Feature flags and kill switches

Feature flags configure independent product surfaces and operational rollouts. They are not an agent prompt, tool-authority, or reply-delivery mechanism.

Per ADR-046, no flag may:

• alter, wrap, or add context to the inbound message;
• trigger KB/web/citation/prompt assembly before Hermes sees the message;
• narrow the normal tool surface per turn;
• hold, hide, replace, or require approval for a successful Hermes reply;
• make MCP replace a normal/native capability.

Legacy turn-control keys such as auto_reply_enabled, correction_fewshot_enabled, prompt_assembler_enabled, kb_retrieval_enabled, task-classification/tool-dispatch keys, response-style or clarification prompt keys, and content/review gates are retired from the managed turn path. Existing rows may remain briefly for migration cleanup but must have no behavioral reader.

The code-level source of truth for still-supported, unrelated product flags is api/src/feature-flags/feature-flags.constants.ts. Administration remains at /ops/feature-flags; writes remain audited and most-specific scope resolution remains org_specialist → org → global → default.