Hermes E2E cannot read the managed service environment after per-sandbox API ports

[cv]

Investigation Summary

• Hermes MCP and related Hermes paths passed at commit 9df101e8 in run 31659712185.
• The first full execution at commit a9affdf6 failed after PR fix(sandbox): give each Hermes sandbox its own OpenAI-compatible API port #8577.
• PR fix(sandbox): give each Hermes sandbox its own OpenAI-compatible API port #8577 added the failing read of /proc/<service-manager-pid>/environ.
• Current Hermes MCP transactions fail with PermissionError: [Errno 13].
• The Hermes native GPU path also stopped reaching its gateway after this boundary.

Description

Hermes must discover its per-sandbox public API port without reading a protected process environment across identities.

The current transaction helper reads the managed service process environment from /proc. OpenShell denies that read in live sandboxes. Hermes MCP configuration then fails even when the gateway process exists.

The related native GPU path also times out while it waits for the Hermes gateway. Confirm whether both symptoms share the new port-discovery boundary.

Reproduction Steps

1. Check out commit 626b75d0a37e4dfe97caf27ac5d921e5069c405e.
2. Run the Hermes MCP bridge target against OpenShell v0.0.101.
3. Add two MCP servers concurrently.
4. Observe both transactions fail while reading /proc/<pid>/environ.
5. Run the native Hermes GPU startup target and inspect the gateway startup evidence.

Environment

• Last executed pass: https://github.com/NVIDIA/NemoClaw/actions/runs/31659712185
• First failing boundary: https://github.com/NVIDIA/NemoClaw/actions/runs/31680950612
• Current MCP failure: https://github.com/NVIDIA/NemoClaw/actions/runs/31743399726/job/94603992012
• Current native GPU failure: https://github.com/NVIDIA/NemoClaw/actions/runs/31743399726/job/94603991915
• Likely introducer: fix(sandbox): give each Hermes sandbox its own OpenAI-compatible API port #8577

Debug Output

PermissionError: [Errno 13] Permission denied: '/proc/38/environ'
Hermes Agent gateway did not respond within 90s

Acceptance Evidence

• Hermes obtains the public API port through a readable, identity-bound source.
• Port discovery rejects stale or untrusted gateway identity.
• Concurrent Hermes MCP mutations pass.
• Hermes full and security E2E pass.
• Native Hermes GPU startup reaches a stable ready state, or a separate confirmed cause receives its own issue.

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate