[Ubuntu 26.04][Sandbox] nemohermes recover and connect --probe-only exit 1 reporting a health failure while status, doctor, and the dashboard all report the same sandbox healthy

[wangericnv]

Description

For a Hermes Agent sandbox, nemohermes {sandbox} recover and nemohermes {sandbox} connect --probe-only both print that the probe succeeded and that the gateway is running, then immediately fail with final launch-readiness validation failed due to health and exit 1.

At the same moment, every other health surface the product exposes for that same sandbox reports it healthy: status shows Phase Ready / Inference healthy / Hermes Agent running, doctor exits 0 with Summary: healthy, the onboarding that created it printed Hermes Agent gateway is healthy and Deployment verified, and the dashboard answers HTTP 200.

Only the recovery path's own readiness validation disagrees. Because it exits non-zero, any script or operator using the documented recovery command sees a healthy sandbox reported as failed, with no indication of what is actually unhealthy.

This is agent-specific, not platform-specific: on the same host, same version, and same moment, the OpenClaw control (nemoclaw {sandbox} recover) exits 0. A Deep Agents Code sandbox on a separate host also exits 0. Only the Hermes Agent path fails.

Platform scope: Reproduced on Ubuntu 26.04 x86_64 on two independent hosts. Not platform-specific — the OpenClaw and Deep Agents Code variants pass on the same platform, so the failure tracks the Hermes Agent path rather than the OS.

Regression: Unknown — this flow was not exercised on an earlier build for the Hermes Agent variant.

Not a duplicate of the earlier "launch-readiness evidence is unavailable on this platform" defect (#9278): that condition reports missing platform evidence, its fix (#9282, merged 2026-08-17) is contained in the v0.0.111 tag used here, and the OpenClaw path on this host now exits 0. The failure reported here is a different message (failed due to health), on a different agent path, in a build that already carries that fix.

Environment

Device:        x86_64 Ubuntu server
OS:            Ubuntu 26.04 LTS
Architecture:  x86_64
Node.js:       v22.23.2
npm:           10.9.8
Docker:        Docker version 29.6.1, build 8900f1d
OpenShell CLI: openshell 0.0.101
NemoClaw:      nemoclaw v0.0.111
Agent:         Hermes Agent v0.19.0 (2026.7.20)

Steps to Reproduce

1. Onboard a Hermes Agent sandbox. Onboarding reports Hermes Agent gateway is healthy and Deployment verified.

   nemohermes onboard --non-interactive --name {sandbox} --no-gpu

2. Confirm the product considers the sandbox healthy:

   nemohermes {sandbox} status
   nemohermes {sandbox} doctor ; printf 'doctor exit=%s\n' "$?"
   curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:{dashboard port}

3. Run the documented recovery command and capture its status:

   nemohermes {sandbox} recover ; printf 'recover exit=%s\n' "$?"

4. Run the probe form and capture its status:

   nemohermes {sandbox} connect --probe-only ; printf 'probe exit=%s\n' "$?"

5. Control — repeat steps 1-3 on the same host with the OpenClaw variant (nemoclaw onboard / nemoclaw {sandbox} recover) and observe exit 0.

Expected Result

recover and connect --probe-only agree with the product's other health surfaces. When the gateway is confirmed running and status, doctor, and the dashboard all report the sandbox healthy, the recovery path reports success and exits 0.

If the recovery path genuinely detects an unhealthy condition that the other surfaces miss, it should name the failing check so an operator can act on it, and doctor should not simultaneously exit 0 with Summary: healthy.

Actual Result

Both commands report the probe succeeding and then fail on their own readiness validation, exiting 1, while every other surface reports the sandbox healthy. The message identifies "health" as the cause but names no failing check.

Logs

# Onboarding claims health
Hermes Agent gateway is healthy
Deployment verified

# status - healthy
$ nemohermes {sandbox} status
Phase: Ready | Inference: healthy | Harness: Hermes Agent (gateway)
Agent: Hermes Agent v0.19.0 | Hermes Agent: running

# doctor - healthy, exit 0
$ nemohermes {sandbox} doctor ; printf 'exit=%s\n' "$?"
[ok] Agent version: Hermes Agent v0.19.0
Summary: healthy
exit=0

# agent binary inside the sandbox responds
$ nemohermes {sandbox} exec -- hermes --version ; printf 'exit=%s\n' "$?"
Hermes Agent v0.19.0 (2026.7.20)
exit=0

# dashboard responds
$ curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:{dashboard port}
200

# recover - contradicts all of the above, exit 1
$ nemohermes {sandbox} recover ; printf 'exit=%s\n' "$?"
Probe complete: Hermes Agent gateway is running in '{sandbox}'; restored dashboard port forward.
Probe failed: final launch-readiness validation failed due to health.
exit=1

# same failure via the probe form
$ nemohermes {sandbox} connect --probe-only ; printf 'exit=%s\n' "$?"
Probe failed: final launch-readiness validation failed due to health.
exit=1

# OpenClaw control on the same host, same version, same moment
$ nemoclaw {control sandbox} recover ; printf 'exit=%s\n' "$?"
exit=0

[wangericnv]

Duplicate of #9716 — same report, created twice by a tooling retry on my side. Tracking in #9716.