Hermes Self-Harness

Governance layer for Hermes Agent — session release pinning, memory architecture, SLO monitoring, static guard, emergency containment, reproducible packaging and seven independent audits.

Совместимая версия Hermes

Hermes Agent v0.18.2 (tag v2026.7.7.2, commit 9de9c25f620ff7f1ce0fd5457d596052d5159596).

Windows 11 Prerequisites

• Windows 11 x64
• Python 3.12+
• Node.js v24+
• npm 11+
• Hermes Agent installed

Architecture

┌─────────────────────────────────────────┐
│         Hermes Agent (runtime)          │
│  ┌─────────────────────────────────┐    │
│  │   Self-Harness Plugin (Python)  │    │
│  │  ┌──────┐ ┌──────┐ ┌─────────┐ │    │
│  │  │Static│ │Sessio│ │Emergency│ │    │
│  │  │Guard │ │n Pin │ │Containm │ │    │
│  │  └──────┘ └──────┘ └─────────┘ │    │
│  │  ┌──────┐ ┌──────┐ ┌─────────┐ │    │
│  │  │Budget│ │Drift │ │ Weakness│ │    │
│  │  │Govern│ │Detect│ │  Mining │ │    │
│  │  └──────┘ └──────┘ └─────────┘ │    │
│  └─────────────────────────────────┘    │
│  ┌─────────────────────────────────┐    │
│  │    SQLite Governance Store      │    │
│  │  releases │ session_pins │ ...  │    │
│  └─────────────────────────────────┘    │
└─────────────────────────────────────────┘

What is built-in Hermes vs Self-Harness

| Feature | Built-in Hermes | Self-Harness adds | |---------|----------------|-------------------| | Memory | MEMORY.md, USER.md | M2 architecture, provenance, drift detection | | Sessions | Session persistence | Release pinning, mid-session promotion block | | Plugins | General plugins | Governance hooks, static guard, policy DSL | | Skills | Skill curator | Write approval gates, risk classification | | Cron | Cron jobs | SLO accounting, burn-rate alerts |

Installation

From npm

npm install -g @anatolijlaptev1991/hermes-self-harness
hsh install --profile evaluation

From GitHub

git clone https://github.com/anatolijlaptev1991-ctrl/hermes-self-harness.git
cd hermes-self-harness
pip install -e python/hermes_self_harness/

CLI Commands

hsh doctor                    # Check installation health
hsh init --project <path>     # Initialize project
hsh build                     # Build artifacts
hsh test --isolation clean    # Run tests in clean room
hsh pack                      # Create npm tgz + wheel
hsh verify <tgz>              # Verify package integrity
hsh install --profile evaluation
hsh install --profile production --require-approval
hsh uninstall --profile <name>
hsh profile create-safe       # Create safe profile
hsh release manifest          # Show release manifest
hsh reproduce --from <manifest>  # Reproduce release
hsh audit --all               # Run seven audits

Session Boundary Model

Self-Harness enforces strict session-release boundaries:

• One session = one release_id (immutable)
• Mid-session promotion is forbidden
• Changes activate via: new session → blue/green → controlled rebuild

Memory Architecture (M2)

Phase 1 uses architecture M2: built-in Hermes memory is authoritative. External backends (Memanto, QMD, Graphify) are optional on-demand tools.

Build & Test

# Python tests (217 tests)
cd python/hermes_self_harness
python -m pytest tests/ -v

# npm package build
npm ci
npm run build
npm test
npm pack

Security Model

• Production memory/skill writes require approval
• YOLO mode forbidden in production
• Path traversal protection during install
• Secret scanning before publication
• Artifact signing and attestation
• Seven independent audit contours before release

Failure & Degradation

| Failure | Behavior | |---------|----------| | External backend down | Degraded response with degraded=true | | SQLite corruption | Restore from backup, quarantine corrupt DB | | Crash loop (5x) | Activate Safe Mode | | Disk full | Read-only mode, alert operator | | KL drift > 0.2 | Block automatic changes, require audit |

Uninstall / Rollback

hsh uninstall --profile production
# Or rollback to previous release:
hsh install --profile production --from <previous-manifest>

Documentation

• Architecture
• Source Specification (normative v2.3)
• Windows 11 Guide
• Testing
• Release
• Runbooks

Compatibility Matrix

See COMPATIBILITY.md.

Reproducibility

See REPRODUCIBILITY.md.

License

MIT — see LICENSE.

Author

Анатолий Лаптев (anatolijlaptev1991)