Hermes Agent boundary

Type: agentic-system-analyses/types/agentic-system-boundary.md

Boundary and evidence

This run examines Hermes Agent as an enclosing agent runtime, including its model-dependent execution and retained-context mechanisms. The intended use is to establish a source-grounded account of the runtime and its memory, skill and session-state responsibilities, not to measure effectiveness or recommend adoption. The evidence is the complete repository at the frozen commit above. The applicability cutoff is 2026-10-14; no later revision or external service behavior is included.

The classification is supported by the shipped command entry points and a traced caller into the agent, rather than by the repository's product description alone. SRC-1 pyproject.toml declares:

[project.scripts] hermes = "hermes_cli.main:main" hermes-agent = "agent.legacy_cli:main" hermes-acp = "acp_adapter.entry:main" --- pyproject.toml

The hermes command's one-shot dispatch reaches hermes_cli.oneshot, which imports and constructs run_agent.AIAgent and calls its conversation API. That class inherits TurnFacadeMixin; the facade invokes agent.conversation_loop.run_conversation (SRC-1 hermes_cli/main.py, hermes_cli/oneshot.py, run_agent.py, agent/turn_facade.py). The caller is shipped target code, not an excluded application. The call site retains this minimum implementation evidence:

result = agent.run_conversation(prompt, conversation_history=conversation_history or None) --- hermes_cli/oneshot.py

The conversation module describes the responsibilities behind that call (doctrine/design evidence, not an independently verified execution trace):

run_conversation(agent, ...) drives one user turn (model call, tool dispatch, retries, fallbacks, compression, post-turn hooks). --- agent/conversation_loop.py

The selected boundary is complete artifact, partial loop, not whole-system. The repository tree and entry-point routing were inspected, but every material producer, admission path, maintenance path and consumer has not been traced. This is a completed declaration of a partial inspection boundary, not a claim of completed whole-system coverage. All files at the registered commit remain available to later source inspection; the paths below are initial inspection coverage, not an evidence allowlist.

Functional inclusions are the core agent and model/tool loop; shipped CLI, gateway and ACP callers; session persistence and recall; prompt/context assembly and compression; memory and skill read/write mechanisms; background maintenance; shipped scheduler and evaluation paths where they bear on those responsibilities. These responsibilities remain part of the target even where initial inspection is incomplete. In particular, gateway or ACP state ownership must not be attributed to an external host merely because those modules call AIAgent.

The persistent-context component is materially relevant rather than incidental. The inspected prompt-building function explicitly distinguishes task-specific skills from across-session memory (SRC-1 agent/prompt_builder.py). Its function contract states:

"""Adapt store and skill-write guidance without widening what belongs in memory.""" --- agent/prompt_builder.py

Background review is also shipped target responsibility, not an external maintenance service. The following passage establishes its declared design only; later analysis must trace the implementation before asserting actual write isolation or cache behavior (SRC-1 agent/background_review.py):

"""Background memory/skill review — fork the agent to evaluate the turn. After every turn AIAgent.run_conversation may spawn a daemon thread that replays the conversation snapshot in a forked :class:AIAgent and asks "should any skill/memory be saved or updated?". Writes go straight to the memory + skill stores; the main conversation and prompt cache are never touched. --- agent/background_review.py

External dependencies include model-provider endpoints, configured credentials, optional memory services, MCP servers, platform APIs and operating-system/tool backends. The source exposes provider, API mode, credentials, model, toolsets and session-database configuration at the agent constructor (SRC-1 run_agent.py); ACP startup imports the external acp protocol package (SRC-1 acp_adapter/entry.py). Only the repository-side integration is included. External implementations and deployments are excluded, preventing conclusions about their independent persistence, privacy, availability or correctness. User-installed configuration, user data and dynamically acquired skills are not frozen here; their actual contents and effects cannot be established.

There is no identified repository access gap. Uninspected files are pending inspection, not unavailable evidence. No target code, tests, examples or services were executed. The overall evidence tier is code-grounded because executable caller and delegation code was inspected; individual module comments and prompt text remain doctrine/design evidence. There is no observed-run or causal-experiment evidence, so this boundary supports neither operational reliability measurements nor claims that skill creation or memory improves outcomes.

Source register