# NousResearch/hermes-agent · Fix state.db file permissions to 0600

## Open now

- Nothing open on GitHub.

These items address a security concern where state.db (and its WAL sidecars) are created with the process umask default (0644) rather than the intended restrictive 0600 permissions. The parent directory's 0700 mode is currently the only access control in place.

## TL;DR

- 4 member(s): 0 open issue(s), 1 closed issue(s), 0 open PR(s), 1 merged PR(s), 2 PR(s) closed without merging.
- A fix was merged to main in PR #109509. Verify it addresses your case.
- **Recommended:** read PR #109509 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `resolved` · deciding PR(s): `pr-109509`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.50`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #59706: state.db is created 0644 (process umask), not 0600 -- the 0700 parent dir is its only protection

## Prior & competing PRs

- **#109509: security: state.db, snapshots and memory locks are owner-only regardless of umask (salvage #102878 + #59716, goose#11613)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`
  - files: `contributors/emails/hermes-fleet-fix@localhost`, `hermes_cli/backup.py`, `hermes_state.py`, `tests/hermes_cli/test_backup_stability.py`, `tests/test_hermes_state.py`, `tests/tools/test_async_delegation.py`, `tests/tools/test_memory_tool.py`, `tools/async_delegation.py`, `tools/memory_tool_store.py`
- **#59716: security(state): create state.db and WAL sidecars at 0600, not process umask**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `d21913b09cce`, `#109509`
- **#59717: fix(hermes_state): ensure state.db created with 0o600 permissions, not 0o644 umask default**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#59716`, `#59706`

## Fix status

- Merged to main in PR #109509 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-09-13`.
- Subsystem: `agent`