fix(hermes): detect the renamed gateway entrypoint in status - #7885
Merged
prekshivyas merged 20 commits intoAug 1, 2026
Conversation
NemoClaw installs its wrapper as `/usr/local/bin/hermes` and moves the real Hermes entrypoint to `hermes.real`, so every managed gateway runs as `... /usr/local/bin/hermes.real gateway run`. Hermes only accepts an entry token whose basename is `hermes` or `hermes.exe`, and that check is the single gate in front of both ways it recognises its own gateway: the liveness re-check inside `get_running_pid()`, which discards an otherwise valid PID file, and the process-table fallback behind `find_gateway_pids()`. With both defeated, `hermes status` reported the Gateway Service as stopped while the foreground gateway was running and serving, which can push an operator or a health dashboard into rebuilding a healthy agent. Add the entry token to the allowlist through a pinned patch of the same module the sibling runtime-metadata patch already rewrites. The subcommand grammar around it is untouched, so a match still requires a real `gateway run` command line and no other process becomes visible as a gateway. NemoClaw's own supervisor already carried this compensation for the rename; Hermes did not. Relocating the real entrypoint instead was rejected: its path is pinned in 42 places across 13 files, including a trust-check byte literal in the MCP config transaction and the privileged managed-gateway controller. Fixes #7804 Signed-off-by: Yanyun Liao <yanyunl@nvidia.com>
yanyunl1991
added
area: cli
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughHermes image construction now stages and verifies a pinned gateway process identity patcher, applies it to gateway status detection, and validates renamed-entrypoint handling, command grammar, idempotency, and fail-closed behavior. ChangesHermes gateway identity
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant HermesDockerBuild
participant HermesPatcher
participant GatewayStatus
HermesDockerBuild->>HermesPatcher: verify pinned SHA256
HermesDockerBuild->>HermesPatcher: patch gateway/status.py
HermesPatcher->>GatewayStatus: update entry-token allowlist
HermesDockerBuild->>GatewayStatus: run gateway-process-identity probe
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 3f69c6b in the TypeScript / code-coverage/cliThe overall coverage in commit 3f69c6b in the Show a code coverage summary of the most impacted files.
Updated |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/hermes-gateway-process-identity-patch.test.ts (1)
18-92: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAvoid maintaining a copied gateway matcher in this test.
UPSTREAM_FIXTUREduplicates the parser and classification algorithm, so it can validate a stale approximation after upstream grammar changes. Keep this test focused on the patcher’s replacement/idempotence/fail-closed output; rely on the Dockerfile’s real-module probe for command-classification behavior.As per path instructions, “Flag copied production algorithms.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/hermes-gateway-process-identity-patch.test.ts` around lines 18 - 92, Remove the copied command parser and classification functions from UPSTREAM_FIXTURE, including _gateway_command_subcommand, looks_like_gateway_command_line, and looks_like_gateway_runtime_command_line. Keep the fixture limited to the upstream content needed to test replacement, idempotence, and fail-closed behavior, while retaining command-classification coverage through the Dockerfile’s real-module probe.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/hermes-gateway-process-identity-patch.test.ts`:
- Around line 18-92: Remove the copied command parser and classification
functions from UPSTREAM_FIXTURE, including _gateway_command_subcommand,
looks_like_gateway_command_line, and looks_like_gateway_runtime_command_line.
Keep the fixture limited to the upstream content needed to test replacement,
idempotence, and fail-closed behavior, while retaining command-classification
coverage through the Dockerfile’s real-module probe.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a2421a2c-379f-4d16-a3fd-fa47ea1e5efb
📒 Files selected for processing (4)
agents/hermes/Dockerfileagents/hermes/patch-gateway-process-identity.pytest/hermes-final-image-layout.test.tstest/hermes-gateway-process-identity-patch.test.ts
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
Contributor
PR Review Advisor — Blocking findings reportedAdvisor assessment: Blockers require maintainer review Model lanes
Second-opinion E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: Blockers
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL and the code-quality gate both flagged `DOCKERFILE` in `test/hermes-gateway-process-identity-patch.test.ts` as an unused variable. It is dead: this suite exercises the patcher against a source-shape fixture and never reads the Dockerfile. The Dockerfile's sha256 pin for this payload is already asserted in `test/hermes-final-image-layout.test.ts`, so using the constant here would duplicate that coverage rather than add any. Signed-off-by: Yanyun Liao <yanyunl@nvidia.com>
cjagwani
approved these changes
Jul 30, 2026
cjagwani
left a comment
cjagwani
left a comment
Collaborator
There was a problem hiding this comment.
