chore(hermes): upgrade Hermes Agent to v2026.7.20 - #7771
Merged
Conversation
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
ericksoa
added
dependencies
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis PR adds Hermes 0.19.0 release-audit tooling and upgrades NemoClaw’s Hermes configuration, wrapper compatibility, image build checks, cross-UID state handling, dashboard policy seeding, dependency pins, and SQLite persistence validation. ChangesHermes 0.19 upgrade
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Contributor
participant ReleaseCollector
participant HermesGit
participant DockerBuild
participant RuntimeTests
Contributor->>ReleaseCollector: provide release and tag-ref snapshots
ReleaseCollector->>HermesGit: verify tag identities and calculate ranges
Contributor->>DockerBuild: build pinned Hermes images
DockerBuild->>RuntimeTests: execute policy, state, and compatibility probes
RuntimeTests-->>Contributor: return migration and runtime validation results
Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-7771.docs.buildwithfern.com/nemoclaw |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 89bf4f1 in the TypeScript / code-coverage/cliThe overall coverage in commit 89bf4f1 in the Show a code coverage summary of the most impacted files.
Updated |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 7 optional E2E recommendations
This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (4)
.agents/skills/nemoclaw-contributor-update-hermes/scripts/collect-hermes-release-supplement.py (1)
335-357: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicate, less-hardened
gitsubprocess call — reuserun_git.The ancestry check re-implements a raw
subprocess.runwith a narrower environment (missingGIT_ATTR_NOSYSTEM,GIT_PAGER,GIT_TERMINAL_PROMPT) thanrun_gituses elsewhere in this same script. Sincerun_gitalready supportscheck=False, this call can be folded into it for consistent hardening and less duplication. Separately,zip(endpoints, endpoints[1:])is flagged by Ruff (B905/RUF007);itertools.pairwiseis the more idiomatic pairwise iterator here (notestrict=Truewould be wrong since the two sequences differ in length by design).The
subprocess-from-request/S603 static-analysis hints on this call and on line 213 are false positives: both use argv lists (no shell),git_executableis pre-validated, and tag values are constrained byCALVER_RE.♻️ Proposed refactor
+from itertools import pairwise + ranges: list[dict[str, Any]] = [] - for older, newer in zip(endpoints, endpoints[1:]): - ancestry = subprocess.run( - [ - git_executable, - "-C", - str(repo), - "merge-base", - "--is-ancestor", - older["commitSha"], - newer["commitSha"], - ], - check=False, - capture_output=True, - env={ - "GIT_CONFIG_GLOBAL": os.devnull, - "GIT_CONFIG_NOSYSTEM": "1", - "GIT_NO_LAZY_FETCH": "1", - "GIT_NO_REPLACE_OBJECTS": "1", - "LC_ALL": "C", - "PATH": os.defpath, - }, - timeout=COMMAND_TIMEOUT_SECONDS, - ) - if ancestry.returncode != 0: + for older, newer in pairwise(endpoints): + try: + run_git( + git_executable, + repo, + "merge-base", + "--is-ancestor", + older["commitSha"], + newer["commitSha"], + ) + except SupplementError: raise SupplementError( f"{older['tag']!r} is not an ancestor of {newer['tag']!r}" )🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/skills/nemoclaw-contributor-update-hermes/scripts/collect-hermes-release-supplement.py around lines 335 - 357, Replace the raw subprocess.run ancestry check in the endpoint iteration with the existing run_git helper, preserving check=False, timeout, and the current merge-base arguments. Import and use itertools.pairwise instead of zip(endpoints, endpoints[1:]) without strict mode, while leaving the existing subprocess safety suppressions unchanged where they address false positives.test/hermes-profile-policy-defaults.test.ts (1)
126-133: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd the established python3 availability gate.
