feat: Update models from claude-sonet-4-5 to claude-sonet-4-6 and from glm-5.1 to glm-5.2

Author: Dwi Fahni Denni

.env.example

@@ -72,10 +72,10 @@ TELEMETRYFLOW_DEFAULT_PROVIDER_ID=
 # TelemetryFlow stores its own provider keys via EncryptionService (AES-256-GCM).
 #
 # Agent model assignments:
-#   Triage       → zhipu/glm-5.1         (cost-efficient)
+#   Triage       → zhipu/glm-5.2         (cost-efficient)
 #   Investigator → anthropic/claude-sonnet-4-5 (complex reasoning)
-#   Reviewer     → zhipu/glm-5.1         (cost-efficient)
-#   Remediator   → zhipu/glm-5.1         (cost-efficient)
+#   Reviewer     → zhipu/glm-5.2         (cost-efficient)
+#   Remediator   → zhipu/glm-5.2         (cost-efficient)
 # ================================================================
 
 # Anthropic — recommended for Investigator (complex reasoning)

.github/workflows/ci.yml

@@ -2,7 +2,7 @@
 # TelemetryFlow Hermes - CI Workflow
 # =============================================================================
 #
-# TelemetryFlow Hermes - Community Enterprise Observability Platform (CEOP)
+# TelemetryFlow Hermes - AI-Powered Observability & Incident Response Management (IRM) Platform
 # Copyright (c) 2024-2026 Telemetri Data Indonesia. All rights reserved.
 #
 # This workflow runs tests and linting for TelemetryFlow Hermes:

.github/workflows/docker.yml

@@ -2,7 +2,7 @@
 # TelemetryFlow Hermes - Docker Image Builder Workflow
 # =============================================================================
 #
-# TelemetryFlow Hermes - Community Enterprise Observability Platform (CEOP)
+# TelemetryFlow Hermes - AI-Powered Observability & Incident Response Management (IRM) Platform
 # Copyright (c) 2024-2026 Telemetri Data Indonesia. All rights reserved.
 #
 # This workflow builds and publishes Docker images for TelemetryFlow Hermes:

.github/workflows/release.yml

@@ -2,7 +2,7 @@
 # TelemetryFlow Hermes - Release Workflow
 # =============================================================================
 #
-# TelemetryFlow Hermes - Community Enterprise Observability Platform (CEOP)
+# TelemetryFlow Hermes - AI-Powered Observability & Incident Response Management (IRM) Platform
 # Copyright (c) 2024-2026 Telemetri Data Indonesia. All rights reserved.
 #
 # This workflow builds and releases TelemetryFlow Hermes:

.gitlab-ci.yml

@@ -2,7 +2,7 @@
 # TelemetryFlow Hermes - GitLab CI/CD Pipeline
 # =============================================================================
 #
-# TelemetryFlow Hermes - Community Enterprise Observability Platform (CEOP)
+# TelemetryFlow Hermes - AI-Powered Observability & Incident Response Management (IRM) Platform
 # Copyright (c) 2024-2026 Telemetri Data Indonesia. All rights reserved.
 #
 # Stages: lint → test → security → coverage → release

.kiro/specs/hermes-llm-provider-integration/design.md

@@ -19,10 +19,10 @@ graph TB
             CONFIG["config.yaml<br/>(global default model/provider)"]
             DOTENV[".env<br/>(forwarded environment variables)"]
             subgraph Profiles["profiles/"]
-                TRIAGE["triage/config.yaml<br/>glm-5.1 / zhipu"]
+                TRIAGE["triage/config.yaml<br/>glm-5.2 / zhipu"]
                 INVESTIGATOR["investigator/config.yaml<br/>claude-sonnet-4-5 / anthropic"]
-                REVIEWER["reviewer/config.yaml<br/>glm-5.1 / zhipu"]
-                REMEDIATOR["remediator/config.yaml<br/>glm-5.1 / zhipu"]
+                REVIEWER["reviewer/config.yaml<br/>glm-5.2 / zhipu"]
+                REMEDIATOR["remediator/config.yaml<br/>glm-5.2 / zhipu"]
             end
             subgraph Plugins["plugins/telemetryflow/tools/"]
                 SHARED["_shared.py<br/>(PROVIDER_TYPES, tfo_request)"]
@@ -197,11 +197,11 @@ def parse_model_env(raw):
 
