# Root merge 5 of 5: Hermes Agent Plugin Hackathon, 17 results combined

Inputs read: b19-deep-x-05, b20-deep-x-06/07/08/09, b21-final-01..04, b22-final-05..08, b23-final-09..12 (17 files, all read in full).
Scale: Useful + Reliable + Polish + Creative + 2 x Beyond, out of 30. Seat = one judge's result file. The deep seats all used the Hermes checkout a84025ade22d2a4085f575d4353072e5b702635d.
Everything below is what the seats reported. The merge adds only tallies (sums, means, mean ranks), marked "merger tally", done by hand. No seat ran Nous's real judges, and no seat could run a graphical Desktop, live audio, telco or paid providers.

## 0. Read this first

1. **final-12 (b23) is missing.** Its file has an empty ranking and `"status":"incomplete"`. Reason given: it could not fetch field.json, PLAN.md or RUN.md (curl timeout through the proxy, host not resolvable, web tool also failed). It scored nothing and ran no plugin, so it counts as no vote. The finals have 11 usable seats (final-01 to final-11).
2. **patient-research (PR 153640) was never judged.** x05, x06 and x07 each report that github.com/solo386/patient-research returns 404 at pin 8642b35bfc6a169ad20cc2f343f8c6dd34d82681 (git fetch asked for authentication; raw plugin/plugin.yaml, codeload and API returned 404 or 403). x07 says this does not establish whether the repo is private, deleted or renamed. All three entered 0s. Read them as "not judged", not "judged worst". Only x05 adds that PR 153640's head is a different plugin, agentpay-guard. That is one seat's claim and nobody examined agentpay-guard's code. Nous's reviewer sends back plugins that move money without approval, so it is worth a look if someone can fetch it. It was in no finals batch.
3. **Source-quality warnings.** The task says some results cite sources that failed on re-read: deep-x-06 (1 source), deep-x-07 (5), deep-x-08 (2), deep-x-09 (3), final-01 (2), final-03 (1), final-05 (3), final-07 (1), final-10 (2), final-11 (3). The files I was given do not say which URLs failed (no sources.json was among my inputs), so I cannot name the failing claims. My handling: a claim from a flagged seat that an unflagged seat also reproduced is kept at normal weight. A claim only a flagged seat made is marked "single flagged seat". Unflagged seats: deep-x-05, final-02, final-04, final-06, final-08, final-09 (final-12 is empty). Treat flagged-seat details (test counts, quoted README lines) as less firm than totals.
4. All finals seats scored the same 20 finalists with large spreads. tenure ranges from 1st (final-05) to 20th (final-06), workroom from 6th to 20th. Most of the spread is real disagreement about findings (Section 3), plus different test environments.

## 1. Finals: the 20 finalists, all seats (merger tally)

Cell = total (rank in that seat). Seats are f01 to f11 (final-01 to final-11). f12 is empty.

| Plugin (PR) | f01 | f02 | f03 | f04 | f05 | f06 | f07 | f08 | f09 | f10 | f11 | Mean total | Mean rank |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| housemate (152458) | 26(5) | 27(1) | 29(2) | 28(1) | 27(5) | 28(5) | 27(9) | 30(1) | 29(1) | 28(1) | 29(2) | **28.0** | **3.0** |
| tenure (153714) | 28(2) | 25(9) | 28(8) | 26(4) | 29(1) | 24(20) | 24(19) | 29(4) | 27(2) | 27(2) | 29(4) | 26.9 | 6.8 |
| hermes-canvas (150644) | 27(3) | 25(7) | 29(1) | 26(6) | 27(4) | 27(11) | 28(5) | 27(16) | 26(5) | 26(3) | 27(11) | 26.8 | 6.5 |
| ariadne (150596) | 26(7) | 23(19) | 29(4) | 26(7) | 27(6) | 28(6) | 27(14) | 28(10) | 26(6) | 26(4) | 28(7) | 26.7 | 8.2 |
| hermes-ui-cards (150556) | 28(1) | 26(2) | 28(6) | 25(8) | 28(2) | 28(7) | 27(8) | 28(6) | 24(14) | 23(13) | 27(15) | 26.5 | 7.5 |
| kata (150840) | 26(4) | 24(14) | 28(9) | 26(5) | 26(9) | 29(2) | 28(6) | 29(2) | 24(15) | 23(15) | 28(8) | 26.5 | 8.1 |
| hermes-ark (149640) | 23(16) | 24(11) | 28(5) | 27(2) | 26(7) | 29(1) | 29(1) | 28(5) | 24(13) | 23(12) | 29(1) | 26.4 | 6.7 |
| fine-print (153844) | 25(9) | 23(20) | 28(10) | 25(12) | 25(12) | 28(4) | 28(4) | 29(3) | 23(20) | 25(6) | 29(3) | 26.2 | 9.4 |
| hypnos (150800) | 25(10) | 24(17) | 27(14) | 25(13) | 25(14) | 27(9) | 27(13) | 28(8) | 25(10) | 25(7) | 28(6) | 26.0 | 11.0 |
| shadow (153955) | 24(14) | 26(3) | 26(18) | 27(3) | 25(13) | 27(14) | 27(12) | 28(7) | 25(12) | 24(11) | 27(12) | 26.0 | 10.8 |
| grimoire (152691) | 25(8) | 24(12) | 27(12) | 25(10) | 25(11) | 27(10) | 26(15) | 28(14) | 25(8) | 25(5) | 27(10) | 25.8 | 10.5 |
| foreman (153851) | 24(11) | 24(13) | 28(7) | 25(11) | 24(17) | 27(13) | 26(16) | 28(12) | 26(4) | 24(9) | 27(16) | 25.7 | 11.7 |
| cmi (151887) | 23(17) | 25(5) | 27(11) | 23(18) | 26(8) | 27(8) | 27(7) | 27(15) | 24(17) | 24(10) | 28(5) | 25.5 | 11.0 |
| fluent (150353) | 22(19) | 25(6) | 27(15) | 23(19) | 24(15) | 28(3) | 29(2) | 28(13) | 24(16) | 24(8) | 27(13) | 25.5 | 11.7 |
| gemini-live (150251) | 24(12) | 25(8) | 27(13) | 24(14) | 27(3) | 26(16) | 27(10) | 27(17) | 25(9) | 22(19) | 26(18) | 25.5 | 12.6 |
| trust-ladder (149738) | 23(15) | 25(4) | 25(20) | 24(15) | 24(16) | 26(15) | 28(3) | 28(11) | 25(7) | 23(14) | 27(9) | 25.3 | 11.7 |
| breadcrumbs (153020) | 23(18) | 24(15) | 29(3) | 23(20) | 24(18) | 25(18) | 25(18) | 28(9) | 24(19) | 23(17) | 27(14) | 25.0 | 15.4 |
| contract-necromancer (152908) | 22(20) | 23(18) | 27(16) | 25(9) | 23(19) | 27(12) | 27(11) | 27(18) | 26(3) | 22(18) | 26(17) | 25.0 | 14.6 |
| living-spaces (153809) | 24(13) | 25(10) | 27(17) | 24(16) | 23(20) | 26(17) | 26(17) | 25(19) | 25(11) | 23(16) | 26(19) | 24.9 | 15.9 |
| workroom (152651) | 26(6) | 24(16) | 26(19) | 24(17) | 26(10) | 25(19) | 23(20) | 25(20) | 24(18) | 22(20) | 25(20) | 24.5 | 16.8 |

