Security fixes are provided for the latest 2.1.x release on supported Python versions and Hermes Agent 0.18.1 or newer.

Windows Python 3.12 receives import, configuration, parser, and state compatibility coverage. The primary production worker and process-lock deployment target is Linux or WSL with one Hermes gateway process.

Use private vulnerability reporting in the icerain-cmd/hermes-hegi Security tab. Include the affected HEGI and Hermes versions, operating system, a minimal reproduction, and the security impact. Replace operational identifiers and paths with placeholders.

If private reporting is unavailable, contact the maintainer privately through the GitHub account before sending sensitive details. A public issue may describe a non-sensitive compatibility problem, but it must not contain a token, API key, real professor or chat ID, raw Telegram update, .env, config file, state database, WAL/SHM file, archive, Memory Forest path/data, approval record, or unredacted log.

Do not test a suspected vulnerability against another person's bot, chat, Hermes runtime, or Memory Forest. Use temporary runtimes and fake backends.

A Memory Forest commit requires all of these controls:

• a Telegram event in the one configured group chat;
• a source user in the explicit professor allowlist;
• an exact supported command;
• a unique Telegram message ID;
• a reply to a HEGI report or an explicit meeting_id, with conflict rejection when both are present;
• an existing, reported meeting and an unambiguous target Draft;
• a fresh Memory Forest search;
• validated Draft structure;
• separate approve and commit calls;
• post-commit validate, audit, index, and backup; and
• persisted idempotency and restart recovery.

The following values are mandatory:

memory:
  auto_commit: false
  auto_draft: false
  require_professor_approval: true
  approval:
    allow_autonomous_commit: false

HEGI rejects configuration that weakens the complete set of required approval and post-commit flags. Duplicate, conflicting, ambiguous, low-recall, validation-failed, and no_memory cases stop closed.

Approve and commit are not exposed as Hermes agent tools. The synchronous pre_gateway_dispatch hook performs authentication and a short SQLite enqueue only. The embedded worker runs Memory, network, and private CLI work after the hook returns.

Store TELEGRAM_BOT_TOKEN in the private runtime .env referenced by telegram.curator_env. Do not put it in HEGI YAML, source code, shell examples, GitHub Actions secrets without an approved release need, or diagnostic artifacts. Restrict the environment file and generated config to the runtime account.

The Telegram adapter retains the token in memory for a request and must not include it in an exception or log. Diagnostic export redacts token-shaped values, user/chat-shaped identifiers, and recent error text. Redaction reduces risk but does not replace a human review before sharing.

Rotate a token at the Telegram provider if it may have appeared in terminal output, a repository, an issue, a message, or a backup with unintended access. Remove the exposed artifact after rotation, but assume repository history and third-party caches retain it.

Treat these as sensitive even when they contain no credential:

• <runtime-home>/hegi/config.yaml;
• state.db, SQLite WAL, and SHM files;
• approval and notification queues;
• Telegram delivery records;
• meeting archives and source message bodies;
• Memory Forest contents and real filesystem paths;
• run logs and dead letters; and
• migration and rollback backups.

Keep them outside the plugin repository. Use SQLite .backup for a live state database, validate copies with PRAGMA quick_check, and protect backup directories from group and world access.

HEGI has no hard dependency on hermes-agent and must not import Hermes private modules from production code. It uses ctx.llm, ctx.dispatch_tool, CLI registration, and pre_gateway_dispatch. Compatibility diagnostics may inspect the host through importlib during an explicit doctor run.

A missing host hook must be fixed upstream as a small generic Hermes change. Do not ship a HEGI-specific monkey patch, edit gateway/run.py during installation, or copy code into an installed Hermes package.

Automated tests and temporary-environment smoke tests use fake Memory backends and do not perform a live commit. A Telegram report without a later approval is also not a commit test.

Do not claim a live professor-authorized Memory Forest commit unless a new authenticated professor approval message arrived during that verification run and the commit plus validate, audit, index, and backup results were observed. Existing approval history, manual CLI execution, and a replayed Telegram event do not satisfy this boundary.