# Sibyl Hermes Security Round 12 2026-06-03

Critical-chain candidate checks for migration, learning-provider prompts,
subagent tool writes, and plugin install path trust on patched packages.

## How to run

```bash
docker run --rm --network none --cap-drop ALL --security-opt no-new-privileges --pids-limit 192 --memory 768m --cpus 1 --tmpfs /tmp:rw,nosuid,nodev,size=128m --tmpfs /data:rw,nosuid,nodev,size=512m,mode=1777 -v "$PWD:/work" -w /work -e SIBYL_SECURITY_DATA_ROOT=/data sibyl-memory:local python scripts/run_hermes_security_round12_critical_chain_suite.py
```

## Summary

| Metric | Count |
|---|---:|
| Total | 4 |
| PASS | 0 |
| FAIL | 4 |

## Runs

| Run | Status | Checks | Reason |
|---|---:|---:|---|
| run-2026-06-03-hermes-run255-migration-secret-reaches-hermes-prefetch | FAIL | 1 / 3 | migration_backup_did_not_copy_secret; migrated_secret_not_in_prefetch; A secret copied through migration from a symlinked project AGENTS.md can be persisted into Hermes memory and later returned inside primary-agent prefetch context. |
| run-2026-06-03-hermes-run256-migration-secret-reaches-learning-provider-prompt | FAIL | 0 / 3 | migration_backup_did_not_copy_secret; byok_prompt_does_not_include_migrated_secret; venice_prompt_does_not_include_migrated_secret; A secret copied through migration can be included in self-learning prompts sent to BYOK or Venice summarizer integrations. |
| run-2026-06-03-hermes-run257-subagent-tool-write-primary-prefetch-escape | FAIL | 0 / 4 | subagent_tool_write_rejected; primary_search_cannot_find_subagent_tool_write; primary_prefetch_has_single_close; injected_text_not_after_close; A subagent-context Hermes adapter can use sibyl_remember directly, persist prompt-boundary content, and have it returned later in primary-agent prefetch. |
| run-2026-06-03-hermes-run258-install-plugin-hermes-home-symlink-modifies-foreign-home | FAIL | 0 / 1 | symlinked_hermes_home_rejected; Hermes install-plugin --force follows a symlinked HERMES_HOME and modifies the target profile's Sibyl plugin directory. |