NVIDIA / NVIDIA/NemoClaw

Hermes rebuild/upgrade-sandboxes fails on every attempt: shipped Dockerfile's own ARG BASE_IMAGE digest fails its own MCP Streamable HTTP/ACP capability check (v0.0.115)

Open
#10,598 4 comments 0 reactions 0 assignees View on GitHub
area: sandbox integration: hermes
Dominant language
TypeScript
Stars
22.5k
Forks
3.1k
Avg merge
1d 1h
Merged PRs (30d)
715

Description

### Investigation Summary

nemoclaw rebuild and nemoclaw upgrade-sandboxes both fail identically on an existing Hermes sandbox
Root cause confirmed via source inspection: agents/hermes/Dockerfile's own ARG BASE_IMAGE digest is byte-identical to the digest the same release's MCP Streamable HTTP/ACP capability check rejects
NEMOCLAW_SANDBOX_BASE_IMAGE_REFRESH=1 (documented bypass for stale cached hints) produces the identical error — rules out a caching issue
Sandbox remains untouched on every attempt; no data loss on any run
Unknown: what the correct current digest should be, and whether fresh nemoclaw onboard --agent hermes is also affected (not tested — this sandbox already existed)

### Description

What happened: Upgraded NemoClaw from v0.0.109 to v0.0.115 on an existing Hermes sandbox, then ran rebuild to bring the sandbox itself up to date. Every attempt fails at the base-image preflight step with no working workaround found across four separate attempts (plain rebuild, refresh-flag rebuild, and the dedicated upgrade-sandboxes tool).

What I expected: rebuild to either succeed, or resolve to a base image digest that actually passes its own capability check.

### Reproduction Steps

1. Have an existing Hermes sandbox onboarded under an older NemoClaw version
2. Upgrade the NemoClaw CLI to v0.0.115 (curl installer, NEMOCLAW_INSTALL_TAG=v0.0.115)
3. Run `nemoclaw rebuild`
4. Observe: preflight fails, citing the base image as missing "required MCP Streamable HTTP and ACP runtimes"
5. Confirm independently of any sandbox: `grep -iB2 -A2 "hermes-sandbox-base" ~/.nemoclaw/source/agents/hermes/Dockerfile` — the ARG BASE_IMAGE digest matches the one rejected in step 4 exactly

Possibly Related
NVIDIA/NemoClaw#7084 — rebuild reporting Hermes "ready" while required MCP state is actually broken (DGX Station, v0.0.84). Different failure shape (false-positive success vs. a hard, correctly-reported preflight failure here), but same general area of rebuild-time MCP-capability consistency.

### Environment

- OS: [your cat /etc/os-release PRETTY_NAME line]
- Hardware: DGX Spark
- Node.js: v22.23.1
- Docker: Docker Engine, server 29.2.1
- NemoClaw: v0.0.115 (output of `nemoclaw --version`)
- OpenShell: 0.0.106

### Debug Output

Sandbox was rolled back to v0.0.109 (stable, working) after this investigation, so a fresh `nemoclaw debug` output reflects the current healthy state rather than the v0.0.115 failure. See Logs below for the exact failure evidence (error text + Dockerfile source) captured during the original diagnosis.
`nemoclaw debug` is not available on v0.0.109 (the version currently installed, per the rollback described above) — it appears to have been added in a later release. Closest available diagnostic:

:~$
dad_hermes@spark:~$
dad_hermes@spark:~$ nemoclaw dad-hermes doctor

NemoClaw doctor: dad-hermes

Host:
[ok] CLI build: dist/nemoclaw.js present
[ok] Docker daemon: server 29.2.1
[ok] OpenShell CLI: /home/dad_hermes/.local/bin/openshell

Gateway:
[ok] OpenShell status: connected to nemoclaw

Sandbox:
[ok] Live sandbox: dad-hermes present (Ready)
[ok] Agent version: Hermes Agent v0.19.0
[ok] Shields: up (lockdown active)
[ok] Lifecycle registration: registry entry has lifecycle metadata for snapshot, rebuild, upgrade, recovery, and reboot

Inference:
[ok] Route: vllm-local / gemma-4
[ok] Inference route (gateway): https://inference.local/v1/models reachable
[ok] Provider health (vllm backend): http://127.0.0.1:8000/v1/models reachable
[info] Serving process: not checked — serving-process probing is not implemented

Messaging:
[info] Channels: telegram enabled; telegram inbound delivery is not inferred from conflict signatures
hint: run `nemoclaw dad-hermes channels status --channel telegram` to probe inbound delivery

Local services:
[info] Ollama: not reachable at http://127.0.0.1:11434/api/tags
[info] cloudflared: stopped
hint: no cloudflared process; run `nemoclaw tunnel start` to start it

