Skip to content

fix(hermes): reset health streak after recovery (Fixes #7671) - #7894

Open
deepujain wants to merge 7 commits into
NVIDIA:mainfrom
deepujain:fix/7671-hermes-health-streak-reset
Open

fix(hermes): reset health streak after recovery (Fixes #7671)#7894
deepujain wants to merge 7 commits into
NVIDIA:mainfrom
deepujain:fix/7671-hermes-health-streak-reset

Conversation

@deepujain

@deepujain deepujain commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Hermes keeps its consecutive health-failure count after a successful gateway recovery. As a result, the replacement gateway can be stopped after its first transient failed probe. Reset the count after recovery so every replacement receives the intended four-probe failure budget.

Related Issue

Fixes #7671

Changes

  • Reset the Hermes supervisor health-failure streak after recover_hermes_gateway_current_user succeeds.
  • Add a runtime shell-harness regression test that drives the production supervisor through four failures, recovery, one transient replacement failure, and a healthy follow-up probe.

Current main already covers the other two failure modes from #7671:
recover_hermes_gateway_current_user prepares and launches the replacement
under the existing sandbox service identity, and
record_hermes_managed_gateway_exit quarantines relaunch after five exits in
60 seconds. This PR fixes the remaining stale probe state that could keep
feeding that recovery loop.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: This corrects internal supervisor state handling without changing commands, configuration, or documented recovery behavior.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop reviewed the exact-PID stop boundary, recovery success condition, crash quarantine accounting, and same-user relaunch path. The change only resets probe state after a successful managed recovery.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

  • Documentation writer subagent reviewed the completed changes
  • Result: no-docs-needed
  • Evidence: No documentation paths changed. Commands, configuration, and user-facing recovery semantics remain unchanged.
  • Agent: Codex Desktop

DGX Station Hardware Evidence

  • Tested on DGX Station
  • Tested commit: Not applicable
  • Station profile/scenario: Not applicable
  • Result: Not applicable
  • Supporting evidence: Not applicable

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/hermes-gateway-supervisor-recovery.test.ts (45/45); related Hermes recovery neighborhood (92/92)
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Deepak Jain deepujain@gmail.com

Summary by CodeRabbit

  • Bug Fixes

    • Reset the gateway supervisor’s unhealthy streak after recovery, giving the relaunched gateway a fresh health-failure allowance.
    • Prevented previous health-failure counts from carrying over to recovered gateways.
    • Improved gateway stability by avoiding premature shutdowns after a successful recovery.
  • Tests

    • Added coverage confirming recovered gateways report failures against the correct reset budget and remain active when within the allowed threshold.

@copy-pr-bot

copy-pr-bot Bot commented Jul 30, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The Hermes gateway supervisor now resets its consecutive health-failure counter after recovering a relaunched gateway. A regression test verifies that the recovered gateway receives a fresh failure budget and remains active.

Changes

Hermes gateway recovery

Layer / File(s) Summary
Reset recovery health budget
agents/hermes/start.sh, test/hermes-gateway-supervisor-recovery.test.ts
The supervisor resets unhealthy_streak after recovery. The test verifies that the new PID starts at (1/4), avoids (5/4), and is not stopped.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#7869: Both PRs modify Hermes gateway supervisor recovery behavior and health-failure handling.
  • NVIDIA/NemoClaw#7972: Both PRs modify managed Hermes gateway recovery and supervisor health-failure handling.

Suggested reviewers: cv, sandl99

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly states that the Hermes health streak is reset after recovery.
Linked Issues check ✅ Passed The change addresses issue #7671 by restoring the full consecutive-failure budget after successful gateway recovery.
Out of Scope Changes check ✅ Passed The shell change and regression test directly support the linked issue and PR objective.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Informational

Advisor assessment: Informational / low confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: Same-session synthesis validation failed; the advisor result is incomplete.

