fix(hermes): pin patched base image and check installed dependencies

[sandl99]

Summary

Some Hermes sandbox image build paths could install versions of aiohttp or cryptography that differed from the reviewed versions after messaging package installation.
This change pins the reviewed Hermes base image OCI index and checks the installed versions after each messaging installation path.
A live E2E check reads both versions from the running Hermes sandbox.

Related Issue

Fixes #8328

Changes

• Pin agents/hermes/Dockerfile to Hermes base image OCI index sha256:57c091ab9b31c924eac0050e66c834c37df875154a254964302a31b119b50b96.
• Require aiohttp==3.14.3 and cryptography==50.0.0 after messaging package installation when NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION is 0 or 1.
• Keep the installed-version check after the last package mutation and run it in Python isolated mode.
• Extend source tests for the OCI digest, check order, previous-version rejection, and corporate CA installation layer.
• Add a live Hermes E2E assertion for both installed versions.
• Update docs/security/hermes-0.19.0-dependency-review.md with base image provenance, installed-version evidence, and the missing SBOM attestation.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: An independent nine-category review found no findings for PR commit 03718ce6cca2e4455a23abd6f2e2a754243f3ae7 against base SHA bf429e90e5b217632356e2d918bfc333e5b8e959.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: No waiver is recorded.

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: Updated documentation path: docs/security/hermes-0.19.0-dependency-review.md. Reviewed the complete PR diff, including agents/hermes/Dockerfile, the source tests, the live Hermes E2E assertion, and the dependency review, for PR commit 03718ce6cca2e4455a23abd6f2e2a754243f3ae7 against base SHA bf429e90e5b217632356e2d918bfc333e5b8e959. The documentation distinguishes the published base image from the Hermes sandbox image. It records the workflow run, source commit, OCI digest, installed-version checks, missing SBOM attestation, and remaining protected gates. The review covered terminology, structure, voice, claim scope, evidence separation, and code-sample presentation; no code sample changed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable; scripts/prepare-dgx-station-host.sh does not change.
• Station profile/scenario: Not applicable.
• Result: Not applicable.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub — all 25 commits appear as Verified.
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable — normal hooks passed for the change set and current-main refresh commits.
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — GitHub Actions and the protected Hermes E2E gate are running for PR commit 03718ce6cca2e4455a23abd6f2e2a754243f3ae7. No standalone local test suite ran after the merge.
• Applicable broad gate passed — required checks are not complete for the current PR commit.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed — the independent security review passed all nine categories.
• npm run docs builds without warnings (doc changes only) — GitHub Actions documentation validation is not complete for the current PR commit.
• Doc pages follow the style guide (doc changes only) — the independent documentation writer review passed.
• New doc pages include SPDX header and frontmatter (new pages only) — not applicable; no new page.

Base Image Provenance

The pinned Hermes base image has this identity:

• Producer: Images / Base Images run 31006872948, attempt 1.
• Source commit: bd668121e918e7b1dda13062bed728f18150360e.
• OCI index: sha256:57c091ab9b31c924eac0050e66c834c37df875154a254964302a31b119b50b96.
• amd64 manifest: sha256:cf6e95640faac8e5099cc9d267a6eb9b1f9192abbfcc9552a81a8ae22b4a47bb.
• arm64 manifest: sha256:92e7c982bc5106f4c3f551032418fb72375b4d37bff50e21baa3d0e861d7519e.

Each platform image identifies repository NVIDIA/NemoClaw and source commit bd668121e918e7b1dda13062bed728f18150360e.
Each platform image has SLSA provenance tied to the producer run and source commit.
The OCI index has no SBOM attestation.

Sensitive-Path Security Review

Independent review found no security finding for PR commit 03718ce6cca2e4455a23abd6f2e2a754243f3ae7 against base SHA bf429e90e5b217632356e2d918bfc333e5b8e959.

