fix(hermes): initialize shields metadata explicitly

[HOYALIM]

Summary

Make the Hermes shields metadata target values visibly total after validating the transition mode. This preserves the existing locked and mutable ownership/mode behavior while giving Python CodeQL an explicit initialization proof for alerts 1218–1219 tracked in #6263.

Related Issue

Refs #6263

Changes

• Reject unsupported shields target modes before deriving target metadata.
• Initialize the desired UID, GID, directory mode, and file mode with total expressions instead of branch-local assignments.
• Preserve the locked parent posture (01775), mutable parent posture (0755), Hermes directory modes (0755/03770), and sealed file modes (0444/0640).

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: The runtime guard, shields transition, and recovery suites exercise both locked and mutable metadata application, including ownership and directory/file mode assertions (38 passed, 2 platform-conditional skips).
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This is a control-flow refactor with no user-facing behavior or configuration change.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Author review confirmed that every target value remains identical for locked and mutable modes and unsupported modes still fail closed before metadata writes.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/hermes-runtime-config-guard.test.ts test/hermes-restart-config-seal-transition.test.ts test/hermes-restart-config-seal-recovery.test.ts (38 passed, 2 skipped)
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Ho Lim subhoya@gmail.com

Summary by CodeRabbit

• Refactor
  • Improved internal handling of locked and mutable runtime configuration modes.
  • Preserved existing permissions, ownership, and sandbox behavior for configured shield targets.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

E2E Advisor Recommendation

Required E2E: hermes-shields-config
Optional E2E: None

Dispatch hint: hermes-shields-config

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: target/main
Head: HEAD
Confidence: high

Required E2E

• hermes-shields-config (high): Validates a fresh non-root Hermes sandbox through two real shields down/up transitions, including the exact locked root-owned and mutable sandbox-owned permission/ownership postures modified by this change.

Optional E2E

• None.

New E2E recommendations

• None.

Dispatch hint

• Workflow: .github/workflows/e2e.yaml
• jobs input: hermes-shields-config

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ef52ec2a-cfa7-49dc-9884-7cc277ddb606

📥 Commits

Reviewing files that changed from the base of the PR and between 79a42b9 and 8f811b8.

📒 Files selected for processing (1)

• agents/hermes/runtime-config-guard.py

---

📝 Walkthrough

Walkthrough

The shields-target metadata configuration now validates the mode once, derives ownership and permission values from a locked-state flag, and preserves the existing sandbox parent metadata behavior.

Changes

Hermes runtime configuration

Layer / File(s)	Summary
Unify shields-target mode handling agents/hermes/runtime-config-guard.py	Mode validation and derived ownership/permission settings replace the previous mode branches while retaining locked sticky-home and sandbox group metadata behavior.

Estimated code review effort: 2 (Simple) | ~5 minutes

Suggested labels: integration: hermes, bug-fix

Suggested reviewers: copilot, chengjiew, ericksoa, jyaunches, yimoj

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: explicitly initializing Hermes shields metadata.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[wscurran]

✨ Thanks for the fix, @HOYALIM. Explicit initialization of shields metadata should satisfy the CodeQL alerts while preserving existing behavior. Ready for maintainer review.

---

Related open issues:

• #6263 chore(security): track remaining CodeQL findings

---

Related open issues:

• #6263 chore(security): track remaining CodeQL findings

[github-actions]

E2E Target Results — ✅ All requested tests passed

Run: 29281013000
Workflow ref: codex/pr-6781-e2e-8f811b83
Requested targets: (default — all supported)
Requested test IDs: hermes-shields-config
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped, 0 unknown

Test	Result
hermes-shields-config	✅ success

[cjagwani]

Reviewed exact head 8f811b83f091ea242cfb51cab6667b526b00f7af: required checks are green; exact-head CodeRabbit has no actionable comments; both PR Advisor lanes recommend merge-as-is with high confidence and zero findings; targeted Hermes tests passed (38 passed, 2 platform skips); and the exact-head hermes-shields-config live E2E passed. No unresolved review threads.