Summary: healthy

dad_hermes@spark:~$

:~$
dad_hermes@spark:~$ nemoclaw debug --quick
[debug] Collecting diagnostics for sandbox 'dad-hermes'...
[debug] Quick mode: true

═══ System ═══

Sat Aug 29 11:01:56 AM CDT 2026
Linux spark 6.17.0-1031-nvidia #31-Ubuntu SMP PREEMPT_DYNAMIC Fri Jul 24 22:03:06 UTC 2026 aarch64 aarch64 aarch64 GNU/Linux
11:01:56 up 10:44, 4 users, load average: 0.91, 0.75, 0.68
total used free shared buff/cache available
Mem: 124610 88831 15640 257 21517 35778
Swap: 16383 0 16383

═══ Processes ═══

PID PPID CMD %MEM %CPU
2931160 2491194 node /home/dad_hermes/.nvm/ 0.1 113
99887 99718 bash /usr/local/bin/nemocla 0.0 3.2
11488 3808 VLLM::EngineCore 3.3 2.6
4337 4254 fdbserver --listen-address 0.0 1.1
2357 1 /usr/bin/dockerd -H fd:// - 0.1 0.5
3777 3564 /opt/erlang/lib/erlang/erts 0.1 0.5
2930094 2930050 /opt/openshell/bin/openshel 0.0 0.5
100206 99887 /opt/hermes/.venv/bin/pytho 0.2 0.3
100912 99887 /opt/hermes/.venv/bin/pytho 0.0 0.2
2146 1 /usr/bin/containerd 0.0 0.2
7476 7470 node dist/src/services/work 0.0 0.2
38260 1569 /home/dad_hermes/jupyterlab 0.1 0.2
3746 3566 redis-server 0.0.0.0:6379 0.0 0.1
1 0 /sbin/init splash 0.0 0.1
3808 3710 /usr/bin/python3 /usr/local 1.9 0.1
2834 2815 /usr/bin/gnome-shell 0.1 0.1
7566 3754 postgres: postgres postgres 0.0 0.1
7565 3754 postgres: postgres postgres 0.0 0.1
2489 2158 /home/dad_hermes/.local/bin 0.1 0.1
2125 1 /usr/sbin/tailscaled --stat 0.0 0.1
7433 7432 node dist/src/services/queu 0.2 0.1
15 2 [rcu_preempt] 0.0 0.1
669 1 /usr/lib/systemd/systemd-ud 0.0 0.1
99718 99696 /opt/openshell/bin/openshel 0.0 0.1
1568 1 @dbus-daemon --system --add 0.0 0.1
2158 1 /usr/lib/systemd/systemd -- 0.0 0.1
2641 1 /usr/lib/systemd/systemd -- 0.0 0.1
624 1 /usr/lib/systemd/systemd-jo 0.0 0.0
1710 1 /usr/sbin/NetworkManager -- 0.0 0.0

═══ GPU ═══

Sat Aug 29 11:01:56 2026
+-----------------------------------------------------------------------------------------+
| NVIDIA-SMI 580.173.02 Driver Version: 580.173.02 CUDA Version: 13.0 |
+-----------------------------------------+------------------------+----------------------+
| GPU Name Persistence-M | Bus-Id Disp.A | Volatile Uncorr. ECC |
| Fan Temp Perf Pwr:Usage/Cap | Memory-Usage | GPU-Util Compute M. |
| | | MIG M. |
|=========================================+========================+======================|
| 0 NVIDIA GB10 On | 0000000F:01:00.0 Off | N/A |
| N/A 41C P0 10W / N/A | Not Supported | 0% Default |
| | | N/A |
+-----------------------------------------+------------------------+----------------------+

+-----------------------------------------------------------------------------------------+
| Processes: |
| GPU GI CI PID Type Process name GPU Memory |
| ID ID Usage |
|=========================================================================================|
| 0 N/A N/A 2697 G /usr/lib/xorg/Xorg 18MiB |
| 0 N/A N/A 2834 G /usr/bin/gnome-shell 6MiB |
| 0 N/A N/A 11488 C VLLM::EngineCore 73881MiB |
+-----------------------------------------------------------------------------------------+

