fix(hermes): refresh sandbox base digest

[prekshivyas]

Summary

Refresh the Hermes sandbox base pin to the validated multi-platform image produced from the current main source. The previous immutable index still contained libexpat1==2.8.2-1, so every Hermes final-image verification job failed deterministically when it required 2.8.3-1.

Changes

• Pin agents/hermes/Dockerfile to OCI index sha256:4295138e..., whose amd64 and arm64 manifests both contain libexpat1==2.8.3-1.
• Record the exact producer run, source revision, platform manifests, and SLSA attestations in the Hermes dependency review.
• Keep the fix to the immutable input update; no retry, fallback, or new abstraction is added.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: the changed-file integration selection validates the managed base-image and Hermes build contracts; the registry manifests and final-image history independently prove the exact package version on both architectures.
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review verified the immutable OCI index, both platform manifests and labels, both SLSA subjects and builder IDs, and the checksum-pinned libexpat1==2.8.3-1 install/runtime assertions. The change does not alter credential, policy, or runtime privilege boundaries.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: docs/security/hermes-0.19.0-dependency-review.md
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable; DGX Station preparation scripts are unchanged.
• Station profile/scenario: Not applicable.
• Result: Not applicable.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npm run test:changed passed 2 files and 30 tests; OCI inspection confirmed libexpat1==2.8.3-1 on amd64 and arm64.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not applicable to an immutable base digest and provenance-only update.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: prekshivyas prekshiv@nvidia.com

Summary by CodeRabbit

• Security
  • Updated the Hermes sandbox base image to a newer immutable revision.
  • Incorporated the latest reviewed security updates, including an updated system library version.
  • Refreshed provenance and verification records for the sandbox image.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3cadb570-bef7-4d27-acdc-261704f6f9e4

📥 Commits

Reviewing files that changed from the base of the PR and between e058d7d and 0ee493d.

📒 Files selected for processing (1)

• src/lib/agent/base-image-hermes.test.ts

---

📝 Walkthrough

Walkthrough

The Hermes Dockerfile and provisioning test now use a new immutable sandbox base image digest. The security review records the image publication, provenance, platform manifests, attestations, and libexpat1==2.8.3-1 contents.

Changes

Hermes base image refresh

Layer / File(s)	Summary
Update Hermes image pin and validation agents/hermes/Dockerfile, src/lib/agent/base-image-hermes.test.ts	The default BASE_IMAGE digest and its provisioning contract test expectation now use the updated Hermes sandbox base image revision.
Refresh provenance record docs/security/hermes-0.19.0-dependency-review.md	The dependency review records the new workflow run, source commit, OCI index, platform manifests, SLSA attestations, publication evidence, and libexpat1==2.8.3-1 update.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Mergeability Score: ⚪ Minimal · up to 0ee49

The PR refreshes the Hermes sandbox base-image digest and documents the validated dependency provenance without changing runtime privileges or fallback behavior. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: sandl99, ericksoa, cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the refreshed Hermes sandbox base image digest, which is the main change.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/fix-hermes-base-pin

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit b3b3e39 in the agent/fix-hermes-bas... branch remains at 96%, unchanged from commit 9584e94 in the main branch.

---

_{Updated August 12, 2026 22:45 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-8928.docs.buildwithfern.com/nemoclaw

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/security/hermes-0.19.0-dependency-review.md`:
- Line 333: Update the selected patched-image publication reference on the
HERMES-12 provenance record to run 31636995117, while retaining run 31031662054
only as superseded historical context. Ensure the referenced publication details
remain consistent with the latest selected OCI index.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 92ca747b-355b-45ff-b910-17aa21e99db4

📥 Commits

Reviewing files that changed from the base of the PR and between 7c721ae and 7bfbda8.

📒 Files selected for processing (2)

• agents/hermes/Dockerfile
• docs/security/hermes-0.19.0-dependency-review.md

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions match; normalized E2E selections differ; severity counts match.

6 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• rebuild-hermes: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• rebuild-hermes-stale-base: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• hermes-discord: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• hermes-slack: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• hermes-gpu-startup: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• whatsapp-qr-compact: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: cloud-onboard, full-e2e, hermes-e2e, hermes-inference-switch, managed-image-multiarch-startup, security-posture
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

lgtm when ready