Hermes Agent report verification
Type: agentic-system-analyses/types/agentic-system-verification.md
Verification
The pinned reports support publication of a bounded implementation account with the local inventory limit below. The previously defective recall selector is repaired. I judged the current reports afresh, including every declared record, source anchor, evidence strength, annotation, Part of relation and reconciliation disposition. The structural report-check is none, so there are no structural failures to route. The epistemic correction answer is supported by direct source inspection; the other answer files are empty.
Git HEAD equals the revision in the boundary, and the frozen checkout has no tracked modifications. All additional reads and searches used SRC-1 at that revision. No target code, tests, examples, providers or services were executed. The boundary remains complete artifact, partial loop; added inspection does not establish whole-system coverage. Implementation wiring, requested model behavior, observed activation and benefit remain separate.
Runtime and delegated workflow
RT-RTE-oneshot-turn, RT-CMP-inference-model and RT-BAP-task-prompt correctly separate caller routing, model proposals and program-owned control. Direct SRC-1 inspection of hermes_cli/oneshot.py confirms resumed history/runtime resolution before provider selection, agent construction, conversation invocation and best-effort cleanup. The caller's bypass flags prevent interpreting command approval as a mandatory human veto. Source inspection of agent/turn_context.py confirms copied history, bound turn identity, cached prompt use and request projection. Configuration selects an inference endpoint, not an immutable numerical checkpoint; provider-owned mutability remains uninspected.
RT-OBJ-tool-call, RT-OBJ-session-messages and RT-RTE-tool-dispatch preserve control-envelope versus content distinctions. SRC-1 agent/turn_tool_round.py, agent/session_persistence.py and agent/tool_executor.py support the conditional durability account. An explicit failed pre-effect append stops dispatch; no-store or persistence-isolated flush returns None rather than False. Failed result persistence prevents later model use of process-only results. The middleware callback's single-dispatch guard does not establish exactly-once external effects or an atomic transcript/effect transaction.
The alternate-effect qualifications in RT-RTE-command-approval, RT-RTE-code-execution and RT-RTE-codex-turn hold. SRC-1 tools/approval.py retains deny checks on the container fast path while bypassing other guards; whole-script permission does not individually authorize every direct Python operation. tools/code_execution_rpc.py checks allowed names and a call budget before its separate dispatch, not a new foreground tool round for every RPC. agent/conversation_loop.py selects the app-server branch before the generic loop; agent/transports/codex_app_server_session.py separately handles native approvals and declines permission escalation. The explicit subset in agent/transports/hermes_tools_mcp_server.py supports the report's warning against expanding exposure from server prose. These paths do not inherit an unconditional generic durability fence or prove deployed OS isolation.
RT-RTE-plugin-admission and RT-BAP-plugin-handler correctly distinguish executable registration from advisory instructions. SRC-1 hermes_cli/plugins_discovery.py, hermes_cli/plugins_loader.py and hermes_cli/plugins.py support configuration/category gating, version checks, import/register, override grants and managed cleanup. Configuration enablement does not establish human content review; disposal of registrations does not undo arbitrary import-time I/O.
RT-RTE-child-delegation, WF-RTE-output-contract and WF-RTE-summary-return support the selected conditional multi-step workflow. SRC-1 tools/delegate_tool.py supplies selected context, separate child construction and configuration-owned budgets. tools/delegate_tool_dispatch.py joins finite-session work and restores task order; its interrupt path avoids waiting for unfinished daemon workers without promising rollback of their effects. tools/delegate_tool_child_run.py and tools/delegation_output_schema.py support one structural retry, permissive JSON extraction, dependency degradation and delivery of unvalidated text. tools/delegate_tool_results.py then independently reduces summaries to head/tail plus a best-effort spill pointer. The schema verdict is not recomputed after trimming. The report correctly withholds factual acceptance, complete parent visibility and successful operator delivery. Both workflow Part of relations are valid portions of the delegation route, not replacement schedulers.
