# Hermes Agent Isolated-Live Qualification

## Result

**Status:** PASS

**Execution date:** 2026-07-11

**Topology:** two isolated Hermes Agent containers, one AIP daemon, RFC 7662
OAuth introspection, NATS, and a deterministic Postgres support system of
record.

This record qualifies the Hermes router/operator connector against a deployed
AIP/MCP stack. It is not a production-readiness claim for the complete AIP
platform or for the Docker fixture itself.

## Artifact Identity

| Artifact | Identity |
| --- | --- |
| AIP source base | `c51e149ce1df762cb62bc736edfb81a674f56852` plus the current connector qualification worktree |
| AIP daemon image | `aipd:local@sha256:00e468c3603941a091e5f9c473b121ef57c9d0f7eaf10f4e07ebfcaf58579786` |
| Hermes upstream revision | `7426c09beee73bdff94d916015bac71384f6bc92` |
| Hermes image | `hermes-agent:aip-lite@sha256:15912eaf6211f3b953ad6ed2268545a521cb0c440604231cc61dabfd9666f32c` |
| Architecture | `linux/arm64` |
| Model route | `cohere/north-mini-code:free` through the configured OpenRouter-compatible provider |

The AIP image digest is the immutable identity for this run because the
qualification worktree had not yet been committed. A release qualification
must rebuild and repeat this campaign from the release commit.

## Security Boundary

- `hermes-1`, `hermes-2`, the external orchestrator, and the independent human
  approver use distinct principals and credentials.
- MCP authentication is verified through the daemon's RFC 7662 introspection
  boundary. An unauthenticated `initialize` request returned HTTP `401`.
- Each Hermes profile exposes only the selected AIP tools. Recursive
  `aip_delegate` access is excluded from the model-facing allowlist.
- Hermes has no support Postgres credentials. Business facts are retrieved
  through `cap:support_sandbox:support.case.get` over authenticated AIP MCP.
- The native child result is read from AIP queue and lifecycle stores and is
  accepted only after action contract, transport principal, scope, identity,
  tenant, and result-integrity verification. Final model prose is ignored.
- No access token, provider key, or introspection client secret is retained in
  this report.

## Reproduction

Start the AIP implementation stack in the order documented by
`examples/aipd-docker/README.md`, then run:

```bash
AIPD_MCP_ACCESS_TOKEN='<external-orchestrator-token>' \
AIPD_NATIVE_BEARER_TOKEN='<independent-approver-token>' \
cargo run -p aip-connector-hermes-agent --bin aipd-hermes-operator-smoke -- \
  --endpoint-id hermes-1 \
  --endpoint-id hermes-2
```

Both embedded Hermes MCP clients were also checked independently with
`hermes mcp test aip`; each authenticated successfully and discovered 89 tools.

## Required Assertions

The driver fails unless every endpoint proves all of the following:

1. The governed operator action enters native pending approval and resumes only
   after an independent authenticated approval decision.
2. Hermes starts a structured run and emits incremental AIP stream chunks,
   including observable AIP tool start and completion events.
3. The operator obtains the expected support facts through `aip_call` rather
   than direct database access or prompt memory.
4. A disallowed delegated capability is rejected by the connector policy.
5. First-class AIP delegation assigns one child action id, Hermes invokes that
   exact action through MCP, and `child_action_id == downstream_action_id`.
6. The authoritative native child result contains the expected business facts.
7. Both isolated endpoints complete independently.

## Provider-Backed Evidence

Expected support record:

| Field | Expected value |
| --- | --- |
| Case | `case_1001` |
| Case status | `resolved` |
| Customer | `ava.thompson@example.com` |
| Order | `ord_1001` |
| Charges | `ch_1001_a`, `ch_1001_b` |

Observed execution identifiers:

| Evidence | `hermes-1` | `hermes-2` |
| --- | --- | --- |
| Operator action | `act_019f4fc0c8827662975eafa2472b8195` | `act_019f4fc2b62673718a511c1408690446` |
| Approval | `appr_019f4fc0c8887491896ec48aaf5949e4` | `appr_019f4fc2b62d7b03a917e04f3d48b649` |
| Hermes run | `run_a6ec36daa5844a7380d1e196bab6158d` | `run_a56d0f25406e42ff92821ccfebb7853b` |
| Direct downstream action | `act_019f4fc0e12e7cf1a9f5ae8f05780a76` | `act_019f4fc2d4ce7c53a144dcc297e15863` |
| Stream chunks | 74 | 76 |
| Delegation parent | `act_019f4fc1c1b577f09d34c3ab87f3acb9` | `act_019f4fc3c92f7b00820bd811475beabe` |
| Delegation child | `act_019f4fc1c1b577f09d34c39fd5e4d0c2` | `act_019f4fc3c92f7b00820bd80ed601f05f` |
| Delegated downstream action | `act_019f4fc1c1b577f09d34c39fd5e4d0c2` | `act_019f4fc3c92f7b00820bd80ed601f05f` |
| AIP tool start/completion | PASS | PASS |
| Scope allowlist rejection | PASS | PASS |
| Business output | PASS | PASS |

The equal child and downstream action ids are the decisive delegation
assertion. A model-generated replacement id cannot satisfy the resolver and
would fail the campaign.

## Deterministic Gates

The provider-backed campaign is supplemented by repository-owned deterministic
gates:

- 27-operation pinned route/method/auth/body matrix;
- 28 Hermes connector unit tests, including schema, tenant, streaming,
  cancellation, channel, operator fencing, approval generation, restart, and
  delegated-result integrity cases;
- 75 AIP runtime tests, including approval-resume lease renewal and remote
  delegation replay/fencing;
- 21 gateway tests, including signed remote HTTP delegation;
- 16 MCP server tests and 31 daemon composition tests;
- the complete RFC 0004 frozen connector conformance driver;
- `clippy -D warnings` for runtime, gateway, Hermes connector, MCP server, and
  daemon.

## Operational Notes

The introspection fixture uses `network_mode: service:aipd`. It must be
recreated after `aipd`, and both Hermes containers must then be restarted so
their embedded MCP managers reconnect against the healthy authorization
boundary. A standalone `hermes mcp test` does not repair an embedded manager
that failed during gateway startup.

The local Docker fixture binds Hermes API ports to loopback on the host, but the
service listens on the container network and uses a local terminal backend.
Production deployment still requires workload isolation, TLS/private service
discovery, secret-manager injection, egress policy, production storage, and
independent service accounts per tenant or trust domain.