 | Input                         | Model               | Provider                |
 | ----------------------------- | ------------------- | ----------------------- |
-| `zhipu/glm-5.1`               | `glm-5.1`           | `opencode-go`           |
+| `zhipu/glm-5.2`               | `glm-5.2`           | `opencode-go`           |
 | `anthropic/claude-sonnet-4-5` | `claude-sonnet-4-5` | `anthropic`             |
 | `openai/gpt-4o`               | `gpt-4o`            | `openai`                |
 | `ollama/llama3.3:70b`         | `llama3.3:70b`      | `ollama`                |
-| `glm-5.1`                     | `glm-5.1`           | `opencode-go` (default) |
+| `glm-5.2`                     | `glm-5.2`           | `opencode-go` (default) |
 
 ### Config Template Substitution
 
@@ -226,13 +226,13 @@ model:
 ### Substitution Flow per Profile
 
 ```
-HERMES_MODEL=zhipu/glm-5.1
+HERMES_MODEL=zhipu/glm-5.2
 HERMES_INVESTIGATOR_MODEL=anthropic/claude-sonnet-4-5
 
-triage       → write_profile_config("triage", "glm-5.1", "opencode-go")
+triage       → write_profile_config("triage", "glm-5.2", "opencode-go")
 investigator → write_profile_config("investigator", "claude-sonnet-4-5", "anthropic")
-reviewer     → write_profile_config("reviewer", "glm-5.1", "opencode-go")
-remediator   → write_profile_config("remediator", "glm-5.1", "opencode-go")
+reviewer     → write_profile_config("reviewer", "glm-5.2", "opencode-go")
+remediator   → write_profile_config("remediator", "glm-5.2", "opencode-go")
 ```
 
 ---
@@ -331,7 +331,7 @@ def write_hermes_env():
 | ------------------- | ------------- | --------------------------------------------------- |
 | `timestamp`         | DateTime64(3) | Request timestamp                                   |
 | `provider_type`     | String        | Provider identifier (anthropic, openai, etc.)       |
-| `model_id`          | String        | Model identifier (claude-sonnet-4-5, glm-5.1, etc.) |
+| `model_id`          | String        | Model identifier (claude-sonnet-4-5, glm-5.2, etc.) |
 | `context_type`      | String        | Context category (metrics, logs, traces, etc.)      |
 | `user_id`           | String        | Requesting user ID                                  |
 | `prompt_tokens`     | UInt64        | Tokens in the prompt                                |

.kiro/specs/hermes-llm-provider-integration/requirements.md

@@ -52,16 +52,16 @@ Each agent profile shall be independently configurable with its own model and pr
 
 | Agent Profile | Default Model       | Provider              | Env Var Override            |
 | ------------- | ------------------- | --------------------- | --------------------------- |
-| Triage        | `glm-5.1`           | `zhipu` (OpenCode Go) | `HERMES_MODEL`              |
+| Triage        | `glm-5.2`           | `zhipu` (OpenCode Go) | `HERMES_MODEL`              |
 | Investigator  | `claude-sonnet-4-5` | `anthropic`           | `HERMES_INVESTIGATOR_MODEL` |
-| Reviewer      | `glm-5.1`           | `zhipu` (OpenCode Go) | `HERMES_MODEL`              |
-| Remediator    | `glm-5.1`           | `zhipu` (OpenCode Go) | `HERMES_MODEL`              |
+| Reviewer      | `glm-5.2`           | `zhipu` (OpenCode Go) | `HERMES_MODEL`              |
+| Remediator    | `glm-5.2`           | `zhipu` (OpenCode Go) | `HERMES_MODEL`              |
 
-**Model Selection Format**: `provider/model-name` (e.g., `anthropic/claude-sonnet-4-5`, `zhipu/glm-5.1`). If no provider prefix, defaults to `zhipu`.
+**Model Selection Format**: `provider/model-name` (e.g., `anthropic/claude-sonnet-4-5`, `zhipu/glm-5.2`). If no provider prefix, defaults to `zhipu`.
 
