fix(hermes): omit upstream tests from base image

[senthilr-nv]

Summary

The Hermes base image previously retained upstream test sources, including
intentionally hostile URL fixtures that are not used at runtime.
This removes those tests in the archive extraction layer so their bytes do not
enter the published image and fails both base and production builds if the test
tree is present.

Changes

• Remove the upstream tests tree in the same layer that extracts the
  checksum-verified Hermes archive.
• Gate the completed base filesystem against an upstream test-tree leak.
• Exercise the extraction layer with a synthetic checksum-verified archive.
• Verify the production image does not contain upstream tests in the Hermes
  root-entrypoint smoke.
• Pin the production Hermes image to the immutable multi-platform base
  published from the reviewed source head.
• Gate the completed production filesystem against /opt/hermes/tests.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This removes build-only upstream
  sources and adds image invariants without changing a user-visible command,
  configuration, API, policy, or supported runtime behavior.
• Sensitive paths changed (security, policy, credentials, preflight,
  onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver
  recorded — reviewer/approval link/justification: The nine-category security
  review of exact head 6cb586da5 passed with no findings. The diff adds no
  credential, input, authorization, dependency, cryptographic, logging, or
  privilege surface. It preserves checksum verification and main's reviewed
  Hermes dependency patch while strengthening image-content checks.
• Non-success, skipped, or missing CI check accepted by maintainer —
  check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Exact head 6cb586da5 changes Hermes image contents and associated
  regression and E2E coverage. It does not change a user-visible command,
  output, configuration, API, UI, workflow, default, error contract, or
  supported product behavior. The changed comments, test title, check messages,
  and E2E descriptions follow the writing guide and controlled word list.
  Focused integration tests passed 26/26, and npm run check:diff passed.
• Agent: Codex Desktop /root/documentation_writer_review_refresh

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: not applicable
• Station profile/scenario: not applicable
• Result: not applicable; scripts/prepare-dgx-station-host.sh is unchanged.
• Supporting evidence: not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears
  as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or
  npm run check:diff passed when hooks were skipped or unavailable — normal
  commit hooks and npm run check:diff passed on exact head 6cb586da5.
• Targeted behavior tests pass for the current change set, or tests are
  marked not applicable above — npm exec -- vitest run --project integration test/hermes-final-image-layout.test.ts test/hermes-share-mount-deps.test.ts test/hermes-dependency-review.test.ts passed 26/26.
• Applicable broad gate passed — trusted
  Base Images run
  published both linux/amd64 and linux/arm64 from exact source head
  b1f101d6d5e857ac564fca052727727d83f89443.
  The immutable OCI index is
  sha256:61feb0e33fae77ad2fcd1ae3aca2d6c484d7ef2c6ed8ebd431d3e514eab6cf2b;
  platform manifests are
  sha256:2d0ea5ead021986dd2ff7f4d7379dc685d1c9acecf3cde7a20cb4137d60f225a
  (linux/amd64) and
  sha256:e3798f541afd5e661cfb6aa844d636cd76e102a3b07ff659c8906411c9be5941
  (linux/arm64).
  A native arm64 production build from that exact index completed all 64
  BuildKit steps and runtime inspection confirmed /opt/hermes/tests is
  absent and Hermes reports version 0.19.0.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style
  guide
  (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com
Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Hermes runtime and final images no longer include upstream test artifacts or other build-only leftovers.
  • Added/strengthened image integrity checks to fail the build if build-only Hermes test paths are detected.

• Tests

  • Updated end-to-end smoke and final image layout validations to assert absence of /opt/hermes/tests and related leaked build-only paths.
  • Added Hermes archive-layer coverage to verify correct package contents (including version) and that extracted tests are removed, using sandboxed stubs to exercise patch handling safely.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 93b1f00d-6ffb-44fd-87fe-7225df8ef0ca

📥 Commits

Reviewing files that changed from the base of the PR and between e980f2a and 6cb586d.

📒 Files selected for processing (2)

• agents/hermes/Dockerfile.base
• test/hermes-share-mount-deps.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• agents/hermes/Dockerfile.base

---

📝 Walkthrough

Walkthrough

The Hermes base image removes upstream test fixtures during archive extraction and checks their absence in base-image scans, final-image gates, and runtime smoke tests. A parity test executes the extraction layer against a local archive and verifies package metadata and test-directory removal.