Model lanes

  • GPT-5.6 Terra (primary): Completed · low confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections match; severity counts match.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

1 semantic terminology decision

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

  • define — health-failure budget at test/hermes-gateway-supervisor-recovery.test.ts:685: Keep the term in this test title. Its modifier distinguishes the per-gateway health-validation allowance from crash-exit quarantine accounting.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: full-e2e, hermes-e2e, hermes-inference-switch, managed-image-multiarch-startup, security-posture, bedrock-runtime-compatible-anthropic, channels-stop-start, dashboard-remote-bind, hermes-shields-config

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

@deepujain
deepujain force-pushed the fix/7671-hermes-health-streak-reset branch from 757a8f4 to 61f641e Compare July 30, 2026 15:25
@deepujain

Copy link
Copy Markdown
Contributor Author

Rebased onto current main. Focused tests and npm run validate:pr pass; all commits remain verified.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/hermes-gateway-supervisor-recovery.test.ts`:
- Around line 721-722: Strengthen the assertions around the recovered gateway’s
health-validation failures so they verify the exact ordered failure sequence,
including "(1/4)" occurring again after recovery. Update the test using the
existing result.stderr assertions, while preserving the check that no "(5/4)"
value is emitted.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0abb2342-0e7f-46a3-a9cf-542e88d88a92

📥 Commits

Reviewing files that changed from the base of the PR and between 757a8f4 and 61f641e.

📒 Files selected for processing (2)
  • agents/hermes/start.sh
  • test/hermes-gateway-supervisor-recovery.test.ts

Comment thread test/hermes-gateway-supervisor-recovery.test.ts Outdated
@deepujain
deepujain force-pushed the fix/7671-hermes-health-streak-reset branch from 61f641e to 55774d0 Compare July 31, 2026 06:11
@wscurran wscurran added area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery bug-fix PR fixes a bug or regression integration: hermes Hermes integration behavior labels Jul 31, 2026
@wscurran

Copy link
Copy Markdown
Contributor

✨ Thanks for the PR. This fixes the Hermes health-streak reset after gateway recovery so replacement gateways receive the full four-probe failure budget. Maintainers will review the streak reset logic and the shell-harness regression test.


Related open issues:


Related open issues:

@apurvvkumaria apurvvkumaria left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approve — reviewed exact head 55774d0. Resetting unhealthy_streak only after successful managed recovery gives the replacement gateway the intended fresh four-probe budget without weakening exact-PID stopping or relaunch quarantine. The runtime shell harness proves the ordered failure sequence, recovery, replacement transient failure, healthy follow-up, and absence of a replacement stop. No blocking defect found. The recorded E2E gate failure was a coordination timeout, not a product/test failure attributable to this diff.

Signed-off-by: Deepak Jain <deepujain@gmail.com>
Signed-off-by: Deepak Jain <deepujain@gmail.com>
@deepujain
deepujain force-pushed the fix/7671-hermes-health-streak-reset branch from 55774d0 to 1ac7dd4 Compare August 4, 2026 07:49
@deepujain

Copy link
Copy Markdown
Contributor Author

Rebased on current main. The 45 recovery tests and full PR validation pass, and both commits are verified. @coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

@deepujain I will review the rebased changes and the Hermes recovery regression test.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@deepujain

Copy link
Copy Markdown
Contributor Author

Synced with latest main. All 45 recovery tests and PR validation pass; CI is rerunning.

@deepujain

Copy link
Copy Markdown
Contributor Author

Synced with current main while preserving the approved history. CodeRabbit is clean; E2E and advisor checks are rerunning.

@deepujain

Copy link
Copy Markdown
Contributor Author

Synced with today's main. CodeRabbit and fast gates pass; advisors and E2E are still running.

@deepujain

Copy link
Copy Markdown
Contributor Author

Synced with current main. All commits remain verified, approval and CodeRabbit are intact, and fresh advisor and E2E checks are running.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery bug-fix PR fixes a bug or regression integration: hermes Hermes integration behavior

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Hermes][Auto-heal] Transient health-check failure stops healthy gateway; restart loops on config permission error

4 participants