@hivemagnus/magnus-agent 1.1.5 → 1.1.7

package/README.md

@@ -18,6 +18,10 @@ integrations is optional and stays inert until you configure it.
 - Command execution with timeouts, signed results and a durable command ledger.
 - Cron management, including finite managed schedules (see
   [MANAGED_SCHEDULER.md](https://github.com/ChefTaco/magnus/blob/main/packages/agent/MANAGED_SCHEDULER.md)).
+  Nodes upgraded from before 1.1.6 may keep one stale remembered Hermes schedule
+  source per past Hermes run; see
+  [Hermes schedule sources remembered before 1.1.6](https://github.com/ChefTaco/magnus/blob/main/packages/agent/MANAGED_SCHEDULER.md#hermes-schedule-sources-remembered-before-116)
+  for the cleanup.
 - File read and write with symlink-resolved path checks. Agent state and
   secrets can never be read or written through the API.
 - Skill publication, listing and removal, for example from

package/dist/executors/hermes-gateway-status.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Classifies `hermes gateway status` and systemd-style output. Mirrored
+ * byte-for-byte by the server's copy, which also carries the Python port used
+ * by SSH detection; a server test pins all three to one table.
+ *
+ * `systemctl status` output appends a journal tail, so a running service can
+ * print "Stopped ..." or "error" from an earlier run. A systemd `Active:` line
+ * is therefore authoritative, and Hermes' own "Recent gateway health" history is
+ * skipped. Without an `Active:` line, only summary lines count, and on
+ * those a negative state outranks a failure, which outranks a positive one.
+ */
+export type HermesGatewayState = 'running' | 'inactive' | 'failed' | 'unknown';
+export declare function parseGatewayStatusText(text: string): HermesGatewayState;
+//# sourceMappingURL=hermes-gateway-status.d.ts.map

package/dist/executors/hermes-gateway-status.js

@@ -0,0 +1,67 @@
+const ANSI_COLOUR = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, 'g');
+const ACTIVE_LINE = /^\s*active:\s*([a-z-]+)(?:\s*\(([^)]*)\))?/;
+const IGNORED_LINE = new RegExp([
+    // Journal tail: "Nov 02 10:00:00 host ..." or "2026-11-02 10:00:00 ...".
+    String.raw `^\s*(?:[a-z]{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}|\d{4}-\d{2}-\d{2}[t ]\d{2}:\d{2})`,
+    // systemctl status fields other than Active, its unit title and its process tree.
+    String.raw `^\s*(?:loaded|docs|main pid|tasks|memory|cpu|cgroup|process|drop-in|triggeredby|invocation|status|ip|mem peak)\s*:`,
+    String.raw `^\s*[●○×↻✗✓]?\s*\S+\.service\b`,
+    String.raw `^\s*[│├└]`,
+    // Boot and session settings say nothing about the gateway's current state.
+    String.raw `\b(?:linger|auto-?start|on boot|at boot)\b`,
+    // systemctl could not ask: that is not evidence about the gateway either.
+    String.raw `failed to connect to bus`,
+].join('|'));
+// `hermes gateway status` ends with history under a heading such as "Recent gateway health:".
+const HISTORY_HEADING = /^\s*recent\b.*:\s*$/;
+const HEALTHY_PHRASE = /\b(?:no|0|zero)\s+(?:errors?|failures?|failed)\b|\b(?:last|previous|recent)\s+(?:errors?|failures?)\b.*$/g;
+const NEGATIVE = /\b(?:not[\s_-]+(?:running|active|started|loaded|installed)|isn'?t\s+running|inactive|stopped|disabled|dead|exited|could not be found)\b/;
+const FAILED = /\b(?:failed|failure|crashed|fatal|errors?|errored|unhealthy|not[\s_-]+healthy)\b/;
+const POSITIVE = /\b(?:running|active|healthy)\b/;
+function withoutHistory(lines) {
+    let inHistory = false;
+    return lines.filter((line) => {
+        if (HISTORY_HEADING.test(line))
+            inHistory = true;
+        else if (!line.trim())
+            inHistory = false;
+        return !inHistory;
+    });
+}
+function activeLineState(state, detail) {
+    if (state === 'active')
+        return detail.startsWith('exited') ? 'inactive' : 'running';
+    if (state === 'reloading')
+        return 'running';
+    if (state === 'inactive' || state === 'deactivating')
+        return 'inactive';
+    if (state === 'failed')
+        return 'failed';
+    // A unit waiting to restart after a crash is failing, one starting up is not known yet.
+    if (state === 'activating')
+        return detail.includes('auto-restart') ? 'failed' : 'unknown';
+    return 'unknown';
+}
+export function parseGatewayStatusText(text) {
+    const lines = text.replace(ANSI_COLOUR, '').toLowerCase().split(/\r?\n/);
+    const activeStates = lines.flatMap((line) => {
+        const match = ACTIVE_LINE.exec(line);
+        return match ? [activeLineState(match[1] ?? '', match[2] ?? '')] : [];
+    });
+    if (activeStates.length > 0) {
+        // User and system units can both print a status block.
+        for (const state of ['running', 'failed', 'inactive'])
+            if (activeStates.includes(state))
+                return state;
+        return 'unknown';
+    }
+    const summary = withoutHistory(lines).filter((line) => !IGNORED_LINE.test(line)).map((line) => line.replace(HEALTHY_PHRASE, ' '));
+    if (summary.some((line) => NEGATIVE.test(line)))
+        return 'inactive';
+    if (summary.some((line) => FAILED.test(line)))
+        return 'failed';
+    if (summary.some((line) => POSITIVE.test(line)))
+        return 'running';
+    return 'unknown';
+}
+//# sourceMappingURL=hermes-gateway-status.js.map

