This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

No actionable comments were generated in the recent review. 🎉

_{Comment @coderabbitai help to get the list of available commands.}

Hitting this exact limitation on Azure AI Foundry

We're running Hermes inside an Azure VM with NemoClaw, routing all inference through inference.local to stay within our Azure tenant. We've deployed gpt-4o-mini-tts and whisper in Azure AI Foundry and configured Hermes TTS/STT to use https://inference.local as base URL — but every audio request gets blocked by managed_inference enforcement.

The irony: the credentials, the models, and the gateway are all inside our tenant. The only missing piece is the two audio routes on the gateway side.

This is blocking voice interaction for an enterprise use case where leaving the Azure tenant is not an option. A +1 on the proposed fix — same credential injection pattern as chat completions, just extended to /v1/audio/speech and /v1/audio/transcriptions.

✨ Thanks for the proposed policy update allowing Hermes managed inference to call audio transcription and speech endpoints. This proposes a way to expand the Hermes policy allowlist for POST /v1/audio/transcriptions and POST /v1/audio/speech while updating the regression test.

Related open issues:

• #1520 Route /v1/audio/transcriptions and /v1/audio/speech through inference gateway

Closing this as premature after an exact-head merge-gate and 9-category security review.

The NemoClaw-side allow rules cannot enable this feature today:

• NemoClaw main pins OpenShell 0.0.72 (blueprint).
• OpenShell 0.0.72's supported inference.local patterns do not include either audio path, and unmatched requests are denied (route documentation, route table).
• OpenShell current main still has the same route table with no /v1/audio/transcriptions or /v1/audio/speech support (current source).
• Hermes' currently implemented managed audio path is the separate openai-audio tool gateway, not inference.local (current NemoClaw matrix).

Security review:

Merge-gate evidence on exact head ac380c225f69d96c43c8a2116808a34370cec2ef:

• Both commits are GitHub-verified.
• Targeted validation passes: 63/63 validate-blueprint tests; git diff --check passes.
• Required checks, commit-lint, and dco-check runs are absent.
• The PR body lacks the repository-required Signed-off-by: declaration.
• No unresolved review threads or competing PR were found.

The right sequence is to implement and security-test the OpenShell routes first (including multipart upload, binary/streamed response framing, credential isolation, and denial cases), then add the Hermes allowlist together with an executable Hermes acceptance test. Issue #1520 remains open and assigned to @jyaunches.

Thank you, @HOYALIM: this PR correctly identified Hermes' narrower policy layer and added a useful exact-shape regression test. That analysis and test design should be credited and reused when the upstream route dependency exists. No contributor code is being carried forward in this closure.