Retention, checks and reliance
MEM-OBJ-memory, MEM-OBJ-user and EPI-OBJ-memory-entries describe two separate stores and a valid combined epistemic grouping, not three stores. MEM-RTE-notes-cycle, EPI-RTE-memory-scan, EPI-RTE-memory-gate and EPI-RTE-memory-retain retain distinct checking, admission and retention functions. SRC-1 tools/memory_tool_store.py supports load-time snapshots, raw-entry preservation, threat-pattern checks, locked rereads and operation-specific size/drift checks. tools/memory_tool.py separately stages unattended destructive proposals. agent/system_prompt.py and agent/conversation_compression.py establish compaction refresh and the seeded-prompt exception. Neither immediate adoption of every disk write nor permanent session freezing follows. None of these software checks licenses factual truth.
MEM-OBJ-pending-write and MEM-RTE-pending-review correctly distinguish a proposal from adopted content and a returned pending ID from durable proposal existence. SRC-1 tools/write_approval.py can return a record after disk failure; hermes_cli/write_approval_commands.py consumes exact payloads, discards successful applications and retains application failures. Optional approval is not a universal content gate. The separate shipped mutation path remains the inventory limit below.
MEM-OBJ-skill-package, EPI-OBJ-skill-content, MEM-RTE-skill-cycle and EPI-RTE-skill-guard distinguish content, package metadata and executable support. SRC-1 tools/skills_tool.py confirms selective rendered delivery, readiness metadata and fresh read marking. tools/skill_manager_tool.py and tools/skill_manager_guards.py distinguish opt-in scan/covered-target rollback, fail-open scan exceptions, read-before-write and deletion provenance. The epistemic qualifications prevent interpreting the memory cycle's scan description as mandatory security or procedure-quality acceptance. Untraced preprocessing and acquisition remain explicit, not absent.
RT-RTE-review-handoff, MEM-RTE-review-write and EPI-RTE-review-candidate have different endpoints. SRC-1 agent/turn_finalizer.py and agent/codex_runtime.py retain separate scheduling predicates. agent/background_review.py shares the built-in store while detaching session persistence, distinguishes same-model history from routed digest input, and restricts dispatch with configured exceptions. The records support an automatic trace-fed retention pathway, not observed lesson correctness, formulated criticism or improvement. MEM-RTE-skill-curation is independently supported by agent/curator.py and tools/skill_usage.py: activity/provenance/protection rules change availability, archive moves preserve packages, and restore has collision/layout restrictions. Aging is not truth evaluation; optional consolidation and full recovery remain incompletely assessed.
MEM-OBJ-session-content, MEM-OBJ-native-checkpoint and EPI-OBJ-summary-content are valid parts of RT-OBJ-session-messages. SRC-1 hermes_state_messages.py supports separate active, compacted and audit projections and API-content sidecars. agent/native_compaction.py selects the newest checkpoint run with separately budgeted plaintext user messages and whole summaries; encrypted payloads are not readable handoffs. MEM-RTE-local-compaction, EPI-RTE-summary-check and MEM-RTE-session-recall distinguish lossy transformation, narrow provenance rejection and requested evidence recovery. agent/context_compressor.py supports model/fallback alternatives and the no-real-user attribution guard; tools/session_search_tool.py supports lineage filtering, cron demotion and bounded hydration. Guard success and retained raw rows do not establish summary fidelity or lossless context.
MEM-OBJ-provider-state, EPI-OBJ-recalled-context, MEM-RTE-provider-cycle, EPI-RTE-recall-reshape, EPI-RTE-recall-consume and MEM-BAP-retained-text preserve opaque lineage and advisory consumption. SRC-1 agent/memory_manager.py supports exact standalone-bullet dedupe without dropping continued provenance, and separate potentially content-removing sanitization. agent/turn_context.py projects shaped live content and replays historical sidecar bytes. Those operations do not authenticate imported claims or ensure compliance.
The recall correction holds across the selection predicate, coverage table, ledger qualification and bounded conclusion. Direct SRC-1 reads of plugins/memory/retaindb/__init__.py confirm that queue_prefetch captures earlier query inputs and prefetch consumes/clears cached context, synthesis and agent-model results without selecting them with its current query argument. plugins/memory/byterover/__init__.py instead queries at prefetch time. The corrected EPI-RTE-recall-consume agrees with MEM-RTE-provider-cycle, while preserving import, wrapper authority and unknown source warrant. ByteRover's limited add/replace mirror also supports withholding system-wide forgetting from local withdrawal. The prior selector blocker is discharged.
EPI-OBJ-goal-verdict, EPI-RTE-goal-check and EPI-RTE-goal-disposition withstand the evaluator/consumer check. SRC-1 hermes_cli/goals.py executes gates before the judge and consumes results to repair, pause, park or stop; hermes_cli/cli_loops_mixin.py and gateway/run_goals.py supply continuation consumers. Exit-zero equality licenses only that status proposition. The model verdict has a different, bounded evidence basis and does not certify every task claim or reusable procedure. RT-CLM-product-work, supported as doctrine by SRC-1 README.md, is not demonstrated benefit. EPI-CLM-reference-data, supported by the wrapper, is a reliance instruction rather than factual endorsement. Wired implementation and uninspected operation are appropriate throughout; no evidenced absences or unsupported system-complete negatives are emitted.
Reconciliation and omission-search disposition
The reconciliation preserves valid containers, overlapping scopes and stage connections without identity-changing supersessions. There are no Amendment paragraphs to adjudicate. All explicit Part of relations have supported containment. Lens annotations do not redefine their referents. The current reports no longer contain the earlier selector disagreement, so reconciliation correctly removes that unresolved conflict. Snapshot horizon, staged review writes and authority overlap remain compatible qualifications. The additional learning-node mutation account supplements rather than contradicts the scoped memory-tool cycle. No current unresolved report conflict needs routing.
Omission questions were selected from the frozen top-level tree, shipped alternate callers and producer/consumer dependencies: could another executor defeat a universal approval/durability claim; could post-check delivery invalidate a child verdict; could provider timing defeat current-request targeting; and could another shipped principal mutate retained content outside the memory-tool gate? The first two have supported scoped dispositions in the runtime/workflow records. The third is repaired and independently checked. The fourth retains a local incomplete-admission-inventory disposition, strengthened by direct SRC-1 reads of agent/learning_mutations.py, hermes_cli/web_routers/status.py and hermes_cli/journey.py. The CLI path confirms explicit edit/delete handling but does not settle web authorization or live prompt refresh. Searches also located shipped conversation callers in batch_runner.py and cron/scheduler.py; their existence does not make them external or establish equivalence with one-shot admission/delivery.
Further optional expansion stopped because every selected material challenge has a disposition and no identified contradiction remains undisposed. Full frontend authorization, scheduler/async delivery, micro-compaction, context-engine alternatives, skill acquisition/preprocessing, optional consolidation and external transformations remain unassessed as the reports state. Their presence does not invalidate the selected positive routes. Readers cannot infer uniform admission, complete route enumeration, lossless retention, factual knowledge acceptance throughout the system, or measured improvement from this partial-loop account. Additional inventory work is not needed to preserve those bounded conclusions.
Blockers
none
Limits
- The write inventory around MEM-RTE-notes-cycle, MEM-RTE-pending-review and EPI-RTE-memory-gate remains incomplete for shipped learning-node edits/deletes. SRC-1
hermes_cli/web_routers/status.pyandhermes_cli/journey.pycall edit_node/delete_node;agent/learning_mutations.pyresolves retained entries and invokes MemoryStore._mutate with its own replacement/budget closure, outside the optional memory-tool approval gate. The epistemic report now names this alternative, but full caller authorization and end-to-end prompt refresh remain untraced. The scoped tool-gate, store-retention and later-consumer findings hold; readers must withhold a complete inventory of memory admission controls and UI/tool equivalence. This does not establish unsafe deployment, factual acceptance or a learning result. The supporting mutation passage is retained in EPI-RTE-memory-gate.