“Latest” broke two AI agents in a week: pin your versions

What happened

Both were found and fixed on 29 September 2026; Hermes was re-pinned on 30 September. The uncomfortable part is how we found them: by accident. We were verifying our Blender setup on a raw Ubuntu 22.04 server, installed both agents to register a tool server with them, and both were broken. Our full test run had last passed on 18–19 September, so anyone installing either agent from scratch in that window could have got a dead agent for up to about ten days.

The sharper lesson: silent success

A crash is easy. The Hermes installer did something worse: it printed

installed (gateway service enabled and started)

with no system gateway unit present at all. Run as root, it had written only a user systemd unit, which does not start on boot. An install log is a claim, not evidence. Our installers now require the service to still be up 20 seconds after start (OpenClaw must also answer on port 18789) and print the journal tail when it is not.

Drift can outrun a week

Our first fix pinned Hermes to a commit but still fetched the hosted install.sh from main. Within a day that script belonged to a newer repository layout and failed against the older commit (run 20260929-233943):

pm/lock.json: No such file
No module named 'pm'

Pinning the code and not the installer is half a pin. The version that passed (run 20260930-000354, 754 s, $0.04) takes the installer from the same commit and checks its hash.

How to pin each one

These are the exact pins our own installers use as of 1 October 2026. The rule behind all four: version, commit and installer or archive hash move together, and only after a test run on a fresh server.

OpenClaw 2026.9.6

Pin the npm version and check the runtime it needs before installing it. 2026.9.6 declares Node >=24.16 <25 || >=26.1; our installs give it a private, checksum-verified Node v24.21.0 so nothing else on the box can change its runtime.

# What does the version you are about to install require?
npm view openclaw@2026.9.6 engines

node --version                       # must satisfy it: v24.16+ or v26.1+
npm install -g openclaw@2026.9.6     # an exact version, never @latest
openclaw --version

Full walkthrough: self-host OpenClaw.

Hermes Agent 0.21.5

No version flag, no environment variable: the installer takes --commit SHA. Release tags are CalVer (v2026.9.24), the version Hermes reports is semver (0.21.5), and there is no published checksum, so the 40-character commit id is the content pin.

sudo apt install -y libatomic1     # the installer's bundled Node needs it on Ubuntu 22.04

HERMES_COMMIT=f97608f178d1ffeca59860195ab7da295f7c8e5f   # v0.21.5 = tag v2026.9.24
HERMES_INSTALLER_SHA256=2017ddf0cc7bc6cfb70d40dc9fba1d916f47dbcccf5fe73bdee2cf93a11262af

# The installer from the SAME commit, not from main
curl -fsSL "https://raw.githubusercontent.com/NousResearch/hermes-agent/$HERMES_COMMIT/scripts/install.sh" \
  -o /tmp/hermes-install.sh
echo "$HERMES_INSTALLER_SHA256  /tmp/hermes-install.sh" | sha256sum -c - || exit 1
bash /tmp/hermes-install.sh --skip-browser --commit "$HERMES_COMMIT"

hermes --version | grep -q 0.21.5 || { echo "wrong hermes"; exit 1; }

One thing we have not solved: hermes update would take you off the pin. Update by moving the three values above instead. Full walkthrough: self-host Hermes Agent.

Blender 5.2.2

Blender publishes a checksum file next to each release; check the archive before you unpack it.

curl -fsSLO https://download.blender.org/release/Blender5.2/blender-5.2.2-linux-x64.tar.xz
echo "84098912789dc450e95697c4184fb8a90acbe5111c2ba4aede3fecb57806a168  blender-5.2.2-linux-x64.tar.xz" \
  | sha256sum -c - || exit 1

Godot 4.7.2

Pin the GitHub release, not a package manager’s idea of “current”, and check the editor and the export templates separately: the templates are a 1.28 GB download of their own.

BASE=https://github.com/godotengine/godot/releases/download/4.7.2-stable
curl -fsSLO "$BASE/Godot_v4.7.2-stable_linux.x86_64.zip"
curl -fsSLO "$BASE/Godot_v4.7.2-stable_export_templates.tpz"
sha256sum -c - <<'EOF' || exit 1
cadd3204e728a35d3f13adb7fd0d7902636b79f6b95c40c265eb73b6c35329e4  Godot_v4.7.2-stable_linux.x86_64.zip
f298490b8d44d934be425a5a65a51bf15f422428b229a06a6e11d9ffea248011  Godot_v4.7.2-stable_export_templates.tpz
EOF

How we validate the pins every week

A pin only protects you from changes you did not choose. It does not tell you when the pinned version stops installing (a vanished package, a moved URL) or when upstream has moved far enough that you should follow. So we built a canary: every preset we sell, installed on a brand-new server, checked through four tiers (server provisioned, software installed, reachable over HTTPS on its own hostname, and a real model completion where the preset has a model), then destroyed.

Its first supervised run, canary-20260930-003625 on 30 September 2026:

• 18 of 18 presets passed all four tiers, in 1 h 37 min, for $0.62.
• 2 cents per preset on the smallest server, 4 cents on the agent tier, 7 cents on 4 vCPU / 8 GB. Each took 4–7 minutes; Hermes was slowest at 12.7.
• All 19 servers were destroyed afterwards, each with a recorded destruction time.

It also runs a drift probe that compares each pin with upstream’s latest release. OpenClaw 2026.9.6, Blender 5.2.2 and Godot 4.7.2 were current. Hermes 0.21.5 was reported as drifted from 2026.9.24, which is a false positive: the probe compared a CalVer tag with a semver pin, and paged us once. A checker that has never been tested against an upstream’s naming scheme is a silent failure of its own.

To be straight about where it stands: as of 1 October 2026 the canary has run twice under supervision (18 of 18 presets passed on the full run) and the weekly schedule has been switched on since 30 September. The first unattended run is the next Monday.

If you self-host, do the same on a smaller scale

1. Write the pin down next to the server: version, commit, and the hash of whatever you downloaded.
2. Once a week, rent a throwaway box for a few cents, install the same pin from scratch, and send one real message. A pin that no longer installs is something you want to learn before you need to rebuild.
3. Check the service, not the log. Is the unit still active 20 seconds later? Does the port answer? Did a real prompt get a reply?
4. Move the pin on purpose. Try the new release on the throwaway box first, read its runtime requirements, and change all three values together.
5. Test the image your provider actually gives you. A pass on Ubuntu 24.04 (Python 3.12.3) said nothing about 22.04 (Python 3.10.12), which is what some providers still hand out.

Self-hosting an agent is a tracking obligation: its runtime, its native libraries, its file layout and its service model can all change under you. If that is a job you would rather not have, that is the honest case for managed hosting: someone else watches the drift.

Related

• Self-host OpenClaw — updated for Node 24 and 2026.9.6.
• Self-host Hermes Agent — the pinned install, step by step.
• Why your GPU container breaks — the same lesson for image tags.
• What an AI agent turn costs — the other thing that changes when the agent does.