_nous_portal_env_override() is the Portal twin of _nous_inference_env_override(): it is
reached on every routed turn (_nous_effective_routing -> _NousRuntimeResolve._reload_routing)
and still read os.environ, so under gateway.multiplex_profiles a secondary profile POSTed
its refresh token to the DEFAULT profile's HERMES_PORTAL_BASE_URL while its inference
override (scoped in #108319) was correctly isolated. Same shape as that fix: get_secret with
the UnscopedSecretError -> environ fallback for the unscoped CLI / default-profile path.
The two inline os.getenv fallbacks in _nous_effective_routing were dead — the
env_portal_override branch two lines later always wins when the variable is set — so they
are removed rather than scoped twice. The CLI-only readers (_nous_device_code_login,
nous_billing, the dashboard OAuth router) run single-profile and stay on environ.
Deployments that set HERMES_PORTAL_BASE_URL only in the process env must carry it in each
served profile's .env, the rule #108319 established for NOUS_INFERENCE_BASE_URL.
Flagged by @webtecnica in the #108319 review thread. One invariant test: scoped value wins,
scoped miss stays a miss, unscoped keeps environ; red on main.
kshitijk4poor
9366f59533