test/hermes-wrapper-provider-merge.test.tsguards its python-dependent suite withdescribe.skipIf(!canRun)so a maintainer on macOS/Windows does not see a spurious red onnpm test. This suite shells out topython3unconditionally; when the interpreter is absent,spawnSyncreturnsstatus: nulland the assertion fails with an opaque message rather than skipping.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/hermes-profile-policy-defaults.test.ts` around lines 126 - 133, Update the “Hermes profile policy defaults” suite to use the established python3 availability gate, reusing the existing canRun detection pattern from the related test and applying describe.skipIf(!canRun) before the suite executes. Keep the current spawnSync behavior unchanged when python3 is available.test/hermes-light-skin-boundary.test.ts (1)
16-24: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winThe newly added
v2026.7.20entry is inert in both cases.The positive case still pins
v2026.7.1and the negative case pinsv2026.8.1, so neither test would fail ifv2026.7.20were dropped fromreviewedVersions. Since the shipped Dockerfile now pinsv2026.7.20, assert the pass path for that version.♻️ Suggested coverage for the newly reviewed version
- reviewedVersions: ["v2026.6.19", "v2026.7.1", "v2026.7.20"], + reviewedVersions: ["v2026.6.19", "v2026.7.1", "v2026.7.20"], + }), + ).toBeNull(); + expect( + checkHermesLightSkinBoundary({ + dockerfileText: dockerfileWithVersion("v2026.7.20"), + reviewedVersions: ["v2026.6.19", "v2026.7.1", "v2026.7.20"], }), ).toBeNull();🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/hermes-light-skin-boundary.test.ts` around lines 16 - 24, Update the positive test using checkHermesLightSkinBoundary to pin v2026.7.20 in its dockerfileText, so the test directly verifies the newly reviewed version passes. Keep the existing negative test for the unreviewed v2026.8.1 unchanged.test/hermes-dependency-review.test.ts (1)
72-76: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSubstring checks on production source stand in for behavioral coverage of the changed contracts. Both suites assert that a source file contains an identifier rather than that the changed behavior holds, so they pass even if the referenced code is unreachable, commented out, or semantically wrong.
test/hermes-dependency-review.test.ts#L72-L76: assert membership in the wrapper's parsed flag constants (as the Dockerfile AST gate does), or drop the case and rely ontest/hermes-wrapper-provider-merge.test.tsandtest/hermes-wrapper-oneshot-routing.test.ts.test/hermes-discord-recovery-permissions.test.ts#L184-L219: replace theos.fchown/os.fchmod/O_NOFOLLOWtoContainassertions with arunCrossUidParentRepairsuccess case that asserts the created directory ends up at mode2770.As per path instructions: "Prefer observable outcomes through the public boundary over source-text, private-shape, or mock-call assertions."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/hermes-dependency-review.test.ts` around lines 72 - 76, Replace the source-text substring assertions in test/hermes-dependency-review.test.ts:72-76 with an assertion that the wrapper’s parsed flag constants contain the expected entries, or remove this case if coverage is already provided by hermes-wrapper-provider-merge.test.ts and hermes-wrapper-oneshot-routing.test.ts. In test/hermes-discord-recovery-permissions.test.ts:184-219, replace the os.fchown, os.fchmod, and O_NOFOLLOW toContain checks with a successful runCrossUidParentRepair scenario that verifies the created directory has mode 2770.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@agents/hermes/Dockerfile.base`:
- Around line 440-455: Lower the python-multipart pin in the override from
0.0.32 to 0.0.31, including both package hashes and the version assertion in the
uv pip install block. Update the surrounding Hermes security rationale to
identify 0.0.31 as the first stable release addressing the stated GHSAs.
In `@agents/hermes/hermes-wrapper.py`:
- Around line 395-441: Add a Dockerfile build-time drift check for
_HERMES_SESSION_NAME_BOUNDARIES, comparing the wrapper’s set with the pinned
Hermes v0.19 reference used by the existing drift gate. Integrate it into the
current validation flow without changing the boundary set or the existing
subcommand and flag checks.