═══ Docker ═══

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
f3d3b8c6002e 73f42de2d368 "/opt/openshell/bin/…" 16 hours ago Up 4 seconds openshell-son-hermes
b9af04378b2f c877f79ed6da "/opt/openshell/bin/…" 4 days ago Up 10 hours openshell-dad-hermes
808e35807684 firecrawl-api "docker-entrypoint.s…" 7 days ago Up 11 hours 0.0.0.0:3002->3002/tcp, [::]:3002->3002/tcp, 8080/tcp firecrawl-api-1
d0e37dfdbd21 searxng/searxng:latest "/usr/local/searxng/…" 7 days ago Up 11 hours 8080/tcp firecrawl-searxng-1
4cee4686ec97 firecrawl-playwright-service "docker-entrypoint.s…" 7 days ago Up 11 hours firecrawl-playwright-service-1
c86011de1a7c vllm/vllm-openai:gemma4-cu130 "vllm serve --model …" 2 weeks ago Up 11 hours 0.0.0.0:8000->8000/tcp, [::]:8000->8000/tcp spark-vllm-reasoning
d069f04760c4 3491f720097b "/bin/sh -c 'apt-get…" 2 weeks ago Exited (1) 2 weeks ago happy_ptolemy
439cba2a9356 foundationdb/foundationdb:7.3.63 "/usr/bin/tini -g --…" 3 weeks ago Up 11 hours firecrawl-foundationdb-1
33c79f4b3384 redis:alpine "docker-entrypoint.s…" 3 weeks ago Up 11 hours 6379/tcp firecrawl-redis-1
7db9a2d554cb firecrawl-nuq-postgres "docker-entrypoint.s…" 3 weeks ago Up 11 hours 5432/tcp firecrawl-nuq-postgres-1
829dc1489c14 rabbitmq:3-management "docker-entrypoint.s…" 3 weeks ago Up 11 hours (healthy) 4369/tcp, 5671-5672/tcp, 15671-15672/tcp, 15691-15692/tcp, 25672/tcp firecrawl-rabbitmq-1
9260c19234a6 postgres:17 "docker-entrypoint.s…" 3 weeks ago Up 11 hours 0.0.0.0:5432->5432/tcp, [::]:5432->5432/tcp stock_intelligence
CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS
f3d3b8c6002e openshell-son-hermes 0.00% 14.05MiB / 4GiB 0.34% 3.53kB / 654B 0B / 24.6kB 19
b9af04378b2f openshell-dad-hermes 47.36% 457.1MiB / 121.7GiB 0.37% 55.4MB / 35MB 174MB / 71.4MB 52
808e35807684 firecrawl-api-1 0.29% 2.779GiB / 8GiB 34.73% 148MB / 259MB 1.72MB / 0B 167
d0e37dfdbd21 firecrawl-searxng-1 0.00% 157.3MiB / 121.7GiB 0.13% 6.17MB / 4.27MB 62.9MB / 344kB 10
4cee4686ec97 firecrawl-playwright-service-1 0.00% 338.1MiB / 32GiB 1.03% 348kB / 126B 199MB / 639kB 76
c86011de1a7c spark-vllm-reasoning 2.01% 7.391GiB / 121.7GiB 6.07% 1.6MB / 642kB 2.65GB / 72.6MB 217
439cba2a9356 firecrawl-foundationdb-1 1.02% 105.3MiB / 121.7GiB 0.08% 4.62MB / 5.82MB 78.2MB / 1.06GB 9
33c79f4b3384 firecrawl-redis-1 0.19% 30.02MiB / 121.7GiB 0.02% 15.5MB / 4.62MB 23.9MB / 41kB 21
7db9a2d554cb firecrawl-nuq-postgres-1 0.31% 132.9MiB / 121.7GiB 0.11% 217MB / 131MB 49.2MB / 797MB 9
829dc1489c14 firecrawl-rabbitmq-1 23.66% 295.9MiB / 121.7GiB 0.24% 27.3MB / 12.4MB 66MB / 315MB 122
9260c19234a6 stock_intelligence 0.00% 37.78MiB / 121.7GiB 0.03% 697kB / 954B 21.6MB / 692kB 6

═══ OpenShell ═══

Server Status

Gateway: nemoclaw
Server: https://127.0.0.1:8080
Status: Connected
Authentication: Authenticated (mTLS transport)
Version: 0.0.101
NAME CREATED PHASE
dad-hermes 2026-08-25 00:54:54 Ready
Sandbox:

Id: e562805d-9824-4345-9249-e8169d5d0d6d
Name: dad-hermes
Phase: Ready
Resource version: 6803
Policy source: sandbox
Revision: 93

Policy:

