{"repo":"NousResearch/hermes-agent","public_id":"59706","display_label":"Fix state.db file permissions to 0600","summary":"These items address a security concern where state.db (and its WAL sidecars) are created with the process umask default (0644) rather than the intended restrictive 0600 permissions. The parent directory's 0700 mode is currently the only access control in place.","subsystem":"agent","counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":109509,"merged_at":"2026-09-13T03:43:42+00:00"},"resolution":{"state":"resolved","by":"pr-109509"},"freshness":{"state":"verified","last_verified_at":"2026-09-13T03:43:42+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":59706,"pr_number":109509,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-13T03:43:42+00:00"}],"members":[{"kind":"issue","number":59706,"title":"state.db is created 0644 (process umask), not 0600 -- the 0700 parent dir is its only protection","url":null,"state":"closed"},{"kind":"pr","number":59716,"title":"security(state): create state.db and WAL sidecars at 0600, not process umask","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"d21913b09cce","number":0},{"kind":"pr","value":"#109509","number":109509}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":59717,"title":"fix(hermes_state): ensure state.db created with 0o600 permissions, not 0o644 umask default","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#59716","number":59716},{"kind":"pr","value":"#59706","number":59706}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":109509,"title":"security: state.db, snapshots and memory locks are owner-only regardless of umask (salvage #102878 + #59716, goose#11613)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["contributors/emails/hermes-fleet-fix@localhost","hermes_cli/backup.py","hermes_state.py","tests/hermes_cli/test_backup_stability.py","tests/test_hermes_state.py","tests/tools/test_async_delegation.py","tests/tools/test_memory_tool.py","tools/async_delegation.py","tools/memory_tool_store.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}