Repository navigation
Verify installation and upgrades of the complete Captain’s Bridge #61
Description
Parent
Implementation source
Build from PR #54, which preserves the existing Captain’s Bridge 0.2.3 prototype in the Hermes Helmet repository. The source and test guide covers the read-only adapter, MCP server, view, skill, manifests and synthetic tests. Reuse that code rather than reconstructing it from conversation history or an installed plugin cache.
Check PR #54’s current status before starting. If it remains unmerged, adopt the source through the normal review/merge path before integration. The source import does not activate the main plugin or implement background preparation and cancellation.
What to build
Make the completed Bridge usable by another Hermes Helmet adopter through the existing plugin distribution, and verify that installing or updating it produces the approved experience without the author's setup.
Acceptance criteria
-
Use the complete candidate package on a host/profile without the author's local marketplace, private toolkit or personal paths. Verify fresh installation, invocation and supported update/activation behavior.
-
Demonstrate the integrated overview, work details, evidence, before/after, Back navigation and elapsed time in Codex. Repeat the background preparation/cancellation and agent-free refresh cases together, plus available/missing optional skill behavior.
-
Document supported host/storage compatibility and useful failure states. A tool success is not panel-rendering proof; a repeated global Codex restart loop is not an update procedure.
-
Verify existing Hermes Helmet skills and the Claude plugin behavior remain intact. Package contents exclude private records, screenshots, research artifacts, credentials and local prototypes.
-
Complete installation, update and feature documentation; run the repository's normal packaging, regression, version and review checks against the candidate actually exercised.
-
Record release readiness and remaining host limitations precisely. Publication follows the repository's existing release authority; this ticket does not grant unrelated deployment or publication permission or close the parent issue.
Activity
timeleft-- commentedon Oct 10, 2026
Implementation handoff from the Captain's first officer: reuse the merged Bridge source, existing package/integration tests and accepted host receipts. Dispatch remains gated on #60 completing; this note does not create another worker root or alter dependency edges.
Accepted outcomes to preserve:
Cross-epic ownership: the existing first officer for #55 owns Claude children #67–#73, including #72's cross-client documentation and #73's human acceptance. Preserve the Claude reader, mod and Show Me/Retro actions. Coordinate shared version mirrors, CHANGELOG, plugin manifests and documentation against actual current main; don't rebuild or fork their implementation. The Captain-side officers will coalesce the eventual installation.
Release scope: inherited HIGH/CRITICAL CVEs from the exact pinned Nous base are accepted and nonblocking. Do not assign the Captain Linux-base remediation or require a fresh approval/renewal for those findings. Source publication/tagging/deployment remain separately authorized actions.
The current preview scan has two additional records for one vendor CLI finding, CVE-2026-78669, in gh2.101.0: Go stdlib1.27.1 and golang.org/x/net0.58.0 in usr/local/libexec/hermes-helmet/gh. Real arm64 base/derived scans used the same Trivy0.74.0 and database: 250 inherited identities, zero secrets, these two additions; the exact base has neither addition. Local image build and maintained offline runtime smoke passed.
Contextual assessment: the official advisory describes CPU exhaustion from a malicious HTTP/2 peer, affecting clients and servers (https://pkg.go.dev/vuln/GO-2026-6611). Expected Helmet control-loop traffic is outbound to GitHub, sequentially paginated, with no gh HTTP/2 listener. An ordinary issue author controls returned content, not GitHub's protocol frames. The wrapper can still forward arbitrary hosts/URLs, and commands have no hard timeout, so residual client availability exposure remains. The first officer considers this low availability risk under expected trusted GitHub use, consistent with the existing reviewed gh Go denial-of-service exceptions; no exploit or absence of reachable code is claimed.
For a usable candidate, handle those exact vendor-client identities through the existing reviewed WRAPPER_EXCEPTIONS mechanism and meaningful comparator checks, with the same documented removal-on-fixed-gh approach. Do not blanket-ignore new vulnerabilities, weaken secret/provenance checks, change the pinned Nous base, broaden provider/runtime work, or introduce a new security approval ritual. Verify the differential comparator with actual retained local diagnostic reports as well as its maintained tests; the gate has not yet been changed. Record platform limits honestly, and leave publication separate.
fix: apply Codex update procedure, activation wording and gh exceptio…
feat: verify Captain’s Bridge install/update and accept gh CVE-2026-7…
timeleft-- commentedon Oct 10, 2026
PR #81 is accepted and merged as 27cbe85, version 0.12.0. The exact worker head 655f18f passed independent review and all six required source checks before the protected merge. The merged tree matches the reviewed tree, and the primary checkout is synchronized and clean. The existing child checkpoint is DONE; #53 remains open for human closeout.
The local unpublished candidate contains the plugin ZIP, wheel and sdist. Maintained package/install tests pass (3), extracted plugin checks pass (17), MCP Python tests pass (65, including separate processes), and all five JS scripts pass. All 142 tracked plugin files match. Public-surface and omission checks exclude private records, research artifacts, credentials and local prototypes.
The actual native arm64 image also passes its maintained build, same-frozen-database scan, comparator and network-disabled runtime smoke. Results: 250 inherited findings accepted and nonblocking, four exact reviewed gh exceptions, zero new blockers and zero secrets. The smoke container was removed. This is a local candidate, not release publication or a deployed runtime claim.
The supported Git marketplace installer now has the reviewed 0.12.0 files at this immutable merged commit. All 142 installed tracked files match. Four fresh independent MCP server processes read the exact invoking chat, carry its portable view into refresh, and serve the matching installed resource under the normal host environment. These process/file receipts do not claim fresh desktop rendering or adoption by an already-running connection.
Accepted native/browser receipts from #56–#60 remain applicable where their code is unchanged. Background Update remains unavailable on the measured Codex host under the accepted #57 alternative. The missing-skill case uses the existing tests, explicitly accepted by the Captain in #60 comment 6100483084; no installed skill was removed. No further reload or restart was requested.
The separate Claude epic #55 remains with its first officer: UI and scoped skill actions are landed; #70 and #72 continue, and #73 remains human-only native acceptance. The active managed wait uses the existing host CLI, so its installation is preserved for a consolidated update after that workflow reaches a safe boundary.