Approved exact head 576006bec8405e15c61c3d22d862530f604726b3.
Security review: PASS. The image-time patch is SHA-pinned, idempotent, and fails closed on upstream source-shape drift. It widens only the existing entry-token allowlist to NemoClaw’s managed hermes.real basename; the upstream gateway run/restart grammar remains authoritative, and negative look-alike/subcommand cases are covered. The real installed module is probed during the image build.
All 52 exact-head checks are green, including x86/arm64 image builds, self-hosted sandbox/gateway tests, CodeQL, macOS/WSL E2E, and the protected E2E gate. DCO and both Verified commits pass; no unresolved major/critical findings remain. Stale-base-only failure is waived because GitHub reports MERGEABLE/conflict-free.
senthilr-nv
approved these changes
Jul 31, 2026
senthilr-nv
left a comment
senthilr-nv
left a comment
Collaborator
There was a problem hiding this comment.
Approved exact head dd5daee against base 57f73a5 after reviewing Files changed.
Product scope: PASS. This restores process detection in the existing Tested Hermes surface tracked by #7804 and adds no new integration, configuration, lifecycle, ownership, or compatibility contract.
The SHA-pinned patch is exact-shape and fail-closed, preserves Hermes’s gateway subcommand grammar, and covers renamed/upstream entrypoints, negative subcommands, look-alike basenames, idempotence, source drift, image placement, digest synchronization, and current-main integrity-pin classification.
I reviewed the exact-head security, documentation-writer, focused-test, hook, and automated-review evidence. No actionable finding remains. Merge still requires all exact-head/base CI and both E2E gates to pass.
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
…med-gateway-7804' into codex/pr7885-review-57f73a
Collaborator
|
Exact-state receipt: head
|
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (4)
test/hermes-image-build-probes.test.ts (1)
14-30: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAssert set equality between the runner commands and the Dockerfile invocations.
commandsis a hand-copied list. The two tests only prove that every listed command exists in the usage output and in the Dockerfile. A probe added toCOMMANDSinagents/hermes/image-build-probes.pybut never invoked by the Dockerfile still passes. Parse the command list from the usage output and compare it as a set againstcommands, so an unwired probe fails.As per path instructions for test files: prefer observable outcomes over duplication that can drift.
♻️ Proposed change
it("lists every Dockerfile probe command in the runner usage", () => { const result = spawnSync("python3", ["-I", probes], { encoding: "utf8", timeout: 5000, }); expect(result.status).toBe(1); - for (const command of commands) { - expect(result.stderr).toContain(command); - } + const listed = result.stderr + .split("\n") + .find((line) => line.startsWith("commands: ")) + ?.slice("commands: ".length) + .split(", ") + .map((entry) => entry.trim()); + expect(listed).toEqual([...commands]); });Also applies to: 47-57
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/hermes-image-build-probes.test.ts` around lines 14 - 30, Update the tests around the commands constant and usage-output assertions to parse the complete command list from the runner’s usage output, then compare it as a set with the Dockerfile-invoked commands. Ensure the assertions detect probes present in COMMANDS but missing from Dockerfile invocations, while preserving the existing validation that listed commands are wired correctly.Source: Path instructions
agents/hermes/image-build-probes.py (2)
323-326: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winTwo probe helpers spawn
chmodwhereos.chmodsuffices. Both backup probes shell out to set mode0660on the staged database copy. The shared root cause is the use ofsubprocess.runfor a mode change that the standard library performs directly, which also triggers the Ruff S603 and S607 findings at both lines.
