Shared HMAC secret for the Gitea -> Hermes webhook relay merged in #2. Both hosts need the same value: jupiter signs deliveries with it (the webhook config registered by gitea-hermes-webhook-provision), and mars verifies them in the relay and hands it to Hermes through the hermes-agent.env template. 32 random bytes, hex-encoded, stored with no trailing newline — the value reaches Hermes via an env-file template where a newline would both corrupt the file and change the key the HMAC is computed with. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa