Made Soren's provider-routing layer compatible with the Hermes Agent Pantheon release and proved it against the real tag in a disposable tree without touching a live system.

The upstream agent runtime changed the signature of the function Soren wraps to enforce zero-data-retention routing on OpenRouter, which would have broken inference on upgrade. The fix forwards every argument transparently and was verified the hard way: the exact release tag was built in a throwaway directory, every network call was blocked at the socket layer, the API client was replaced with a recorder, and the recorder showed the three privacy fields on the real request and on a forced retry, with only the inert clarify tool exposed. The same pass caught two behaviors the upgrade would have introduced silently, a session-title request that bypassed the privacy wrapper and a runtime pip install at startup, and both became configuration invariants. The rollback helper for the database migration was drilled on synthetic data.