{"repo":"NousResearch/hermes-agent","public_id":"116313","display_label":"Block ambient cloud credentials in multiplexed profiles","summary":"These issues and PRs address a security concern where multiplexed profiles could inherit or mint cloud credentials (Azure/AWS) from the launch profile's ambient credential chain. The work focuses on refusing or isolating such credential access when a multiplexed profile lacks its own explicit credentials.","subsystem":null,"counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":116963,"merged_at":"2026-09-20T19:09:48+00:00"},"resolution":{"state":"resolved","by":"pr-116963"},"freshness":{"state":"verified","last_verified_at":"2026-09-20T19:09:48+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":116313,"pr_number":116963,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-20T19:09:48+00:00"}],"members":[{"kind":"issue","number":116313,"title":"Multiplexed profiles can mint the launch profile's ambient Azure/AWS credential chain","url":null,"state":"closed"},{"kind":"pr","number":116317,"title":"fix(agent): refuse ambient credential chains for multiplex profiles","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"297ebd506e9b","number":0},{"kind":"pr","value":"#116963","number":116963},{"kind":"pr","value":"#116313","number":116313},{"kind":"pr","value":"#116317","number":116317}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":116370,"title":"fix(agent): isolate ambient cloud credentials across multiplexed profiles","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"297ebd506e9b","number":0},{"kind":"pr","value":"#116963","number":116963},{"kind":"pr","value":"#116313","number":116313},{"kind":"pr","value":"#116317","number":116317}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":116963,"title":"fix(agent): multiplexed profiles without their own Azure/AWS credentials are refused instead of minting the launch identity (#116313, salvage #116317)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/azure_identity_adapter.py","agent/bedrock_adapter.py","tests/agent/test_azure_identity_adapter.py","tests/agent/test_bedrock_adapter.py","website/docs/developer-guide/multiplexing-gateway.md","website/docs/guides/azure-foundry.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}