---
Nitpick comments:
In
@.agents/skills/nemoclaw-contributor-update-hermes/scripts/collect-hermes-release-supplement.py:
- Around line 335-357: Replace the raw subprocess.run ancestry check in the
endpoint iteration with the existing run_git helper, preserving check=False,
timeout, and the current merge-base arguments. Import and use itertools.pairwise
instead of zip(endpoints, endpoints[1:]) without strict mode, while leaving the
existing subprocess safety suppressions unchanged where they address false
positives.
In `@test/hermes-dependency-review.test.ts`:
- Around line 72-76: Replace the source-text substring assertions in
test/hermes-dependency-review.test.ts:72-76 with an assertion that the wrapper’s
parsed flag constants contain the expected entries, or remove this case if
coverage is already provided by hermes-wrapper-provider-merge.test.ts and
hermes-wrapper-oneshot-routing.test.ts. In
test/hermes-discord-recovery-permissions.test.ts:184-219, replace the os.fchown,
os.fchmod, and O_NOFOLLOW toContain checks with a successful
runCrossUidParentRepair scenario that verifies the created directory has mode
2770.
In `@test/hermes-light-skin-boundary.test.ts`:
- Around line 16-24: Update the positive test using checkHermesLightSkinBoundary
to pin v2026.7.20 in its dockerfileText, so the test directly verifies the newly
reviewed version passes. Keep the existing negative test for the unreviewed
v2026.8.1 unchanged.
In `@test/hermes-profile-policy-defaults.test.ts`:
- Around line 126-133: Update the “Hermes profile policy defaults” suite to use
the established python3 availability gate, reusing the existing canRun detection
pattern from the related test and applying describe.skipIf(!canRun) before the
suite executes. Keep the current spawnSync behavior unchanged when python3 is
available.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7f7149a2-7ebc-43e6-ac58-a7fd41ff3fd5
📒 Files selected for processing (35)
.agents/skills/nemoclaw-contributor-update-hermes/SKILL.md.agents/skills/nemoclaw-contributor-update-hermes/agents/openai.yaml.agents/skills/nemoclaw-contributor-update-hermes/references/hermes-contract-map.md.agents/skills/nemoclaw-contributor-update-hermes/scripts/collect-hermes-release-supplement.py.agents/skills/nemoclaw-skills-guide/SKILL.mdagents/hermes/Dockerfileagents/hermes/Dockerfile.baseagents/hermes/config/hermes-config.tsagents/hermes/hermes-wrapper.pyagents/hermes/manifest.yamlagents/hermes/patch-discord-recovery-permissions.pyagents/hermes/patch-langfuse-credentials.mtsagents/hermes/patch-profile-policy-defaults.pyagents/hermes/patch-session-list-preview.pyagents/hermes/seed-dashboard-config.pyagents/hermes/start.shdocs/security/hermes-0.19.0-dependency-review.mdsrc/lib/domain/sandbox/connect-env.test.tssrc/lib/domain/sandbox/connect-env.tssrc/lib/state/state-file-restore.tstest/generate-hermes-config.test.tstest/hermes-dependency-review.test.tstest/hermes-discord-recovery-permissions.test.tstest/hermes-doctor-config-hash.test.tstest/hermes-final-image-layout.test.tstest/hermes-light-skin-boundary.test.tstest/hermes-profile-policy-defaults.test.tstest/hermes-release-supplement.test.tstest/hermes-start.test.tstest/hermes-state-ledger-snapshot.test.tstest/hermes-upgrade-skill.test.tstest/hermes-wrapper-oneshot-routing.test.tstest/hermes-wrapper-provider-merge.test.tstest/seed-hermes-dashboard-config.test.tstest/snapshot.test.ts
💤 Files with no reviewable changes (1)
- test/snapshot.test.ts
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
agents/hermes/seed-dashboard-config.py (1)
537-544: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDocument the intentionally broad
except Exceptioncatches for the linter.Static analysis flags all four blind excepts (BLE001). Each is deliberately broad for a documented security reason (avoid interpolating credential-bearing parser/decoder context into stderr), which is the right call here — but without a
# noqa: BLE001explaining that, the linter will keep re-flagging these on every run.🧹 Example suppression
- except Exception: + except Exception: # noqa: BLE001 - avoid leaking parser context that may contain secretsAlso applies to: 606-612, 627-634, 660-668
