Simplify Athena operator maintenance workflow

platform/hermes/config.yaml

@@ -39,7 +39,7 @@ web:
   keyless_rescue: true
 
 agent:
-  max_turns: 100
+  max_turns: 500
   gateway_timeout: 3600
   session_stall_timeout: 600
   tool_loop_guardrails:
@@ -57,6 +57,27 @@ agent:
       max_web_searches: 20
       max_subagents: 8
 
+# Compact before a tool-heavy session can grow beyond the selected model's
+# usable window. Large old tool results are pruned without an LLM call first;
+# lean tail retention avoids several expensive back-to-back summary passes.
+compression:
+  enabled: true
+  progress_notices: true
+  threshold: 0.65
+  target_ratio: 0.15
+  tail_mode: "lean"
+  protect_last_n: 20
+  proactive_prune_tokens: 50000
+  proactive_prune_min_result_chars: 4000
+  proactive_prune_min_reclaim_tokens: 4096
+  context_total_ceiling_seconds: 600
+
+auxiliary:
+  compression:
+    provider: "main"
+    model: ""
+    reasoning_effort: "none"
+
 # German is the platform default. The display setting localizes the static
 # messages Hermes currently supports; agent replies are governed by SOUL.md.
 display:

platform/hermes/skills/athena-operator/SKILL.md

@@ -65,6 +65,9 @@ repository and use live measurements only as evidence of current state.
 5. **Change the source of truth.** Modify repository sources, not only a live
    container. Prefer `athena_operator_prepare`; show its full preview and stop
    for the exact user confirmation before `athena_operator_execute`.
+   Use `file_update` for the exact source paths. Never clone the repository in
+   the Hermes sandbox and never request or copy an SSH key; the Operator owns
+   the canonical worktree and its deploy credentials.
    Completion: the approved ticket matches the intended content.
 6. **Deploy narrowly.** Change only named services. Never restart the entire
    stack merely to activate one component. Completion: unrelated containers
@@ -72,8 +75,9 @@ repository and use live measurements only as evidence of current state.
 7. **Verify behavior.** Run syntax/config checks, focused tests, service health,
    and one bounded functional test. A running container alone is not proof.
    Completion: expected behavior and rollback path are both verified.
-8. **Close the maintenance loop.** Update relevant docs, publish the Git
-   change, create a newer recovery bundle, then check maintenance status.
+8. **Close the maintenance loop.** Update relevant docs, publish only the
+   explicitly selected changed paths with `git_publish`, create a newer
+   recovery bundle, then check maintenance status.
    Completion: source commit, deployed state, docs, and recovery agree.
 
 ## Persistent Versus Temporary Work
@@ -102,7 +106,8 @@ repository and use live measurements only as evidence of current state.
 - A profile switch can terminate active generation and invalidate prompt cache.
 - A healthy container can still expose the wrong model, route, or tool set.
 - `/opt/mike-ai/stack` is deployed source, not automatically the canonical Git
-  worktree. Complete durable changes through the documented Git workflow.
+  worktree. Complete durable changes through Operator operations `file_update`,
+  `run_checks`, `compose_deploy`, `git_publish`, and `recovery`.
 - New skills are loaded at the next Hermes session; absence in the current
   session is expected.