Changes

Hermes packaging validation

Layer / File(s)	Summary
Archive extraction cleanup agents/hermes/Dockerfile.base	The Hermes archive extraction removes /opt/hermes/tests, and the image scan checks it with the existing root cache paths.
Runtime image integrity gates agents/hermes/Dockerfile, test/hermes-final-image-layout.test.ts	The final image uses an updated base-image digest and asserts that /opt/hermes/tests and other build-only Hermes paths are absent.
Runtime image assertions test/e2e/live/hermes-root-entrypoint-smoke.test.ts	The clean runtime smoke flow checks upstream tests and root cache directories, with updated assertion names and contract text.
Archive-layer parity test test/hermes-share-mount-deps.test.ts	The test executes the Dockerfile extraction layer against a local tarball, verifies the package version, and asserts that the extracted tests directory is absent.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7622: Updates Hermes final-image layout assertions and payload-layer handling related to the Dockerfile image structure.

Suggested labels: area: sandbox, area: ci

Suggested reviewers: jyaunches

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: removing upstream Hermes tests from the base image.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, full-e2e, hermes-e2e, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Major blocker on exact head b1f101d: the cleaned Hermes base is not wired into the production image. This PR updates agents/hermes/Dockerfile.base, but agents/hermes/Dockerfile remains pinned to the pre-existing hermes-sandbox-base@sha256:c4aee5… digest. The resolver intentionally tries that tracked immutable digest before the branch-SHA and latest candidates, so normal production builds continue using the old base containing /opt/hermes/tests. The new smoke does not catch this because it builds Dockerfile.base locally and explicitly overrides BASE_IMAGE. Please publish the exact-head base for both linux/amd64 and linux/arm64, resolve its immutable multi-platform digest, update the final Dockerfile pin, then build and inspect the production image from that exact digest and let the exact-head gates settle. I found no other major correctness or security blockers.

[senthilr-nv]

Addressed in e980f2a936b640dee83b67e27e0dfde62c775eea.

• Published the exact reviewed source head b1f101d6d5e857ac564fca052727727d83f89443 for both linux/amd64 and linux/arm64 in Base Images run 30471832712.
• Resolved and pinned the production Dockerfile to immutable multi-platform index sha256:61feb0e33fae77ad2fcd1ae3aca2d6c484d7ef2c6ed8ebd431d3e514eab6cf2b.
• Verified platform manifests sha256:2d0ea5ead021986dd2ff7f4d7379dc685d1c9acecf3cde7a20cb4137d60f225a (linux/amd64) and sha256:e3798f541afd5e661cfb6aa844d636cd76e102a3b07ff659c8906411c9be5941 (linux/arm64).
• Built the production image natively on arm64 from that exact index.
  All 64 BuildKit steps passed, runtime inspection confirmed /opt/hermes/tests is absent, and Hermes reports version 0.19.0.
• Added a production-image absence gate for /opt/hermes/tests.
  Focused layout and extraction tests pass 22/22.

The new exact-head CI is now running.

[coderabbitai]

🧹 Nitpick comments (1)

test/hermes-final-image-layout.test.ts (1)

338-338: 🎯 Functional Correctness | 🔵 Trivial | 🏗️ Heavy lift

Prefer a behavior-oriented assertion.

This only checks for an exact Dockerfile substring, so it can pass without proving /opt/hermes/tests is absent from the final image and is brittle to formatting changes. Assert the built-image or parity-test outcome instead; retain this text check only as supplementary wiring coverage.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/hermes-final-image-layout.test.ts` at line 338, Update the assertion
around finalStage to verify the built image or parity-test behavior that
/opt/hermes/tests is absent from the final image, rather than relying solely on
the exact Dockerfile substring. Keep the existing text assertion only as
supplementary wiring coverage if needed.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/hermes-final-image-layout.test.ts`:
- Line 338: Update the assertion around finalStage to verify the built image or
parity-test behavior that /opt/hermes/tests is absent from the final image,
rather than relying solely on the exact Dockerfile substring. Keep the existing
text assertion only as supplementary wiring coverage if needed.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cd5c26f3-0fe9-41f5-aeea-d36de24b093a

📥 Commits

Reviewing files that changed from the base of the PR and between b1f101d and e980f2a.

📒 Files selected for processing (2)

• agents/hermes/Dockerfile
• test/hermes-final-image-layout.test.ts