Hermes Agent synthesis
Type: agentic-system-analyses/types/agentic-system-synthesis.md
Bounded synthesis
Hermes Agent is an enclosing runtime: shipped callers construct an agent, assemble model context, execute proposed tools, retain session state and return results. This account uses the repository at commit 0e427d788d253630d38a3a51cd76849e73cd6925, with an applicability cutoff of 2026-10-14. SRC-1 supplies implementation and doctrine/design evidence, not execution traces or causal experiments. The complete repository was frozen, but inspection covers only part of its operational loop. External model and memory services, actual user state and deployed permissions are not established. See the boundary and Source register. This synthesis introduces no source reads.
Admit a request and execute work
The selected ordinary invocation is the finite non-interactive hermes -z path. The caller resolves optional resumed history and its stored model route, configures the agent, invokes a conversation and prints the final response. The model proposes content and tool calls; program code owns phase order, retry and iteration budgets, dispatch and termination. The configured inference endpoint is not a frozen numerical checkpoint, and foreground, child, review and summary calls need not share weights. These findings are wired implementation, with operation uninspected (RT-RTE-oneshot-turn, RT-CMP-inference-model; SRC-1 hermes_cli/oneshot.py, agent/conversation_loop.py).
Generic tool rounds stage calls and test transcript persistence before execution. An explicit failed append stops dispatch. This fence requires an enabled working session store and passage through the generic tool round; a missing store or persistence-isolated agent does not trigger that failure branch. It establishes neither an atomic transcript/effect transaction nor exactly-once external effects. Result shaping can replace raw output with previews or pointers before the next model receives it (RT-RTE-tool-dispatch; SRC-1 agent/turn_tool_round.py, agent/session_persistence.py, agent/tool_executor.py).
Consequential effects do not all pass through one human or durability gate. One-shot enables approval bypass. Terminal authorization depends on backend and policy, and isolated-backend fast paths retain deny checks while skipping other guards. Approved Python can perform direct file and subprocess operations; its RPC allowlist does not confine all script behavior. Opt-in Codex app-server mode delegates the turn before the generic loop, uses separate native approvals and projects transcript rows afterwards. Plugin loading separately admits executable handlers through configuration, compatibility and override controls; managed registration cleanup does not undo arbitrary import-time effects. None of these inspected controls establishes deployed OS isolation (RT-RTE-command-approval, RT-RTE-code-execution, RT-RTE-codex-turn, RT-RTE-plugin-admission; SRC-1 tools/approval.py, tools/code_execution_tool.py, agent/codex_runtime.py, hermes_cli/plugins_loader.py).
Delegate, check and deliver
The representative multi-step workflow is a one-shot request that conditionally delegates subtasks. Children receive selected goals/context, separate sessions, resolved tools and configuration-owned budgets. Construction skips context files and memory rather than automatically inheriting the parent window. A finite caller cannot use detached completion delivery, so a background request falls back to a synchronous join. Separate model contexts are not separate filesystems (RT-RTE-child-delegation; SRC-1 tools/delegate_tool.py, tools/delegate_tool_dispatch.py).
An optional output schema checks extracted JSON and permits one correction turn. If jsonschema is unavailable, parsed JSON is accepted without schema validation. Invalid text can still return after correction, and a completed child status does not certify task success. Host-owned summary reduction happens after checking: oversized output becomes head/tail and, when storage succeeds, a pointer to the full answer. That reduction can invalidate JSON without recomputing the schema flag. The foreground model decides whether to read omissions, recover failures, test the product or finalize. Terminal delivery is printing its final text, not semantic acceptance of child work. This is a reconstructed conditional workflow, not a successful observed run (WF-RTE-output-contract, WF-RTE-summary-return; SRC-1 tools/delegation_output_schema.py, tools/delegate_tool_child_run.py, tools/delegate_tool_results.py).
Retain experience and shape the next invocation
The strongest supported learning-related contribution is an automatic trace-fed write/read architecture. Completed conversation and tool traces can feed a detached review model, which proposes notes or skill changes through restricted tools. The fork has no real session database but shares the built-in store. Admitted updates have later prompt or skill-view consumers; pending proposals do not yet have that authority. Existing-skill review writes require fresh reads, while unattended destructive memory operations are staged. Configured extra tools can broaden review dispatch, and interruption does not roll back prior writes. This supports a wired pathway, not reliable lesson formation or improved capacity (MEM-RTE-review-write, EPI-RTE-review-candidate; SRC-1 agent/background_review.py, tools/memory_tool.py, tools/skill_manager_guards.py).
Built-in notes and user profiles are bounded text files delivered as whole enabled prompt snapshots. Ordinary mid-turn writes change live state without replacing the cached prefix. Admitted local compaction reloads memory and rebuilds the prompt, although seeded detached compression can retain earlier bytes. Thus adoption is neither universally immediate nor limited strictly to session start. Optional per-content approval can admit or reject selected pending payloads, but it is not a universal gate. Shipped learning-node edits/deletes bypass the memory tool's optional approval path; their full authorization and refresh remain untraced (MEM-RTE-notes-cycle, MEM-RTE-pending-review, EPI-RTE-memory-gate; SRC-1 agent/system_prompt.py, tools/write_approval.py, agent/learning_mutations.py).