 **Acceptance Criteria**:
 
-- `docker-entrypoint.py` reads `HERMES_MODEL` (default: `zhipu/glm-5.1`) for Triage/Reviewer/Remediator profiles.
+- `docker-entrypoint.py` reads `HERMES_MODEL` (default: `zhipu/glm-5.2`) for Triage/Reviewer/Remediator profiles.
 - `docker-entrypoint.py` reads `HERMES_INVESTIGATOR_MODEL` (default: `anthropic/claude-sonnet-4-5`) for the Investigator profile.
 - `parse_model_env()` parses `provider/model` format, defaulting to `zhipu` if no prefix.
 - `write_profile_config()` substitutes `default:` and `provider:` fields in each profile's `config.yaml`.
@@ -246,10 +246,10 @@ The Docker entrypoint shall dynamically substitute model and provider configurat
 
 **Acceptance Criteria**:
 
-- Container startup prints resolved model assignments: `[hermes] Default model: glm-5.1 via opencode-go`.
+- Container startup prints resolved model assignments: `[hermes] Default model: glm-5.2 via opencode-go`.
 - Investigator profile uses `HERMES_INVESTIGATOR_MODEL` independently from other profiles.
 - Profiles without explicit model overrides use `HERMES_MODEL`.
-- If `HERMES_MODEL` is not set, defaults to `zhipu/glm-5.1`.
+- If `HERMES_MODEL` is not set, defaults to `zhipu/glm-5.2`.
 - If `HERMES_INVESTIGATOR_MODEL` is not set, defaults to `anthropic/claude-sonnet-4-5`.
 - The `--check` flag validates environment variables without starting the agent.
 
@@ -331,7 +331,7 @@ The Docker Compose configuration shall support multi-provider deployment with al
 
 **Acceptance Criteria**:
 
-- `docker-compose.yaml` passes `HERMES_MODEL` (default: `zhipu/glm-5.1`) and `HERMES_INVESTIGATOR_MODEL` (default: `anthropic/claude-sonnet-4-5`).
+- `docker-compose.yaml` passes `HERMES_MODEL` (default: `zhipu/glm-5.2`) and `HERMES_INVESTIGATOR_MODEL` (default: `anthropic/claude-sonnet-4-5`).
 - All 11 provider API key environment variables are passed with defaults to empty strings.
 - `LLM_ENCRYPTION_KEY` is passed to the backend service.
 - `TELEMETRYFLOW_DEFAULT_PROVIDER_ID` is supported via `.env` file.

.kiro/specs/hermes-llm-provider-integration/tasks.md

@@ -36,7 +36,7 @@ This plan covers the integration of multi-provider LLM support into Hermes acros
 - [*] 5. Test parse_model_env() All Cases
   - Source: `docker-entrypoint.py`
   - Verify `parse_model_env()` handles all input formats
-  - Test cases: `zhipu/glm-5.1` → `("glm-5.1", "opencode-go")`, `anthropic/claude-sonnet-4-5` → `("claude-sonnet-4-5", "anthropic")`, `ollama/llama3.3:70b` → `("llama3.3:70b", "ollama")`, `glm-5.1` → `("glm-5.1", "opencode-go")` (default), `unknown/model` → `("model", "unknown")` (pass-through)
+  - Test cases: `zhipu/glm-5.2` → `("glm-5.2", "opencode-go")`, `anthropic/claude-sonnet-4-5` → `("claude-sonnet-4-5", "anthropic")`, `ollama/llama3.3:70b` → `("llama3.3:70b", "ollama")`, `glm-5.2` → `("glm-5.2", "opencode-go")` (default), `unknown/model` → `("model", "unknown")` (pass-through)
   - _Requirements: REQ-002, REQ-008_
 
