Hermes base image v2026.3.17 misses runtime patches and starts via systemctl

[mostlydev]

During the Tiverton House Allen Hermes Stage 1 rollout on 2026-04-28, the published base image ghcr.io/mostlydev/hermes-base:v2026.3.17 failed in two ways:

1. Default image command is hermes gateway start, which shells out to systemctl. The container does not include systemd/systemctl, so the agent restart-looped with:

FileNotFoundError: [Errno 2] No such file or directory: 'systemctl'

2. After overriding the command to foreground mode (CMD ["gateway", "run"]), Hermes gateway failed on import:

ModuleNotFoundError: No module named 'minisweagent_path'

Local inspection showed the published image has:

Entrypoint: ["/usr/bin/tini", "--", "hermes"]
Cmd: ["gateway", "start"]

and importlib.util.find_spec("minisweagent_path") returns None.

The clawdapus repo already has compatibility patch files under dockerfiles/hermes-base/, and Tiverton House carries equivalent files under images/hermes-base/. Applying those patch files during the Allen image build, plus CMD ["gateway", "run"], fixed the paper pod rollout: Allen came up healthy, hermes gateway status reported foreground mode, and the live smoke test completed with a cllama-managed perplexity.search tool call.

Expected fix:

• Rebuild/publish ghcr.io/mostlydev/hermes-base:v2026.3.17 or a new pinned tag with minisweagent_path.py and the Hermes runtime patches applied.
• Make the container default command foreground gateway mode (gateway run) or have Clawdapus emit/override that command for Hermes services.
• Add a release verification that starts a Hermes service container and imports tools.terminal_tool successfully.

Workaround currently used in Tiverton House Stage 1:

COPY images/hermes-base/minisweagent_path.py /tmp/minisweagent_path.py
COPY images/hermes-base/patch-hermes-runtime.py /tmp/patch-hermes-runtime.py
RUN python /tmp/patch-hermes-runtime.py \
    && rm /tmp/minisweagent_path.py /tmp/patch-hermes-runtime.py

CMD ["gateway", "run"]