feat(runtime): exact current-upstream shared auth and result metadata - #6
feat(runtime): exact current-upstream shared auth and result metadata#6cermm wants to merge 1 commit into
Conversation
…stream Squash the accepted NousResearch#358/NousResearch#380 runtime and profile-auth candidate onto current upstream without importing its second-parent history. Repair the Flux profile-root credential assertion and invoke the installed ascii-guard console entry before pinned uv fallbacks. Co-authored-by: Hermes Agent <hermes-agent@local>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c03fe63b63
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| getattr(cli, "result_meta_file", None) | ||
| or getattr(cli, "result_meta_fd", None) is not None | ||
| ): | ||
| cli._publish_result_metadata(result) |
There was a problem hiding this comment.
When --result-meta-file or --result-meta-fd is used without --quiet, argument validation accepts the invocation, but this publication call is reachable only inside the if quiet: branch. The normal single-query branch instead calls cli.chat() and then finalizes, so the file is never created and an accepted pipe is closed without a frame. Either reject metadata transports unless quiet mode is selected or publish the structured result from the non-quiet query path as well.
Useful? React with 👍 / 👎.
| except (OSError, PermissionError, RuntimeError, ValueError) as exc: | ||
| logger.warning("Could not snapshot auth authority: %s", exc) |
There was a problem hiding this comment.
When hermes backup --quick --auth-mode include-encrypted encounters an auth read, locking, encryption, or envelope-write failure, this handler logs the error and allows create_quick_snapshot() to return a normal snapshot ID; run_quick_backup() then prints State snapshot created even though the requested credentials are absent. This creates a false-success backup that may only be discovered during disaster recovery, so explicit encrypted-auth mode should fail the snapshot and remove the partial directory instead of degrading to an auth-free backup.
Useful? React with 👍 / 👎.
Evidence-preserving supersession closurePre-close readback for #6: state=OPEN; updatedAt=2026-07-31T20:03:51Z; headRefOid=c03fe63b63b3cbd1a9e260888705dbb459049404; baseRefOid=4b60979dc188655eb4fb81abf292890147ec2d4c; mergeable=MERGEABLE; mergeStateStatus=UNSTABLE. This stale PR is superseded by merged PR #10 (#10), which preserves the reviewed producer-bound NousResearch#358 evidence, and merged PR #17 (#17), which delivered the NousResearch#380 shared-auth repair. Merged PR #16/current main is e0c3e1b. Closure does not prove NousResearch#358 integration. NousResearch#358 remains OPEN and not close-ready; current repair/review continues on t_9be14185 / the result-metadata FD path, followed by required protected canary evidence. This PR is closed as superseded without merge, force-push, branch deletion, or ref alteration. No issue closure, install, rollout, or live Hermes/SOUL/profile mutation is authorized. |
1 participant
Exact candidate identity
c03fe63b63b3cbd1a9e260888705dbb459049404770478508a891da7035abfa3c468af6827d69c0d4b60979dc188655eb4fb81abf292890147ec2d4creview-base-358-380-4b60979dc188current-upstream-358-380-c03fe63b63b3Fresh fork-side exact-base CI artifact for cermm/wc-infrastructure#358 and NousResearch#380. This does not replace or mutate stale PR #5 and must not be merged by this publication task.