# Sibyl Hermes Security Round 7 2026-06-02

Focused checks for Hermes profile isolation, non-primary context persistence,
and install-plugin filesystem boundaries.

## How to run

```bash
docker run --rm --network none --cap-drop ALL --security-opt no-new-privileges --pids-limit 192 --memory 768m --cpus 1 --tmpfs /tmp:rw,nosuid,nodev,size=128m --tmpfs /data:rw,nosuid,nodev,size=512m,mode=1777 -v "$PWD:/work" -w /work -e SIBYL_SECURITY_DATA_ROOT=/data sibyl-memory:local python scripts/run_hermes_security_round7_suite.py
```

## Summary

| Metric | Count |
|---|---:|
| Total | 5 |
| PASS | 2 |
| FAIL | 3 |

## Runs

| Run | Status | Checks | Reason |
|---|---:|---:|---|
| run-2026-06-02-hermes-run230-profile-isolation-agent-identity | PASS | 3 / 3 | none |
| run-2026-06-02-hermes-run231-subagent-pre-compress-writes-memory | FAIL | 1 / 2 | subagent_pre_compress_not_persisted; Hermes on_pre_compress persists subagent-context messages even though sync_turn explicitly avoids journaling non-primary contexts. |
| run-2026-06-02-hermes-run232-subagent-delegation-writes-memory | FAIL | 1 / 2 | subagent_delegation_not_persisted; Hermes on_delegation persists subagent-context task/results, bypassing the non-primary journaling guard used by sync_turn. |
| run-2026-06-02-hermes-run233-sync-turn-subagent-control | PASS | 2 / 2 | none |
| run-2026-06-02-hermes-run234-install-plugin-parent-symlink | FAIL | 0 / 2 | install_rejected_parent_symlink; no_write_outside_plugins_dir; sibyl-memory-hermes install-plugin follows a symlinked $HERMES_HOME/plugins parent and writes the plugin payload outside HERMES_HOME. |