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/seed-dashboard-config.py` around lines 537 - 544, Add an inline # noqa: BLE001 suppression to each of the four intentionally broad except Exception handlers, including the handler near the shown security log and those in the referenced sections. Preserve the existing credential-protective comments and error-handling behavior.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@agents/hermes/seed-dashboard-config.py`:
- Around line 537-544: Add an inline # noqa: BLE001 suppression to each of the
four intentionally broad except Exception handlers, including the handler near
the shown security log and those in the referenced sections. Preserve the
existing credential-protective comments and error-handling behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c6b631c1-f07b-425f-8344-ecb77a5e77c3
📒 Files selected for processing (11)
.agents/skills/nemoclaw-contributor-update-hermes/SKILL.md.agents/skills/nemoclaw-contributor-update-hermes/references/hermes-contract-map.mdagents/hermes/Dockerfileagents/hermes/seed-dashboard-config.pydocs/security/hermes-0.19.0-dependency-review.mdtest/hermes-light-skin-boundary.test.tstest/sandbox-provisioning.test.tstest/sandbox-rlimit-hooks.test.tstest/seed-hermes-dashboard-config.test.tstest/snapshot-stale-directory-restore.test.tstest/update-hermes-agent-script.test.ts
🚧 Files skipped from review as they are similar to previous changes (4)
- .agents/skills/nemoclaw-contributor-update-hermes/references/hermes-contract-map.md
- .agents/skills/nemoclaw-contributor-update-hermes/SKILL.md
- docs/security/hermes-0.19.0-dependency-review.md
- agents/hermes/Dockerfile
Contributor
Author
Exact-head security reviewPASS at head No upgrade-created exploitable vulnerability, credential exposure, command/path injection, authorization bypass, or container/root escape remains. This is safe to continue toward merge once exact-head CI, protected E2E, and required review pass. Fixed finding
Explicit residual dispositions
Security categories: secrets PASS; input validation PASS; authentication/authorization PASS; dependencies WARNING (accepted baseline); errors/logging PASS; cryptography PASS; configuration PASS; security testing PASS; system security WARNING (accepted bounded residuals). Base provenance also passes: trusted workflow run 30411365314 published amd64 and arm64 manifests under OCI index |
Contributor
Author
Ready for maintainer reviewExact head
The remaining branch-protection item is independent approval. Target landing remains Friday, July 31, 2026; please do not merge earlier. |
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Contributor
Exact-head differential security review — PASSReviewed base
Blocking findings: none.
Local evidence: selected-file hooks passed; 7 focused files / 99 tests passed; immutable |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
Author
Exact-head security review — PASSReviewed The Hermes 0.19 retarget preserves Direct upstream The Hermes-upgrade skill now requires a full pinned-tree search for explicit path consumers and forbids treating a helper-level image probe as complete relocation evidence. Integrity, focused patch/image tests, and skill validation pass. Security disposition: safe to merge once normal exact-head checks and the protected managed-restart E2E pass. This accepts the documented inherited residual only; it is not a waiver asserting broader direct-CLI support. |
jyaunches
approved these changes
Jul 29, 2026
This was referenced Jul 29, 2026
jyaunches
added a commit
that referenced
this pull request
Jul 30, 2026
<!-- markdownlint-disable MD041 --> ## Summary Hermes 0.19 introduced deterministic runtime regressions after `v0.0.97`: dashboard seed-marker drift, an unsupported blanket reasoning-effort request, and a mutable cron execution ledger inside the sealed cron job-definition directory. This change aligns the reviewed configuration contracts and relocates only mutable cron execution history into the writable runtime boundary while keeping cron job definitions sealed. The trusted exact-head E2E also exposed a stale Hermes MCP fixture: Hermes 0.19 names native MCP tools as `mcp__server__tool`, but the fixture still queried the Hermes 0.18 single-underscore name and accepted an echoed search query as a match. The fixture now uses the v0.19 name and requires an exact structural match before progressing. ## Changes - Require the current Hermes dashboard seed marker and omit the blanket reasoning-effort default