 - [*] 6. Test write_profile_config() Substitution
@@ -48,7 +48,7 @@ This plan covers the integration of multi-provider LLM support into Hermes acros
 - [*] 7. Test Profile Model Assignment Flow
   - Source: `docker-entrypoint.py:configure()`
   - Verify the full configuration flow
-  - Default model from `HERMES_MODEL` (default: `zhipu/glm-5.1`), Investigator model from `HERMES_INVESTIGATOR_MODEL` (default: `anthropic/claude-sonnet-4-5`)
+  - Default model from `HERMES_MODEL` (default: `zhipu/glm-5.2`), Investigator model from `HERMES_INVESTIGATOR_MODEL` (default: `anthropic/claude-sonnet-4-5`)
   - Triage/Reviewer/Remediator use default model, Investigator uses its own model, all 4 profile config.yaml files are generated
   - _Requirements: REQ-002_
 

.kiro/specs/hermes-multi-agent-incident-response/design.md

@@ -19,11 +19,11 @@ graph TB
     subgraph Hermes Pipeline
         ALERT[Alert Fired]
         HOOK1[on-alert-fired.sh]
-        TRIAGE[Triage Agent<br/>glm-5.1 / 30 turns<br/>readonly]
+        TRIAGE[Triage Agent<br/>glm-5.2 / 30 turns<br/>readonly]
         HOOK2[pre-investigation.sh]
-        INVEST[Investigator Agent<br/>claude-sonnet-4-5 / 45 turns<br/>readonly]
-        REVIEW[Reviewer Agent<br/>glm-5.1 / 20 turns<br/>readonly]
-        REMED[Remediator Agent<br/>glm-5.1 / 15 turns<br/>require_approval]
+        INVEST[Investigator Agent<br/>claude-sonnet-4-6 / 45 turns<br/>readonly]
+        REVIEW[Reviewer Agent<br/>glm-5.2 / 20 turns<br/>readonly]
+        REMED[Remediator Agent<br/>glm-5.2 / 15 turns<br/>require_approval]
         HOOK3[post-remediation.sh]
     end
 
@@ -201,7 +201,7 @@ profiles/{agent_name}/
 
 ```yaml
 model:
-  default: "glm-5.1"
+  default: "glm-5.2"
   provider: "opencode-go"
 
 agent:
@@ -254,7 +254,7 @@ readonly: true
 
 ```yaml
 model:
-  default: "claude-sonnet-4-5"
+  default: "claude-sonnet-4-6"
   provider: "anthropic"
 
 agent:
@@ -307,7 +307,7 @@ readonly: true
 
 ```yaml
 model:
-  default: "glm-5.1"
+  default: "glm-5.2"
   provider: "opencode-go"
 
 agent:
@@ -359,7 +359,7 @@ readonly: true
 
 ```yaml
 model:
-  default: "glm-5.1"
+  default: "glm-5.2"
   provider: "opencode-go"
 