package/dist/executors/hermes-manager.d.ts

@@ -108,6 +108,12 @@ export declare function configureHermes(options: {
     warnings: string[];
     state: HermesNodeState;
 }>;
+export declare function hermesInstallationStatus(input: {
+    installed: boolean;
+    runnable: boolean;
+    gatewayStatus: HermesServiceStatus;
+    configPresent: boolean;
+}): HermesNodeState['status'];
 export declare function collectHermesState(options?: {
     hermesHome?: string;
     hermesBin?: string;

package/dist/executors/hermes-manager.js

@@ -7,6 +7,7 @@ import { Hono } from 'hono';
 import { z } from 'zod';
 import { observeHermesDashboard } from './hermes-dashboard-discovery.js';
 import { inspectHiveMemToken } from './hivemem-token.js';
+import { parseGatewayStatusText } from './hermes-gateway-status.js';
 import { childEnvironment } from '../utils/child-env.js';
 import { armChildTimeout } from '../utils/child-timeout.js';
 const OFFICIAL_INSTALL_SCRIPT = 'https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh';
@@ -417,7 +418,7 @@ function parseProfileListText(text, home) {
             name,
             profileHome: join(home, 'profiles', name),
             isDefault: nameCell.startsWith('*') || nameCell.startsWith('◆') || /\bdefault\b/i.test(nameCell),
-            gatewayStatus: cells[2] && !['-', '—'].includes(cells[2]) ? cells[2] : 'unknown',
+            gatewayStatus: cells[2] ? parseGatewayStatusText(cells[2]) : 'unknown',
             modelSummary: cells[1] && !['-', '—'].includes(cells[1]) ? cells[1] : null,
             distribution: cells[4] && !['-', '—'].includes(cells[4]) ? cells[4] : null,
             metadata: { source: 'hermes profile list' },
@@ -425,6 +426,14 @@ function parseProfileListText(text, home) {
     }
     return profiles;
 }
+function profileGatewayStatus(profile, installationStatus) {
+    const reported = profileString(profile, 'gatewayStatus', 'gateway_status');
+    const state = reported ? parseGatewayStatusText(reported) : 'unknown';
+    if (state !== 'unknown')
+        return state;
+    return profile['isDefault'] === true || profile['is_default'] === true || profile['default'] === true || profile['name'] === 'default'
+        ? installationStatus : 'unknown';
+}
 function profileString(profile, ...keys) {
     for (const key of keys) {
         const value = profile[key];
@@ -458,15 +467,17 @@ function profileNumber(profile, ...keys) {
     return null;
 }
 /**
- * Hermes exposes gateway, API-server, and model routing at the installation
- * level. Profile-list output varies by Hermes release and often contains only
- * names, so carry the observed installation posture into every profile unless
- * that profile explicitly reported its own value.
+ * Hermes exposes API-server and model routing at the installation level.
+ * Profile-list output varies by Hermes release and often contains only names,
+ * so carry the observed installation posture into every profile unless that
+ * profile explicitly reported its own value. `hermes gateway status` observes
+ * only the default profile's gateway, so another profile that reported nothing
+ * stays unknown instead of counting as one more running gateway.
  */
 function enrichProfiles(profiles, installation) {
     return profiles.map((profile) => ({
         ...profile,
-        gatewayStatus: profileString(profile, 'gatewayStatus', 'gateway_status') ?? installation.gatewayStatus,
+        gatewayStatus: profileGatewayStatus(profile, installation.gatewayStatus),
         providerSummary: profileString(profile, 'providerSummary', 'provider_summary', 'provider') ?? installation.configuration.modelProvider,
         modelSummary: profileString(profile, 'modelSummary', 'model_summary', 'model') ?? installation.configuration.modelName,
         apiServerEnabled: profileBoolean(profile, installation.apiServerEnabled, 'apiServerEnabled', 'api_server_enabled'),
@@ -589,6 +600,15 @@ export async function configureHermes(options, configuration) {
     return { warnings, state: await collectHermesState(options, true) };
