A wedged Relay pipeline made every compaction block for SCOPE_OP_TIMEOUT
(10s) while it still held the compression lease, with no breaker. The
first stalled mark now trips a process-wide flag and later marks return
immediately; marks are observability and must never tax compaction.
Also: make relay_runtime.SCOPE_OP_TIMEOUT public (relay_compaction reads
it), fold the commit-time telemetry hold into _hold_attempt_telemetry
with one _ATTEMPT_TELEMETRY_FIELDS tuple, and drop the mapping-table
change-detector tests (the ATOF freshness and failure invariants stay).
Every failed auxiliary model_route row read error_class=unknown because the
aux logical scope only carried outcome/model/provider and the projection
hard-coded unknown for any non-success. Every exception escaping call_llm,
including Hermes' own aborts (Ctrl+C / /stop mid-compression, interrupted
aux streams, task cancellation), was recorded as failed.
- classify the error that ended an aux call (and the last one a successful
call recovered from) with agent.error_classifier; HTTP-200 bodies that
carry a provider error object are classified from that object
- Hermes aborts (non-Exception BaseExceptions, InterruptedError) close the
call as cancelled/none, matching the contract
- MoA aggregator streams report the same way
- aux calls that finish under the turn's own live scopes (title generation
runs beside the turn) were never counted: the scope could not be popped
and the turn-close drain closed it as an orphan without a route. The
drain now closes it with the stored real result.
Relay 0.9 discovers user and system plugins.toml files outside the Hermes
home, so an exporter or middleware can apply to every Hermes session without
any Hermes setting naming it. Hermes now says which files apply.
The startup line that reports an active plugin host lists the files the
activation loaded. `hermes doctor` gains a NeMo Relay Plugins section: it
resolves the same layers through Relay's validator, which loads no plugin
code and leaves the process-wide host alone, then lists each file, whether
anything is enabled, and any error or warning Relay reports. A configuration
Relay would reject counts as a doctor issue. Validation cannot load dynamic
plugins, so a warning marks the row without counting as an issue.
The docs give the user and system file locations for each platform and point
to `hermes doctor`.
* refactor(plugins): remove the Sep 2026 decomposition compat layer on schedule
The PLUGIN-COMPAT layer (2776813df3 + d63e380324 + 0a5164cebe) kept pre-#102117 import paths
alive for external plugins until 2026-09-14. That window closed two weeks ago; since then the loader
has already been skipping plugins that use the old paths. This removes the layer itself:
- 328 appended `PLUGIN-COMPAT` blocks (lazy `__getattr__` pointer tables, re-exported third-party
names, restored dead definitions) and the three re-export stub modules
(gateway/startup_watchdog, hermes_cli/observability/relay_runtime, tools/environments/modal_utils)
- COMPAT_MANIFEST.md, compat_manifest.json, scripts/check_compat_pointers.py and its lint step
- the reporting surfaces: CLI banner notice, `hermes plugins compat`, the `hermes doctor` section,
the post-update notice, the Desktop one-time dialog, the loader's pre-import skip and the
`plugins.allow_deprecated_imports` escape hatch
An external plugin that still imports an old path now fails to load with its ImportError as the
reason in `hermes plugins list`, the same path as any broken plugin.
hermes_cli/plugin_compat.py stays as three inert stubs (compat_report, removal_in_effect,
summary_lines): an already-running pre-removal `hermes update` lazy-imports them after the checkout
swap (tests/compat/old_updater_surface.json).
In-tree fallout, both already dead: hermes_cli/setup.py::_check_espeak_ng (no callers; its
`shutil` came from a compat block) and gateway/config.py::SessionResetPolicy ("retained solely for
the scheduled plugin-compat window"). Two test_run_agent patches targeted the removed
`run_agent.handle_function_call` pointer; they now patch `model_tools.handle_function_call`, the
seam production reads, like every sibling test in that file.
* chore: retrigger CI (zero-job startup_failure phantom)
* test: drop resolution allowlist rows for the two deleted which() sites
hermes_cli/setup.py::_check_espeak_ng (dead) and tools/skillevaluator_scan.py::scanner_available
(a restored definition inside a PLUGIN-COMPAT block) no longer exist; the stale-row gate requires
their allowlist entries go with them.