from generated requests. - Patch the hash-pinned Hermes 0.19 execution ledger and quick-snapshot sources to use `runtime/cron-executions.db`. - Repair the writable `gateway` and `runtime` boundaries during restart while preserving `cron` as `root:sandbox` with mode `0755`. - Emit fixed, allowlisted startup diagnostics without exposing untrusted output. - Align the Hermes MCP fixture with the v0.19 `mcp__server__tool` name and fail closed unless discovery and schema responses structurally identify the exact deferred tool. - Add focused unit, integration, E2E-support, and live-E2E regression coverage for the post-tag failure paths. - Document the sealed cron definition boundary, runtime ledger, restore behavior, and exact-head Hermes dependency evidence. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop completed the repository nine-category review for exact head `8e0bbe24a` against base and merge base `d52d4599a`; all categories passed with no findings. The final delta is test-only and strengthens fail-closed MCP fixture validation. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/manage-sandboxes/backup-restore.mdx` documents the relocated cron ledger and named-profile snapshot limitation. `docs/security/hermes-0.19.0-dependency-review.md` documents the restart regression, protected `cron` directory, writable `runtime` boundary, and Hermes v0.19 `mcp__server__tool` naming. The final test-only delta aligns the fixture with that documented naming and requires an exact structural discovery match; no additional user-facing documentation is required. - Agent: Codex Desktop <!-- docs-review-head-sha: 8e0bbe2 --> <!-- docs-review-agents-blob-sha: c052d60 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable - Station profile/scenario: Not applicable - Result: Not applicable - Supporting evidence: Not applicable ## Trusted E2E Failure and Fix The approved trusted run for prior exact head `cdd62f906` passed Bedrock-compatible Anthropic with Hermes and both Hermes inference-switch scenarios, but failed [MCP bridge (Hermes)](https://github.com/NVIDIA/NemoClaw/actions/runs/30502554974/job/90745710062). This is a deterministic fixture regression, not a flake or production MCP failure. [PR #7771](#7771) upgraded Hermes to 0.19; upstream commit [`e01f58ff1`](NousResearch/hermes-agent@e01f58f) changed native MCP names to `mcp__server__tool`. The fixture retained `mcp_fake_fake_echo`, and its substring assertion mistook the echoed query for a discovery match before calling `tool_describe` with the nonexistent legacy name. Exact head `8e0bbe24a` corrects the tool name, requires `matches[].name` to equal the deferred name, validates the exact described schema, and adds an echoed-query-with-empty-matches regression test. A new exact-head trusted E2E verdict is required before merge. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: Focused Hermes suites passed 111 tests with 3 skips; the post-writing affected set passed 86 tests with 1 skip; startup passed 39 tests; MCP/E2E-support passed 57 tests; PR-risk/gate coverage passed 97 tests. On exact head `8e0bbe24a`, `npm exec -- vitest run test/mcp-bridge-servers.test.ts` passed all 10 tests after normal hooks; `npm run typecheck`, targeted Biome checks, `git diff --check`, and `npm run checks:repository` passed. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Exact-head GitHub CI is in progress. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — result: exact-head build completed with 0 errors and 2 existing Fern warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> --------- Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
23 tasks
cv
pushed a commit
that referenced
this pull request
Jul 30, 2026