 }
 let stateCache = null;
+export function hermesInstallationStatus(input) {
+    if (!input.installed)
+        return 'not_installed';
+    if (input.gatewayStatus === 'running')
+        return 'running';
+    if (!input.runnable)
+        return 'degraded';
+    return input.configPresent ? 'detected' : 'needs_setup';
+}
 export async function collectHermesState(options = {}, refresh = false) {
     const requested = { hermesHome: options.hermesHome ?? DEFAULT_HERMES_HOME, hermesBin: options.hermesBin ?? 'hermes' };
     const runtime = await discoverRuntimeTarget(requested);
@@ -605,9 +625,11 @@ export async function collectHermesState(options = {}, refresh = false) {
     const fallbackVersion = runtime.fallbackVersion;
     const homeProfiles = await profilesFromHome(resolved.home);
     const installed = versionResult.code === 0 || fallbackVersion?.code === 0 || runtime.homeDetected || configPresent || homeProfiles.length > 0;
-    const version = installed ? firstLine(versionResult.stdout || fallbackVersion?.stdout || versionResult.stderr) : null;
-    const gatewayResult = versionResult.code === 0 || fallbackVersion?.code === 0 ? await runHermes(runtime.requested, ['gateway', 'status']) : null;
-    const profileListResult = versionResult.code === 0 || fallbackVersion?.code === 0 ? await runHermes(runtime.requested, ['profile', 'list', '--json'], 15_000) : null;
+    // A Hermes home without a working binary is leftover data, not a usable installation.
+    const runnable = versionResult.code === 0 || fallbackVersion?.code === 0;
+    const version = runnable ? firstLine(versionResult.stdout || fallbackVersion?.stdout || versionResult.stderr) : null;
+    const gatewayResult = runnable ? await runHermes(runtime.requested, ['gateway', 'status']) : null;
+    const profileListResult = runnable ? await runHermes(runtime.requested, ['profile', 'list', '--json'], 15_000) : null;
     let profiles = [];
     if (profileListResult?.code === 0 && profileListResult.stdout.trim()) {
         try {
@@ -617,7 +639,7 @@ export async function collectHermesState(options = {}, refresh = false) {
         }
         catch { /* fall through with empty profiles */ }
     }
-    if (profiles.length === 0 && (versionResult.code === 0 || fallbackVersion?.code === 0)) {
+    if (profiles.length === 0 && runnable) {
         const textResult = await runHermes(runtime.requested, ['profile', 'list'], 15_000);
         profiles = parseProfileListText(`${textResult.stdout}\n${textResult.stderr}`, resolved.home).slice(0, 50);
     }
@@ -632,12 +654,9 @@ export async function collectHermesState(options = {}, refresh = false) {
                 metadata: { source: 'implicit default profile' },
             }];
     }
-    const gatewayText = `${gatewayResult?.stdout ?? ''}\n${gatewayResult?.stderr ?? ''}`.toLowerCase();
     const gatewayStatus = !installed
         ? 'not_installed'
-        : /running|active|healthy/.test(gatewayText) ? 'running'
-            : /failed|error/.test(gatewayText) ? 'failed'
-                : /inactive|stopped|not running/.test(gatewayText) ? 'inactive' : 'unknown';
+        : parseGatewayStatusText(`${gatewayResult?.stdout ?? ''}\n${gatewayResult?.stderr ?? ''}`);
     const modelProvider = yamlBlockValue(config, 'model', 'provider');
     const modelName = yamlBlockValue(config, 'model', 'default');
     const modelBaseUrl = yamlBlockValue(config, 'model', 'base_url');
@@ -703,7 +722,7 @@ export async function collectHermesState(options = {}, refresh = false) {
     const dashboard = await observeHermesDashboard(resolved.home);
     const state = {
         installed,
-        status: !installed ? 'not_installed' : gatewayStatus === 'running' ? 'running' : configPresent ? 'detected' : 'needs_setup',
+        status: hermesInstallationStatus({ installed, runnable, gatewayStatus, configPresent }),
         installMode: installed ? 'official-script' : 'existing',
         version,
         hermesBin: requested.hermesBin,

