{"repo":"NousResearch/hermes-agent","public_id":"93689","display_label":"Scope run-scoped API routes to calling profile","summary":"These members identify and address a bug where run-scoped API endpoints were authenticated but not properly scoped to the owning or calling profile, enabling unintended cross-profile access. Fixes are applied at both the gateway and API server layers.","subsystem":null,"counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":101256,"merged_at":"2026-09-02T13:17:48+00:00"},"resolution":{"state":"resolved","by":"pr-101256"},"freshness":{"state":"verified","last_verified_at":"2026-09-02T13:17:48+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":90415,"pr_number":101256,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-02T13:17:48+00:00"},{"issue_number":93689,"pr_number":101256,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-02T13:17:48+00:00"},{"issue_number":94071,"pr_number":101256,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-02T13:17:48+00:00"}],"members":[{"kind":"issue","number":93689,"title":"multiplex_profiles: run-scoped endpoints are authenticated but not profile-scoped — cross-profile stop reproduced","url":null,"state":"closed"},{"kind":"pr","number":93704,"title":"fix(api_server): scope run-scoped endpoints to the owning profile","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"16370ae5394","number":0},{"kind":"pr","value":"#101256","number":101256}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":93747,"title":"fix(gateway): scope run-scoped API routes to the calling profile","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"16370ae5394","number":0},{"kind":"pr","value":"#101256","number":101256}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":101256,"title":"fix(api_server): runs are owned by the requesting profile; handoff/readiness answer for the routed profile (#93689 #90415, salvage #93747 #100054 #94147)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["gateway/platforms/api_server.py","gateway/platforms/api_server_runs.py","hermes_cli/main.py","tests/gateway/test_api_server.py","tests/gateway/test_api_server_runs.py","tests/test_tui_gateway_server.py","tui_gateway/methods_config.py","tui_gateway/methods_session.py","website/docs/user-guide/features/api-server.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}