hermes - 💡(How to fix) Fix [Feature]: ZDR header support for privacy/data retention compliance

name: zdr-header-support about: Request for Zero Data Retention (ZDR) header support for custom providers title: "[Feature]: ZDR header support for privacy/data retention compliance" labels: ["type/feature", "area/config", "comp/agent", "privacy"] assignees: []

Problem Statement

Users cannot configure Zero Data Retention (ZDR) enforcement headers for custom OpenAI-compatible providers in Hermes Agent. This prevents privacy-sensitive workflows where users need to guarantee that prompts and responses are not stored or used for training.

Specific Use Case

Provider: Wafer AI (https://pass.wafer.ai/v1)
Model: Qwen3.5-397B-A17B

To enable ZDR protection, users need to either:

1. Use Privacy/Enterprise tier API keys (requires special provisioning)
2. Send custom headers like Wafer-ZDR: true or X-Privacy-Tier: enterprise

Currently, Hermes has no supported way to configure these headers, forcing users to:

• Manually patch source code (lost on every hermes update)
• Run local proxy middleware to inject headers
• Avoid using Hermes for privacy-sensitive work

Why ZDR Matters

Zero Data Retention means:

• ✅ Provider doesn't store prompts/responses
• ✅ No training on user data
• ✅ Compliance with privacy regulations and organizational policies

Without ZDR enforcement, all conversations may be logged, stored, or used for model training by the provider.

Proposed Solution

Extend the custom provider header support (tracked in #9721 / PR #26505) to explicitly support ZDR-related headers.

Desired Configuration Format

model:
  provider: custom
  base_url: https://pass.wafer.ai/v1
  api_key: wfr_...
  headers:
    Wafer-ZDR: "true"
    X-Privacy-Tier: "enterprise"

OR for provider-specific configurations:

custom_providers:
  - name: wafer-zdr
    base_url: https://pass.wafer.ai/v1
    api_key: wfr_...
    headers:
      Wafer-ZDR: "true"

Implementation Requirements

1. Support arbitrary custom headers for all OpenAI-compatible providers
2. Headers must persist across switch_model operations
3. Headers must apply to:
   • Main agent client
   • Auxiliary clients (vision, compression, etc.)
   • Runtime model switches
4. Document ZDR use case in configuration docs

Related Issues

• #9721 - Cannot set custom HTTP headers for custom providers (Cloudflare 403)
• #12785 - Configurable default headers / User-Agent for third-party API
• #25354 - Volcengine Ark API fails due to User-Agent fingerprinting

Testing & Verification

Once implemented, verify:

# 1. Configure headers in config.yaml
hermes config set model.headers '{"Wafer-ZDR": "true"}'

# 2. Make a request and verify headers are sent
# (Provider should confirm ZDR status in response or dashboard)

# 3. Test that headers persist across model switches
hermes chat -q "Test message" --model Qwen3.5-397B-A17B

Business Impact

• Privacy Compliance: Enables use in regulated environments (healthcare, legal, enterprise)
• User Trust: Users can verify their data isn't retained or used for training
• Competitive Parity: Other agent frameworks support custom headers for privacy controls

Willingness to Help

Happy to:

• Test implementation against Wafer API
• Provide before/after verification of header transmission
• Help document ZDR configuration for other providers

Priority: P2 (Medium) - Degraded functionality with workaround (local proxy), but blocks privacy-sensitive use cases.