package/dist/executors/scheduler-discovery.d.ts

@@ -51,12 +51,23 @@ export declare function stableServiceProperties(raw: string): string;
  * (waiting/running/elapsed) and description change whenever a timer fires. */
 export declare function stableTimerUnitList(raw: string): string;
 /**
- * A process is a possible Hermes runtime when what it executes is Hermes: its
- * executable, the script or module an interpreter runs, or an explicit Hermes
- * home option. Other argument text is data, not identity: an operator's
- * `grep hermes`, a report filter naming a Hermes kind, or a shell whose inline
- * code mentions Hermes is not a runtime (any Hermes it starts is a separate
- * process observed on its own).
+ * Whether a program or script file name is Hermes: the `hermes` CLI and its
+ * `hermes-*`/`hermes_*` shims, or the gateway runner. Only the final path
+ * component counts; a `.hermes` or `hermes` directory is where unrelated
+ * software can live too, so it never identifies a runtime by itself.
+ */
+export declare function hermesProgramName(path: string): boolean;
+/** Whether a Python module (`-m`) is Hermes: `hermes`, `hermes_cli`, `hermes_cli.main`, `hermes_agent`... */
+export declare function hermesModuleName(module: string): boolean;
+/**
+ * A process is a possible Hermes runtime when what it executes is Hermes: the
+ * basename of its executable, the basename of the script or the module an
+ * interpreter runs, or an explicit `--hermes-home` option. Other argument text
+ * is data, not identity: an operator's `grep hermes`, a report filter naming a
+ * Hermes kind, a shell whose inline code mentions Hermes, or unrelated software
+ * installed under a `.hermes` directory is not a runtime (any Hermes it starts
+ * is a separate process observed on its own). Every command the dashboard
+ * recogniser accepts (hermes-dashboard-discovery.ts) is recognised here too.
  */
 export declare function hermesRuntimeCommand(args: string[]): boolean;
 export declare function discoverSchedulerSources(options?: DiscoveryOptions): Promise<{

