# Task 1 evidence — isolated Hermes runtime

Date: 2026-07-17 (Asia/Seoul)

## Scope and collision handling

The requested profile directory already existed when the installed Hermes entry
point was invoked. The exact, sanitized invocation was:

```sh
env -i PATH=/home/cube/projects/richard/hermes-agent/venv/bin:/usr/bin:/bin \
  HOME=/home/cube HERMES_HOME=/home/cube/.hermes \
  /home/cube/projects/richard/hermes-agent/venv/bin/hermes \
  profile create physique-coach --no-skills --no-alias
```

Result (exit 1, expected; no overwrite was attempted):

```text
Error: Profile 'physique-coach' already exists at /home/cube/.hermes/profiles/physique-coach
```

No default profile configuration, default `.env`, token, service, or gateway
was copied or changed. The missing standard runtime directories were added at
`0700`; existing concurrent-task files were preserved.

## Guarded profile configuration

`/home/cube/.hermes/profiles/physique-coach/config.yaml` is profile-local and
sets `timezone: Asia/Seoul`, `terminal.home_mode: profile`, empty environment
pass-through/shell-init lists, `gateway.multiplex_profiles: false`, and explicit
`enabled: false` blocks for every built-in messaging/platform adapter. Its
profile-local `.env` is intentionally empty of credential assignments.

Profile config check, run with a sanitized environment:

```sh
env -i PATH=/home/cube/projects/richard/hermes-agent/venv/bin:/usr/bin:/bin \
  HOME=/home/cube HERMES_HOME=/home/cube/.hermes/profiles/physique-coach \
  /home/cube/projects/richard/hermes-agent/venv/bin/hermes config show
```

Relevant output:

```text
Config:       /home/cube/.hermes/profiles/physique-coach/config.yaml
Secrets:      /home/cube/.hermes/profiles/physique-coach/.env
Working dir:  /home/cube/.hermes/profiles/physique-coach/workspace
Timezone:     Asia/Seoul
Telegram:     not configured
Discord:      not configured
```

Runtime probe, also sanitized:

```sh
env -i PATH=/home/cube/projects/richard/hermes-agent/venv/bin:/usr/bin:/bin \
  HOME=/home/cube HERMES_HOME=/home/cube/.hermes/profiles/physique-coach \
  /home/cube/projects/richard/hermes-agent/venv/bin/python -c '<load config; assert no enabled/connected platforms>'
```

Result:

```text
timezone=Asia/Seoul
terminal.home_mode=profile
telegram.enabled=false
telegram.connected=false
enabled_platforms=[]
connected_platforms=[]
```

## Inherited-token failure check

The parent process was given a non-secret sentinel `TELEGRAM_BOT_TOKEN`, then
`env -i` deliberately removed it before loading the profile:

```sh
env TELEGRAM_BOT_TOKEN=sentinel_parent_only env -i \
  PATH=/home/cube/projects/richard/hermes-agent/venv/bin:/usr/bin:/bin \
  HOME=/home/cube HERMES_HOME=/home/cube/.hermes/profiles/physique-coach \
  /home/cube/projects/richard/hermes-agent/venv/bin/python -c '<assert Telegram unavailable>'
```

Result:

```text
sentinel-cleared: telegram unavailable
```

## Isolation and permissions checks

```sh
stat -c '%a %n' <profile runtime directories>
```

Result: `memories`, `sessions`, `skins`, `logs`, `plans`, `workspace`, `cron`,
and `home` are each `0700`. `config.yaml` and `.env` are each `0600`.

```sh
rg -n '^[A-Za-z_][A-Za-z0-9_]*(TOKEN|KEY|SECRET|PASSWORD)[A-Za-z0-9_]*=' \
  /home/cube/.hermes/profiles/physique-coach/.env
```

Result: no matches (`profile_env_secret_assignments=none`).

```sh
test -e /home/cube/.hermes/profiles/physique-coach/gateway.pid
```

Result: absent. No profile gateway or service was started/installed.

The SHA-256 digest of `/home/cube/.hermes/config.yaml` was captured independently
before and after verification:

- `task-1-default-config.before.sha256`
- `task-1-default-config.after.sha256`

Both contain the same digest, so `default_config_checksum=unchanged`.

## Remediation verification

The profile had acquired unrelated bundled skills during parallel work. To keep
the new coach minimal without deleting anything, every such skill root was moved
recoverably into the profile-local
`/home/cube/.hermes/profiles/physique-coach/quarantine/bundled-skills-20260717/`.
This archive is deliberately outside `skills/`, so Hermes cannot discover it.
The only active skill root is `skills/physique-coach`.
`.no-bundled-skills` is present so a future Hermes update cannot re-seed them
automatically. No dedicated physique-coach asset was moved.

Sanitized Hermes discovery check:

```sh
env -i PATH=/home/cube/projects/richard/hermes-agent/venv/bin:/usr/bin:/bin \
  HOME=/home/cube HERMES_HOME=/home/cube/.hermes/profiles/physique-coach \
  /home/cube/projects/richard/hermes-agent/venv/bin/hermes skills list
```

Result:

```text
physique-coach  local  local  enabled
0 hub-installed, 0 builtin, 1 local — 1 enabled, 0 disabled
```

Every directory under `/home/cube/.hermes/profiles/physique-coach` was verified
as `0700` after remediation (`non_owner_only_directories=0`).

The following value-redacting scanner inspected both profile `.env` and
`config.yaml`. It only reports the number of sensitive assignments, classified
as real or placeholder; it never prints a value.

```sh
env -i PATH=/home/cube/projects/richard/hermes-agent/venv/bin:/usr/bin:/bin \
  HOME=/home/cube HERMES_HOME=/home/cube/.hermes/profiles/physique-coach \
  /home/cube/projects/richard/hermes-agent/venv/bin/python - <<'PY'
# classify TOKEN/KEY/SECRET/PASSWORD/CREDENTIAL assignments without printing values
PY
```

Result:

```text
sensitive_assignments_real=0
sensitive_assignments_placeholder=0
```

## DoneClaim

**DoneClaim:** Task 1 is complete. `physique-coach` has an isolated,
pre-activation Hermes runtime configuration with no real or placeholder profile
credential assignment, no enabled platforms under sanitized execution,
Asia/Seoul time, profile-only terminal home, owner-only profile directories,
exactly one Hermes-discovered active skill (`physique-coach`), unchanged default
configuration before/after verification, and no started gateway/service.