feat(hermes-agent): version-tag proof events (Wave 2 P2-6) [re-target of #168] - #173
Merged
Ghenghis merged 3 commits intoMay 10, 2026
Conversation
… 7/7 gates green) Wave 1 of the v0.13 production promotion swarm cleared all 7 hard gates. This PR flips the resolver default from v0.12 (hermes-agent-fresh) to v0.13 (hermes-agent-v013-canary). v0.12 remains the opt-in fallback via HERMES_AGENT_CHECKOUT=G:/Github/hermes-agent-fresh. Hard gates (all PASS, evidence below) 1. MiniMax accepted=true — P1-1 (ev_84c2ba93c25d4017) 2. DeepSeek accepted=true — P1-1 (ev_6fa1536b411822db) 3. Canary runtime smoke passes — P1-2 (8/8 imports, 38-subcommand CLI, 10 MCP tools, redaction default-ON per upstream PR #21193) 4. v0.12 rollback path proven — P1-2 (resolver mid-process flip 4/4 reads correct; production HEAD bit-identical pre/post) 5. No secret leak — P1-1 + P1-4 (only env-var NAMES + host labels in evidence; auth_scheme is static "Authorization: Bearer <redacted>"; OWASP A09 review clean) 6. No v0.12 regression — P1-2 (production checkout bit-identical; git status --short empty post-run) 7. BLK-013 fixed by PR #159 — P1-4 (bounded CLI runner endpoint shipped with --network=none + --read-only + --cap-drop=ALL + sha256-only stderr; 6/6 new tests + 52/52 adjacent regression PASS) Bonus discovery (P1-3) - Upstream PR #21561 already merged the Windows TUI signal.SIGPIPE/ SIGHUP guard on 2026-05-08 (uses hasattr() pattern + SIGBREAK fallback). Canary at v2026.5.7 (498bfc7, 2026-05-07) predates this fix, so the TUI/PTY surface still requires advancing the canary checkout to >= e93bfc6c to gain native Windows TUI support. Core CLI + MCP + redaction + provider chat all work TODAY without that advance, which is why this promotion is safe. Patch - DEFAULT_AGENT_CHECKOUT now points to v0.13 (canary path). - New V012_FALLBACK_CHECKOUT constant exposes the v0.12 path for operators + tests that need explicit fallback semantics. - CANARY_AGENT_CHECKOUT retained as alias for back-compat. Tests added/updated (11/11 PASS) - test_default_is_v013_post_promotion: env unset → v0.13 - test_v012_fallback_via_env: env=hermes-agent-fresh → v0.12 - test_resolver_constants_are_correct: DEFAULT == CANARY == v0.13; V012_FALLBACK == hermes-agent-fresh - test_a5_per_call_env_flip: post-promotion semantic (v0.13 ↔ v0.12) - test_a4_agent_updates_repo_path_per_call: same semantic via agent_updates._repo_path() - test_v013_default_when_env_unset: route helper + resolver agree - (4 source-level pin tests retained from PR #155) Verification - py_compile: OK - Focused tests: 11/11 pass - Pre-push hook: passed Rollback - Operators set HERMES_AGENT_CHECKOUT=G:/Github/hermes-agent-fresh in the FastAPI process env to revert to v0.12 mid-process (no restart; per-call resolver from PR #155). - Or revert this PR (1 commit) to restore v0.12 as the file-level default. - Production v0.12 checkout at G:/Github/hermes-agent-fresh remains byte-identical (HEAD 73bf3ab1, v2026.4.30, status clean) — never modified by canary work. Companion PRs - PR #155 (8544bbc): per-call env-switch resolver (Wave A4 + A5) - PR #157 (b8277db): canary smoke results 7/1/0 - PR #158 (5a32fe0): production v0.13 + multi-version action plan - PR #159 (open): BLK-013 bounded task — provides hard gate 7 Hermes-Agent-Only Wave 1 swarm provenance - P1-1 Live provider probes: PASS (ev_84c2ba93c25d4017 + ev_6fa1536b411822db) - P1-2 Canary runtime + production-untouched: PASS (5/5 sub-checks) - P1-3 Upstream Windows guard: ALREADY MERGED upstream (PR #21561) - P1-4 BLK-013: PR #159 OPEN (6/6 + 52/52 regression PASS) - P1-5 Promotion: this PR References - Upstream v0.13.0 release: https://github.com/NousResearch/hermes-agent/releases/tag/v2026.5.7 - Upstream redaction default-ON: NousResearch/hermes-agent#21193 - Upstream Windows guard: NousResearch/hermes-agent#21561 - 12-Factor App rule III (config in env): https://12factor.net/config Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds services/agent_version_registry.py — a frozen-dataclass registry (KNOWN_VERSIONS = (V012, V013)) of known Hermes Agent versions and their feature flags (redaction_default_on, has_kanban, has_heartbeat_reclaim, has_zombie_detection, has_pluggable_providers_dir). Pairs with agent_checkout.py: that module resolves which path is active right now; this one says what we know about each version we've shipped. active_version() reads the live checkout path through hermes_agent_checkout() so per-call env-flips (PR #155 / Wave A5) propagate without restart, and returns None if the operator points HERMES_AGENT_CHECKOUT at a custom fork. Reads agent_checkout module-level constants only; does not edit it. Pinned by tests: - KNOWN_VERSIONS = (v0.12@v2026.4.30, v0.13@v2026.5.7) in order. - v0.13.redaction_default_on=True (NousResearch/hermes-agent#21193, Wave A3 verified). - v0.12.redaction_default_on=False (Wave 2 prior swarm Agent 2). - active_version() == v0.13 with env unset (post-PR #160 default). - active_version() == v0.12 when env=hermes-agent-fresh. - active_version() is None for unknown checkouts. - FrozenInstanceError on any field mutation (no cross-version leak). LoC: 89 lines source (67 non-blank/non-comment) + 114 lines tests. Tests: 13/13 pass; combined with test_agent_checkout_resolver.py 24/24 pass. References: - Python @DataClass(frozen=True): https://docs.python.org/3/library/dataclasses.html#frozen-instances - Django AppConfig metadata pattern: https://docs.djangoproject.com/en/5.1/ref/applications/ Handoff: P2-5 (compat matrix) reads KNOWN_VERSIONS for capability rows; P2-6 (proof events) reads active_version().label/upstream_tag for the version_tag field on every event.
…stream tag (Wave 2 P2-6) Every persisted proof_events row now carries the active Hermes Agent version (v0.12 / v0.13), the upstream tag (v2026.4.30 / v2026.5.7), and the resolved checkout path. Without this, post-promotion forensic queries cannot tell which Hermes Agent version emitted any given event — a gap that becomes load-bearing the moment an operator flips HERMES_AGENT_CHECKOUT mid-process (per-call resolver, PR #155). Approach (single-point change, not 23 per-call-site edits): - New shared services/proof_helpers.py exposes proof_version_fields() and attach_version_fields(payload). The latter returns a NEW dict with version fields merged in, caller keys winning on collision. - Three identical _append_proof_event helpers (agent_updates.py / desktop_updates.py / jobs.py) augmented at the single SQL-insertion site. All 23 transitive callers inherit version tagging without per-site edits. Backward compat: legacy rows have no version_label key. Reader code must use payload.get("version_label", "unknown") semantics. Pin test (test_reader_pattern_uses_get_with_unknown_default) catches any future regression that breaks this fall-through. Provenance basis (cited in helper docstring + test docstring): - NIST SP 800-92 §4 Log Generation and Storage (https://csrc.nist.gov/publications/detail/sp/800-92/final) - OpenTelemetry resource attribute service.version (https://opentelemetry.io/docs/specs/semconv/resource/#service) Tests: 13 new in test_proof_event_version_tagging.py. Suite: pytest test_agent_version_registry.py + test_agent_checkout_resolver.py + test_proof_event_version_tagging.py = 37 passed in 1.46s. Hermes evidence chain: PASS Task ID: P2-6-PROOFS-2026-05-09 hermes_run_gate: pytest 3-file suite green (37/37) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Ghenghis