 agent:
@@ -600,7 +600,7 @@ fi
 ```yaml
 # profiles/{agent}/config.yaml
 model:
-  default: string # Model identifier (e.g., "glm-5.1", "claude-sonnet-4-5")
+  default: string # Model identifier (e.g., "glm-5.2", "claude-sonnet-4-6")
   provider: string # Provider name (e.g., "opencode-go", "anthropic")
 
 agent:

.kiro/specs/hermes-multi-agent-incident-response/requirements.md

@@ -37,10 +37,10 @@ Alert → on-alert-fired.sh → Triage → Investigator → Reviewer → Remedia
 
 | Term                       | Definition                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Triage_Agent**           | The first agent in the pipeline (glm-5.1, max_turns=30, readonly). Classifies alerts as CRITICAL, KNOWN, NOISE, or INCOMPLETE. Paranoid gatekeeper personality.                                                                                                                                                                                                                                                                         |
-| **Investigator_Agent**     | The second agent in the pipeline (claude-sonnet-4-5, max_turns=45, readonly). Gathers evidence from 20 ClickHouse tables across 4 telemetry signals. Hostile scientist personality.                                                                                                                                                                                                                                                     |
-| **Reviewer_Agent**         | The third agent in the pipeline (glm-5.1, max_turns=20, readonly). Independently challenges investigations for bias and falsifies hypotheses. Professional skeptic personality.                                                                                                                                                                                                                                                         |
-| **Remediator_Agent**       | The fourth and final agent in the pipeline (glm-5.1, max_turns=15, require_approval=true). Proposes fixes requiring human approval via Telegram. Cautious pragmatist personality.                                                                                                                                                                                                                                                       |
+| **Triage_Agent**           | The first agent in the pipeline (glm-5.2, max_turns=30, readonly). Classifies alerts as CRITICAL, KNOWN, NOISE, or INCOMPLETE. Paranoid gatekeeper personality.                                                                                                                                                                                                                                                                         |
+| **Investigator_Agent**     | The second agent in the pipeline (claude-sonnet-4-6, max_turns=45, readonly). Gathers evidence from 20 ClickHouse tables across 4 telemetry signals. Hostile scientist personality.                                                                                                                                                                                                                                                     |
+| **Reviewer_Agent**         | The third agent in the pipeline (glm-5.2, max_turns=20, readonly). Independently challenges investigations for bias and falsifies hypotheses. Professional skeptic personality.                                                                                                                                                                                                                                                         |
+| **Remediator_Agent**       | The fourth and final agent in the pipeline (glm-5.2, max_turns=15, require_approval=true). Proposes fixes requiring human approval via Telegram. Cautious pragmatist personality.                                                                                                                                                                                                                                                       |
 | **Incident_Context**       | The structured data payload passed between agents during pipeline execution. Contains alert_id, classification, evidence, hypotheses, and verdicts.                                                                                                                                                                                                                                                                                     |
 | **Alert_Classification**   | One of four discrete labels assigned by Triage: CRITICAL (genuine anomaly), KNOWN (matches verified pattern), NOISE (below threshold/duplicate), INCOMPLETE (insufficient data).                                                                                                                                                                                                                                                        |
 | **SOUL_File**              | A markdown file (SOUL.md) in each agent's profile directory that defines the agent's personality, behavioral rules, zero-hallucination policy, hard limits, and inter-agent communication protocol.                                                                                                                                                                                                                                     |
@@ -385,10 +385,10 @@ Alert → on-alert-fired.sh → Triage → Investigator → Reviewer → Remedia
 **WHEN** an agent profile is configured
 **THEN** the profile SHALL be located at `profiles/{agent_name}/config.yaml`
 **AND** the config SHALL specify: model (default + provider), agent (max_turns), terminal (backend + timeout), delegation (max_iterations + max_concurrent_children), tools (terminal, web, delegation), gateway (type + credentials), allowed_clickhouse_tables, readonly flag
-**AND** the Triage Agent SHALL use glm-5.1 via opencode-go, max_turns=30, timeout=120s, readonly=true
-**AND** the Investigator SHALL use claude-sonnet-4-5 via anthropic, max_turns=45, timeout=300s, readonly=true
-**AND** the Reviewer SHALL use glm-5.1 via opencode-go, max_turns=20, timeout=180s, readonly=true
-**AND** the Remediator SHALL use glm-5.1 via opencode-go, max_turns=15, timeout=180s, readonly=false, require_approval=true, approval_timeout_seconds=600, auto_escalate_on_timeout=true
+**AND** the Triage Agent SHALL use glm-5.2 via opencode-go, max_turns=30, timeout=120s, readonly=true
+**AND** the Investigator SHALL use claude-sonnet-4-6 via anthropic, max_turns=45, timeout=300s, readonly=true
+**AND** the Reviewer SHALL use glm-5.2 via opencode-go, max_turns=20, timeout=180s, readonly=true
+**AND** the Remediator SHALL use glm-5.2 via opencode-go, max_turns=15, timeout=180s, readonly=false, require_approval=true, approval_timeout_seconds=600, auto_escalate_on_timeout=true
 **AND** all agents SHALL have access to the same 20 ClickHouse tables
 **AND** only the Remediator SHALL have readonly=false