1. Secrets and credentials: PASS. No secret material changes. Runtime output contains package names and versions only.
2. Input validation and data sanitization: PASS. The checks use fixed package identifiers, fixed expected versions, and Python isolated mode.
3. Authentication and authorization: PASS. No authentication, permission, or policy boundary changes.
4. Dependencies and third-party libraries: PASS. The base image uses an immutable OCI digest, exact installed versions, reviewed dependency inputs, and recorded provenance. The missing SBOM attestation is explicit.
5. Error handling and logging: PASS. A version mismatch stops the image build without exposing credentials or personal data.
6. Cryptography and data protection: PASS. The change advances cryptography to the reviewed version and adds no custom cryptography or protected-data handling.
7. Configuration and security headers: PASS. No port, CORS, header, capability, privilege, or sandbox-user setting is relaxed.
8. Security testing: PASS. Source tests protect the digest and check placement, and the live E2E reads both versions from the running Hermes sandbox.
9. System security: PASS. The check follows each relevant package mutation and does not weaken sandbox controls.

Required checks and maintainer approval remain separate merge requirements.

GitHub Actions

GitHub Actions is authoritative for PR commit 03718ce6cca2e4455a23abd6f2e2a754243f3ae7 against base SHA bf429e90e5b217632356e2d918bfc333e5b8e959.
Required checks and the protected Hermes E2E gate are not complete.
No check waiver is recorded.

---

Signed-off-by: San Dang sdang@nvidia.com

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Hermes now uses an updated immutable base-image digest. Its build unconditionally verifies aiohttp==3.14.3 and cryptography==50.0.0. Tests and security documentation enforce the updated image and verification evidence.

Changes

Hermes dependency patch

Layer / File(s)	Summary
Patched image and runtime guards agents/hermes/Dockerfile, test/corporate-ca-build-tls-anchor.test.ts	The Dockerfile uses the updated base-image digest. The install step fails unless aiohttp is 3.14.3 and cryptography is 50.0.0. The corporate-CA test expects the updated command.
Security contract validation src/lib/agent/base-image-hermes.test.ts, ci/source-shape-test-budget.json	The contract test checks the exact base digest and dependency guard placement. The CI exception test requires the pinned image and unconditional guard.
Dependency review evidence docs/security/hermes-0.19.0-dependency-review.md	The review records patched OCI image identity, architecture manifests, source metadata, provenance, preserved inputs, and final-image dependency assertions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• NVIDIA/NemoClaw#8228: Both PRs modify Hermes Dockerfile installation and contract tests.
• NVIDIA/NemoClaw#8257: The Hermes base-image digest and provenance requirements build on its provenance-aware image publication flow.

Suggested labels: integration: hermes, area: sandbox, bug-fix

Suggested reviewers: apurvvkumaria, cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes pin the patched base image and enforce aiohttp 3.14.3 and cryptography 50.0.0 during standard onboarding as required by issue #8328.
Out of Scope Changes check	✅ Passed	The Dockerfile, tests, CI contract, and documentation changes directly support the dependency remediation and security requirements in issue #8328.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: pinning the patched Hermes base image and validating installed dependency versions.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/hermes-managed-image-dependencies-8328

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-8344.docs.buildwithfern.com/nemoclaw

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 03718ce in the fix/hermes-managed-i... branch remains at 96%, unchanged from commit bf429e9 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 03718ce in the fix/hermes-managed-i... branch remains at 82%, unchanged from commit bf429e9 in the main branch.

Show a code coverage summary of the most impacted files.

File	main bf429e9	fix/hermes-managed-i... 03718ce	+/-
src/lib/credentials/store.ts	56%	55%	-1%
src/lib/shields/index.ts	81%	81%	0%
src/lib/messagi...flow-planner.ts	93%	93%	0%
src/lib/core/immutable.ts	97%	97%	0%
src/lib/onboard...-transaction.ts	94%	94%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/domain/...dbox/destroy.ts	84%	89%	+5%

---

_{Updated August 06, 2026 04:30 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• justified — patched base image at docs/security/hermes-0.19.0-dependency-review.md:24: Keep `patched base image` where the dependency overrides or their provenance distinguish it from an unpatched base image.
• established — Hermes sandbox image at docs/security/hermes-0.19.0-dependency-review.md:26: Keep `Hermes sandbox image` for the final image and `base image` for its build input.
• established — OCI index at docs/security/hermes-0.19.0-dependency-review.md:37: Keep `OCI index` when the multi-platform digest is intended. Name a manifest or image configuration when that lower-level object is intended.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, full-e2e, hermes-e2e, hermes-inference-switch, managed-image-multiarch-startup, security-posture

1 optional E2E recommendation

• rebuild-hermes

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Security review completed for the current branch: PASS, with no actionable findings.

Reviewed categories: input and command injection, credentials and secrets, network exposure, authentication and authorization, supply-chain provenance, sandbox and privilege boundaries, filesystem and process safety, error and log disclosure, and dependency integrity.

The change uses an immutable Hermes base-image digest and adds an unconditional post-messaging version assertion under isolated Python execution. It adds no user-controlled command material, credentials, network endpoints, permissions, or runtime write surfaces. The focused base-image contract passed 7/7, the documentation build completed with 0 errors and the 2 existing Fern warnings, DCO passed, and the commit is GitHub Verified.

Remaining gates are the active repository CI, managed-image and E2E validation, automated review completion, and independent human approval.

[apurvvkumaria]

The author follow-up updates the corporate-CA security contract to include the intentional final dependency guard, which addresses the PR-related CLI shard failure. The resulting change matches the independently validated fix: the corporate-CA contract passes 6/6 and the Hermes base-image contract passes 7/7 locally. No maintainer push is needed; I am monitoring the fresh repository checks and E2E gate.

[apurvvkumaria]

Current-run classification: installer integration failed in an unrelated DGX Station revoked-host-key test because the inspection helper returned no binding under that runner; this PR does not change Station preparation or SSH trust. The focused failing case passes locally (1/1). Both advisor lanes also stopped on advisor-protocol consistency errors after preserving zero findings: the primary lane reported a terminology-receipt mismatch, and the second lane emitted analysis before its required terminology result completed. These are transient test/advisor infrastructure failures, not findings in the Hermes dependency change. After the parent workflows settle, I will use one bounded failed-job rerun and will not repeat it if either condition recurs.

[apurvvkumaria]

Self-hosted ARM64 classification: the managed-image build stopped because the npm registry reported an invalid attestation for eventsource-parser@3.1.0 while installing the unchanged reviewed MCP discovery runtime. The AMD64 managed-image build passed, and this PR does not change that package or install script. This is external registry-attestation infrastructure rather than a Hermes dependency regression. I will wait for the remaining self-hosted job to settle, then use the one bounded failed-job rerun; no further retry will be attempted if it recurs.

[apurvvkumaria]

E2E classification: the controller-validated child completed all selected Hermes, multi-platform managed-image startup, cloud onboarding, and security-posture jobs successfully. Its sole failure was the OpenClaw full-E2E timing budget: onboarding completed in 267 seconds against 263 seconds, the final first-turn segment took about 41 seconds against 14 seconds, and provider selection exceeded its 8-second budget by 21 milliseconds. This PR changes only the Hermes managed image, its security contracts, and dependency-review documentation; it does not change OpenClaw onboarding or timing thresholds. The required gate records a selected-job failure without a supported retry marker, so repository policy forbids rerunning that child on this branch revision. Later workflow attempts were rejected by the child identity guard and do not provide merge evidence. This is an external performance-timing blocker requiring human resolution before a new validated run.

[apurvvkumaria]

CI follow-up: the first attempt failed in timing-sensitive MCP lifecycle lock assertions outside this Hermes dependency change. The repository-controlled second attempt passed every job, including CLI shard 4 and the aggregate checks. I restarted the standard E2E gate controller so it can evaluate the successful CI result. No source change was needed; I am monitoring the resulting E2E run.

[apurvvkumaria]

The current branch and base were revalidated after the green CI retry. I approved the repository standard risk-reviewed E2E path for the reviewed Hermes dependency, build-validation, and documentation changes. The controller is now running; I will classify and address any resulting E2E failure before merge.

[apurvvkumaria]

Gate follow-up: the repository-controlled CI retry and trusted E2E controller both completed successfully. All 46 current checks pass, including both protected managed-image architectures, Hermes E2E, security posture, inference switching, and full E2E. No PR code change was needed for the earlier timing failure. The remaining merge gate is repository approval; I will re-audit and merge normally when approval is present.

[apurvvkumaria]

Independent security review completed for the current revision: APPROVE.\n\n- Secrets and credentials: no new secret material or handling path.\n- Input and injection safety: the change uses fixed package names and reviewed version constants; no user-controlled command construction was added.\n- Authentication and authorization: no boundary or permission change.\n- Dependencies and supply chain: the final image now consumes the reviewed immutable OCI digest and verifies plus after every messaging install path. The producer workflow completed successfully from a verified repository commit.\n- Failure behavior: version drift fails the image build before onboarding can use the artifact.\n- Cryptography and integrity: no cryptographic primitive changed; image provenance and SLSA attestations are documented. The absence of an OCI-index SBOM remains explicitly recorded.\n- Configuration and deployment: both ordinary and managed-capability image configurations execute the final assertion.\n- Tests and holistic review: the two focused suites pass locally (13 tests total), the current required-check query succeeds including E2E, documentation and automated reviews are green, all commits are verified, DCO passes, and there are no unresolved review threads.\n\nNo security blocker remains. The temporary merge freeze still applies, so this approval does not authorize merging yet.

[apurvvkumaria]

Correction to the dependency line in my approval review: the final image verifies aiohttp 3.14.3 and cryptography 50.0.0 after every messaging installation path. The rest of the security-review disposition is unchanged: approved, with no remaining security blocker, and the merge freeze remains active.

[apurvvkumaria]

Advisor retry disposition: the primary GPT lane completed with high confidence and reported 0 blockers, 0 warnings, and 0 suggestions. The secondary Nemotron lane stopped after a partial review and also preserved 0 findings. The single bounded retry for this branch revision is consumed; no further retry is warranted. The documentation receipt has also been revalidated successfully for the current revision.

[cjagwani]

Verdict

Security review — exact head 49fb1609cf47e0ddb80ded834f50957fba89aadf against base c6713c9dd17a9682654713ccb6829b8714f1b307: PASS with no findings. The effective patch is safe from the reviewed security perspective, subject to every repository merge gate.

Findings Table

No findings.

Detailed Analysis

1. Secrets and Credentials — PASS. No secret, credential source, environment allowlist, or sensitive logging behavior changes.

2. Input Validation and Data Sanitization — PASS. The final-image assertion uses fixed package names and exact reviewed versions. No caller-controlled value enters the Python command, image reference, path, or shell structure.

3. Authentication and Authorization — PASS. No identity, permission, ownership, or authorization boundary changes.

4. Dependencies and Third-Party Libraries — PASS. The final Hermes image moves from the stale base to immutable OCI index sha256:57c091ab9b31c924eac0050e66c834c37df875154a254964302a31b119b50b96 and fails its build unless aiohttp==3.14.3 and cryptography==50.0.0 remain installed after every messaging installation path. Trusted Images / Base Images run 31006872948 completed successfully from verified main commit bd668121e918e7b1dda13062bed728f18150360e, which is an ancestor of the reviewed base. The documented absence of an OCI-index SBOM attestation remains explicit and is not represented as resolved.

5. Error Handling and Logging — PASS. Version drift raises an assertion during image construction and prevents onboarding from consuming the artifact. Failure output is limited to package names and versions and contains no secret material.