<!-- markdownlint-disable MD041 --> ## Summary Add the canonical pre-tag release entry for NemoClaw v0.0.98. The dated entry records the user-visible changes merged after v0.0.97 and links each release theme to its published documentation. ## Changes - Add `docs/changelog/2026-07-29.mdx` with the exact `## v0.0.98` release heading. - Summarize Hermes 0.19, Deep Agents Code automation and skill safety, readiness diagnostics, lifecycle recovery, uninstall behavior, messaging conflicts, dependency hardening, and bounded diagnostics. - Use the parser-safe MDX SPDX comment and root-absolute routes for published OpenClaw, Hermes, and Deep Agents documentation. ### Source summary - [#7849](#7849) -> `docs/changelog/2026-07-29.mdx`: Record the Hermes 0.19 runtime migration repairs for cron state, dashboard seeding, and MCP naming. - [#7662](#7662) -> `docs/changelog/2026-07-29.mdx`: Record bounded gateway and Docker subprocess diagnostics. - [#7850](#7850) -> `docs/changelog/2026-07-29.mdx`: Record verified no-clobber Deep Agents Code skill installation. - [#7848](#7848) -> `docs/changelog/2026-07-29.mdx`: Record post-reboot delivery-chain recovery for visible OpenClaw sandboxes. - [#7831](#7831) -> `docs/changelog/2026-07-29.mdx`: Record OpenShell gateway-state preservation during uninstall. - [#7827](#7827) -> `docs/changelog/2026-07-29.mdx`: Record the removal of upstream test sources from published Hermes images. - [#7775](#7775) -> `docs/changelog/2026-07-29.mdx`: Record the blocking diagnostic for unsupported `DOCKER_HOST` values. - [#7833](#7833) -> `docs/changelog/2026-07-29.mdx`: Record reviewed Python dependency baselines for Hermes and Deep Agents Code images. - [#7771](#7771) -> `docs/changelog/2026-07-29.mdx`: Record the managed Hermes Agent 0.19.0 upgrade. - [#7811](#7811) -> `docs/changelog/2026-07-29.mdx`: Record fail-closed messaging channel conflict handling. - [#7797](#7797) -> `docs/changelog/2026-07-29.mdx`: Record the managed non-interactive Deep Agents Code JSON envelope. - [#7782](#7782) -> `docs/changelog/2026-07-29.mdx`: Record the storage-remediation readiness capability. - [#7784](#7784) -> `docs/changelog/2026-07-29.mdx`: Record the 120-second OpenShell readiness budget for sandbox recreation. - [#7810](#7810) -> `docs/changelog/2026-07-29.mdx`: Record rejection of stale Deep Agents Code security inventories. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: `test/changelog-docs.test.ts` validates the native changelog contract, including the version heading, MDX SPDX comment, and published routes. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/changelog/2026-07-29.mdx` was reviewed against `docs/CONTRIBUTING.md` and `WRITING.md` for release meaning, terminology, structure, voice, sentence form, MDX structure, published routes, and code-sample presentation. The changelog contract passed 6 tests. The docs build completed with 0 errors and 2 existing Fern warnings. - Agent: Codex CLI <!-- docs-review-head-sha: e3221d1 --> <!-- docs-review-agents-blob-sha: c052d60 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable. `scripts/prepare-dgx-station-host.sh` is unchanged. - Station profile/scenario: Not applicable. - Result: Not applicable. - Supporting evidence: Not applicable. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run test/changelog-docs.test.ts` passed 6 tests. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not run for this documentation-only change. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — The build completed with 0 errors and 2 existing Fern warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — Native changelog entries use the required parser-safe MDX SPDX comment and do not use frontmatter. --- Signed-off-by: San Dang <sdang@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added managed Hermes upgrades with verified releases, version reporting, and preserved configuration contracts. - Improved Deep Agents Code JSON output and skill installation behavior. - Added clearer Docker host and system readiness reporting. - Improved post-reboot delivery recovery and sandbox readiness timing. - **Bug Fixes** - Preserved gateway state when uninstalling with `--keep-openshell`. - Prevented conflicting messaging credentials from blocking onboarding and rebuilds. - Improved gateway diagnostics, dependency security, runtime filesystem protection, and evidence handling. - **Documentation** - Published the v0.0.98 release notes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This was referenced Jul 31, 2026
cv
pushed a commit
that referenced
this pull request
Aug 3, 2026
