fix(hermes): refresh image probe integrity pin

[cjagwani]

Outcome

Hermes sandbox images can verify and run the current reviewed image-build probe source. A focused regression test now rejects stale probe digests before image-build CI.

Reason

PR #11317 changed agents/hermes/image-build-probes.py without updating its two Dockerfile digest bindings. Both Hermes image jobs on main run 34398766384 stopped at the fail-closed digest check.

Related issues

Refs #10791

Changes

• Update both Hermes image stages to the SHA-256 digest of the current probe source.
• Verify that every probe digest binding matches the reviewed source bytes.

Verification

• npx vitest run --project integration test/agents/hermes/hermes-image-build-probes.test.ts — 57 passed.
• npm run validate:pr — passed against main commit ae5b2ca922023120f90e23242c133c774ae30aa0.
• GitHub commit verification — commit 605ba00d990c538a7c088deffc6a728da38ef4b3 is Verified.
• Secret scan — the diff contains no secrets, API keys, or credentials.

Review notes

agents/hermes/Dockerfile is a contributor-sensitive path. A self-review of NVIDIA/NemoClaw commit 605ba00d990c538a7c088deffc6a728da38ef4b3 covered the complete Dockerfile and regression-test diff and found no additional change. A documentation writer review found no user-visible documentation impact. Independent maintainer review remains required.

---

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 605ba00 in the codex/ci-hermes-prob... branch remains at 96%, unchanged from commit f893b83 in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 605ba00 in the codex/ci-hermes-prob... branch remains at 83%, unchanged from commit ae5b2ca in the main branch.

Show a line coverage summary of the most impacted files.

File	main ae5b2ca	codex/ci-hermes-prob... 605ba00	+/-
src/lib/actions...ridge-output.ts	95%	89%	-6%
src/lib/actions...e-validation.ts	88%	84%	-4%
src/lib/actions...ard-recovery.ts	97%	95%	-2%
src/lib/actions...ard-recovery.ts	85%	84%	-1%
src/lib/onboard...uild-context.ts	75%	75%	0%
src/lib/actions...ess-recovery.ts	82%	84%	+2%
src/lib/actions...eway-restart.ts	92%	94%	+2%
src/lib/inferen...anaged-state.ts	82%	85%	+3%
src/lib/state/o...config-merge.ts	85%	92%	+7%
src/lib/actions...-diagnostics.ts	67%	81%	+14%

---

_{Updated September 09, 2026 21:32 UTC}

[cjagwani]

Superseded by merged PR #11338, which updates the same two Hermes probe digest bindings and adds the stronger source-shape regression contract. Closing this draft duplicate so #11209 can validate against the canonical main-branch repair.