The post-commit cell assumed a manual `gateway run` that died at boot leaves the retry nothing to
relaunch. The pre-swap pause records its argv, so the retry relaunches it on HEAD; the cell now
asserts that, keeping the invariant that the obligation discharges only once a gateway serves HEAD
(observed: PID 6 -> 1210, code_sha == HEAD). The operator-restart leg is gone: it would start a twin.
The resume asked get_running_pid for the home's gateway.pid, which also needs that home's runtime
lock: a multiplexed host gateway serving the home was not found, so the recovery launch replayed
the paused argv, the replay exited 0 ("already serves"), and the restart was reported as failed
and stayed owed forever. live_gateway_pid_for_home is the reader every other caller uses (PID
file + lock, then the runtime status record).
A discovery or durable-record failure refused the whole update at arm_commit_point (exit 1),
so a host where systemctl cannot reach a user bus (SSH without lingering, containers) could no
longer update at all. The pause is protection, not a gate: any failure restarts whatever it
stopped and the update continues the way POSIX always updated (gateways run through the swap,
restarted after the commit). A failed rollback stays owed and restarts after the deps sync; a
successful one clears the restarted set so the fleet restart refreshes those gateways.
Caught by six existing completion/branch-switch tests whose fake subprocess layer makes
discovery raise; they pass unchanged.
The early before_build resume ran for Windows sets too. The fleet restart skips only what the
POSIX pause restarted (already_restarted), so a Windows gateway resumed before the build was
then drained and restarted a second time by the fleet pass: one extra outage per update that
main never had. The early resume is now POSIX-only and goes through the main facade like every
other resume call; Windows resumes where it always did. Docs say so.
Explicit encoding + DEVNULL stdin on every subprocess.run, SIGKILL via getattr, BOM-tolerant
reads in the pause e2e cells (writes stay plain utf-8), and the macOS-only launchd test waives
os.getuid inline. The footgun lint runs on every file regardless of platform guards.
The supervisor check read an inherited INVOCATION_ID as "systemd will respawn this". Every
shell in a terminal hosted by systemd (Konsole, GNOME Terminal) carries one, and so does any
process deep under a CI runner's service, so the commonest bare gateway was left running on
old code. systemd restarts a unit only when its main process exits: a gateway now counts as
supervised only when it is a Restart= unit's MainPID or that MainPID's direct child.
macOS: launchd's application.<bundle id> names (iTerm2 shells) are no longer read as jobs.
The follow-up review found that the entry pointed at 6f464f72 while the engine
pin inside it still said a9641795, so an install fetched the old engine and lost
both of the fixes that round was meant to deliver. The pin is fixed in the
plugin itself now; this repins the catalog entry to that corrected commit so the
reviewed revision and the installed revision are the same thing again.
Also updated:
- `docs_url` and `image` now resolve at the new commit (both verified reachable).
- The description no longer implies "runs fully local" without qualification: it
notes that an embedding key already present in the environment is
auto-detected, and points at the README's egress section as the authoritative
list. That was the third finding.
Validation: `scripts/validate_plugin_catalog.py plugin-catalog/nexus.yaml` →
`OK: 1 file(s) valid`.
A second review pass over e420433 found five issues, one of them a real leak:
the endpoint matcher used a substring host test, so a lookalike domain could
receive a real provider key. Fixed in 616258b, along with the docstring that
promised a redirect the code never performed, a silent key rejection, an unused
import and a dependency-bound drift across three manifests.
Suite on the new pin: 2171 passed, 3 skipped.
Final revision: the mcp floor is corrected and the paid-station tests opt in
explicitly, so the audit passes on a clean machine. Audit run on this commit:
completed/success.
Carries the corrected mcp floor (>=2.0.0,<3.0.0). The previous pin resolved
mcp 1.x on CI, where `add_request_handler` does not exist, and the audit run
failed at collection. Reproduced and fixed; the CI job now passes in a clean
replica.
Points at 3be00e5, which carries the review fixes: opt-in cloud embedding,
opt-in query rewriting and paid stations, no cwd/.env load, key only paired
with its own endpoint, full egress documentation. The description no longer
claims a blanket 'runs fully local' without naming the opt-in paths.