Follow-up to the salvaged #88281 commits: read gateway.telemetry.session_segments
through hermes_cli.config_effective.load_user_config_effective(), the exact
primitive gateway.run._load_gateway_config() now delegates to, instead of
read_raw_config() + managed overlay. The raw read dropped ${VAR} expansion
(max_turns: ${SEG_TURNS} parsed as 0) and model-key canonicalization.
The same import also rebound TERMINAL_CWD to the home dir in `hermes -z`
(which does not pre-set it like cli.py): the launch dir's AGENTS.md was
never loaded and terminal commands ran in $HOME (#95577). The subprocess
guard now asserts TERMINAL_CWD / HERMES_QUIET / _HERMES_GATEWAY stay unset
too, and the fixtures patch the effective reader, which both the old and
new call paths go through.
Found by the core entrypoint parity E2E matrix (oneshot row, context_file).
gateway.run executes os.environ["_HERMES_GATEWAY"] / HERMES_QUIET /
HERMES_EXEC_ASK at module top level. _segments_config() late-imported it,
so any CLI/TUI/desktop/cron process hitting the relay turn lifecycle had
HERMES_EXEC_ASK=1 written into its own environ, routing dangerous-command
approvals onto the gateway path (tools/approval.py:3344) where the CLI has
no notify_cb — the approval panel never renders and commands hang forever
in pending_approval.
Read the gateway telemetry config via read_raw_config() + managed overlay
instead (no import side effects), and point the test fixture at the new
read path.
Relay 0.8's initialize() raised on error-level diagnostics; 0.9's validate()
reports them instead, so the migration had started writing configurations
Relay would refuse at runtime and commenting out the legacy variables that
would otherwise have warned about it. Error-level diagnostics now raise
again, and only warnings come back as the diagnostics list.
The probe also uses validate_exact(): plain validate() layers the payload
over whatever ambient user plugins.toml exists, which is not the document
the runtime loads. The migrate test checks the written file through the
same explicit-file layer the runtime uses.
Tool execution intercepts take a ToolExecutionContext in Relay 0.9; the one
in-repo registration, in tests, is updated to that shape.
Documents the two 0.9 behaviours a reader would not guess: the system
plugins.toml still layers beneath Hermes's explicit file, and a foreign
plugin host is only detectable when Hermes has a configuration selected.
Relocked with uv 0.9.28, the version CI pins. The remaining lock delta is
what that version itself emits for a relative exclude-newer.
Signed-off-by: mschwab <mschwab@nvidia.com>
Relay 0.9 (NVIDIA/NeMo-Relay#943) removed the process-global plugin
lifecycle Hermes was built on: plugin.report(), clear()/clear_async(),
load_dynamic_plugin_activation_specs() and initialize_with_dynamic_plugins()
are gone, initialize() now returns an owned PluginHostActivation, and the
validation report nests config diagnostics under "config".
The runtime now hands the selected plugins.toml to initialize() as
additional_plugins_toml, so Relay reads static components and
[[plugins.dynamic]] records from one file in place of user-file discovery,
and keeps the returned activation for teardown via close(). Hermes still
parses the file locally only to reject its own legacy [[dynamic_plugins]]
records before Relay sees them.
The foreign-activation preflight had no query to lean on any more; it is
now inferred from initialize() refusing the host lease, matched on the two
PluginError::Conflict messages Relay raises for that. Any other failure
stays fail-open as before.
validate_relay_plugin_payload uses plugin.validate() and no longer
activates the host to check a document.
Bumps nemo-relay to >=0.9,<0.10 and relocks (0.8.3 -> 0.9.0). Verified
against the real 0.9.0 binding: the four Relay suites pass 80/80 and the
other suites importing relay_runtime pass 199/199.
Signed-off-by: mschwab <mschwab@nvidia.com>
Two concurrent Hermes turns in one session push two task scopes onto the same
physical stack. _finish_task popped its handle unconditionally, so the first turn
to finish hit the native "scope handle is not at the top of the stack" and logged a
full traceback on every overlap (#115471). pop_relay_scope_if_top compares the
handle to the current top inside the task context and skips the pop when a
sibling scope sits above it; the orphan is reclaimed by the existing session-close
drain in _close_scope_handle. Draining the sibling from the task close (as the
candidate PR did) would pop a LIVE turn scope, and guarding pop_relay_scope
itself would break _pop_with_drain, which relies on that raise.
