Investigation Summary

• nemohermes <sb> rebuild calls ensureAgentBaseImage with forceBaseImageRebuild: true (rebuild-flow-helpers.js) unless NEMOCLAW_HERMES_SANDBOX_BASE_IMAGE_REF is set, so it builds agents/hermes/Dockerfile.base locally.
• Dockerfile.base pins Debian trixie packages (libssl-dev=3.5.6-1~deb13u2 etc.), but node:24-trixie-slim already ships libssl3t64 3.5.7-1~deb13u2, so apt fails to resolve.
• Onboarding itself used the published base image ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:ffafa4dd..., which is present locally; rebuild ignores it.
• Exporting NEMOCLAW_HERMES_SANDBOX_BASE_IMAGE_REF=<that digest> makes rebuild reuse the published image and succeed.

Description

A rebuild on a fresh onboarding fails before touching the sandbox:

Rebuilding Hermes Agent base image...
#6 ERROR: process "/bin/sh -c apt-get update && apt-get install -y --no-install-recommends build-essential=12.12 ca-certificates=20250419 curl=8.14.1-2+deb13u4 git=1:2.47.3-0+deb13u1 libssl-dev=3.5.6-1~deb13u2 ..."
 libssl-dev : Depends: libssl3t64 (= 3.5.6-1~deb13u2) but 3.5.7-1~deb13u2 is to be installed
Rebuild preflight failed: agent base image could not be built.
Failed to build Hermes Agent base image (exit 1)

Expected: rebuild reuses the exact published base digest recorded at onboarding unless the user explicitly asks for a local base build; and pins in Dockerfile.base should not silently rot between releases.

Reproduction Steps

1. Onboard Hermes with the stock installer (base image resolves to the published digest).
2. nemohermes <sb> channels add telegram (or any change), then nemohermes <sb> rebuild --yes.
3. Observe the local Dockerfile.base build and the apt dependency failure above.
4. NEMOCLAW_HERMES_SANDBOX_BASE_IMAGE_REF=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:<digest from onboarding> nemohermes <sb> rebuild --yes → "Reusing locally validated Hermes Agent sandbox base image" and the rebuild proceeds.

Environment

• macOS 15 (Darwin 25.6.0), Apple Silicon (M2 Pro), Homebrew 6.0.21
• Docker via Colima (docker 29.2.1, linux/arm64 VM)
• NemoClaw v0.0.109 via the hosted installer (lkg), OpenShell 0.0.101 (Homebrew formula), Hermes Agent v0.19.0
• Same code path present on main at the time of filing

Debug Output

See the apt error above; docker images --digests shows the published base digest already present locally.

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate