Add fail-closed Relay and Switchyard readiness to Classic Hermes #13864

Parent epic: #7937

Accepted scope decision

• Decision: Accept — host-only verification for Classic Hermes adaptive routing.
• Reason: NemoClaw verifies the deployment inputs and OpenShell state it owns. Hermes remains responsible for native Relay activation and request execution.
• Placement: existing NemoClaw configuration, startup, verification, status, and recovery paths. Routing remains disabled by default.
• Accountable maintainer: @rsliter, the issue assignee.
• Validation plan: focused predicate and ordering tests, real filesystem/process tests for configuration publication and restart guards, and integration evidence for bounded diagnostics and routing-disabled regressions.
• This decision supersedes this issue's earlier requirement to attest to Relay/Switchyard activation inside the supervised Hermes process. It does not amend sibling issues or establish general availability for the parent epic.

Outcome

Classic distinguishes adaptive-routing preflight, ordinary Hermes gateway health, and observed request outcomes. NemoClaw withholds its own verification inference requests when required host-side checks fail. Observable startup and request failures produce actionable, non-secret diagnostics.

Host-side success means the intended deployment inputs passed validation and the gateway passed its ordinary health checks. It does not prove that Hermes consumed those inputs, activated Switchyard, or used the intended route for a successful request. Silent runtime bypass may be undetectable. This issue does not guarantee rejection of every external Hermes request after a runtime failure.

Implementation

• Verify the installed Switchyard manifest and native library against the packaged artifact identities and check expected runtime/package compatibility without claiming in-process activation.
• Validate the generated Relay activation and complete Switchyard deployment through the installed upstream contracts without classifier or target requests. Confirm the configured llm-classifier route and NemoClaw-owned role invariants without copying the upstream deployment schema.
• Consume the accepted onboarding and provider contracts from Add Switchyard onboarding configuration and adaptive Hermes routing #13862 and Bind adaptive Switchyard targets and judge through OpenShell #13863. Compare efficient, capable, and explicit logical judge roles with fresh observed OpenShell provider bindings.
• Use capable-as-judge when reuse is qualified. Otherwise require the dedicated judge selection. Never infer an unrecorded judge or choose a hidden fallback.
• Verify credential-reference/placeholder configuration and effective network policy for every physical provider. Raw credentials remain in OpenShell custody; readiness does not retrieve them.
• Reuse Add Switchyard onboarding configuration and adaptive Hermes routing #13862's generated activation/deployment pair and existing runtime configuration guards. Protect files and containing directories against gateway-user modification.
• Validate the complete proposed pair, confirm the gateway is stopped before replacement, install and verify the pair, then start the gateway. Reject incomplete or mismatched pairs after interrupted publication. Do not overwrite configuration under a running gateway.
• Bind the expected startup configuration identity to the tracked process/start identity. Include relevant package, configuration, provider, role, credential-reference, and policy identities. This is an expected startup configuration identity, not an activation attestation.
• Recheck relevant identities before accepting host-side verification. Restart or relevant configuration/provider/policy changes invalidate prior evidence. Missing, ambiguous, stale, or unavailable required evidence blocks NemoClaw verification probes rather than triggering automatic repair or alternate routing.
• Preserve existing gateway process/listener identity checks and ordinary health behavior. Keep routing preflight, gateway health, and request outcomes separate across onboarding, startup, restart/recovery, and status consumers.
• Report bounded failure reasons and direct operators to existing Hermes gateway logs and applicable diagnostics. Distinguish a withheld probe from a request that was sent and failed. Attribute failures to a component only when evidence supports it. Keep authenticated diagnostics available and avoid repetitive log spam.
• Preserve ordinary Hermes readiness when routing is disabled. Missing routing files must not be interpreted as disabled when persisted intent requests routing.

Acceptance criteria

• Routing preflight passes only when required package, activation/deployment, route, target/judge, credential-reference, and effective-policy checks succeed against consistent observed state.
• Failed, ambiguous, stale, or unavailable required preflight evidence prevents NemoClaw's verification inference request. Rejection tests prove zero classifier and target requests from that verification flow.
• Output distinguishes routing preflight, gateway health, and observed request results. It never represents host-only checks or a successful inference response as proof of supervised Relay/Switchyard activation or the internal routing path.
• The efficient, capable, and judge roles match accepted intent and observed provider state. Qualified capable-as-judge reuse is explicit; otherwise a dedicated judge is required. Missing, hidden, ambiguous, incompatible, or stale roles fail preflight.
• The activation/deployment pair is protected against gateway-user modification, validated together, and replaced only while the gateway is stopped. Interrupted or mixed-pair publication cannot pass startup validation.
• Restart and relevant configuration, provider, credential-reference, or policy changes invalidate prior verification. Startup and recovery require fresh checks rather than reuse of stale success.
• Observable gateway startup and request failures return actionable, bounded diagnostics with an investigation location. Diagnostics say a request was blocked or withheld only when NemoClaw actually withheld it, and do not guess an unobserved runtime failure's cause.
• Output, logs, and evidence contain no raw credentials, provider response bodies, prompts, or private classifier reasoning.
• Routing-disabled sandboxes retain ordinary Hermes readiness behavior, and required process-identity and configuration protections remain intact.
• The implementation adds no Hermes patch, backport, upstream dependency change, second Relay lifecycle, sidecar, copied routing algorithm, hot reload, automatic repair, or new provider retry/fallback loop.

Dependencies and exclusions

• Package Switchyard plugin 0.3.0 for Classic Hermes #13861 / feat(hermes): package released Switchyard 0.3.0 #13879: released package, merged.
• Add Switchyard onboarding configuration and adaptive Hermes routing #13862 / feat(hermes): add adaptive Switchyard onboarding #13982: accepted input, generated configuration, persistence, and configuration publication.
• Bind adaptive Switchyard targets and judge through OpenShell #13863: provider observations, explicit role resolution, and judge-reuse qualification.
• Enforce Switchyard credential, network, and failure boundaries #13865: OpenShell credential/network enforcement and routed-request failure behavior. Host-only checks in this issue do not replace that enforcement.
• Prove adaptive Classic Hermes Switchyard routing with live E2E #13866: broader adaptive-flow qualification.
• Portable activation, a runtime activation attestation, silent-bypass detection, and new per-request Hermes routing enforcement are outside this issue.