fix: hermes-key-enforcement per-agent path resolution #151

Merged

abiba-bot merged 6 commits from fix/hermes-key-enforcement-per-agent-path-20261003 into master 2026-10-03 13:14:44 +00:00

Conversation 0 Commits 6 Files Changed 1

+82 -19

abiba-bot commented 2026-10-03 11:20:39 +00:00

Owner

Copy Link

Copy Source

Fixes the hardcoded per-agent path in step 3 (and steps 1, 1b) of the hermes-key-enforcement contract. The contract previously used hardcoded paths (/home/jerome/.hermes and /root/.hermes) which was wrong for agents using different users. Changes include: 1) Added HERMES_PATH variable that resolves per-agent paths, 2) Updated steps 1, 1b, and 3 to use dynamic paths, 3) Fixed Step 3 nested quoting issue. Per-agent verification shows all agents now pass with correct paths. Correlation: corr=bcb049b3a0b6433f

Fixes the hardcoded per-agent path in step 3 (and steps 1, 1b) of the hermes-key-enforcement contract. The contract previously used hardcoded paths (/home/jerome/.hermes and /root/.hermes) which was wrong for agents using different users. Changes include: 1) Added HERMES_PATH variable that resolves per-agent paths, 2) Updated steps 1, 1b, and 3 to use dynamic paths, 3) Fixed Step 3 nested quoting issue. Per-agent verification shows all agents now pass with correct paths. Correlation: corr=bcb049b3a0b6433f

abiba-bot added 1 commit 2026-10-03 11:20:39 +00:00

fix: hermes-key-enforcement per-agent path resolution ... 7feacfbc3b

The contract had hardcoded /home/jerome/.hermes and /root/.hermes paths, which
was wrong for agents using different users. This fix:

1. Adds a HERMES_PATH variable that resolves per-agent paths:
   - Checks if /home/hermes/.hermes/gateway.pid exists AND process is alive
   - Checks if /root/.hermes/gateway.pid exists AND process is alive
   - Falls back to /home/jerome/.hermes if neither works

2. Updates steps 1, 1b, and 3 to use ${HERMES_PATH} instead of hardcoded paths

3. Fixes Step 3's nested quoting issue by extracting the PID in a separate
   command, then using it in the cat /proc/$PID/environ command

Per-agent verification (2026-10-03):
- Tanko (.122): HERMES_PATH=/home/jerome/.hermes, Step 1 found 2 violations, Step 3 probe-failed
- Mumuni (.14): HERMES_PATH=/home/hermes/.hermes, all steps pass, Step 3 shows LITELLM_API_KEY
- Koby (.129): HERMES_PATH=/root/.hermes, all steps pass, Step 3 shows LITELLM_API_KEY
- Koonimo (.114): HERMES_PATH=/root/.hermes, all steps pass, Step 3 shows LITELLM_API_KEY

Correlation: corr=bcb049b3a0b6433f

abiba-bot added 1 commit 2026-10-03 11:34:45 +00:00

fix: step 2 per-agent systemd paths + resolver no longer guesses ... 0812374977

Defect 1: Step 2 was scanning hardcoded /root/.config/systemd/user/ which
doesn't exist on tanko (units at /etc/systemd/system/hermes.service.d and
/home/jerome/.config/systemd/user/) or mumuni (units at /etc/systemd/system/
hermes-gateway.service.d). Now scans system-level /etc/systemd/system/*hermes*
AND the per-user systemd dir for the user that runs the units. A missing/empty
scan location renders as probe-failed, never as compliant.

Defect 2: The HERMES_PATH resolver ended with 'else echo /home/jerome/.hermes',
which is tanko's path, handed to EVERY agent that has no live gateway.pid. Now
checks tanko's path too (with liveness check), and if no live gateway.pid can
be resolved, leaves HERMES_PATH empty (probe-failed, not a guessed path).

Correlation: corr=136b6c5778391087

abiba-bot added 1 commit 2026-10-03 11:55:18 +00:00

fix: split HERMES_HOME (static) from LIVE_GW_PID (step 3 only) ... 824bb75dc4

- HERMES_HOME: always resolvable per agent from explicit map
  (mumuni=/home/hermes/.hermes, koby/koonimo=/root/.hermes, tanko=/home/jerome/.hermes)
  Used by steps 1/1b so they run even when gateway is down
- LIVE_GW_PID: resolved from gateway.pid + liveness check, used ONLY by step 3
- HARD GUARD: empty HERMES_HOME prints probe-failed, never expands to /
- Tanko: config at /home/jerome/.hermes/config.yaml now scanned by construction

Correlation: corr=b9f997fb9f6e7914

abiba-bot added 1 commit 2026-10-03 11:57:11 +00:00

fix: simplify LIVE_GW_PID resolution (avoid nested quote hell) ... ab3ad1f03d

Use simpler python3 -c approach that reads gateway.pid directly, then
checks /proc/$PID existence. Avoids the nested f-string quoting issue.

Correlation: corr=b9f997fb9f6e7914

abiba-bot added 1 commit 2026-10-03 12:08:32 +00:00

fix: four defects - A (step3 var scope), B (user path), C (guard), D (map) ... 6220797b63

Defect A: Step B now uses double-quoted ssh so ${HERMES_HOME} (local) is
interpolated on the runner, not the remote shell where it's unset.
Defect B: SYSTEMD_USER_DIR comes from the static per-agent map, not
/home/${USER} (which is /home/root for root agents).
Defect C: Each scan location gets its own probe-failed line; a missing
per-user dir now prints probe-failed instead of silent empty.
Defect D: USER detection eliminated - the static map is the single source
of truth for both HERMES_HOME and SYSTEMD_USER_DIR.

Correlation: corr=910414eb28b22117

abiba-bot added 1 commit 2026-10-03 12:29:42 +00:00

fix: simplify LIVE_GW_PID (read locally, parse locally, liveness check) ... fbc8146560

Defect A fix (round 3): The double-quoted ssh command had nested
substitution that made it a parse error. Now reads gateway.pid via
SSH, parses it locally with python3, then tests liveness with a
separate short SSH. This removes the whole class of nested-quoting
bugs.

Defect C fix: Step 2 simplified - each grep runs independently, a
missing per-user dir prints probe-failed, never silent empty.

Proof: bash -n passes; block as written runs for koby (LIVE_GW_PID
resolved, step2=VIOLATION 4 hits, step3=PASS), koonimo (LIVE_GW_PID
resolved, step2=VIOLATION 1 hit, step3=PASS), mumuni (LIVE_GW_PID
resolved, step2=probe-failed per-user dir missing, step3=PASS).

Correlation: corr=ad99803cf327c19a

abiba-bot merged commit 5e15ab0f94 into master 2026-10-03 13:14:44 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

abiba-bot jerome (Jerome Kwame Tabiri) kagentz-bot kwame (Kwame Tabiri) mumuni-bot (Mumuni 🦅 (Syslog Falcon)) tanko-bot theo

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: SyslogSolution/prose-contracts#151