Skip to content
Chorus Protocol

Hermes S22 verification gate

Run the canonical gate from the repository root:

Terminal window
sh scripts/audit/run-hermes-s22-gate.sh

The command succeeds only after every phase runs. Its last line is S22_HERMES_GATE=GO; the process exit code is authoritative. A missing tool, network failure, timeout, skipped test, vulnerability, digest mismatch, source change during the run, or cleanup failure produces a nonzero exit.

The gate creates separate Python 3.12 build and runtime virtual environments, a disposable HERMES_HOME, and all build artifacts beneath a current-user-owned 0700 temporary directory. It verifies the frozen Python locks, tests the fail-closed overlay builder, builds the adapter wheel from a clean temporary copy, fetches and hashes the exact official Hermes 0.18.2 wheel, builds the reviewed overlay twice, and requires byte-identical overlay outputs. It then installs only the hash-locked runtime plus the two local wheels, checks installed versions and provenance, runs pip check, requires a zero-vulnerability pip-audit, runs Ruff and installed bytecode compilation, and executes the adapter tests from a copied temporary tree so the checkout cannot shadow the installed wheel. Finally it performs the exact real GatewayRunner/local-model round trip against an in-process loopback Chorus server.

The runtime audit expects only hermes-agent and hermes-chorus-adapter to be reported as local, unindexed distributions. Their wheel digests, versions, entry point, install locations, and embedded overlay provenance are verified directly. No audit phase is skipped for these distributions.

The Bun install, SDK build, and live test run from a clean temporary source copy that contains the frozen lockfile and required sources but no .env files. The only external network access is hash-locked installation from fixed public PyPI and npm registries (pypi.org, files.pythonhosted.org, and registry.npmjs.org) plus the exact reviewed Hermes wheel fetch from files.pythonhosted.org; the live Chorus round trip itself is loopback-only.

Supported overrides

Section titled “Supported overrides”

All overrides are optional and non-sensitive. Unknown S22_HERMES_* variables are rejected.

  • S22_HERMES_PYTHON: absolute executable path for Python 3.12.
  • S22_HERMES_BUN: absolute executable path for Bun 1.3.14.
  • S22_HERMES_TEMP_PARENT: absolute, current-user-owned directory that is not group/world writable. The gate creates its own 0700 child beneath it.
  • S22_HERMES_STEP_TIMEOUT_SECONDS: 60–900 seconds; default 600.
  • S22_HERMES_TOTAL_TIMEOUT_SECONDS: 300–3600 seconds; default 1800.

There are deliberately no endpoint, credential, proxy, package-index, wheel-URL, or skip overrides. The official artifact URL and public PyPI/npm registries are fixed by the reviewed source. The gate rejects inherited Chorus, live-test, database, and object-store authority variables by name without printing their values. It also disables Bun environment-file loading and telemetry, keeps checkout environment files outside the disposable Bun source tree, and constructs sanitized subprocess environments with disposable home/cache paths and loopback-only NO_PROXY.

The emitted S22_HERMES_GATE_PROVENANCE JSON records the Python and Bun versions, frozen lock digests, official and overlay wheel digests, built adapter wheel digest, critical-source digest, upstream commit, installed provenance, zero-vulnerability result, live-gateway run count, and orchestrator_production_deployment_command_invoked: false. This narrowly attests that the reviewed gate orchestrator did not invoke a production deployment command. The disposable directory is removed with a bounded cleanup before the GO result is emitted.