jenkins 0a4ff7f1f6 hermes: read node access keys through CSI symlinks ...

The Vault CSI secrets-store projects /vault/secrets/node-ssh-public-key
as a symlink chain (file -> ..data/file -> ..<timestamp>/file), which
the O_NOFOLLOW hardened reader refuses with ELOOP, crash-looping the
hermes-node-ssh-access key reconciler on most nodes.

Resolve the projection safely instead of relaxing the reader: realpath
the secret strictly (loops and dangling links become a clean refusal),
refuse any resolution that escapes the read-only mount, then apply the
unchanged O_NOFOLLOW regular-file read to the resolved target. Host
account databases and authorized_keys keep the strict no-symlink read.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-18 16:28:25 -03:00

..

ai_usage_codex.py

hermes: split AI usage exporter engines

2026-08-17 15:33:56 +00:00

ai_usage_exporter.py

hermes: split AI usage exporter engines

2026-08-17 15:33:56 +00:00

ai_usage_http.py

hermes: split AI usage exporter engines

2026-08-17 15:33:56 +00:00

classifier_broker.py

hermes: sanitize classifier tool history

2026-08-15 13:35:31 -03:00

claude

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

claude_command_policy.py

hermes: grant owner agent union access

2026-08-10 17:05:14 -03:00

claude_oauth_broker.py

hermes: avoid unavailable worker providers

2026-08-16 09:19:23 -03:00

cli_lane_board.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

cli_lane_capabilities.py

hermes: refresh capabilities and readiness per loop

2026-08-17 15:03:50 -03:00

cli_lane_config.py

hermes: align capacity gate with auth classifier

2026-08-17 20:46:00 -03:00

cli_lane_dispatch.py

Merge remote-tracking branch 'origin/feature/hermes-review-goal-semantics' into feature/hermes-distributed-worker-pool

2026-08-18 01:43:39 -03:00

cli_lane_evidence.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

cli_lane_execution.py

hermes: add in-pod autonomous kanban supervisor

2026-08-18 06:28:49 -03:00

cli_lane_failover.py

hermes: enforce quota-aware fail-closed cli-auto provider routing

2026-08-17 20:31:05 -03:00

cli_lane_files.py

hermes: gate mixed image lane APIs

2026-08-17 08:16:35 -03:00

cli_lane_finalization.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

cli_lane_goal.py

hermes: close the review-role gaps found reviewing PR 22

2026-08-17 17:27:11 +00:00

cli_lane_health.py

hermes: enforce quota-aware fail-closed cli-auto provider routing

2026-08-17 20:31:05 -03:00

cli_lane_metrics.py

hermes: enforce quota-aware fail-closed cli-auto provider routing

2026-08-17 20:31:05 -03:00

cli_lane_prompt.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

cli_lane_provider.py

hermes: enforce quota-aware fail-closed cli-auto provider routing

2026-08-17 20:31:05 -03:00

cli_lane_quarantine.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

cli_lane_quota.py

hermes: enforce quota-aware fail-closed cli-auto provider routing

2026-08-17 20:31:05 -03:00

cli_lane_records.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

cli_lane_recovery.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

cli_lane_retention.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

cli_lane_routing.py

hermes: enforce quota-aware fail-closed cli-auto provider routing

2026-08-17 20:31:05 -03:00

cli_lane_runner.py

hermes: enforce quota-aware fail-closed cli-auto provider routing

2026-08-17 20:31:05 -03:00

codex

fix(hermes): run coding workers unattended

2026-08-10 02:15:34 -03:00

codex_broker.py

hermes: harden routed vision normalization

2026-08-16 07:24:20 -03:00

configure_agent_clients.py

hermes(agent): validate Codex owner runtime

2026-08-10 22:54:26 -03:00

execution_pool_client.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

execution_pool_coordinator.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

execution_pool_maintenance.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

execution_pool_project.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

execution_pool_protocol.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

execution_pool_scm.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

execution_pool_server.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

execution_pool_store.py

hermes: make pool lease recovery and release isolation safe

2026-08-17 16:31:15 +00:00

execution_pool_worker.py

hermes: add the fenced three-node distributed execution pool

2026-08-17 16:31:15 +00:00

hermes_coordinator.py

hermes: isolate Atlas SCM write authority

2026-08-17 07:58:44 -03:00

hermes_model_routing.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

hermes_stt_client.py

perf(hermes): use conversational Whisper default

2026-08-10 01:30:50 -03:00

image_broker.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

install_agent_tools.sh

hermes: install pinned Go toolchain

2026-08-16 05:38:01 -03:00

jenkins_build_evidence.py

hermes: streamline forge evidence tools

2026-08-16 08:21:33 -03:00

jenkins_image_build_trigger.py

hermes: add daemonless agent image release lane

2026-08-17 08:25:52 -03:00

kanban_status_recovery.py

hermes: recover stale kanban status pages

2026-08-16 04:49:02 -03:00

kanban_supervisor.py

hermes: make supervisor terminal emissions idempotent across ticks

2026-08-18 06:51:36 -03:00

migrate_api_session_lineage.py

hermes: close stale API worker sessions

2026-08-15 14:20:12 -03:00

migrate_herdr_state.py

hermes(agent): replace HERDR with native CLI lanes

2026-08-10 16:31:06 -03:00

migrate_telegram_api_sessions.py

hermes: harden chat continuity and activity

2026-08-17 14:39:21 +00:00

node_account_audit.py

hermes: audit every sudo include spelling

2026-08-17 20:37:30 -03:00

node_account_hardening.py

hermes: read node access keys through CSI symlinks

2026-08-18 16:28:25 -03:00

node_account_io.py

hermes: read node access keys through CSI symlinks

2026-08-18 16:28:25 -03:00

node_polkit_audit.py

hermes: reject regex literals in polkit grants

2026-08-17 20:37:30 -03:00

patch_api_server_sessions.py

hermes: harden chat continuity and activity

2026-08-17 14:39:21 +00:00

patch_codex_runtime.py

hermes: restore native provider routing

2026-08-12 23:08:21 -03:00

patch_hermes_auth.py

feat(hermes): split chat agent and triage surfaces

2026-08-08 17:59:57 -03:00

patch_process_output_redaction.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

patch_stream_recovery.py

hermes: recover interrupted provider streams

2026-08-12 10:41:47 -03:00

patch_subprocess_secret_boundary.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

patch_ttyd_index.py

fix(hermes): recover browser terminal sessions

2026-08-09 16:12:00 -03:00

patch_tui_gateway.py

hermes(agent): restore stock dashboard reliability

2026-08-10 21:09:06 -03:00

patch_web_session_activity.py

hermes: scope stale activity lineage

2026-08-16 02:51:33 -03:00

recover_cassandra_workers.py

hermes: bind terminal commit to journal inode

2026-08-17 07:19:10 -03:00

repair_cassandra_kanban.py

hermes: recover stale kanban status pages

2026-08-16 04:49:02 -03:00

routing_catalog.py

hermes: restore native provider routing

2026-08-12 23:08:21 -03:00

stage_runtime_access.py

Merge remote-tracking branch 'origin/feature/hermes-review-goal-semantics' into feature/hermes-distributed-worker-pool

2026-08-18 01:43:39 -03:00

supervisor_policy.py

hermes: make supervisor terminal emissions idempotent across ticks

2026-08-18 06:51:36 -03:00

sync_runtime_credentials.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

telegram_media_server.py

hermes: isolate runtime access and expose activity

2026-08-15 22:15:40 -03:00

worker_route_broker.py

hermes: expose Switchyard worker health

2026-08-11 22:38:05 -03:00