RECORD / UPSTREAM
Upstream
- 8 pull requests
- 2 repositories
- Every outcome listed
Eight fixes filed into two open-source repositories I do not control. Two merged, two closed, four open. All eight are listed with the outcome their maintainer gave them, because a contribution record that shows only the merges is a marketing page.
Check the record on GitHubRECORD / UPSTREAM
- Filed
- 8 pull requests across two repositories, between 2026-06-15 and 2026-07-12. Every one is a bug fix. None is a feature.
- Merged
- 2, both in odysseus.
- Closed
- 2, both in hermes-agent. One was folded into a merged upstream sweep with authorship preserved; the other was already fixed on main by the time it was reviewed.
- Open
- 4, all in hermes-agent. Three carry a maintainer review that kept them open with the premise re-confirmed against current main.
- How they were found
- By running the software, not by reading its issue tracker. An unusual host (Fedora, Python 3.14) surfaces what a maintainer's machine does not, and git blame on a suspicious line surfaces the rest.
- Attribution
- All eight authored as victorv2i. No AI co-authorship trailer on any commit.
NousResearch/hermes-agent
The agent runtime the bot fleet runs on. Six fixes, all found by running it.
- #46863
Open
fix(delegation): validate batch input before resolving credentials
Batch delegation resolved its credentials before validating the batch, so an over-cap or malformed batch reported a missing delegation provider instead of the real input error. The fix moves validation first.
Maintainer review kept it open and re-confirmed the premise on current main.
- #47489
Closed
fix(skills): pass encoding="utf-8" on skills-hub file I/O
Skills Hub state files were written without an explicit encoding, so non-ASCII skill metadata raised a UnicodeEncodeError on a Windows locale that is not UTF-8 and left the install record truncated.
Closed 2026-07-25 and the fix shipped. Upstream retired the whole class of bug in one pass across 139 call sites, salvaging eleven contributor patches into it with authorship preserved. This was one of the eleven.
- #47492
Open
fix(tools): reap tar/ssh subprocesses on non-timeout errors in SSH bulk upload
The SSH bulk upload only killed its tar and ssh children on a timeout, so any other failure from communicate() left a zombie pair behind on a long-running gateway.
Maintainer review kept it open with the premise confirmed. Third-party triage later checked it against a neighbouring pull request and found the two address distinct causes.
- #47669
Closed
fix(state): order replayed conversation by id, not timestamp
A feature commit had flipped replayed conversation ordering from id back to timestamp, silently reopening the tool-adjacency bug an earlier merged pull request had closed. Found with git blame, filed with a regression test.
Closed 2026-07-14 as redundant. Main already carried the ordering guarantee by the time it was reviewed.
- #63366
Open
fix(curator): abort rollback when safety snapshot fails
Skill rollback promised a safety snapshot before replacing the live tree, but the snapshot function reports expected failure by returning nothing and rollback only handled raised exceptions. It now fails closed before touching anything.
Maintainer review kept it open with the premise confirmed on current main.
- #63382
Open
fix(backup): keep same-second snapshots distinct
Quick snapshot ids carried one-second precision, so two snapshots taken in the same second reused one directory and the second silently overwrote the first recovery point.
No maintainer review yet.
odysseus-dev/odysseus
Both merged. Both filed against the project's dev branch, per its contributing rules.
- #4387
Merged
test: stop test_skill_index_prompt_injection leaking a stub prefs_routes
A test installed a fake preferences module into sys.modules and never removed it, so a later test that imported the real one failed depending on run order. One line, moved onto monkeypatch so teardown reverts it.
Merged 2026-06-18.
- #4464
Merged
fix(email): validate IMAP/SMTP ports instead of crashing with 500
A non-numeric IMAP or SMTP port crashed three email endpoints with an HTTP 500, because the port was coerced with a bare int(). Bad input now returns the endpoints' own error shape.
Merged 2026-06-26.
01 / 02
How you find a bug in somebody else's repository
Not by reading the tracker. On a fast-moving project the freshest actionable issues already have two or three competing patches attached within the hour, and a ninth opinion on a known bug is worth nothing to the maintainer. Every fix listed above came out of running the software instead: an unusual host surfaces what a maintainer's machine does not, their own test suite fails in a way that is mine to explain, and git blame on one suspicious line turns up a feature commit that quietly reverted an older documented fix.
That last class is the reliable one. An obvious missing null guard gets claimed in minutes. A regression nobody noticed, where the evidence is a commit that flipped one clause back, stays uncontested long enough to write a test for it.
02 / 02
Why the closed ones are on this page
Because the bench publishes failed runs and this record follows the same rule. Two of the eight did not merge. One was folded into a repo-wide sweep that retired the entire class of bug across 139 call sites, with eleven contributor patches salvaged into it and authorship preserved. The other was closed because main already carried the guarantee it argued for.
Neither is a rejection on the merits, and neither is a merge either. The honest description of both is that the bug is fixed upstream and my patch is not the commit that did it, which is a normal outcome of working on a repository with hundreds of other people in it. Listing them costs nothing except the ability to claim a better number.