From 6136eb13974898b22f8f4b6b06c5a0643705cee4 Mon Sep 17 00:00:00 2001 From: Dotta Date: Thu, 8 Oct 2026 23:07:47 -0500 Subject: [PATCH] fix(hermes): pin the Linux device sandbox closure Derive platform pins from previously verified manifests with only tool_process.py changed. Require fresh cloud materialization and retain the prior concurrent-write failure. Co-Authored-By: Paperclip --- doc/plans/2026-10-06-hermes-native-runner.md | 21 +++++++++++++++++++ .../src/drivers/acpx/hermes-distributions.ts | 4 ++-- 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/doc/plans/2026-10-06-hermes-native-runner.md b/doc/plans/2026-10-06-hermes-native-runner.md index e1c7bce9a8d..6a7df21b878 100644 --- a/doc/plans/2026-10-06-hermes-native-runner.md +++ b/doc/plans/2026-10-06-hermes-native-runner.md @@ -1697,3 +1697,24 @@ succeeds, and a control after settlement is refused. This is credential-free native transport evidence. The earlier browser and regression failures remain failed; a fresh browser acceptance run and cloud checks remain required. No local Docker or Rust build is used. + +### 2026-10-08 Linux tool device access + +Current-source cloud qualification passed all 11 Mac native fixtures, but the +Linux run failed overlapping restored-session writes: shell redirects could +not open `/dev/null`, so Hermes fell back to a PID-based temporary name shared +by separate tool PID namespaces. Ordinary bubblewrap bind mounts disable +device access. The native tool sandbox now mounts bubblewrap's minimal `/dev` +before applying the existing protected-path and assigned-skill overlays. +Admission probes the actual character device and read/write redirects before +staging credentials, rather than only executing `true` in a namespace. + +A focused policy regression fails before the change and passes afterwards. +Four host-probe tests pass locally. A Linux-only regression exercises 16 +concurrent atomic writes, device redirects, hidden protected files and read-only +assigned skills on the real host sandbox. Its live result requires fresh cloud +CI; a Mac skip is not Linux evidence. Candidate closure pins replace only +`tool_process.py` in the previously verified manifests; fresh provisioning must +match them before any runtime is admitted. The prior Linux failure remains +recorded. Both existing PR file sets remain unchanged, and no local Docker or +Rust build is used. Full provider, product and Daytona qualification is pending. diff --git a/packages/paperclip-runner/src/drivers/acpx/hermes-distributions.ts b/packages/paperclip-runner/src/drivers/acpx/hermes-distributions.ts index 19befb9a0f5..876624b472d 100644 --- a/packages/paperclip-runner/src/drivers/acpx/hermes-distributions.ts +++ b/packages/paperclip-runner/src/drivers/acpx/hermes-distributions.ts @@ -1,5 +1,5 @@ /** Reviewed native closures. Setup cannot adopt a digest from downloaded files. */ export const HERMES_CLOSURES: Readonly> = Object.freeze({ - "darwin-arm64": "91ece73cc9aa57ccf43847d5177a57c3820f8016972bb52d7c39b839c7edd31b", - "linux-x64": "f423779a11a2f2340b8f69088b9e1f13f5624084bd14bcc662ec5fbde63c1e95", + "darwin-arm64": "26371563768eb6578b80019f86d4a49cb55e36fd1593021cf9eac2cba945180c", + "linux-x64": "06a4e2d0005f0600125b8b3032cb200d7d5ff21280ecd6c3b80f29d29a3491a8", });