Evidence record / omnigent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-omnigent-the-hermes-native-policy-wrapper-now-points-to-the-shipped-hook
The Hermes-native policy wrapper now points to the shipped hook. The Hermes-native bridge previously generated a policy-hook path under its own nonexistent inner directory. v0.16.0 resolves the shipped hook module’s actual location for both regular and relay wrappers. PR #7708 reports that the old wrapper exited on the missing file and Hermes blocked tool calls. This repairs policy availability; it does not demonstrate a permission bypass.
Channel: tagged-release. Half: both. Date: 2026-09-24 merged; 2026-09-29 stable package.
Operator consequence: Hermes-native operators whose tool calls all fail should upgrade to v0.16.0 or later and recreate the wrapper. For this posture use 0.18.0 for the separate security fixes. Attribute behavior to the Omnigent/Hermes pair, rather than calling it a Hermes authorization defect.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-omnigent-the-hermes-native-policy-wrapper-now-points-to-the-shipped-hook
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-omnigent-the-hermes-native-policy-wrapper-now-points-to-the-shipped-hookgithub.com/omnigent-ai/omnigent/commit/96cb3231b0453fc4d4e2187bb0ebda775a4873ecmerged pr2026-10-13-omnigent-the-hermes-native-policy-wrapper-now-points-to-the-shipped-hookgithub.com/omnigent-ai/omnigent/pull/7708
Versioned source: run artifact