fix(hermes): pin the Linux device sandbox closure

Derive platform pins from previously verified manifests with only tool_process.py changed. Require fresh cloud materialization and retain the prior concurrent-write failure.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/plans/2026-10-06-hermes-native-runner.md

@@ -1697,3 +1697,24 @@ succeeds, and a control after settlement is refused. This is credential-free
 native transport evidence. The earlier browser and regression failures remain
 failed; a fresh browser acceptance run and cloud checks remain required. No
 local Docker or Rust build is used.
+
+### 2026-10-08 Linux tool device access
+
+Current-source cloud qualification passed all 11 Mac native fixtures, but the
+Linux run failed overlapping restored-session writes: shell redirects could
+not open `/dev/null`, so Hermes fell back to a PID-based temporary name shared
+by separate tool PID namespaces. Ordinary bubblewrap bind mounts disable
+device access. The native tool sandbox now mounts bubblewrap's minimal `/dev`
+before applying the existing protected-path and assigned-skill overlays.
+Admission probes the actual character device and read/write redirects before
+staging credentials, rather than only executing `true` in a namespace.
+
+A focused policy regression fails before the change and passes afterwards.
+Four host-probe tests pass locally. A Linux-only regression exercises 16
+concurrent atomic writes, device redirects, hidden protected files and read-only
+assigned skills on the real host sandbox. Its live result requires fresh cloud
+CI; a Mac skip is not Linux evidence. Candidate closure pins replace only
+`tool_process.py` in the previously verified manifests; fresh provisioning must
+match them before any runtime is admitted. The prior Linux failure remains
+recorded. Both existing PR file sets remain unchanged, and no local Docker or
+Rust build is used. Full provider, product and Daytona qualification is pending.

packages/paperclip-runner/src/drivers/acpx/hermes-distributions.ts

@@ -1,5 +1,5 @@
 /** Reviewed native closures. Setup cannot adopt a digest from downloaded files. */
 export const HERMES_CLOSURES: Readonly<Record<string, string>> = Object.freeze({
-  "darwin-arm64": "91ece73cc9aa57ccf43847d5177a57c3820f8016972bb52d7c39b839c7edd31b",
-  "linux-x64": "f423779a11a2f2340b8f69088b9e1f13f5624084bd14bcc662ec5fbde63c1e95",
+  "darwin-arm64": "26371563768eb6578b80019f86d4a49cb55e36fd1593021cf9eac2cba945180c",
+  "linux-x64": "06a4e2d0005f0600125b8b3032cb200d7d5ff21280ecd6c3b80f29d29a3491a8",
 });