[Hermes] Langfuse plugin cannot use OpenShell-managed credentials

[prekshivyas]

Investigation Summary

• In NemoClaw v0.0.92, the bundled Hermes v2026.7.1 Langfuse plugin rejects openshell:resolve:env:... values before constructing the Langfuse client.
• OpenShell v0.0.85 can rewrite resolver placeholders embedded in Basic authentication at egress.
• Raw Langfuse keys in /sandbox/.hermes/.env make tracing work but bypass NemoClaw's sandbox credential boundary.
• NemoClaw does not currently provide a complete managed Langfuse provider, endpoint-policy, configuration, and E2E path.
• Maintainers need to decide whether Langfuse becomes a supported Hermes integration; an upstream Hermes change may complement but does not replace the NemoClaw integration work.

Description

Hermes's bundled Langfuse plugin cannot initialize with credentials registered through NemoClaw/OpenShell. The sandbox correctly sees resolver placeholders, but Hermes requires the public and secret values to begin with pk-lf- and sk-lf- and rejects the placeholders locally before the SDK sends a request.

Expected behavior: if Langfuse is accepted as a supported Hermes integration, NemoClaw should configure it without exposing raw credentials inside the sandbox. Otherwise, the unsupported boundary should be explicit in the CLI and documentation.

Relevant source boundaries:

• Hermes Langfuse validation
• NemoClaw Hermes image pins Hermes v2026.7.1
• OpenShell v0.0.85 credential rewriting

Reproduction Steps

1. Export valid LANGFUSE_PUBLIC_KEY=pk-lf-... and LANGFUSE_SECRET_KEY=sk-lf-... values.
2. Register both as generic credentials with nemoclaw credentials add.
3. Run nemohermes onboard and confirm the sandbox environment contains versioned openshell:resolve:env:... placeholders.
4. Put the corresponding placeholders in /sandbox/.hermes/.env as HERMES_LANGFUSE_PUBLIC_KEY and HERMES_LANGFUSE_SECRET_KEY.
5. Enable the bundled Langfuse plugin and restart Hermes.
6. Observe that the plugin rejects the values as placeholders and emits no traces.
7. Replacing the placeholders with raw keys makes tracing work, demonstrating the unsafe workaround but exposing credentials inside the sandbox.

Environment

• NemoClaw: v0.0.92
• Bundled Hermes: v2026.7.1 / 0.18.0
• OpenShell credential contract: v0.0.85
• Langfuse: self-hosted endpoint
• Host OS, Node.js, and Docker versions: not supplied; the failure occurs in the pinned Hermes plugin's local value validation

Debug Output

No debug archive is attached. The relevant Hermes agent.log warning is:

Langfuse plugin: credentials look like placeholders, traces will NOT be emitted (HERMES_LANGFUSE_PUBLIC_KEY='opensh...' (expected 'pk-lf-' prefix); HERMES_LANGFUSE_SECRET_KEY='***' (expected 'sk-lf-' prefix)).

Proposed acceptance criteria, pending scope approval

• Keep both Langfuse keys in OpenShell providers; never persist raw values in sandbox-visible files or process environment.
• Accept only exact, key-bound OpenShell resolver placeholders at the Hermes Langfuse validation boundary while retaining normal prefix checks for raw values.
• Provide a managed host-side configuration path for the self-hosted base URL and required endpoint policy.
• Prove authentication and trace ingestion through OpenShell in live E2E coverage, including credential-sanitization checks.
• Fail closed for malformed, mismatched, or unresolved placeholders.
• Coordinate or upstream the Hermes validator change when appropriate.

Checklist

• I confirmed the failure from the exact pinned source and the reported runtime behavior
• I searched existing issues and did not find a duplicate

[ericksoa]

Maintainer decision: accept the narrow Hermes validator compatibility patch as prerequisite substrate for OpenShell-managed Langfuse credentials.

This decision is limited to recognizing the exact same-name LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY OpenShell resolver placeholders while preserving Hermes raw-key prefix validation and NemoClaw network-policy enforcement. It does not establish Langfuse as a supported NemoClaw onboarding or configuration surface, does not waive the managed base-URL and endpoint-policy work, and does not replace live authentication, trace-ingestion, and credential-sanitization evidence.

Keep this issue open to track that remaining product contract. PR #7447 should reference, rather than close, #7446.