merged commit May 10, 2026
5b1a192
into
feat/hermes3d-7-complete-gui-repo-wiring
1 check passed
This was referenced May 10, 2026
Ghenghis
added a commit
that referenced
this pull request
May 10, 2026
…entions (W8-6) (#187) * proof(audit): retroactive truth-gate for PRs #136-#178 (W7-1 follow-up) Closes audit findings F-149-01 (P0), F-CI-EMPTY-01 (P1), F-CI-CRBOT-01 (P2). PR #149's recovery_controller.py (1,129 LoC RC v2 foundation) and 9 sibling PRs were merged into feat/hermes3d-7-complete-gui-repo-wiring with empty statusCheckRollup. This file captures ex-post-facto pytest evidence against the integration HEAD (d1334ed) so the merged work has redacted, archivable proof per the ITIL incident-management evidence-of-fix pattern. Targeted suites (56/56 green, all directly close F-149-01): - recovery_controller_freeze: 7 passed (3.34s) - agent_checkout + v012/v013 pins: 27 passed (3.47s) - canary_dirt_filter: 22 passed (0.13s) Wider unit scan: 1146 passed / 11 failed / 5 skipped (98.6% pass rate). All 11 failures are environmental (MCP workspace path mismatch in test_code_operator, firmware-inventory state drift in test_source_runtime_contracts) and pre-date the audited PR window. Verdict: PARTIAL - honest gap documented per the persistence rule. Hermes evidence chain: PASS Task ID: W8-6-RETRO-PROOF-2026-05-09 hermes_run_gate: pytest 4-suite green; redacted-evidence JSON shipped Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(contributing): PR-body conventions for tests-added + re-target tag Adopts two cosmetic-but-recurring PR-body conventions surfaced by W7-1's audit, so future reviewers don't have to guess file-vs-case counts or which branch a stacked PR was rebased onto. - Tests-added: write "N file(s), M cases - all green" (closes F-DRIFT-143-01). - Stacked-on / Reland-of: required on PRs not targeting develop / main (codifies the verified-equivalent pattern from W7-2's #168 -> #173, #170 -> #174 reland chain). Source: GitHub PR best-practices guidance on stacked PRs and discoverable context (https://docs.github.com/en/pull-requests). Hermes evidence chain: PASS Task ID: W8-6-RETRO-PROOF-2026-05-09 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every persisted
proof_eventsrow now carries the active Hermes Agent version (v0.12/v0.13), the upstream tag (v2026.4.30/v2026.5.7), and the resolved checkout path. Without this, post-promotion forensic queries cannot tell which Hermes Agent version emitted any given event.P2-1 (registry) merged via #162. The 3
_append_proof_eventhelpers are augmented at a single sink so all 23 callers inherit version tagging for free.Fields added
{ "version_label": "v0.12" | "v0.13" | "unknown", "upstream_tag": "v2026.4.30" | "v2026.5.7" | "unknown", "checkout_path": "<resolved path or literal env value when unknown>" }Tests
37/37 pass:
test_agent_version_registry.py+test_agent_checkout_resolver.py+test_proof_event_version_tagging.py(+13 new).Hermes evidence chain: PASS
P2-6-PROOFS-2026-05-09claude-lead-p2-6-proofs03_implementation/docs/handoffs/HERMES_AGENT_PROOF_EVENT_VERSION_TAGGING_2026-05-09.mdProvenance: NIST SP 800-92 §4 (log generation), OpenTelemetry
service.versionsemantic convention.Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com