6. Cryptography and Data Protection — PASS. The patch upgrades the reviewed cryptography package version but changes no cryptographic primitive, key handling, protected-data flow, or retention boundary.

7. Configuration and Security Headers — PASS. The guard runs after both ordinary messaging installation and the optional managed-capability union, outside the conditional. No network policy, port, privilege, capability, user, or security-header setting changes.

8. Security Testing — PASS. Source-shape tests bind the exact digest, exact dependency versions, guard placement after the final conditional, and corporate-CA final-stage command. Current exact-head GitHub checks, managed-image builds on all three agents, self-hosted sandbox checks, WSL, macOS, CodeQL, DCO, commit lint, and installer hash validation pass. Protected E2E remains mandatory and is still running.

9. System Security — PASS. The change prevents a stale dependency graph from reaching a supported Hermes sandbox and preserves the existing sandbox, messaging, corporate-CA, and managed-image trust boundaries.

Files Reviewed

• agents/hermes/Dockerfile
• ci/source-shape-test-budget.json
• docs/security/hermes-0.19.0-dependency-review.md
• src/lib/agent/base-image-hermes.test.ts
• test/corporate-ca-build-tls-anchor.test.ts

Provenance and Required Gates

The signed base refresh is conflict-free. The effective five-file patch has raw SHA-256 886fbcc541df8f52a7d0a00ce2f090cfcf18b4c23adaf9d13498b0d110cdc373 and stable patch ID dd4faf941f214e774869d8f6cc367688d7dd3bae. Accepted security bug #8328 establishes the remediation scope. Base PR #8383 adds only the v0.0.103 release-note page and does not alter any effective PR file or reviewed trust boundary.

Fresh protected E2E, documentation receipt, unresolved-review resolution, and independent exact-head approval remain mandatory. This security review waives none of those gates.

[apurvvkumaria]

Current advisor retry disposition: both advisor jobs stopped because the review workflow omitted required internal analysis/tool results. The partial secondary review preserved 0 blockers, 0 warnings, and 0 suggestions. The single bounded retry for this branch revision is consumed; no further retry will be requested. Current CI, protected E2E, documentation receipt, DCO, verification, approval, and independent security review are otherwise complete. The merge freeze remains active.

[cjagwani]

Verdict

Security revalidation — exact head f15e1709c01d81a0c03c0325f4421550c9ee5eb6 against current base 1608281462923ff8282151c7be1a109ee262b4e9: PASS with no findings, subject to every repository merge gate.

Findings Table

No findings.

Detailed Analysis

1. Secrets and Credentials — PASS. The effective PR patch is unchanged from the prior exact review. The base refresh adds no overlapping secret, credential, environment, or sensitive-logging path.

2. Input Validation and Data Sanitization — PASS. The reviewed validation and command/path construction are unchanged. The new base delta does not alter an effective PR file.

3. Authentication and Authorization — PASS. No identity, ownership, permission, or authorization boundary changed in the PR patch or its integration with the refreshed base.

4. Dependencies and Third-Party Libraries — PASS. The PR's reviewed dependency and artifact identities are unchanged. Base PR #8387 adds verified llama.cpp GGUF acquisition in eight disjoint files and does not change this PR's dependency surface.

5. Error Handling and Logging — PASS. The reviewed fail-closed behavior and diagnostics are unchanged; the base refresh introduces no overlapping error or logging path.

6. Cryptography and Data Protection — PASS. The PR's reviewed cryptographic and protected-data behavior is unchanged. No new cross-patch data flow exists.

7. Configuration and Security Headers — PASS. The effective PR patch preserves its reviewed configuration, network, privilege, capability, port, and header boundaries.

8. Security Testing — PASS. Raw patch SHA-256 remains 886fbcc541df8f52a7d0a00ce2f090cfcf18b4c23adaf9d13498b0d110cdc373 and stable patch ID remains dd4faf941f214e774869d8f6cc367688d7dd3bae. The documentation receipt must still be restamped to this exact head before merge. Prior targeted test evidence remains applicable; fresh exact-head GitHub Actions is authoritative.

