Add Payment Operations Hermes example

[aadesoba-nv]

Description

Add examples/payment-ops-hermes, a regulated payment-operations blueprint built around a constrained Hermes agent, NeMo Relay evidence, and a platform-enforced maker/checker boundary.

FinGuard can screen synthetic ISO 20022-shaped payments, explain holds, and prepare evidence for human review. OpenShell deliberately provides no payment-rail egress, so an agent release attempt is denied independently of the prompt or model. A separately attributed host-side human checker is the only component that can call the mock rail.

The example includes:

• a custom Hermes + NeMo Relay sandbox image
• real Hermes model/tool hook forwarding to Relay
• local ATIF trajectories and Phoenix OpenInference export
• a curated three-record public OFAC fixture with deterministic positive and negative controls
• an idempotent phased lifecycle for initial bring-up and Brev resume
• separate agent and human-checker telemetry
• FSI production-adaptation guidance

The root examples table and THIRD-PARTY-NOTICES are updated for the new example. The curated source snapshot is derived from standalone source commit aadesoba-nv/payment-ops-hermes@361b49e without carrying that repository's history into this contribution.

Verification

• python scripts/check_license_headers.py --check
• git diff --check
• Shell syntax checks for all example lifecycle scripts and entrypoints
• Python compile checks for all example Python sources and the Relay finalize hook
• JavaScript syntax check for the FinGuard UI
• Six of six payment-control fixture scenarios pass
• Curated OFAC positive control holds ACH-2003 on BANK ROSSIYA
• Curated OFAC negative control clears WIRE-1007 for human review
• Markdown local-link validation
• Private-environment and generated-artifact scans
• Standalone source deployment verified on Brev with Hermes, NeMo Relay, ATIF, Phoenix, sandbox denial, and human checker evidence
• Fresh end-to-end bring-up from examples/payment-ops-hermes in this community branch

Release And Compliance

• No secrets, local .env files, private certificates, snapshots, or token caches are included.
• Third-party dependency changes are reflected in THIRD-PARTY-NOTICES.
• Public documentation is free of internal-only links or private workspace details.
• Commits include DCO sign-off (git commit -s).

[nv-nedelman-1]

@aadesoba-nv I think this file should be removed - since it specifically refers to showing this demo at a booth/workshop.

[nv-nedelman-1]

openshell sandbox list returns the PHASE with ascii color characters, which breaks the case statement that maps to ready. I did not encounter this when running scripts/bring-up.sh the first time, only in subsequent invocations.

claude gave me this change to parse the actual ready string and it works well:

sandbox_phase() {
  local name="${1:-$NEMOCLAW_SANDBOX_NAME}"
  openshell sandbox list 2>/dev/null | awk -v wanted="$name" '
    { gsub(/\033\[[0-9;]*m/, "") }
    NR > 1 && $1 == wanted { print $NF; found = 1; exit }
    END { if (!found) print "Missing" }
  '
}

[nv-nedelman-1]

Hi @aadesoba-nv I made two more minor comments. I'll get this merged once addressed, thank you!