agents/hermes/image-build-probes.py#L323-L326: inverify_cron_backup, replacesubprocess.run(["chmod", "0660", "--", str(staged)], check=True)withos.chmod(staged, 0o660)and drop the localimport subprocess.agents/hermes/image-build-probes.py#L385-L388: inverify_discord_backup, apply the same replacement and drop the localimport subprocess.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/image-build-probes.py` around lines 323 - 326, Replace the subprocess-based chmod calls with direct os.chmod(staged, 0o660) calls in verify_cron_backup and verify_discord_backup. Remove the now-unused local import subprocess in both agents/hermes/image-build-probes.py locations: lines 323-326 and 385-388.Source: Linters/SAST tools
107-124: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAssert the negative cases on the runtime matcher too, and cover the interleaved global option.
The probe checks the negatives only through
looks_like_gateway_command_line.looks_like_gateway_runtime_command_lineaccepts a wider subcommand set, so a widened entry-token allowlist could over-match on the runtime path and still pass this gate. The probe also omits two cases that only the copied fixture intest/hermes-gateway-process-identity-patch.test.tsproves: the run-vs-runtime split forgateway restart, and a global option placed before thegatewaytoken. The fixture cannot prove either against the real installed module.As per path instructions for
agents/**: "Require negative-path tests that prove the boundary rejects bypasses".♻️ Proposed additional assertions
assert looks_like_gateway_command_line(renamed) assert looks_like_gateway_runtime_command_line(renamed) assert _gateway_command_subcommand(renamed) == "run" - assert _gateway_command_subcommand( - "/opt/hermes/.venv/bin/python /usr/local/bin/hermes.real gateway restart" - ) == "restart" + restart = "/opt/hermes/.venv/bin/python /usr/local/bin/hermes.real gateway restart" + assert _gateway_command_subcommand(restart) == "restart" + assert not looks_like_gateway_command_line(restart) + assert looks_like_gateway_runtime_command_line(restart) + assert looks_like_gateway_command_line( + "/usr/local/bin/hermes.real --profile alpha gateway run" + ) assert looks_like_gateway_command_line(upstream) - assert not looks_like_gateway_command_line( - "/opt/hermes/.venv/bin/python /usr/local/bin/hermes.real gateway status" - ) - assert not looks_like_gateway_command_line( - "/opt/hermes/.venv/bin/python /usr/local/bin/hermes.real dashboard" - ) - assert not looks_like_gateway_command_line("python -m tui_gateway run") - assert not looks_like_gateway_command_line( - "/opt/hermes/.venv/bin/python /usr/local/bin/hermes.realish gateway run" - ) + for rejected in ( + "/opt/hermes/.venv/bin/python /usr/local/bin/hermes.real gateway status", + "/opt/hermes/.venv/bin/python /usr/local/bin/hermes.real dashboard", + "python -m tui_gateway run", + "/opt/hermes/.venv/bin/python /usr/local/bin/hermes.realish gateway run", + ): + assert not looks_like_gateway_command_line(rejected), rejected + assert not looks_like_gateway_runtime_command_line(rejected), rejected🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/image-build-probes.py` around lines 107 - 124, Extend the probe assertions around looks_like_gateway_command_line and looks_like_gateway_runtime_command_line to cover all negative cases on both matchers, including gateway restart being rejected by the run matcher but accepted by the runtime matcher. Add a case with a global option interleaved before the gateway token, and retain the existing status, dashboard, module, and hermes.realish bypass cases so the installed module’s entry-token boundary is exercised.Source: Path instructions
agents/hermes/Dockerfile (1)
321-325: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winAdd a combined patcher test.