Skill catalogs expose eligible descriptions; requested views load procedures and support files. Review read marks, ownership rules and optional scans constrain mutation, not procedure quality. Agent-created security scanning defaults off and scan exceptions permit writes; a rejecting covered scan restores the original target or removes a new one. Separate project-skill quarantine affects loading. Activity-driven curation lowers availability and archives packages, with guarded restore; age is not evidence of correctness (MEM-RTE-skill-cycle, EPI-RTE-skill-guard, MEM-RTE-skill-curation; SRC-1 tools/skill_manager_tool.py, tools/skills_guard.py, agent/curator.py).
Local compaction automatically reduces selected history into a model-generated or deterministic continuation handoff. It preferentially prunes tool/media content and preserves bounded anchors/tails, not a lossless transcript. Depending on failure conditions it aborts or uses an explicitly incomplete fallback; required provider checkpoint capability/success can gate admission. Raw summarized rows can remain archived for requested session search. The narrow summary guard rejects invented user attribution when no real user turn exists; it does not validate all summary claims. Encrypted native checkpoints are separate opaque payloads, not readable summaries. Delegation isolates a window and returns selected results; compaction instead replaces part of a window with derived content. In both cases, durable sessions, files and external effects can outlive what remains visible (MEM-RTE-local-compaction, MEM-RTE-session-recall, MEM-OBJ-native-checkpoint, EPI-RTE-summary-check; SRC-1 agent/context_compressor.py, hermes_state_messages.py, agent/native_compaction.py).
Optional external recall supplies shaped prose under an authoritative-reference instruction. Exact duplicate removal and fence sanitization do not authenticate its claims; sanitization can remove content. RetainDB consumes cached results selected by earlier queued queries, whereas ByteRover queries at prefetch time. A current turn triggering delivery therefore does not establish current-query targeting for every block. Historical API sidecars can replay the delivered bytes. Remote derivation, warrant and matching algorithms remain opaque, and local deletion does not establish withdrawal of external copies (MEM-RTE-provider-cycle, EPI-RTE-recall-reshape, EPI-RTE-recall-consume; SRC-1 agent/memory_manager.py, agent/turn_context.py, plugins/memory/retaindb/__init__.py, plugins/memory/byterover/__init__.py).
Evaluate completion without generalizing its warrant
Optional goal mode supplies consequential evaluation beyond ordinary open requests. Configured shell gates run first; failure can produce repair guidance. When gates pass, an auxiliary model judges bounded goal/contract and response evidence. The manager consumes results to continue, pause, park or stop, saving verdict/status for later boundaries. Exit-zero checks license only the command-status proposition. Completion acceptance is for stopping the current goal, not endorsing every output claim or retaining a verified procedure (EPI-RTE-goal-check, EPI-RTE-goal-disposition; SRC-1 hermes_cli/goals.py, hermes_cli/cli_loops_mixin.py, gateway/run_goals.py).
For a finite delegated task, Hermes therefore has joined execution and bounded structural correction, but leaves semantic recovery to the foreground. For continuing work, it has trace-derived handoffs, review retention and saved goal feedback that can shape later invocations. The independently checked memory classifications remain partial on all ten axes; provider ingress does not establish a qualifying remote trace-learning update or its source (profile verification). These positive architectural contributions do not demonstrate the product's claimed improvement from experience (RT-CLM-product-work).
The theory-builder properties remain separate. Condition 1, localized formulated theory, is unestablished for unavailable actual skills or notes. Condition 2, decisions depending on what that theory says, is not established by delivery. Condition 3, stated content-directed criticism with blame and changed reliance/revision, is not established by review instructions or gate failures alone. Condition 4, retaining that criticism's result to shape a next round, is likewise unestablished; ordinary continuation does not supply it. No theory route is classified in the runtime baseline. Criticism of a consumed theory improving future capacity is unestablished independently of the wired trace-fed pathways. Reflection's two-way self-representation mechanism is not established by reviewing one's traces alone. Bounded automated scheduling and goal continuation are wired, but autonomous theory building is unestablished role by role. These are not system-wide absences (EPI-RTE-review-candidate, epistemic conclusion, runtime account).
For the post-turn review pathway, the independently stated objective is more effective and correct reusable task procedures, not merely more stored text. There is a dispositional, improvement-directed self-change pathway: operation records feed review, admitted notes/skills change retained guidance, and later consumers are wired. Exercised self-improvement over later requests/sessions is unestablished because no subsequent operation is traced as causally depending on such a change. Successful improvement also lacks outcome comparison. This conclusion does not depend on resolving reflection, autonomy or theory-builder status. A retained before/after update linked to its trace and later action would change the exercised-path assessment; a suitable comparison independently varying the update would be needed to attribute improved capacity. A factual acceptance route consuming evidence against named criteria, or a verified post-reduction child-output check, would separately change the warrant currently available for retained claims or delivered child output.
