feat: provision private Hermes assistants for authenticated Hope accounts

Dockerfile

@@ -41,30 +41,28 @@ RUN curl -sSL "https://github.com/livekit/livekit/releases/download/${LIVEKIT_VE
 # Copy Python agent + venv from build stage
 COPY --from=build /app/agent/.venv /opt/voice-agent/.venv
 COPY agent/agent.py /opt/voice-agent/agent.py
-COPY agent/web_mcp.py /opt/voice-agent/web_mcp.py
-COPY agent/weather_mcp.py /opt/voice-agent/weather_mcp.py
-
-COPY agent/skills_mcp.py /opt/voice-agent/skills_mcp.py
-COPY agent/task_registry.py /opt/voice-agent/task_registry.py
-COPY agent/task_router.py /opt/voice-agent/task_router.py
-COPY agent/intent_router.py /opt/voice-agent/intent_router.py
-COPY agent/task_worker.py /opt/voice-agent/task_worker.py
-COPY agent/dispatch_mcp.py /opt/voice-agent/dispatch_mcp.py
-COPY agent/media_mcp.py /opt/voice-agent/media_mcp.py
+COPY --chmod=644 agent/hermes_llm.py /opt/voice-agent/hermes_llm.py
+COPY --chmod=644 agent/healthcheck.py /opt/voice-agent/healthcheck.py
 
 # Copy the voice frontend + token endpoint. Hope Music is a separate service.
+# Source files created by automation may be private on the build host; packaged
+# non-secret application assets must be readable by nginx/voiceuser.
 COPY web/index.html /var/www/voice/
 COPY web/app.js /var/www/voice/
+COPY web/auth.js /var/www/voice/
+COPY web/brand /var/www/voice/brand
 COPY web/style.css /var/www/voice/
 COPY web/livekit-client.umd.js /var/www/voice/
 COPY web/manifest.json /var/www/voice/
 COPY web/favicon.svg /var/www/voice/
 COPY web/token_server.py /opt/voice/token_server.py
+RUN chmod -R a+rX /var/www/voice \
+    && chmod 644 /opt/voice-agent/*.py /opt/voice/token_server.py
 
 # Config files
 COPY livekit.yaml /etc/livekit.yaml
 COPY supervisord.conf /etc/supervisor/conf.d/voice.conf
-COPY config/users.json /etc/hope/users.json
+
 
 # Configure nginx to serve the voice UI on WEB_PORT (9178 by default).
 # Browsers require a secure context (HTTPS or localhost) for microphone access.
@@ -75,10 +73,8 @@ RUN rm -f /etc/nginx/sites-enabled/default \
     && ln -sf /etc/nginx/sites-available/voice /etc/nginx/sites-enabled/voice \
     && mkdir -p /etc/voice/certs
 
-# Create non-root user for agent and protect the server-side user registry.
-RUN useradd -m -s /bin/bash voiceuser || true \
-    && chown -R voiceuser:voiceuser /etc/hope \
-    && chmod 600 /etc/hope/users.json
+# The speech process has no Docker socket or persistent account database.
+RUN useradd -m -s /bin/bash voiceuser
 
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh