fix(hermes): root staged OpenShell build context

[senthilr-nv]

Summary

• stage the rendered Hermes Dockerfile at the root of its reviewed build context
• preserve source authority against agents/hermes/Dockerfile
• bind onboarding fixtures to the new root-context Dockerfile receipt

What changed

OpenShell 0.0.106 derives the build context from the parent directory of the path passed to sandbox create --from. Hermes previously staged the Dockerfile under agents/hermes/, which excluded root-level reviewed inputs such as tools/mcp-tool-discovery-runtime/.../BUNDLED_PACKAGES.json from that inferred context.

The source Dockerfile remains reviewed at agents/hermes/Dockerfile, while the rendered staged copy is now published as <context>/Dockerfile. All allowlisted source assets remain below the inferred context root.

Why

Fresh Hermes Portable onboarding reached sandbox image creation but failed when Podman could not find the reviewed MCP bundle referenced by the Dockerfile. The asset was staged correctly; it was outside the narrower context OpenShell inferred from the nested Dockerfile path.

How tested

• Hermes build-context and onboarding suites: 64 passed
• affected CLI/plugin/E2E-support tests: 172 passed
• codebase growth guardrails: 32 passed
• CLI typecheck and CLI/plugin builds passed
• Oxlint, formatting, repository architecture/safety checks, commit hooks, and pre-push hooks passed

Risks

The staged context receipt changes its Dockerfile relative path from agents/hermes/Dockerfile to Dockerfile. Context manifest hashing and transaction authority remain fail-closed, so an older staged generation cannot be silently reused.

Refs #9211

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7f4e7340-a5cd-4816-8921-4243e8535e2a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit c021932 in the fix/hermes-openshell... branch remains at 96%, unchanged from commit c7af373 in the fix/hermes-openshell... branch.

[github-actions]

PR Review Advisor — Blocking findings reported

Advisor assessment: Blockers require maintainer review
Next action: Review the blockers below.
Findings: 1 blocker · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 1 blocker · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized terminology decisions match; normalized E2E selections differ; Nemotron reported 1 fewer blocker, the same number of warnings, the same number of suggestions.

2 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• hermes-discord: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• rebuild-hermes: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: onboard-repair, onboard-resume, cloud-onboard
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

1 optional E2E recommendation

• hermes-e2e

Blockers

PRA-1 Blocker — Update the installer-admission test for the root staged Dockerfile

• Location: test/install-hermes-portable-active.test.ts:277
• Category: security
• Problem: The installer-admission integration test still expects the staged Dockerfile below `agents/hermes`, although the changed build-context plan stages and dispatches it as `Dockerfile` at the context root.
• Impact: The checked-in installer/onboarding integration test rejects the intended `--from` value and no longer verifies the security-relevant staged build-context dispatch contract.
• Fix: Change the integration assertion to `path.join(buildContextPath, "Dockerfile")`.
• Verification: Compare the `createSandbox` assertion at `test/install-hermes-portable-active.test.ts:274-280` with the `dockerfilePath` returned by `materializeContext`.
• Test coverage: Keep the installer-admission integration assertion and make it require `path.join(buildContextPath, "Dockerfile")`, so the real build-context plan and onboarding dispatch share one tested path contract.
• Evidence: `test/install-hermes-portable-active.test.ts:274-278` expects `path.join(buildContextPath, "agents", "hermes", "Dockerfile")`. `src/lib/onboard/experimental/hermes-portable-build-context.ts:1315-1319` returns `dockerfilePath` from `authority.dockerfileRelativePath`, which now equals `Dockerfile`. `src/lib/onboard/experimental/hermes-portable-build-context.test.ts:115-126` verifies the root Dockerfile and absence of the former staged path.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.