package/dist/executors/scheduler-discovery.js

@@ -133,38 +133,62 @@ export function stableServiceProperties(raw) {
 export function stableTimerUnitList(raw) {
     return raw.split('\n').map(line => line.trim().split(/\s+/).slice(0, 3).join(' ')).join('\n');
 }
-const HERMES_RUNTIME_TEXT = /(?:hermes|run_gateway\.py)/i;
 const SCRIPT_INTERPRETER = /^(?:python(?:[23](?:\.\d+)?)?|pypy3?|node|bun|deno|bash|sh|dash|zsh)$/;
+/** Interpreter options whose next argument is a value (a preloaded module, a
+ * warning filter), never the script being run. */
+const INTERPRETER_VALUE_OPTIONS = new Set(['-r', '--require', '--import', '--loader', '--experimental-loader', '-C',
+    '--conditions', '--env-file', '--input-type', '-W', '-X', '--check-hash-based-pycs', '-o']);
+const basenameOf = (path) => path.slice(path.lastIndexOf('/') + 1);
 /**
- * A process is a possible Hermes runtime when what it executes is Hermes: its
- * executable, the script or module an interpreter runs, or an explicit Hermes
- * home option. Other argument text is data, not identity: an operator's
- * `grep hermes`, a report filter naming a Hermes kind, or a shell whose inline
- * code mentions Hermes is not a runtime (any Hermes it starts is a separate
- * process observed on its own).
+ * Whether a program or script file name is Hermes: the `hermes` CLI and its
+ * `hermes-*`/`hermes_*` shims, or the gateway runner. Only the final path
+ * component counts; a `.hermes` or `hermes` directory is where unrelated
+ * software can live too, so it never identifies a runtime by itself.
+ */
+export function hermesProgramName(path) {
+    const name = basenameOf(path).replace(/\.(?:py|pyc|js|mjs|cjs|ts|sh|exe)$/i, '');
+    return /^hermes(?:[-_][A-Za-z0-9_.-]*)?$/i.test(name) || /^run_gateway$/i.test(name);
+}
+/** Whether a Python module (`-m`) is Hermes: `hermes`, `hermes_cli`, `hermes_cli.main`, `hermes_agent`... */
+export function hermesModuleName(module) {
+    return /^hermes(?:_[A-Za-z0-9_]*)?(?:\.[A-Za-z0-9_.]*)?$/i.test(module) || /^run_gateway$/i.test(module);
+}
+/**
+ * A process is a possible Hermes runtime when what it executes is Hermes: the
+ * basename of its executable, the basename of the script or the module an
+ * interpreter runs, or an explicit `--hermes-home` option. Other argument text
+ * is data, not identity: an operator's `grep hermes`, a report filter naming a
+ * Hermes kind, a shell whose inline code mentions Hermes, or unrelated software
+ * installed under a `.hermes` directory is not a runtime (any Hermes it starts
+ * is a separate process observed on its own). Every command the dashboard
+ * recogniser accepts (hermes-dashboard-discovery.ts) is recognised here too.
  */
 export function hermesRuntimeCommand(args) {
     const executable = args[0] ?? '';
-    if (HERMES_RUNTIME_TEXT.test(executable))
+    if (hermesProgramName(executable))
         return true;
     if (args.some(arg => /^--hermes-home(?:=|$)/.test(arg)))
         return true;
-    if (!SCRIPT_INTERPRETER.test(executable.split('/').pop() ?? ''))
+    if (!SCRIPT_INTERPRETER.test(basenameOf(executable)))
         return false;
     for (let index = 1; index < args.length; index++) {
         const arg = args[index];
         if (arg === '-m')
-            return HERMES_RUNTIME_TEXT.test(args[index + 1] ?? '');
+            return hermesModuleName(args[index + 1] ?? '');
         if (/^-m./.test(arg))
-            return HERMES_RUNTIME_TEXT.test(arg.slice(2));
+            return hermesModuleName(arg.slice(2));
         // Inline code is not a script identity.
         if (/^-[a-zA-Z]*[ce]$/.test(arg) || ['--command', '--eval', '--print'].includes(arg))
             return false;
         if (arg === '--')
-            return HERMES_RUNTIME_TEXT.test(args[index + 1] ?? '');
+            return hermesProgramName(args[index + 1] ?? '');
+        if (INTERPRETER_VALUE_OPTIONS.has(arg)) {
+            index++;
+            continue;
+        }
         if (arg.startsWith('-'))
             continue;
-        return HERMES_RUNTIME_TEXT.test(arg);
+        return hermesProgramName(arg);
     }
     return false;
 }

package/dist/executors/scheduler-inventory.d.ts

@@ -13,6 +13,16 @@ export interface SchedulerInventoryOptions {
     atSpools?: string[];
     wrapper?: (job: Awaited<ReturnType<ManagedScheduler['job']>> & {}) => string;
 }
+export declare const hermesJobClaimed: (job: Record<string, unknown>) => boolean;
+/** Path-scoped identity of one Hermes cron/jobs.json. Schedules: the canonical
+ * job definitions, so adding, editing or enabling a job is a new source while a
+ * run-state rewrite is not. Claims: the set of jobs currently holding a claim. */
+export declare function hermesJobsIdentity(path: string, value: unknown): {
+    schedulesSha256: string;
+    claimsSha256: string;
+    enabled: number;
+    claims: number;
+};
 export declare function schedulerInventory(options?: SchedulerInventoryOptions): Promise<{
     version: number;
     barrier: {