The patchers modify disjoint regions, and either order produces the same result. Add a fixture test that applies both patchers to
gateway/status.pyand asserts that both changes remain present.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/Dockerfile` around lines 321 - 325, Add a fixture test for the patcher scripts that applies both gateway-process-identity and image-build-probes changes to gateway/status.py, exercising both application orders if supported, and asserts the resulting file retains both modifications. Use the existing patcher test conventions and symbols for the fixture and patch operations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@agents/hermes/Dockerfile`:
- Around line 321-325: Add a fixture test for the patcher scripts that applies
both gateway-process-identity and image-build-probes changes to
gateway/status.py, exercising both application orders if supported, and asserts
the resulting file retains both modifications. Use the existing patcher test
conventions and symbols for the fixture and patch operations.
In `@agents/hermes/image-build-probes.py`:
- Around line 323-326: Replace the subprocess-based chmod calls with direct
os.chmod(staged, 0o660) calls in verify_cron_backup and verify_discord_backup.
Remove the now-unused local import subprocess in both
agents/hermes/image-build-probes.py locations: lines 323-326 and 385-388.
- Around line 107-124: Extend the probe assertions around
looks_like_gateway_command_line and looks_like_gateway_runtime_command_line to
cover all negative cases on both matchers, including gateway restart being
rejected by the run matcher but accepted by the runtime matcher. Add a case with
a global option interleaved before the gateway token, and retain the existing
status, dashboard, module, and hermes.realish bypass cases so the installed
module’s entry-token boundary is exercised.
In `@test/hermes-image-build-probes.test.ts`:
- Around line 14-30: Update the tests around the commands constant and
usage-output assertions to parse the complete command list from the runner’s
usage output, then compare it as a set with the Dockerfile-invoked commands.
Ensure the assertions detect probes present in COMMANDS but missing from
Dockerfile invocations, while preserving the existing validation that listed
commands are wired correctly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6a3862fb-fe2d-4bc9-8531-efaeaed848e5
📒 Files selected for processing (5)
agents/hermes/Dockerfileagents/hermes/image-build-probes.pysrc/lib/onboard/managed-startup/profile.tstest/hermes-final-image-layout.test.tstest/hermes-image-build-probes.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- src/lib/onboard/managed-startup/profile.ts
- test/hermes-final-image-layout.test.ts
22 tasks
senthilr-nv
added a commit
that referenced
this pull request
Aug 4, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds the canonical dated `v0.0.101` changelog entry that was missing when the release tag was cut. This post-release recovery records the shipped behavior on current `main` without changing or replacing the existing tag. ## Changes - Add `docs/changelog/2026-08-03.mdx` with the exact `## v0.0.101` heading, release summary, detailed behavior changes, support boundaries, and links to durable documentation. - [#7317](#7317) -> `docs/changelog/2026-08-03.mdx`: Records experimental OpenClaw Google Chat support and its restricted credential and webhook boundary. - [#7715](#7715) -> `docs/changelog/2026-08-03.mdx`: Records strict onboarding recovery state and authoritative resume identity. - [#7749](#7749) -> `docs/changelog/2026-08-03.mdx`: Records the provider-neutral policy seam and unchanged runtime support boundary. - [#7817](#7817) -> `docs/changelog/2026-08-03.mdx`: Records preserved Hermes home-channel assignments across rebuilds. - [#7820](#7820) -> `docs/changelog/2026-08-03.mdx`: Records the SSH-session status field correction. - [#7847](#7847) -> `docs/changelog/2026-08-03.mdx`: Records fail-closed credential filtering for migration and rebuild backups. - [#7870](#7870) -> `docs/changelog/2026-08-03.mdx`: Records sandbox-qualified in-sandbox host command hints. - [#7875](#7875) -> `docs/changelog/2026-08-03.mdx`: Records Microsoft Teams stop and start E2E coverage. - [#7885](#7885) -> `docs/changelog/2026-08-03.mdx`: Records