tracer-cloud--opensre
wehub-resource-sync
4b6817381b
CI (OpenClaw E2E) / openclaw test (push) Has been cancelled
CI / coverage-report (push) Has been cancelled
CI / test-kubernetes (push) Has been cancelled
CI / should-run-thorough (push) Has been cancelled
CI / test-thorough (cloudwatch-demo) (push) Has been cancelled
CI / test-thorough (flink-ecs) (push) Has been cancelled
CI / test-thorough (upstream-lambda) (push) Has been cancelled
CI / test-thorough (prefect-ecs-fargate) (push) Has been cancelled
Release / build-binaries (zip, opensre.exe, onefile, windows-latest, windows-x64) (push) Has been cancelled
Benchmark image — build + push to ECR (any adapter) / build + push (push) Has been cancelled
CI / quality (ubuntu-latest) (push) Has been cancelled
CI / test (tools-runtime) (push) Has been cancelled
CI / test (e2e-general) (push) Has been cancelled
CI / test (cli-runtime) (push) Has been cancelled
CI / test (e2e-provider-and-openclaw) (push) Has been cancelled
CI / test (integrations-and-misc) (push) Has been cancelled
Release / verify (push) Has been cancelled
Release / build-python-dist (push) Has been cancelled
Release / build-binaries (tar.gz, opensre, onedir, macos-15-intel, darwin-x64) (push) Has been cancelled
Release / build-binaries (tar.gz, opensre, onedir, macos-latest, darwin-arm64) (push) Has been cancelled
Release / build-binaries (tar.gz, opensre, onedir, ubuntu-22.04, linux-x64) (push) Has been cancelled
Release / publish-release (push) Has been cancelled
Release / publish-main-release (push) Has been cancelled
Interactive Shell Live (PR + post-merge) / turn-checks (no-LLM) (push) Has been cancelled
CodeQL / Analyze (python) (push) Has been cancelled
Interactive Shell Live (PR + post-merge) / turn-live shard ${{ matrix.shard_index }} (push) Has been cancelled
Release / prepare (push) Has been cancelled
Release / build-binaries (tar.gz, opensre, onedir, ubuntu-22.04-arm, linux-arm64) (push) Has been cancelled
Synthetic Deterministic Tests / Synthetic offline (deterministic) (push) Has been cancelled
36 行
894 B
YAML
36 行
894 B
YAML
root_cause_category: "missing_credential_isolation"
|
|
|
|
required_keywords:
|
|
- "credential"
|
|
- "in-process"
|
|
- "proxy"
|
|
- "isolation"
|
|
- "outbound call"
|
|
|
|
required_evidence_sources:
|
|
- "hermes_credential_state"
|
|
|
|
optimal_trajectory:
|
|
- "get_hermes_credential_state"
|
|
- "get_hermes_session_log"
|
|
- "get_hermes_runtime_state"
|
|
|
|
max_investigation_loops: 2
|
|
|
|
forbidden_categories:
|
|
- "user_error"
|
|
- "unknown"
|
|
- "healthy"
|
|
|
|
forbidden_keywords:
|
|
- "real secret"
|
|
- "expected behavior"
|
|
- "user mistake"
|
|
|
|
model_response: |
|
|
The root cause is missing_credential_isolation.
|
|
|
|
Hermes kept credentials in process memory and used them directly for outbound calls instead of isolating them behind a credential proxy daemon or KMS-backed boundary.
|
|
|
|
The fixture uses only synthetic redacted token placeholders, but the control gap is clear: credential handling is in-process rather than isolated.
|