Extract Cortex OS Hermes WebUI Host Adapter

tests/integration/test_loader_contract.py

@@ -13,6 +13,7 @@ import pytest
 
 PLUGIN_REPO = Path(__file__).resolve().parents[2]
 FORK_REPO = PLUGIN_REPO.parent / "hermes-webui"
+MANIFEST = PLUGIN_REPO / "manifest.yaml"
 
 
 @pytest.fixture(scope="module")
@@ -85,6 +86,15 @@ def test_loader_register_wires_our_plugin(loader, monkeypatch):
     assert len(loader._AUDIO_PROCESSORS) == 1
 
 
+def test_manifest_declares_cortex_os_runtime_health_surface():
+    manifest = MANIFEST.read_text(encoding="utf-8")
+
+    assert "/api/cortex-os/runtime-health" in manifest
+    assert "routes/cortex_os_extension.py" in manifest
+    assert "/plugins/svrnty/cortex-os/runtime-health/runtime_health.css" in manifest
+    assert "/plugins/svrnty/cortex-os/runtime-health/runtime_health.js" in manifest
+
+
 def test_loader_noop_when_env_unset(loader, monkeypatch):
     """No env var = no plugin loaded. Upstream behavior fully preserved."""
     monkeypatch.delenv("HERMES_WEBUI_PYTHON_PLUGIN", raising=False)

tests/unit/test_cortex_os_extension_adapter.py

@@ -0,0 +1,51 @@
+from unittest.mock import Mock
+
+from routes import cortex_os_extension
+
+
+def test_adapter_constants_preserve_s27_identity():
+    assert cortex_os_extension.PACKAGE_ID == "cortex-os-extension"
+    assert cortex_os_extension.MEMBER_ID == "s23-runtime-health-read-only-slice"
+    assert cortex_os_extension.ACTIVE_DEVELOPMENT_MOUNT_TARGET == "hermes-webui"
+    assert cortex_os_extension.RUNTIME_HEALTH_METHOD == "GET"
+    assert cortex_os_extension.RUNTIME_HEALTH_ROUTE == "/api/cortex-os/runtime-health"
+
+
+def test_adapter_registers_runtime_health_route_and_assets_only():
+    api = Mock()
+    api.logger.return_value = Mock()
+
+    cortex_os_extension.register(api, "svrnty")
+
+    api.inject_stylesheet.assert_called_once_with(
+        "/plugins/svrnty/cortex-os/runtime-health/runtime_health.css"
+    )
+    api.inject_script.assert_called_once_with(
+        "/plugins/svrnty/cortex-os/runtime-health/runtime_health.js"
+    )
+    api.register_route.assert_called_once()
+    method, path = api.register_route.call_args.args[:2]
+    assert method == "/api/cortex-os/runtime-health"
+    assert path == "GET"
+    api.register_static.assert_not_called()
+    api.config_get.assert_not_called()
+    api.register_audio_attachment_processor.assert_not_called()
+
+
+def test_adapter_source_has_no_forbidden_runtime_discovery():
+    source = cortex_os_extension.__loader__.get_source(cortex_os_extension.__name__)
+    forbidden = [
+        "glob(",
+        "rglob(",
+        "subprocess",
+        "os.walk",
+        "sot/08-OUTPUTS",
+        "hermes_webui",
+        "hermes_agent",
+        "register_static",
+        "config_get",
+        "register_audio_attachment_processor",
+        "product readiness",
+    ]
+    for snippet in forbidden:
+        assert snippet not in source