Hermes managed gateway detection in status. - [#7889](#7889) -> `docs/changelog/2026-08-03.mdx`: Records policy-authenticated HTTPS Pin Runtime route revocation. - [#7891](#7891) -> `docs/changelog/2026-08-03.mdx`: Records default fallback for negative timeout and polling overrides. - [#7993](#7993) -> `docs/changelog/2026-08-03.mdx`: Records correct sibling detection during uninstall. - [#7995](#7995) -> `docs/changelog/2026-08-03.mdx`: Records absent configuration-hash handling before shields lock. - [#8001](#8001) -> `docs/changelog/2026-08-03.mdx`: Records the dormant atomic managed workload replacement foundation. - [#8029](#8029) -> `docs/changelog/2026-08-03.mdx`: Records repository terminology review in PR Review Advisor. - [#8031](#8031) -> `docs/changelog/2026-08-03.mdx`: Records provider-neutral managed snapshot authority. - [#8032](#8032) -> `docs/changelog/2026-08-03.mdx`: Records immutable managed clone handoff contracts. - [#8034](#8034) -> `docs/changelog/2026-08-03.mdx`: Records the dormant provider-owned clone transaction surface. - [#8035](#8035) -> `docs/changelog/2026-08-03.mdx`: Records the dormant Hermes managed clone broker boundary. - [#8036](#8036) -> `docs/changelog/2026-08-03.mdx`: Records the dormant transactional managed bootstrap boundary. - [#8037](#8037) -> `docs/changelog/2026-08-03.mdx`: Records dormant Docker bootstrap primitives and the unchanged provider support boundary. - [#8070](#8070) -> `docs/changelog/2026-08-03.mdx`: Records consolidated sandbox resource-limit E2E coverage. - [#8071](#8071) -> `docs/changelog/2026-08-03.mdx`: Records escaped and bounded CLI validation diagnostics. - [#8081](#8081) -> `docs/changelog/2026-08-03.mdx`: Records bounded linear snapshot Base64 validation. - [#8085](#8085) -> `docs/changelog/2026-08-03.mdx`: Records commit-bound workflow approval for eligible same-repository maintainers. - [#8088](#8088) -> `docs/changelog/2026-08-03.mdx`: Records Hermes managed-policy E2E selection. - [#8090](#8090) -> `docs/changelog/2026-08-03.mdx`: Records pinned CI search-tool provisioning. - [#8106](#8106) -> `docs/changelog/2026-08-03.mdx`: Records fallback from failed managed OpenShell gateway startup. - [#8107](#8107) -> `docs/changelog/2026-08-03.mdx`: Records Hermes adapter lifecycle E2E selection. - [#8128](#8128) -> `docs/changelog/2026-08-03.mdx`: Records the dormant transactional Docker bootstrap adapter and rollback authority. - [#8140](#8140) -> `docs/changelog/2026-08-03.mdx`: Records Slack conflict scope across independent OpenShell gateways. - [#8147](#8147) -> `docs/changelog/2026-08-03.mdx`: Records completion of durable v0.0.100 documentation audit follow-ups. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: This documentation-only recovery does not change executable behavior. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Independently reviewed `docs/changelog/2026-08-03.mdx` at commit `0bebe1f568e3dc85cf410aac1dfb8f8830070b85`. Its blob is `82887920f9720eafd75db6b2271c35f7477edb9b`. The entry follows the writing guide, controlled terminology, changelog structure, MDX SPDX format, literal CLI-name rule, and root-absolute route requirements. It accurately records the `v0.0.100...v0.0.101` release range, Announcement #8162, accepted scope boundaries, and shipped security behavior. There are no code samples. Focused changelog tests and the documentation build pass for this commit. - Agent: Codex Desktop independent documentation writer <!-- docs-review-head-sha: 0bebe1f --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## Security Review - Result: `PASS` - Reviewed commit: `0bebe1f568e3dc85cf410aac1dfb8f8830070b85` - Base commit: `643a4ab8b5f583d8555192a37927268b26022c51` - Findings: None. - Secrets and credentials: `PASS`. No credential values or secret files are present. - Input validation and data sanitization: `PASS`. No executable input path changes. - Authentication and authorization: `PASS`. No identity or permission logic changes. - Dependencies and third-party libraries: `PASS`. No dependency changes. - Error handling and logging: `PASS`. No runtime path changes; diagnostic-security claims are precise. - Cryptography and data protection: `PASS`. No implementation changes. - Configuration and security controls: `PASS`. No configuration, container, port, or HTTP