9. System Security — PASS. The signed refresh is conflict-free, preserves the reviewed patch byte-for-byte, and introduces no new runtime trust-boundary interaction with the disjoint base delta.

Provenance and Required Gates

This exact-head revalidation supplements the full prior nine-category review at #8344 (review). It applies the current rubric from .agents tree 7320c9e331ddbcd9ff83e0fce9387a004e3bd1aa.

Fresh required CI, protected E2E, the exact documentation receipt, unresolved-review resolution, GitHub commit verification, and an independent exact-head approval remain mandatory. This review waives none of those gates.

[cjagwani]

Verdict

Security review — exact head f69ec94d59e2ee2c40921a148c21db6ab4d508e9 against current base b148bc13ee53b7a1f612d07e42275ec732e71877: PASS with no findings, subject to every repository merge gate.

Findings Table

No findings.

Detailed Analysis

1. Secrets and Credentials — PASS. The effective PR patch is unchanged and adds no secret, credential source, environment exposure, or sensitive logging. The refreshed base introduces no overlapping credential path.

2. Input Validation and Data Sanitization — PASS. Reviewed validation, command construction, and path handling remain unchanged. The portable-profile base delta has no exact file overlap with this PR.

3. Authentication and Authorization — PASS. No identity, ownership, permission, or authorization boundary is widened by the PR patch or its integration with the refreshed base.

4. Dependencies and Third-Party Libraries — PASS. The PR's reviewed dependency and artifact identities are unchanged. Base PRs #8333 and #8376 add disjoint E2E artifact restoration and portable experimental onboarding behavior.

5. Error Handling and Logging — PASS. Reviewed fail-closed behavior and diagnostics remain unchanged; the signed integrations add no overlapping error or logging path.

6. Cryptography and Data Protection — PASS. Reviewed cryptographic and protected-data behavior remains unchanged, with no new cross-patch data flow.

7. Configuration and Security Headers — PASS. The effective PR patch preserves its reviewed configuration, network, privilege, capability, port, and header boundaries. The hidden portable profile does not bypass this PR's authority checks.

8. Security Testing — PASS. Raw patch SHA-256 remains 886fbcc541df8f52a7d0a00ce2f090cfcf18b4c23adaf9d13498b0d110cdc373 and stable patch ID remains dd4faf941f214e774869d8f6cc367688d7dd3bae. The prior exact dependency, image, source-shape, and managed-image evidence remains applicable. Exact-head documentation writer revalidation passed; fresh GitHub Actions is authoritative.

9. System Security — PASS. Both signed refreshes are conflict-free, preserve the effective patch byte-for-byte, and introduce no new runtime trust-boundary interaction. For #7853 specifically, the portable profile supplies onboarding defaults but neither stages messaging credentials nor bypasses registry-driven credential-drift validation.

Provenance and Required Gates

The exact head preserves contributor history through signed merge commits and applies the current rubric from .agents tree 7320c9e331ddbcd9ff83e0fce9387a004e3bd1aa. This supplements the full prior nine-category review at #8344 (review).

Fresh required CI, protected E2E, the exact documentation receipt, unresolved-review resolution, GitHub commit verification, and an independent exact-head approval remain mandatory. This review waives none of those gates.

[apurvvkumaria]

Final validation receipt for branch revision c4cc818e2f25 against the current main revision db31c286129e: the protected controller and its live E2E run completed successfully.

All eight selected protected jobs passed: Hermes inference switching, Hermes and OpenClaw full journeys, Hermes and OpenClaw security posture, cloud onboarding, and managed-image startup on both AMD64 and ARM64. The current check set has no pending or failing contexts (70 successful; 36 intentionally skipped), the PR remains approved and mergeable, and there are no unresolved review threads. The current branch revision is GitHub-verified and the PR DCO declaration remains present. No code change or additional retry was needed.

The merge freeze remains active, so no merge or auto-merge action was taken.