addopts= → 281 passed
• pytest tests/hermes_cli/test_auth_commands.py tests/hermes_cli/test_anthropic_provider_persistence.py tests/hermes_cli/test_runtime_provider_resolution.py -q -o addopts= → 166 passed

I am keeping it in draft until I rerun the live GitHub Actions WIF workflow and confirm the final hermes chat path is green end to end.

Final update: I’m moving this PR back to ready for review.

I validated the Anthropic WIF path end to end with a live GitHub Actions OIDC run using real Anthropic credits. The validation covered the previously failing CLI path, including Hermes auth WIF and chat E2E, and it passed after the latest fixes.

I also removed the temporary diagnostic workflow/run artifacts from my fork after validation so the PR does not depend on public diagnostic logs.

Targeted local validation passes:

• tests/agent/test_anthropic_adapter.py
• tests/cli/test_cli_provider_resolution.py
• tests/hermes_cli/test_runtime_provider_resolution.py
• tests/hermes_cli/test_auth_commands.py
• tests/hermes_cli/test_anthropic_provider_persistence.py

Result: 337 passed

The WIF implementation has now been validated from auth setup through an actual hermes chat response, not just through the lower-level token exchange or SDK path. Existing Anthropic API-key/OAuth users remain unchanged; WIF is opt-in.

One note for reviewers: the PR branch still shows a general upstream Tests / test check as red in GitHub’s check rollup, but the dedicated WIF live validation and the targeted local regression suite above are green.

Quick status clarification after rebasing/updating this PR against the current upstream main:

• The WIF/auth/runtime-focused validation is green locally: 353 passed across the Anthropic adapter, auth commands, provider persistence, runtime provider resolution, Bedrock/Anthropic beta behavior, unsupported-parameter retry handling, and delegation credential-resolution coverage.
• Current PR checks are green for attribution, lint (ruff + ty diff), supply-chain audit, Nix on ubuntu/macos, and Tests / e2e.
• The remaining red check is the broad Tests / test job.

I do not want to overclaim this as full green CI while that broad job is red. I checked recent upstream/main and other open PR runs, and the same broad-suite failure families are showing up outside this WIF branch too (cron MCP init, gateway platform config, browser Chromium checks, delegate heartbeat timing, credential-pool env fallback, sandbox cwd assertions, etc.). That makes this look like current upstream-wide CI noise rather than a WIF-specific failure.

So the intended review posture is:

• ready for review on the WIF/auth/runtime implementation;
• targeted WIF validation is green;
• broad Tests / test is still red and called out honestly here and in the PR body;
• happy to follow up if maintainers want that broad-suite noise split out or triaged separately.

Hi @teknium1, sorry for the ping — this PR adds Anthropic WIF as an opt-in auth mode. Targeted WIF validation is green, and the remaining broad test failure appears to match current upstream CI noise. Would you be the right person to review the auth/provider shape, or should I route it elsewhere?

Branch refreshed onto current main; WIF conflicts are resolved while preserving the newer Nous Portal README section, provider timeout/native Anthropic initialization, oneshot fallback model handling, and the WIF Bearer-auth propagation.

• New head: 67477f0d1
• Local validation rerun with isolated Hermes state:
  • /opt/venv/bin/python -m py_compile agent/anthropic_adapter.py hermes_cli/auth.py hermes_cli/auth_commands.py hermes_cli/main.py hermes_cli/runtime_provider.py hermes_cli/web_server.py run_agent.py gateway/run.py cli.py tui_gateway/server.py tools/delegate_tool.py tools/process_registry.py cron/scheduler.py hermes_cli/oneshot.py scripts/release.py
  • /opt/venv/bin/python -m pytest tests/agent/test_bedrock_1m_context.py tests/agent/test_unsupported_parameter_retry.py -q -o addopts= → 19 passed
  • /opt/venv/bin/python -m pytest tests/tools/test_delegate.py::TestDelegationCredentialResolution tests/hermes_cli/test_auth_commands.py tests/hermes_cli/test_anthropic_provider_persistence.py tests/hermes_cli/test_runtime_provider_resolution.py -q -o addopts= → 205 passed
  • /opt/venv/bin/python -m pytest tests/agent/test_anthropic_adapter.py tests/cli/test_cli_provider_resolution.py -q -o addopts= → 177 passed
  • /opt/venv/bin/python -m pytest tests/run_agent/test_run_agent.py -q -o addopts= → 346 passed
  • git diff --check

Total targeted local validation rerun: 747 passed. Fresh GitHub checks are running on the refreshed head, so I am not claiming full green CI until they finish.

Current-main reassessment:

I rechecked this against current main and the newer auth/provider-runtime changes.

Conclusion: the feature remains useful, but this branch should not be merged as-is.

What current main still lacks:

• I did not find equivalent Anthropic Workload Identity Federation support.
• Current main has Anthropic OAuth / Claude Code / Bearer-auth-adjacent work, but not the full WIF flow: federation rule/org/service-account config, identity-token-file exchange, WIF token caching, and WIF-specific CLI auth UX.

Current update status:

• The branch is stale and conflicts with current main in auth/runtime-adjacent files.
• The conflict is not just mechanical; the surrounding Anthropic/provider-resolution stack has changed enough that this needs a real rebase/reintegration pass.

Recommendation:

• Keep the concept, but rework/rebase before review.
• Salvage the WIF core pieces (config/env shape, token exchange, short-lived cache, Bearer-auth forcing, CLI auth UX) and reintegrate them with the current provider resolution / credential pool / OAuth / delegate paths and updated tests.

Rebased onto current main and resolved the current auth/runtime conflicts.

• New head: 089a89a1d
• Conflict resolution kept the WIF Bearer-auth propagation through the current Anthropic/provider runtime paths and adapted the process-registry Windows guard to the newer code.
• Local validation:
  • /opt/venv/bin/python -m pytest tests/agent/test_anthropic_adapter.py tests/hermes_cli/test_anthropic_provider_persistence.py tests/hermes_cli/test_auth_commands.py tests/hermes_cli/test_runtime_provider_resolution.py tests/cli/test_cli_provider_resolution.py tests/tools/test_delegate.py -q -o addopts='' --tb=short → 502 passed
  • /opt/venv/bin/python -m py_compile agent/agent_init.py agent/agent_runtime_helpers.py agent/anthropic_adapter.py agent/auxiliary_client.py cli.py cron/scheduler.py gateway/run.py hermes_cli/auth.py hermes_cli/auth_commands.py hermes_cli/main.py hermes_cli/oneshot.py hermes_cli/runtime_provider.py hermes_cli/web_server.py run_agent.py tools/delegate_tool.py tools/process_registry.py tui_gateway/server.py → OK
  • git diff --check → OK
• Attribution was refreshed to the mapped GitHub noreply author email.