changes. - Security testing: `PASS`. No coverage is removed; the entry records shipped test and security behavior. - System security: `PASS`. No runtime control changes; dormant and non-activation boundaries are explicit. - Agent: Codex Desktop independent security reviewer ## Verification - [ ] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub — verification is pending after commit `0bebe1f568e3dc85cf410aac1dfb8f8830070b85` is pushed. - [ ] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable — commit hooks passed; pre-push is pending. - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — tests are not applicable to this documentation-only recovery. - [x] Applicable broad gate passed — not applicable to this documentation-only recovery. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, credentials, or private keys are added by this diff. - [ ] `npm run docs` builds without warnings (doc changes only) — GitHub documentation checks are pending. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) — independent documentation review passed. - [x] New doc pages include SPDX header and frontmatter (new pages only) — the native changelog entry uses the required parser-safe MDX SPDX comment and intentionally has no frontmatter. GitHub CI is authoritative. Focused changelog tests and `npm run docs` passed after the merge refresh. --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added experimental Google Chat support. * Improved runtime and session status visibility. * Added onboarding recovery and persistence safeguards. * Added snapshot validation and dormant managed-workload support. * **Bug Fixes** * Improved backup sanitization, route handling, and gateway reliability. * **Documentation** * Added the v0.0.101 changelog and related updates. * **Tests** * Expanded end-to-end coverage and strengthened trusted CI validation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Senthil Ravichandran <senthilr@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
hermes statusreported a running foreground gateway as stopped because NemoClaw renames the managed entrypoint tohermes.real, while Hermes recognized onlyhermesandhermes.exe. This change applies a SHA-pinned, exact-shape image patch that recognizes NemoClaw's managed basename without changing Hermes's gateway subcommand grammar.Related Issue
Closes #7804.
Changes
hermes.realto Hermes's gateway entry-token allowlist and fails on upstream source-shape drift.main.Type of Change
Quality Gates
504b365f2da5fcb8581edfba724e02686f30faa0; refer to the exact-head agent review evidence.Exact-State Evidence
504b365f2da5fcb8581edfba724e02686f30faa0.299050fc0563db0cd3a803298a6fb986dcfbb745fromupstream/main.504b365f2da5fcb8581edfba724e02686f30faa0preserves both signed canonical-base refresh9a42cffe6af5e4944207b3c5bb3badba15099171and concurrent GitHub Verified branch updatef1cfeb15a63ab6f529fe1883c1cc1bb919b0ea6c. Both parents have the same tree and integrate tested base299050fc0563db0cd3a803298a6fb986dcfbb745, so the push remains fast-forward and non-force.8c673831c0a48f3aed0f40efad1b4af64a0b5475routes the unchanged installed matcher assertions through current main's builder-independent Hermes probe runner. The complete seven-file diff has stable patch IDda20cca51b92f870fbe7fb713ed07bc4066bf01d.test(e2e): keep calibration ancestry durable (#8023)at299050fc0fixes the unrelated orphaned closed-PR calibration reference that failed the preceding required CLI shard. The refreshed calibration contract passes 14/14; no evidence from that failed head/base pair is reused.docs/reference/platform-support.mdx. It adds no integration, configuration, lifecycle, ownership, or compatibility surface.Documentation Writer Review
no-docs-neededgit diff --checkpassed.DGX Station Hardware Evidence
scripts/prepare-dgx-station-host.sh.Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailable504b365f2; the security specialist also passed 132/132 exact-head Hermes/image and managed profile contracts.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: Not applicable; the exact image patcher, checked-in probe runner, image-layout, and Docker input inventory contracts are covered by the focused suite and exact-head CI.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Yanyun Liao yanyunl@nvidia.com
Summary by CodeRabbit
Bug Fixes
Reliability