Hermes Agent Isolated-Live Qualification

Result

Status: PASS

Execution date: 2026-07-11

Topology: two isolated Hermes Agent containers, one AIP daemon, RFC 7662 OAuth introspection, NATS, and a deterministic Postgres support system of record.

This record qualifies the Hermes router/operator connector against a deployed AIP/MCP stack. It is not a production-readiness claim for the complete AIP platform or for the Docker fixture itself.

Artifact Identity

Artifact	Identity
AIP source base	c51e149ce1df762cb62bc736edfb81a674f56852 plus the current connector qualification worktree
AIP daemon image	aipd:local@sha256:00e468c3603941a091e5f9c473b121ef57c9d0f7eaf10f4e07ebfcaf58579786
Hermes upstream revision	7426c09beee73bdff94d916015bac71384f6bc92
Hermes image	hermes-agent:aip-lite@sha256:15912eaf6211f3b953ad6ed2268545a521cb0c440604231cc61dabfd9666f32c
Architecture	linux/arm64
Model route	cohere/north-mini-code:free through the configured OpenRouter-compatible provider

The AIP image digest is the immutable identity for this run because the qualification worktree had not yet been committed. A release qualification must rebuild and repeat this campaign from the release commit.

Security Boundary

• hermes-1, hermes-2, the external orchestrator, and the independent human approver use distinct principals and credentials.
• MCP authentication is verified through the daemon’s RFC 7662 introspection boundary. An unauthenticated initialize request returned HTTP 401.
• Each Hermes profile exposes only the selected AIP tools. Recursive aip_delegate access is excluded from the model-facing allowlist.
• Hermes has no support Postgres credentials. Business facts are retrieved through cap:support_sandbox:support.case.get over authenticated AIP MCP.
• The native child result is read from AIP queue and lifecycle stores and is accepted only after action contract, transport principal, scope, identity, tenant, and result-integrity verification. Final model prose is ignored.
• No access token, provider key, or introspection client secret is retained in this report.

Reproduction

Start the AIP implementation stack in the order documented by examples/aipd-docker/README.md, then run:

AIPD_MCP_ACCESS_TOKEN='<external-orchestrator-token>' \
AIPD_NATIVE_BEARER_TOKEN='<independent-approver-token>' \
cargo run -p aip-connector-hermes-agent --bin aipd-hermes-operator-smoke -- \
  --endpoint-id hermes-1 \
  --endpoint-id hermes-2

Both embedded Hermes MCP clients were also checked independently with hermes mcp test aip; each authenticated successfully and discovered 89 tools.

Required Assertions

The driver fails unless every endpoint proves all of the following:

1. The governed operator action enters native pending approval and resumes only after an independent authenticated approval decision.
2. Hermes starts a structured run and emits incremental AIP stream chunks, including observable AIP tool start and completion events.
3. The operator obtains the expected support facts through aip_call rather than direct database access or prompt memory.
4. A disallowed delegated capability is rejected by the connector policy.
5. First-class AIP delegation assigns one child action id, Hermes invokes that exact action through MCP, and child_action_id == downstream_action_id.
6. The authoritative native child result contains the expected business facts.
7. Both isolated endpoints complete independently.

Provider-Backed Evidence

Expected support record:

Field	Expected value
Case	case_1001
Case status	resolved
Customer	ava.thompson@example.com
Order	ord_1001
Charges	ch_1001_a, ch_1001_b

Observed execution identifiers:

Evidence	hermes-1	hermes-2
Operator action	act_019f4fc0c8827662975eafa2472b8195	act_019f4fc2b62673718a511c1408690446
Approval	appr_019f4fc0c8887491896ec48aaf5949e4	appr_019f4fc2b62d7b03a917e04f3d48b649
Hermes run	run_a6ec36daa5844a7380d1e196bab6158d	run_a56d0f25406e42ff92821ccfebb7853b
Direct downstream action	act_019f4fc0e12e7cf1a9f5ae8f05780a76	act_019f4fc2d4ce7c53a144dcc297e15863
Stream chunks	74	76
Delegation parent	act_019f4fc1c1b577f09d34c3ab87f3acb9	act_019f4fc3c92f7b00820bd811475beabe
Delegation child	act_019f4fc1c1b577f09d34c39fd5e4d0c2	act_019f4fc3c92f7b00820bd80ed601f05f
Delegated downstream action	act_019f4fc1c1b577f09d34c39fd5e4d0c2	act_019f4fc3c92f7b00820bd80ed601f05f
AIP tool start/completion	PASS	PASS
Scope allowlist rejection	PASS	PASS
Business output	PASS	PASS

The equal child and downstream action ids are the decisive delegation assertion. A model-generated replacement id cannot satisfy the resolver and would fail the campaign.

Deterministic Gates

The provider-backed campaign is supplemented by repository-owned deterministic gates:

• 27-operation pinned route/method/auth/body matrix;
• 28 Hermes connector unit tests, including schema, tenant, streaming, cancellation, channel, operator fencing, approval generation, restart, and delegated-result integrity cases;
• 75 AIP runtime tests, including approval-resume lease renewal and remote delegation replay/fencing;
• 21 gateway tests, including signed remote HTTP delegation;
• 16 MCP server tests and 31 daemon composition tests;
• the complete RFC 0004 frozen connector conformance driver;
• clippy -D warnings for runtime, gateway, Hermes connector, MCP server, and daemon.

Operational Notes

The introspection fixture uses network_mode: service:aipd. It must be recreated after aipd, and both Hermes containers must then be restarted so their embedded MCP managers reconnect against the healthy authorization boundary. A standalone hermes mcp test does not repair an embedded manager that failed during gateway startup.

The local Docker fixture binds Hermes API ports to loopback on the host, but the service listens on the container network and uses a local terminal backend. Production deployment still requires workload isolation, TLS/private service discovery, secret-manager injection, egress policy, production storage, and independent service accounts per tenant or trust domain.