Nexus Memory is a self-hosted MemoryProvider: Qdrant for storage, a
knowledge graph, and auto-detected embeddings (Voyage, OpenAI, Google,
Jina, Ollama, sentence-transformers). It prefetches before each turn and
writes back after it, and shares one collection with the Nexus MCP server
so Hermes and any MCP-connected agent read and write the same memories.
Fully local operation is supported — no cloud key is required with Ollama
or sentence-transformers.
The pinned tree is a dependency shim: its engine resolves from the same
repository at the pinned commit through tool.uv.sources, so the provider
arrives with its runtime rather than asking an index for a bare name.
Disclosure for review (admission rule 13):
- Network: Qdrant over HTTP (localhost by default), and HTTPS to the
configured embedding provider (Voyage/OpenAI/Google/Jina) or to a local
Ollama instance. No other hosts are contacted.
- Reads outside its own data: it checks ~/.hermes/scripts/*.sh and
~/Library/LaunchAgents/*.plist for a backup entry naming its backups
directory, only to decide whether to mention setting up off-site backup.
- Credentials: only its own config (the embedding provider key). It reads
no other tool's token file.
- Background: daemon threads for write-back, prefetch, backup and entity
extraction. No shell commands, no self-update (opt-in and off here).
Nothing tested mac_bundle_recover(), the start-of-run repair that finishes or
rolls back a Hermes.app swap a killed hand-off left half done.
posix.sh --self-test-swap-interrupt (body in swap-selftest.sh) runs the REAL
mac_swap on a fixture bundle tree in its own process group. mac_swap now
names its step boundaries (swap_checkpoint start/staged/aside/installed); the
self-test makes the swapper SIGSTOP itself at one of them and SIGKILLs the
whole group there, or resumes it and SIGKILLs it mid-ditto / mid-cleanup rm.
It checks the wreck has the expected shape, runs the REAL mac_bundle_recover,
and asserts the target is the complete old or complete new bundle (whole-tree
checksum, version marker included), no .old/.new/.hermes-update-* is left,
and a second recovery changes and logs nothing. Seven cells: before-stage,
mid-stage, staged, aside, installed, mid-cleanup, complete (control).
The seams are inert in a real run: SWAP_PAUSE_AT is set only inside the
self-test, and MAC_DITTO stays /usr/bin/ditto unless the self-test runs where
ditto is absent (Linux: cp -R).
test_desktop_update_mac_swap_interrupt.py drives the arm under
platforms("posix"): the Linux suite and the macOS lanes of tests-os.yml
(real /usr/bin/ditto, macOS /bin/bash 3.2).
Get-DefaultBrowserExe read only the legacy UserChoice ProgId, which Windows
11 25H2 Settings no longer updates, so the update hand-off fell back to the
WinForms card (or a stale browser) on machines whose real default is
Chrome/Edge. Read UserChoiceLatest\ProgId first, legacy UserChoice second.
Fixes#108051. Follows #108062 / #108064.
Co-authored-by: KoNit-K <konit.block@protonmail.com>
Co-authored-by: Konstantin Khlopkov <konstantin.khlopkov93@gmail.com>
Windows 11 25H2 Settings records the default browser under
UrlAssociations\https\UserChoiceLatest\ProgId and stops updating the legacy
UserChoice key, which UCPD.sys also write-protects. Reading only the legacy
ProgId made real-profile browsing refuse a correctly configured Edge/Chrome
default ("not a supported Chromium browser"), with WinError 2 when the key
exists without a value, or picked a stale browser when it still held one.
Resolve the effective ProgId via AssocQueryStringW(ASSOCSTR_PROGID) first,
then fall back to UserChoiceLatest\ProgId, then the legacy UserChoice value.
Classification (channels fail closed) is unchanged.
Salvages #106971 (Shell API lookup); the UserChoiceLatest fallback follows
#108064 and the reports on #107854.
Co-authored-by: Konstantin Khlopkov <konstantin.khlopkov93@gmail.com>