package/dist/executors/scheduler-inventory.js

@@ -5,6 +5,55 @@ import { join } from 'node:path';
 import { hash } from './execution-supervisor-state.js';
 import { aggregateSchedulerBlockers, boundedSchedulerMemberEvidence, boundedSchedulerRead, discoverSchedulerSources, schedulerContentDigest, schedulerMemberEvidenceDigest, schedulerMembersDigest } from './scheduler-discovery.js';
 import { ManagedScheduler } from './managed-scheduler.js';
+/** Per-job fields Hermes rewrites while running or finishing a job. They are
+ * run state, not schedule definition: excluding them keeps one remembered source
+ * per jobs.json definition instead of one per run. Every other field, including
+ * fields this list does not know, is part of the definition. */
+const HERMES_RUN_STATE_FIELDS = new Set(['next_run_at', 'updated_at', 'run_count', 'runs', 'failure_count',
+    'consecutive_failures', 'fire_claim', 'run_claim']);
+const hermesRunStateField = (key) => key.startsWith('last_') || HERMES_RUN_STATE_FIELDS.has(key);
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalJson);
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.keys(value).sort().map(key => [key, canonicalJson(value[key])]));
+}
+function hermesJobDefinition(job) {
+    const definition = {};
+    for (const [key, value] of Object.entries(job))
+        if (!hermesRunStateField(key))
+            definition[key] = value;
+    // `repeat.times` is configuration; `repeat.completed` is a run counter.
+    if (definition['repeat'] && typeof definition['repeat'] === 'object' && !Array.isArray(definition['repeat'])) {
+        const { completed: _completed, ...repeat } = definition['repeat'];
+        definition['repeat'] = repeat;
+    }
+    return canonicalJson(definition);
+}
+export const hermesJobClaimed = (job) => Boolean(job['fire_claim'] || job['run_claim'] || ['running', 'working'].includes(job['last_status']));
+/** Path-scoped identity of one Hermes cron/jobs.json. Schedules: the canonical
+ * job definitions, so adding, editing or enabling a job is a new source while a
+ * run-state rewrite is not. Claims: the set of jobs currently holding a claim. */
+export function hermesJobsIdentity(path, value) {
+    const document = Array.isArray(value) ? undefined : value && typeof value === 'object' ? value : undefined;
+    const jobs = Array.isArray(value) ? value : document?.['jobs'];
+    if (!Array.isArray(jobs) || jobs.length > 1000 || jobs.some(job => !job || typeof job !== 'object' || Array.isArray(job)
+        || job.enabled !== undefined && typeof job.enabled !== 'boolean' || job.paused !== undefined && typeof job.paused !== 'boolean'))
+        throw new Error('Invalid native jobs');
+    const rows = jobs;
+    const definitions = rows.map(job => JSON.stringify(hermesJobDefinition(job))).sort();
+    // Top-level document fields other than the job list are kept, except its rewrite stamp.
+    const envelope = document ? canonicalJson(Object.fromEntries(Object.entries(document).filter(([key]) => key !== 'jobs' && key !== 'updated_at'))) : null;
+    const claimed = rows.filter(hermesJobClaimed).map(job => ['string', 'number'].includes(typeof job['id']) && String(job['id'])
+        ? 'id:' + String(job['id']) : 'definition:' + hash(JSON.stringify(hermesJobDefinition(job)))).sort();
+    return {
+        schedulesSha256: schedulerContentDigest(JSON.stringify({ domain: 'magnus.hermes-schedules.v1', source: hash(path), envelope, definitions })),
+        claimsSha256: schedulerContentDigest(JSON.stringify({ domain: 'magnus.hermes-claims.v1', source: hash(path), claimed })),
+        enabled: rows.filter(job => job['enabled'] !== false && job['paused'] !== true).length,
+        claims: claimed.length,
+    };
+}
 export async function schedulerInventory(options = {}) {
     const blockers = [];
     const issues = [];
@@ -147,15 +196,14 @@ export async function schedulerInventory(options = {}) {
         if (raw === undefined)
             continue;
         try {
-            const value = JSON.parse(raw);
-            const jobs = Array.isArray(value) ? value : value.jobs;
-            if (!Array.isArray(jobs) || jobs.length > 1000 || jobs.some(job => !job || typeof job !== 'object'
-                || job.enabled !== undefined && typeof job.enabled !== 'boolean' || job.paused !== undefined && typeof job.paused !== 'boolean'))
-                throw new Error('Invalid native jobs');
-            blockContent('NATIVE_HERMES_SCHEDULES', raw, jobs.filter(job => job.enabled !== false && job.paused !== true).length);
-            // Native claim TTL/PID liveness cannot prove descendants stopped. A paused
-            // schedule with any unresolved claim remains uncertain until its owner proves completion.
-            blockContent('NATIVE_HERMES_UNSETTLED_CLAIMS', raw, jobs.filter(job => job.fire_claim || job.run_claim || ['running', 'working'].includes(job.last_status)).length);
+            const identity = hermesJobsIdentity(path, JSON.parse(raw));
+            // Hermes rewrites jobs.json on every run. Evidence and remembered identity
+            // follow the job definitions and the set of claimed jobs, not run state.
+            sources[hash(path)] = schedulerContentDigest(JSON.stringify({ schedules: identity.schedulesSha256, claims: identity.claimsSha256 }));
+            blockers.push(...[{ kind: 'NATIVE_HERMES_SCHEDULES', sourceSha256: identity.schedulesSha256, count: identity.enabled },
+                // Native claim TTL/PID liveness cannot prove descendants stopped. A paused
+                // schedule with any unresolved claim remains uncertain until its owner proves completion.
+                { kind: 'NATIVE_HERMES_UNSETTLED_CLAIMS', sourceSha256: identity.claimsSha256, count: identity.claims }].filter(row => row.count));
         }
         catch {
             issues.push('HERMES_SCHEDULE_INVENTORY_INVALID:' + hash(path));

