fix(policy): drop github from Hermes baseline

agents/hermes/policy-additions.yaml

@@ -90,21 +90,12 @@ network_policies:
       - { path: /usr/bin/python3* }
       - { path: /opt/hermes/.venv/bin/python }
 
-  github:
-    name: github
-    endpoints:
-      - host: github.com
-        port: 443
-        access: full
-      - host: api.github.com
-        port: 443
-        access: full
-    binaries:
-      # `gh` was historically whitelisted here, but the Hermes sandbox base
-      # image (agents/hermes/Dockerfile.base) only apt-installs `git`, not
-      # `gh`, so the entry was a phantom — see #2179.
-      - { path: /usr/bin/git }
-      - { path: /opt/hermes/.venv/bin/python }
+  # NOTE: github.com / api.github.com and the git binary used to
+  # live in this base policy and were therefore granted to every
+  # Hermes sandbox regardless of user opt-in. They have been moved
+  # into a discoverable preset (`presets/github.yaml`) so a sandbox
+  # only gets GitHub access when the user explicitly selects the
+  # `github` preset during onboard.
 
   # ── Nous Research — public metadata and agent updates ─────────
   # Nous Portal OAuth, managed inference, and managed tool gateway auth are

ci/test-file-size-budget.json

@@ -12,6 +12,6 @@
     "test/onboard-messaging.test.ts": 2063,
     "test/onboard-selection.test.ts": 6891,
     "test/onboard.test.ts": 4774,
-    "test/policies.test.ts": 2763
+    "test/policies.test.ts": 2753
   }
 }

test/policies.test.ts

@@ -1822,16 +1822,6 @@ exit 1
       }
     });
 
-    it("Hermes GitHub policy does not whitelist the absent gh CLI (#2179)", () => {
-      const parsed = parseRepoYaml("agents/hermes/policy-additions.yaml");
-      const githubPolicy = parsed.network_policies?.github as
-        | { binaries?: Array<{ path?: string }> }
-        | undefined;
-      const binaries = (githubPolicy?.binaries ?? []).map((binary) => binary.path).sort();
-      expect(binaries).toEqual(["/opt/hermes/.venv/bin/python", "/usr/bin/git"]);
-      expect(binaries).not.toContain("/usr/bin/gh");
-    });
-
     it("REST policy YAML avoids deprecated tls: terminate", () => {
       const agentsDir = path.join(REPO_ROOT, "agents");
       const agentPolicyFiles = fs.existsSync(agentsDir)

test/validate-blueprint.test.ts

@@ -545,6 +545,18 @@ describe("Hermes sandbox policy", () => {
   it("regression #4230: managed_inference keeps a narrow inference API allowlist", () => {
     expectManagedInferenceSecurityShape();
   });
+
+  function expectGithubBaselineAbsent(): void {
+    const np = policy.network_policies ?? {};
+    expect("github" in np).toBe(false);
+    const hosts = Object.values(np).flatMap((entry) => (entry.endpoints ?? []).map((e) => e.host));
+    expect(hosts).not.toContain("github.com");
+    expect(hosts).not.toContain("api.github.com");
+  }
+
+  it("base policy does not silently grant GitHub access; only the opt-in preset does", () => {
+    expectGithubBaselineAbsent();
+  });
 });
 
 describe("github preset", () => {