version: 1
filesystem_policy:
include_workdir: true
read_only:
- /usr
- /lib
- /opt/hermes
- /dev/urandom
- /app
- /etc
- /var/log
- /var/lib/dpkg
- /run/nvidia-persistenced
read_write:
- /sandbox
- /tmp
- /dev/null
- /dev/pts
- /sandbox/.hermes
- /dev/nvidiactl
- /dev/nvidia-uvm
- /dev/nvidia-uvm-tools
- /dev/nvidia-modeset
- /proc
- /dev/nvidia0
landlock:
compatibility: best_effort
process:
run_as_user: sandbox
run_as_group: sandbox
network_policies:
allow_api_firecrawl_dev_443:
name: allow_api_firecrawl_dev_443
endpoints:
- host: api.firecrawl.dev
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: '**'
- allow:
method: HEAD
path: '**'
- allow:
method: OPTIONS
path: '**'
- allow:
method: POST
path: '**'
- allow:
method: PUT
path: '**'
- allow:
method: PATCH
path: '**'
- allow:
method: POST
path: /v2/**
- allow:
method: GET
path: /v2/**
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
- path: /usr/bin/curl
allow_finnhub_io_443:
name: allow_finnhub_io_443
endpoints:
- host: finnhub.io
port: 443
protocol: rest
enforcement: enforce
access: read-write
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
- path: /usr/bin/curl
allow_models_dev_443:
name: allow_models_dev_443
endpoints:
- host: models.dev
port: 443
protocol: rest
enforcement: enforce
access: read-write
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
- path: /usr/bin/curl
allow_paper_api_alpaca_markets_443:
name: allow_paper_api_alpaca_markets_443
endpoints:
- host: paper-api.alpaca.markets
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: '**'
- allow:
method: HEAD
path: '**'
- allow:
method: OPTIONS
path: '**'
- allow:
method: POST
path: '**'
- allow:
method: PUT
path: '**'
- allow:
method: PATCH
path: '**'
- allow:
method: DELETE
path: /v2/positions*
- allow:
method: DELETE
path: /v2/orders*
- allow:
method: POST
path: /v2/orders*
- allow:
method: PATCH
path: /v2/orders*
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
- path: /usr/bin/curl
allow_query1_finance_yahoo_com_443:
name: allow_query1_finance_yahoo_com_443
endpoints:
- host: query1.finance.yahoo.com
port: 443
protocol: rest
enforcement: enforce
access: read-write
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
- path: /usr/bin/curl
allow_query2_finance_yahoo_com_443:
name: allow_query2_finance_yahoo_com_443
endpoints:
- host: query2.finance.yahoo.com
port: 443
protocol: rest
enforcement: enforce
access: read-write
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
- path: /usr/bin/curl
alpaca_data_api:
name: alpaca_data_api
endpoints:
- host: data.alpaca.markets
port: 443
protocol: rest
enforcement: enforce
access: read-write
binaries:
- path: /opt/hermes/.venv/bin/python
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /usr/bin/curl
alpaca_trading_api:
name: alpaca_trading_api
endpoints:
- host: api.alpaca.markets
port: 443
protocol: rest
enforcement: enforce
access: read-write
binaries:
- path: /opt/hermes/.venv/bin/python
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /usr/bin/curl
brew:
name: brew
endpoints:
- host: formulae.brew.sh
port: 443
tls: skip
access: full
- host: github.com
port: 443
access: full
- host: ghcr.io
port: 443
tls: skip
access: full
- host: pkg-containers.githubusercontent.com
port: 443
tls: skip
access: full
- host: objects.githubusercontent.com
port: 443
tls: skip
access: full
- host: raw.githubusercontent.com
port: 443
access: full
binaries:
- path: /usr/bin/curl
- path: /usr/local/bin/brew
- path: /home/linuxbrew/.linuxbrew/bin/brew
- path: /home/linuxbrew/.linuxbrew/bin/*
- path: /home/linuxbrew/.linuxbrew/Homebrew/bin/*
browser_use_api:
name: browser_use_api
endpoints:
- host: api.browser-use.com
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: '**'
- allow:
method: HEAD
path: '**'
- allow:
method: OPTIONS
path: '**'
- allow:
method: POST
path: '**'
- allow:
method: PUT
path: '**'
- allow:
method: PATCH
path: '**'
- allow:
method: GET
path: /v2/
- allow:
method: POST
path: /v2/
- allow:
method: DELETE
path: /v2/
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
- path: /usr/bin/curl
browser_use_cdp:
name: browser_use_cdp
endpoints:
- host: '*.cdp.browser-use.com'
port: 443
protocol: websocket
enforcement: enforce
access: full
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
- path: /usr/bin/curl
claude_code:
name: claude_code
endpoints:
- host: api.anthropic.com
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: /**
- allow:
method: POST
path: /**
- host: platform.claude.com
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: /v1/oauth/**
- allow:
method: POST
path: /v1/oauth/**
- host: statsig.anthropic.com
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: /**
- allow:
method: POST
path: /**
- host: sentry.io
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: /**
- allow:
method: POST
path: /**
binaries:
- path: /usr/local/bin/claude
- path: /usr/bin/claude
- path: /tmp/npm-global/bin/claude
- path: /home/linuxbrew/.linuxbrew/bin/claude
- path: /tmp/npm-global/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe
- path: /usr/local/bin/node
- path: /usr/bin/node
- path: /opt/hermes/.venv/bin/python
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /usr/bin/curl
docs_nvidia_com:
name: docs_nvidia_com
endpoints:
- host: docs.nvidia.com
port: 443
protocol: rest
enforcement: enforce
access: read-write
binaries:
- path: /usr/bin/curl
- path: /opt/hermes/.venv/bin/python
firecrawl_local:
name: firecrawl_local
endpoints:
- host: host.openshell.internal
port: 3002
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: '**'
- allow:
method: HEAD
path: '**'
- allow:
method: OPTIONS
path: '**'
- allow:
method: POST
path: '**'
- allow:
method: PUT
path: '**'
- allow:
method: PATCH
path: '**'
- allow:
method: GET
path: /v0/**
- allow:
method: GET
path: /v2/**
- allow:
method: POST
path: /v2/**
- allow:
method: DELETE
path: /v2/**
allowed_ips:
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
- path: /usr/bin/curl
github:
name: github
endpoints:
- host: github.com
port: 443
access: full
- host: api.github.com
port: 443
access: full
binaries:
- path: /usr/bin/git
gmail_mail:
name: gmail_mail
endpoints:
- host: imap.gmail.com
port: 993
tls: skip
access: full
- host: smtp.gmail.com
port: 465
tls: skip
access: full
binaries:
- path: /usr/bin/python3
google_genai_api:
name: google_genai_api
endpoints:
- host: generativelanguage.googleapis.com
port: 443
protocol: rest
enforcement: enforce
access: read-write
binaries:
- path: /opt/hermes/.venv/bin/python
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /usr/bin/curl
managed_inference:
name: managed_inference
endpoints:
- host: inference.local
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: POST
path: /v1/chat/completions
- allow:
method: POST
path: /v1/messages
- allow:
method: POST
path: /v1/responses
- allow:
method: POST
path: /v1/completions
- allow:
method: POST
path: /v1/embeddings
- allow:
method: GET
path: /v1/models
- allow:
method: GET
path: /v1/models/**
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3.11
- path: /opt/hermes/.venv/bin/python
nous_research:
name: nous_research
endpoints:
- host: nousresearch.com
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: /**
- allow:
method: POST
path: /**
- host: hermes-agent.nousresearch.com
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: /**
- allow:
method: POST
path: /**
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
nvidia:
name: nvidia
endpoints:
- host: integrate.api.nvidia.com
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: POST
path: /v1/chat/completions
- allow:
method: POST
path: /v1/completions
- allow:
method: POST
path: /v1/embeddings
- allow:
method: GET
path: /v1/models
- allow:
method: GET
path: /v1/models/**
binaries:
- path: /usr/local/bin/hermes
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
pypi:
name: pypi
endpoints:
- host: pypi.org
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: /**
- host: files.pythonhosted.org
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: /**
binaries:
- path: /usr/bin/curl
- path: /usr/local/bin/pip3
- path: /usr/local/bin/curl
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