Limitations
| limitation | affected SRC IDs and record citations | inspected boundary | conclusion prevented | evidence that would resolve it |
|---|---|---|---|---|
| Partial-loop inspection and external deployment boundary | SRC-1; boundary, RT-RTE-oneshot-turn, RT-CMP-inference-model | Frozen repository; selected callers and runtime seams; external services and actual user/configuration state not captured | Whole-system route completeness, frontend equivalence, deployed grants/isolation, exact numerical model fixity or training | Traced remaining shipped callers and maintenance/evaluation loops, deployment configuration and pinned provider contracts/checkpoints |
| No supplied operation or causal comparison | SRC-1; RT-CLM-product-work, MEM-RTE-review-write, EPI-RTE-review-candidate, WF-RTE-output-contract | Implementation and doctrine only; no target execution | Successful delivery, reliable compliance, improved future capacity, exercised or successful self-improvement | Inspectable update/input/output and later-consumer traces; independently varied comparisons for component attribution |
| Learning-node admission inventory remains incomplete; required report-verification limit | SRC-1; MEM-RTE-notes-cycle, MEM-RTE-pending-review, EPI-RTE-memory-gate, report verification | Tool/store route and learning-node edit/delete calls through agent/learning_mutations.py; full UI authorization and prompt refresh untraced |
Complete memory-admission inventory and UI/tool equivalence; the bypass alone establishes neither unsafe deployment nor factual acceptance or learning | End-to-end caller authorization, replacement/budget admission and live prompt-refresh tracing for web and CLI mutation paths |
| Approval and durability have alternate paths | SRC-1; RT-RTE-tool-dispatch, RT-RTE-command-approval, RT-RTE-code-execution, RT-RTE-codex-turn, RT-RTE-plugin-admission | Generic executor, bypass/backend policies, Python/RPC, app-server bridge and managed plugin loading | Universal human veto, atomic or exactly-once effects, universal pre-effect durability, OS confinement or full production-change controls | Separate external-effect/recovery contracts and deployment evidence for every relevant route; plugin-host and update/install tracing |
| Child checking precedes potentially lossy delivery | SRC-1; WF-RTE-output-contract, WF-RTE-summary-return, RT-RTE-child-delegation | Optional schema check, one retry and synchronous reduction/join; spill reload and durable async consumers incomplete | Parent-visible schema validity, semantic success, complete child visibility or guaranteed async delivery | Post-reduction validation, semantic acceptance evidence, spill paging/retention and async consumer traces |
| Skill acquisition, preprocessing and maintenance alternatives incomplete | SRC-1; MEM-RTE-skill-cycle, EPI-RTE-skill-guard, MEM-RTE-skill-curation | Guarded tools and deterministic age transitions; hub/plugin/inline-shell/auto-load paths and optional consolidation/recovery not fully traced | Exhaustive skill admission, rendering/execution safety, optional consolidation quality or universal rollback | Acquisition and alternate-rendering traces, support-script executor contracts, optional curator backup/purge/cron-rewrite and restoration tracing |
| Compaction and alternate context parts remain incomplete or opaque | SRC-1; MEM-RTE-local-compaction, MEM-OBJ-native-checkpoint, MEM-RTE-session-recall, EPI-RTE-summary-check | Local summary/fallback and archive recall; native replay wiring, micro selector/commits, context engines, todo/context-file admission and all rotation cases incomplete | Lossless retention, universal rationale preservation, full recovery/deletion horizons or equivalent opaque/readable representations | Source/output fidelity comparisons and complete commit/reload/repair traces; provider checkpoint specification and alternative context-route inspection |
| External recall warrant, learning transformation and withdrawal unresolved | SRC-1; MEM-OBJ-provider-state, MEM-RTE-provider-cycle, EPI-RTE-recall-consume, profile verification | Repository adapters, queue/cache and shaped delivery; external derivation/ranking/storage and reset/deletion unknown | Factual endorsement, exact targeting, provider-specific qualifying trace learning/source or system-wide forgetting | Provider derivation/admission and consumer records, original provenance, selector contracts and verified deletion/reset propagation |
| Narrow evaluators do not establish general factual acceptance | SRC-1; EPI-RTE-memory-scan, EPI-RTE-skill-guard, EPI-RTE-summary-check, EPI-RTE-goal-check, EPI-RTE-goal-disposition | Threat/provenance/structure checks and selected goal mode; gate adequacy and Kanban/other evaluators unassessed | Truth of retained entries, procedure effectiveness, all-summary fidelity, producing-mechanism correctness or future transfer | Named claim-level criteria and evidence-consuming acceptance decisions; adequate goal references and full alternative evaluator tracing |
| Actual theory content, criticism and reflective/autonomous theory operations unavailable or unassessed | SRC-1; EPI-RTE-review-candidate, epistemic conclusion, RT-CMP-inference-model | Review guidance and selected control/write/read routes; actual retained theories, model internals and other learning planes unresolved | Positive or system-complete negative theory-builder conditions, criticism-driven learning, reflection or autonomous theory building | Individuated theory and consumption evidence, stated criticism/blame and next-round effects, two-way self-representation paths and role-by-role ownership |