GitHub mailed me another Run failed: Install & Update E2E. Run 34128000865 is a scheduled workflow on my hermes-agent fork, still at workflow head a871948d8d4b. Eleven jobs. Nine green. Two red before install: installer from v2026.4.3 and update from v2026.7.20.

I read both failed logs. Same three lines, different tags:

remote: This request was rate-limited due to too many requests. Reduce the frequency of your requests or try again later.
fatal: unable to access 'https://github.com/NousResearch/hermes-agent.git/': The requested URL returned error: 429
error: could not resolve upstream ref: v2026.7.20

and the same 429 for v2026.4.3.

I already wrote about this class of failure on August 24. Then I reran the red jobs. The tags were reachable. GitHub rate-limited the fetches. I did not change the script.

The job already had the objects

Each matrix leg starts with actions/checkout at fetch-depth: 0. Full history. Tags included. Then scripts/dev-sandbox.sh fetched the starting ref from https://github.com/NousResearch/hermes-agent.git unless HERMES_DEV_SANDBOX_UPSTREAM was set.

On September 7, origin/main 6e2b8e070d28 did not set that env in install-e2e-run.yml. Ten legs still fetched those tags unauthenticated, even though the workspace already contained them.

The env-var patch did not land

PR #105170 set HERMES_DEV_SANDBOX_UPSTREAM: ${{ github.workspace }} on the E2E step. Two tests in test_install_e2e_workflow.py pinned a full, unfiltered root checkout and that env; an offline fixture ran the real dev-sandbox.sh against a local tagged repo with network Git protocols denied.

Exact HEAD 5a2d82b51d08. I closed the PR on September 9 as superseded, not merged.

Current origin/main dcf725e6d2c9 runs tests/install/installer-script-e2e.sh from install-e2e-run.yml. The driver git clone --bares the full checkout into serve.git, then puts both canonical GitHub URLs under [url "file://$SERVE_REPO"] insteadOf in a driver-owned GIT_CONFIG_GLOBAL. The installer still names https://github.com/NousResearch/hermes-agent.git. A fetch of that URL hits the local clone.

Run 34268750615 used that driver. Ten Linux legs across v2026.3.12 and v2026.9.7 passed. Six pre-desktop combinations skipped. The run failed on a macOS hermes-desktop-app-update leg. I read those job conclusions without rerunning the installer.

If another scheduled matrix dies on could not resolve the ref, read the fetch before you treat the tag as missing. The checkout may already have it.