sentiment_pg_v2:
name: sentiment_pg_v2
endpoints:
- host: host.openshell.internal
port: 5432
tls: skip
access: full
allowed_ips:
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
binaries:
- path: /opt/hermes/.venv/bin/python3
telegram:
name: telegram
endpoints:
- host: api.telegram.org
port: 443
protocol: rest
enforcement: enforce
rules:
- allow:
method: GET
path: /bot/**
- allow:
method: POST
path: /bot/**
- allow:
method: GET
path: /file/bot/**
binaries:
- path: /usr/local/bin/node
- path: /usr/bin/python3*
- path: /opt/hermes/.venv/bin/python
[1788018121.751] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] [msg:ssh relay open (channel_id=3c5b8355-e5fb-4e70-94f5-47306335a07b, target=unix:/run/openshell/ssh.sock)]
[1788018121.751] [sandbox] [OCSF ] [ocsf] SSH:OPEN [INFO] ALLOWED
[1788018121.797] [sandbox] [WARN ] [openshell_supervisor_process::ssh] channel_eof on unknown channel ChannelId(2)
[1788018121.818] [sandbox] [WARN ] [openshell_supervisor_process::ssh] channel_eof on unknown channel ChannelId(3)
[1788018121.858] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] [msg:ssh relay open (channel_id=fc2b6803-7151-4bcf-a869-3e7b9a3ec128, target=unix:/run/openshell/ssh.sock)]
[1788018121.858] [sandbox] [OCSF ] [ocsf] SSH:OPEN [INFO] ALLOWED
[1788018121.861] [sandbox] [OCSF ] [ocsf] CONFIG:APPLYING [INFO] Applying Landlock filesystem sandbox [abi:V2 compat:BestEffort ro:9 rw:11]
[1788018121.861] [sandbox] [OCSF ] [ocsf] CONFIG:BUILT [INFO] Landlock ruleset built [rules_applied:19 skipped:1]
[1788018121.880] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED inference.local:443
[1788018121.881] [sandbox] [INFO ] [openshell_router] routing proxy inference request endpoint=http://host.openshell.internal:8000/v1 method=GET path=/v1/models protocols=openai_chat_completions,openai_completions,openai_responses,openai_embeddings,model_discovery
[1788018121.884] [sandbox] [OCSF ] [ocsf] NET:CLOSE [INFO] [msg:ssh relay closed (channel_id=fc2b6803-7151-4bcf-a869-3e7b9a3ec128, target=unix:/run/openshell/ssh.sock)]
[1788018121.894] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] [msg:ssh relay open (channel_id=3fd71487-891f-412c-b75c-996e5ba19bea, target=unix:/run/openshell/ssh.sock)]
[1788018121.895] [sandbox] [OCSF ] [ocsf] SSH:OPEN [INFO] ALLOWED
[1788018121.897] [sandbox] [OCSF ] [ocsf] CONFIG:APPLYING [INFO] Applying Landlock filesystem sandbox [abi:V2 compat:BestEffort ro:9 rw:11]
[1788018121.898] [sandbox] [OCSF ] [ocsf] CONFIG:BUILT [INFO] Landlock ruleset built [rules_applied:19 skipped:1]
[1788018121.909] [sandbox] [OCSF ] [ocsf] NET:CLOSE [INFO] [msg:ssh relay closed (channel_id=3fd71487-891f-412c-b75c-996e5ba19bea, target=unix:/run/openshell/ssh.sock)]
[1788018121.918] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] [msg:ssh relay open (channel_id=a5193e54-4c47-4014-9d3e-cd073106a5c5, target=unix:/run/openshell/ssh.sock)]
[1788018121.918] [sandbox] [OCSF ] [ocsf] SSH:OPEN [INFO] ALLOWED
[1788018121.967] [gateway] [INFO ] [openshell_server::supervisor_session] supervisor session: relay opened successfully
[1788018121.967] [gateway] [INFO ] [openshell_server::supervisor_session] relay stream: claimed pending relay, bridging
[1788018121.920] [sandbox] [OCSF ] [ocsf] CONFIG:APPLYING [INFO] Applying Landlock filesystem sandbox [abi:V2 compat:BestEffort ro:9 rw:11]
[1788018121.920] [sandbox] [OCSF ] [ocsf] CONFIG:BUILT [INFO] Landlock ruleset built [rules_applied:19 skipped:1]
[1788018121.931] [sandbox] [OCSF ] [ocsf] NET:CLOSE [INFO] [msg:ssh relay closed (channel_id=a5193e54-4c47-4014-9d3e-cd073106a5c5, target=unix:/run/openshell/ssh.sock)]
[1788018121.967] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] [msg:ssh relay open (channel_id=6eb16a9c-82b4-4db6-80e6-d861c0794e3b, target=unix:/run/openshell/ssh.sock)]
[1788018121.967] [sandbox] [OCSF ] [ocsf] SSH:OPEN [INFO] ALLOWED
[1788018121.972] [sandbox] [OCSF ] [ocsf] CONFIG:APPLYING [INFO] Applying Landlock filesystem sandbox [abi:V2 compat:BestEffort ro:9 rw:11]
[1788018121.972] [sandbox] [OCSF ] [ocsf] CONFIG:BUILT [INFO] Landlock ruleset built [rules_applied:19 skipped:1]
[1788018122.695] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018132.804] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018142.912] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018153.021] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018153.857] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788018153.973] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788018154.079] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788018163.128] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018173.239] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018183.347] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018193.454] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018203.563] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018213.670] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018223.785] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018233.894] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018244.002] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018244.450] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788018244.572] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788018244.900] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788018254.123] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018264.231] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018274.336] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018284.445] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018294.549] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018304.655] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018314.763] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018324.870] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018334.978] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018335.279] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788018335.402] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788018335.517] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788018345.083] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018355.193] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018365.300] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018375.408] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018385.514] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018395.619] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018405.725] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018415.854] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018425.960] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018427.056] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788018427.170] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788018427.278] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788018436.088] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018446.196] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018456.310] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018466.421] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018476.535] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018486.647] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018496.758] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018506.864] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018516.973] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018517.641] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788018517.959] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788018518.069] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788018527.084] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018537.190] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018547.298] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018557.402] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018567.508] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018577.618] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018587.723] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018597.831] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018607.943] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018608.443] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788018608.568] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788018608.684] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788018618.060] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018628.166] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018638.277] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018648.393] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018658.498] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018668.603] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018678.708] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018688.819] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018698.925] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018699.059] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788018699.174] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788018699.291] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788018709.029] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018719.139] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018729.247] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018739.363] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018749.472] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018759.579] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018769.688] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018779.797] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018789.656] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788018789.772] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788018789.885] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788018789.907] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018800.015] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018810.121] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018820.231] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018830.339] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018840.448] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018850.561] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018860.669] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018870.778] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018880.248] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788018880.362] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788018880.467] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788018880.886] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018890.996] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018901.105] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018911.213] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018921.322] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018931.426] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018941.530] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018951.638] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018961.746] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018971.601] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788018971.854] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018971.925] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788018972.037] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788018981.961] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788018992.069] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019002.174] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019012.284] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019022.390] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019032.498] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019042.611] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019052.768] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019062.397] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788019062.511] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788019062.615] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788019062.874] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019072.979] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019083.087] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019093.197] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019103.311] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019113.426] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019123.537] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019133.644] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019143.752] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019153.215] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788019153.335] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788019153.446] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788019153.857] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019163.966] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019167.370] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019167.578] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED inference.local:443
[1788019167.578] [sandbox] [INFO ] [openshell_router] routing proxy inference request endpoint=http://host.openshell.internal:8000/v1 method=GET path=/v1/models protocols=openai_chat_completions,openai_completions,openai_responses,openai_embeddings,model_discovery
[1788019167.626] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED inference.local:443
[1788019167.626] [sandbox] [INFO ] [openshell_router] routing proxy inference request (streaming) endpoint=http://host.openshell.internal:8000/v1 method=POST path=/v1/chat/completions protocols=openai_chat_completions,openai_completions,openai_responses,openai_embeddings,model_discovery
[1788019168.489] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788019168.614] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/sendChatAction [policy:telegram engine:l7]
[1788019171.072] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788019171.192] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/sendChatAction [policy:telegram engine:l7]
[1788019173.603] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788019173.720] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/sendChatAction [policy:telegram engine:l7]
[1788019176.188] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788019176.315] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/sendChatAction [policy:telegram engine:l7]
[1788019177.481] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019178.733] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788019178.861] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/sendChatAction [policy:telegram engine:l7]
[1788019180.425] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/sendMessage [policy:telegram engine:l7]
[1788019187.586] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019197.699] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019207.807] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019217.916] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019228.024] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019238.135] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019243.999] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/python3.13(326) -> api.telegram.org:443 [policy:telegram engine:opa]
[1788019244.115] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getMe [policy:telegram engine:l7]
[1788019244.221] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getWebhookInfo [policy:telegram engine:l7]
[1788019248.244] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019258.353] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019268.460] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019278.569] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019288.686] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019298.810] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]
[1788019308.919] [sandbox] [OCSF ] [ocsf] HTTP:POST [INFO] ALLOWED POST http://api.telegram.org:443/bot/getUpdates [policy:telegram engine:l7]

═══ Onboard Session ═══

{
"version": 1,
"sessionId": "1787619291681-b4475c4e-8d9e-40b0-b2e0-024e98e54b77",
"status": "complete",
"resumable": false,
"mode": "non-interactive",
"startedAt": "2026-08-25T00:54:51.681Z",
"updatedAt": "2026-08-29T06:13:07.140Z",
"sandboxName": "dad-hermes",
"provider": "vllm-local",
"model": "gemma-4",
"servingProfileProvenance": null,
"endpointUrl": null,
"credentialEnv": null,
"hermesAuthMethod": null,
"preferredInferenceApi": "openai-completions",
"compatibleEndpointReasoning": null,
"compatibleEndpointReasoningEffort": null,
"nimContainer": null,
"toolDisclosure": "progressive",
"observabilityEnabled": false,
"observabilityRequestedExplicitly": false,
"hermesToolGateways": [],
"policyPresets": [
"claude-code",
"github",
"gmail",
"brew",
"pypi",
"telegram",
"sentiment-engine-egress-v2"
],
"gpuPassthrough": true,
"lastStepStarted": "policies",
"lastCompletedStep": "policies",
"failure": null,
"gatewayAuthority": {
"gatewayName": "nemoclaw",
"gatewayPort": 8080,
"mode": "nemoclaw-managed",
"source": "packaged-service",
"endpoint": null,
"supervisor": null,
"requiredCapabilities": []
},
"machine": {
"version": 1,
"state": "complete",
"stateEnteredAt": "2026-08-25T00:55:11.148Z",
"revision": 10
},
"steps": {
"preflight": {
"status": "complete",
"startedAt": null,
"completedAt": "2026-08-25T00:54:51.681Z",
"error": null
},
"gateway": {
"status": "complete",
"startedAt": null,
"completedAt": "2026-08-25T00:54:53.877Z",
"error": null
},
"sandbox": {
"status": "complete",
"startedAt": "2026-08-25T00:54:53.960Z",
"completedAt": "2026-08-25T00:55:02.283Z",
"error": null
},
"provider_selection": {
"status": "complete",
"startedAt": null,
"completedAt": "2026-08-25T00:54:53.890Z",
"error": null
},
"inference": {
"status": "complete",
"startedAt": null,
"completedAt": "2026-08-25T00:54:53.906Z",
"error": null
},
"openclaw": {
"status": "skipped",
"startedAt": null,
"completedAt": null,
"error": null
},
"agent_setup": {
"status": "complete",
"startedAt": null,
"completedAt": "2026-08-25T00:55:02.362Z",
"error": null
},
"policies": {
"status": "complete",
"startedAt": "2026-08-25T00:55:03.929Z",
"completedAt": "2026-08-25T00:55:08.346Z",
"error": null
}
}
}