package/dist/hermes-sync.js

@@ -7,6 +7,7 @@ import { access, chown, chmod, lstat, mkdir, mkdtemp, readFile, readlink, readdi
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
+import { parseGatewayStatusText } from './executors/hermes-gateway-status.js';
 import { childEnvironment } from './utils/child-env.js';
 import { armChildTimeout } from './utils/child-timeout.js';
 // Compare real paths: the service may start this file through a link (node_modules -> current/node_modules).
@@ -667,7 +668,7 @@ async function coreUpdate() {
         const current = (await runAsOwner('/usr/bin/git', home, ['-C', checkout, 'rev-parse', 'HEAD'])).trim();
         evidence.beforeVersion = (await runHermes(bin, home, ['--version'])).trim().slice(0, 100);
         const gatewayBefore = await runHermes(bin, home, ['gateway', 'status']);
-        evidence.beforeGatewayActive = /active|running/i.test(gatewayBefore) && !/inactive|not active|not running|stopped|dead/i.test(gatewayBefore);
+        evidence.beforeGatewayActive = parseGatewayStatusText(gatewayBefore) === 'running';
         const pluginsBefore = await runHermes(bin, home, ['plugins', 'list', '--json']);
         const toolsBefore = await toolsSummary(bin, home);
         if (current === slot.commit) {
@@ -730,7 +731,7 @@ async function coreUpdate() {
         }
         evidence.afterVersion = (await runHermes(bin, home, ['--version'])).trim().slice(0, 100);
         const gatewayAfter = await runHermes(bin, home, ['gateway', 'status']);
-        evidence.afterGatewayActive = /active|running/i.test(gatewayAfter) && !/inactive|not active|not running|stopped|dead/i.test(gatewayAfter);
+        evidence.afterGatewayActive = parseGatewayStatusText(gatewayAfter) === 'running';
         const pluginsAfter = await runHermes(bin, home, ['plugins', 'list', '--json']);
         const before = JSON.parse(pluginsBefore);
         const after = JSON.parse(pluginsAfter);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/magnus-agent",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Magnus node agent: a small daemon that enrolls a Linux host with a magnus-server and runs authenticated health, command, cron, file and skill management, with optional Hermes Agent, Codex and Ardent management.",
   "keywords": [
     "magnus",
@@ -58,7 +58,7 @@
     "clean": "node -e \"const fs=require('node:fs');fs.rmSync('dist',{recursive:true,force:true});fs.rmSync('tsconfig.tsbuildinfo',{force:true})\""
   },
   "dependencies": {
-    "@hivemagnus/magnus-contracts": "1.1.5",
+    "@hivemagnus/magnus-contracts": "1.1.7",
     "@hono/node-server": "^2.1.5",
     "dotenv": "^18.0.9",
     "hono": "^4.13.16",