<!-- markdownlint-disable MD041 --> ## Summary `nemoclaw shields down` replaced the complete live OpenShell policy and dropped generated policy entries for registered Model Context Protocol (MCP) servers. This change reconciles only exact NemoClaw-managed MCP entries during Shields transitions, so a surviving server remains reachable while removed servers stay removed. Stacked on prerequisite #8130, which makes Shields deadline recovery serialize with lifecycle mutations without signaling the lock owner, this focused fix supersedes the MCP portion of #7980. ## Related Issue Fixes #7952 ## Changes - Prove managed MCP policy ownership from exact agreement between the sandbox registry, committed generated-policy record, and live gateway policy. - Save the owned MCP key manifest with the Shields snapshot, remove snapshot-time managed entries during restoration, and overlay only current exact entries. - Fail closed on ambiguous, stale, incomplete, malformed, or legacy ownership during manual transitions. At an expired deadline, omit unproven managed MCP entries and audit the omission instead of extending the Shields-down window. - Preserve current managed MCP entries when building the permissive runtime policy, while rejecting an unreadable or ambiguous live policy. - Clean staged runtime policy files across early failure paths. - Restore the Hermes live regression assertions at the actual failure boundary and around the unrelated server lifecycle. - Document MCP policy reconciliation for manual and automatic restoration. ## Failure Timing and Hermes Upgrade Context The original journey had a hidden Shields lifecycle between the first successful call to server A and the later lifecycle for server B: 1. Run `shields up`. 2. Restart the Hermes gateway. 3. Run `shields down`. 4. Exercise the configuration rollback path. 5. Add and remove B. 6. Call A. Boundary instrumentation recorded in #7952 showed that A remained healthy through Shields up and the gateway restart. It became unusable immediately after Shields down, which dropped A's generated MCP policy. The later failure after B was removed was only where the test noticed the already-broken route; B removal was a misleading correlation. This surfaced during the Hermes upgrade work because new coverage and upgrade repairs landed nearly back-to-back: - #7761 added the Hermes MCP helper containing Shields up, gateway restart, Shields down, and rollback. Its verification collected and imported the live target but did not run the complete live E2E. - #7771 upgraded Hermes the next day, but its selected E2Es skipped the `mcp-bridge` target. - #7849 repaired Hermes 0.19 migrations and updated MCP tool naming, allowing the live test to progress far enough to expose the later failure. - #7866 moved the explicit `mcp restart A` before the first post-removal call. Restart reapplied A's generated policy and masked the missing-policy state. The corrected regression order is: 1. Run `shields up`. 2. Restart the Hermes gateway. 3. Run `shields down`. 4. Call A immediately. 5. Exercise the configuration rollback path. 6. Add B, prove the DNS-rebinding connection is denied, remove B, and verify that A's managed policy is unchanged while B's policy is gone. 7. Call A before the later explicit restart. 8. Capture the authenticated rediscovery offset. 9. Run `mcp restart A` without resupplying the secret. 10. Call A and verify authenticated rediscovery. Whole-policy Shields replacement and the filesystem-only runtime merge predate the Hermes upgrade. This is a latent NemoClaw Shields policy-composition defect detected by expanded Hermes regression coverage, not a Hermes upgrade regression. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent exact-head Codex security review passed all nine categories at `18039569796d6ac7604de032edb7abf84f2c73c4`; no findings. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Reviewed `docs/manage-sandboxes/runtime-controls.mdx` and `docs/reference/commands.mdx`, all rendered guide variants, changed operator-facing text, comments, test titles, and the Hermes E2E chronology. Verified claims against source, issue #7952, and PRs #7761, #7771, #7849, and #7866. `npm run docs` completed with 0 errors and 2 existing Fern warnings. - Agent: Codex Desktop <!-- docs-review-head-sha: 1803956 --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable; `scripts/prepare-dgx-station-host.sh` is unchanged. - Station profile/scenario: Not applicable. - Result: Not applicable. - Supporting evidence: Not applicable. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: Focused CLI 123/123, integration 11/11, E2E support 13/13, `npm run typecheck:cli`, `npm run checks:repository`, test-size guardrail, E2E semantic phase plans, and serial `npm run test:changed` 674/674 passed. - [x] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: [Standard PR CI run 30824992396](https://github.com/NVIDIA/NemoClaw/actions/runs/30824992396) passed. One inherited 50 ms lifecycle-lock assertion timing flake passed on the failed-job rerun without a code change. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) `npm run docs` passed with 0 errors and 2 existing Fern warnings, so the warning-free checkbox remains unchecked. No new documentation pages were added. Trusted E2E [run 30826792180](https://github.com/NVIDIA/NemoClaw/actions/runs/30826792180) passed all 10 selected checks: cloud inference, cloud onboard, security posture, inference routing, MCP bridge, MCP bridge dev, network policy, onboard repair, onboard resume, and OpenShell credential-generation window. The primary review advisor reported no findings. Nemotron completed after retrying a protocol-only failure; its one test warning requested the exact transition/state ownership-mismatch deadline regression already present in `src/lib/shields/policy-transition.test.ts`, which passed. --- Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrade the Hermes sandbox from
v2026.7.1/0.18.0to the published stablev2026.7.20/0.19.0release with immutable source and package identity pins. Preserve NemoClaw's authorization, browser-evaluation, session-retention, output-disclosure, wrapper, and durable-state contracts across Hermes 0.19, and add a reusable Hermes-upgrade skill plus the audited dependency/security record.Target landing is Friday, July 31, 2026. Opening this PR does not authorize an earlier merge.
Changes
v2026.7.20annotated release (3ef6bbd201263d354fd83ec55b3c306ded2eb72a) and0.19.0package identity, including source archive, npm, and PyPI artifact identities. The audit coversv2026.7.1 -> v2026.7.7 -> v2026.7.7.2 -> v2026.7.20(2,399 commits), including the four-component CalVer release.console, preserve global profile selectors plus bare, named, and unquoted multi-word continue/resume forms, and reject resumed one-shot--usage-fileinstead of silently discarding its report. Focused tests bind the target parser/coalescer boundaries, and the final image compares the wrapper's private session-name boundary AST with the exact installed upstream coalescer.profilescapture.python-multipart==0.0.27resolution with attested, hash-pinned0.0.32, clearing its three advisories. The selected target graph introduces no advisory or license regression; reachable pre-existing Pillow and Starlette findings remain explicit baseline debt for security disposition.nemoclaw-contributor-update-hermes, its CalVer release supplement, contract map, regression tests, and the Hermes 0.19 dependency review so future upgrades repeat the release, configuration, wrapper, state, image-publication, and exact-head runtime checks.linux/amd64andlinux/arm64images in trusted workflow run 30411365314, then pin the verified OCI index:ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:c4aee5c9b087840da6e1eb2127fef9f4a2eab0862992008d1741dc09f632422e.Type of Change
Quality Gates
Documentation Writer Review
docs-updated.agents/skills/nemoclaw-contributor-update-hermes/SKILL.md,.agents/skills/nemoclaw-contributor-update-hermes/references/hermes-contract-map.md,.agents/skills/nemoclaw-skills-guide/SKILL.md, anddocs/security/hermes-0.19.0-dependency-review.mdadequately document the Hermes 0.19 migration, supported managed path, inherited residuals, and remaining runtime gates. The update-branch merge introduced no contributor-authored documentation change.DGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablev2026.7.20source patching passed while preserving_get_process_hermes_home(); test-title, source-shape, syntax, formatting, and skill validation passed.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: exact-head CI / Pull Request run 30463072807 passed, including all eight CLI shards and aggregate checks; E2E / PR Gate controller 30464094971 verified first-attempt child run 30464129619 with every selected E2E shard passing.npm run docsbuilds without warnings (doc changes only) — build completed with 0 errors and two unchanged environment/site-theme warnings.Signed-off-by: Aaron Erickson aerickson@nvidia.com
Signed-off-by: Julie Yaunches jyaunches@nvidia.com
Summary by CodeRabbit