═══ Sandbox Internals ═══

UID PID PPID C STIME TTY TIME CMD
root 1 0 0 05:42 ? 00:00:42 /opt/openshell/bin/openshell-sandbox --workdir /sandbox
sandbox 101 1 3 05:42 ? 00:20:12 bash /usr/local/bin/nemoclaw-start
sandbox 113 101 0 05:42 ? 00:00:00 tee -a /tmp/nemoclaw-start.log
sandbox 114 101 0 05:42 ? 00:00:00 tee -a /tmp/nemoclaw-start.log
sandbox 326 101 0 05:42 ? 00:02:09 /opt/hermes/.venv/bin/python /usr/local/bin/hermes.real gateway run
sandbox 341 101 0 05:42 ? 00:00:01 tail -n +1 -F /tmp/gateway.log
sandbox 342 101 0 05:42 ? 00:00:00 sed -u s/^/[gateway-log:] /
sandbox 615 101 0 05:42 ? 00:00:05 socat TCP-LISTEN:8642,bind=0.0.0.0,fork,reuseaddr TCP:127.0.0.1:18642
sandbox 766 101 0 05:42 ? 00:01:39 /opt/hermes/.venv/bin/python /usr/local/bin/hermes.real dashboard --host 127.0.0.1 --port 19119 --skip-build --no-open --isolated
sandbox 782 101 0 05:42 ? 00:00:01 tail -n +1 -F /tmp/dashboard.log
sandbox 783 101 0 05:42 ? 00:00:00 sed -u s/^/[dashboard-log:] /
sandbox 866 101 0 05:42 ? 00:00:00 socat TCP-LISTEN:18789,bind=0.0.0.0,fork,reuseaddr TCP:127.0.0.1:19119
sandbox 933416 1 0 15:42 pts/0 00:00:00 /bin/bash -i
sandbox 1242846 101 0 16:01 ? 00:00:00 sleep 1
sandbox 1242847 1 0 16:01 ? 00:00:00 ps -ef
total used free shared buff/cache available
Mem: 124610 88833 15637 257 21518 35776
Swap: 16383 0 16383

═══ Kernel Messages ═══

(kernel messages skipped: dmesg access is restricted for this user; /proc/sys/kernel/dmesg_restrict=1 prevents non-root users from reading kernel logs.
Re-run with `sudo nemoclaw debug --quick` to include kernel logs in this report.
Note: privileged diagnostics and kernel logs may contain sensitive data; review before sharing.)

[debug] Done. If filing a bug, run with --output and attach the tarball to your issue:
[debug] nemoclaw debug --output /tmp/nemoclaw-debug.tar.gz
dad_hermes@spark:~$

### Logs

```shell
NVIDIA/NemoClaw#7084 — rebuild reporting Hermes "ready" while required MCP state is actually broken (DGX Station, v0.0.84). Different failure shape (false-positive success vs. a hard, correctly-reported preflight failure here), but same general area of rebuild-time MCP-capability consistency.

Warning: Hermes Agent sandbox base image ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:212de47e723e9fec1e697d4eec1db82af2d0fb7802aade4fa5dfc3f05274d3c5 lacks the required MCP Streamable HTTP and ACP runtimes and the immutable security package inventory.
Rebuild preflight failed: agent base image could not be built.
Hermes final image does not accept base image ref 'ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:d30f58b0374c7d281df07c126cc257baaf63eb051264a575b96099ec037d5e5d'; use the tracked official digest or a repository-built local base
Sandbox is untouched — no data was lost.

--- Dockerfile source (confirms the rejected digest is the shipped default, not sandbox-specific state) ---
ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:212de47e723e9fec1e697d4eec1db82af2d0fb7802aade4fa5dfc3f05274d3c5
```

### Checklist

- [x] I confirmed this bug is reproducible
- [x] I searched existing issues and this is not a duplicate

Contributor guide

Open the contributing guide

Research direction

Start with agents/hermes/Dockerfile and inspect the BASE_IMAGE digest, then trace the base-image preflight used by nemoclaw rebuild and upgrade-sandboxes. Verify whether fresh nemoclaw onboard --agent hermes is affected; done means the shipped digest passes the MCP Streamable HTTP and ACP capability check and existing Hermes rebuilds succeed.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, typescript
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.