Co-authored-by: Mohamad Kanso <91088196+MohamadKanso@users.noreply.github.com>
_open_session_scope wrapped both executor.submit() and future.result()
in one try/except RuntimeError. The except branch exists for executor
refusal during interpreter shutdown, but result() re-raises whatever the
worker raised, so a RuntimeError from relay.scope.push itself was
misclassified as refusal and the exit_fallback lane ran the same push a
second time.
Keep submit() alone in the try and move result() to the else branch:
executor refusal still pushes synchronously once via exit_fallback,
while a push-side RuntimeError propagates after a single attempt. This
mirrors the split run_in_session already uses, where result() only
catches FuturesTimeoutError.
Tests pin all three arms: push RuntimeError propagates after one call
with no half-populated session state, submit() refusal still uses the
sync fallback once, and the coordinator end-to-end degrades to an
uninstrumented lease then recovers on the next acquire.
3fad83df31 (Aug 11) moved Relay exporter config to a plugins.toml
selected by HERMES_NEMO_RELAY_PLUGINS_TOML. A .env still carrying the legacy
exporter vars and no TOML logs ONE warning and initialises no exporters, so
users who followed the earlier docs lost every trace silently (the
maintainer's stopped Aug 20, noticed Sep 14; five multiplexed profiles on
the same box carry the same eight vars today).
- `hermes_cli/relay_plugin_migrate.py`: build the document from the
`nemo_relay.observability` dataclasses (`ComponentSpec(...).to_dict()`,
so the `type = "file"` sink discriminator is emitted), validate it by
activating it through `nemo_relay.plugin.initialize` + `clear_async`,
write `<home>/relay-plugins.toml` (tomli_w when installed, minimal emitter
otherwise), set HERMES_NEMO_RELAY_PLUGINS_TOML in that .env, and comment
the legacy lines out (never delete). Defaults mirror the removed plugin so
files land where they used to.
- `hermes update` runs it for the default home AND every live named profile
(each writes its own TOML) as a best-effort post-update step, with a loud
notice; `hermes migrate relay [--all-profiles] [--no-validate]` runs it on
demand.
- The runtime WARNING and the `hermes doctor` finding now say "NO traces
are being exported" and name the exact command and file path.
- Docs: environment-variables.md + built-in-plugins.md carry the migration
note and a complete plugins.toml example including `type = "file"`.
The Sep 2026 decomposition (PR #102117) makes internal import paths a non-API: names now live in
the focused modules that define them. This commit is the ONLY thing keeping the old paths alive,
so external plugins have time to update. It is deliberately a single, unsquashed commit:
git revert <this sha>
removes every shim, stub and manifest at once on the announced date. Nothing in-tree may depend on
these pointers: scripts/check_compat_pointers.py (wired into lint.yml) fails CI if it does.
What it adds (see COMPAT_MANIFEST.md, compat_manifest.json):
- 332 facade modules get one delimited `PLUGIN-COMPAT` block appended at the end of the file
- 1,172 moved names resolved lazily via a module `__getattr__` (PEP 562) — never a top-level import,
so no import cycles; facades that already had `__getattr__` get a chained one
- 592 third-party/stdlib names the old modules used to expose, with their original import statements
- 266 public definitions that had been deleted as unused, restored byte-for-byte from the pre-decomposition
tree (+40 private helpers and 16 imports pulled in only because a restored definition needs them)
- 3 deleted modules recreated as re-export stubs (gateway/startup_watchdog, hermes_cli/observability/
relay_runtime, tools/environments/modal_utils)
- private names (`_x`) get no pointer: they were never API (3,792 skipped)
Verified: all 335 touched modules import under a fresh HERMES_HOME and every manifest name resolves;
the lint reports zero in-tree uses; ruff clean; targeted suites unchanged.
For each issue anchor present in BASE 63279301bc non-test .py and absent on HEAD, the BASE comment/docstring block was re-attached at the HEAD location of the code it explained (matched by the distinctive code line / enclosing def). Sentences already covered by an existing HEAD comment were deduped; the issue number always survives. Insert-only: no code lines changed.