Pooled picture (merger tally, not any seat's verdict):
- **housemate** leads clearly: first in 5 of 11 seats (f02, f04, f08, f09, f10), never below 9th, mean total 28.0. It is the one finalist the seats converge on as the "own hardware" entry.
- Next group by mean rank: hermes-canvas 6.5, hermes-ark 6.7, tenure 6.8, hermes-ui-cards 7.5, kata 8.1, ariadne 8.2, fine-print 9.4. By mean total: tenure 26.9, canvas 26.8, ariadne 26.7, ui-cards and kata 26.5, ark 26.4, fine-print 26.2.
- Then shadow, grimoire, hypnos, cmi (mean rank 10.5 to 11.0), foreman, fluent, trust-ladder (11.7), gemini-live (12.6).
- Bottom four on both measures: contract-necromancer, breadcrumbs, living-spaces, workroom.
- **tenure is the most contested.** Without the two seats that reproduced a stall (f06, f07), its mean total over the other 9 seats is 27.6, second only to housemate. With them it is 26.9. Whether to credit those two reproductions decides its place (3.1).
- Sub-scores were given by f01, f03, f06, f07, f08, f09, f10, f11. f02, f04 and f05 gave totals only, and I do not guess their sub-scores.
- Beyond-a-prompt is 5 for almost every finalist in the seats that gave sub-scores, so it separates little. The 4s come from f01, f09 and f10 (ark, ui-cards, kata, grimoire, foreman, fluent, fine-print, trust-ladder; f01 also gave kata 4).

### Sub-scores for the leaders (U/R/P/C/B)
| Plugin | f01 | f03 | f06 | f07 | f08 | f09 | f10 | f11 |
|---|---|---|---|---|---|---|---|---|
| housemate | 3/4/5/4/5 | 5/4/5/5/5 | 4/4/5/5/5 | 4/4/5/4/5 | 5/5/5/5/5 | 5/4/5/5/5 | 4/4/5/5/5 | 5/4/5/5/5 |
| tenure | 4/4/5/5/5 | 4/4/5/5/5 | 4/1/5/4/5 | 4/1/5/4/5 | 5/4/5/5/5 | 4/4/4/5/5 | 4/4/5/4/5 | 5/4/5/5/5 |
| hermes-canvas | 4/4/4/5/5 | 5/4/5/5/5 | 4/5/5/3/5 | 4/5/5/4/5 | 4/4/5/4/5 | 4/4/4/4/5 | 4/4/4/4/5 | 4/4/5/4/5 |
| hermes-ark | 4/4/4/3/4 | 5/4/5/4/5 | 5/5/5/4/5 | 5/5/5/4/5 | 5/5/5/3/5 | 5/4/4/3/4 | 4/4/4/3/4 | 5/5/5/4/5 |
| hermes-ui-cards | 5/5/5/3/5 | 5/4/5/4/5 | 5/4/5/4/5 | 4/4/5/4/5 | 5/4/5/4/5 | 4/4/5/3/4 | 4/4/4/3/4 | 5/4/5/3/5 |
| kata | 4/4/5/5/4 | 4/4/5/5/5 | 5/4/5/5/5 | 4/4/5/5/5 | 5/5/5/4/5 | 4/4/4/4/4 | 3/4/4/4/4 | 4/4/5/5/5 |
| ariadne | 3/4/4/5/5 | 4/5/5/5/5 | 4/5/5/4/5 | 3/5/5/4/5 | 4/4/5/5/5 | 3/4/4/5/5 | 3/4/4/5/5 | 4/4/5/5/5 |
| fine-print | 3/5/4/5/4 | 4/5/4/5/5 | 5/4/5/4/5 | 5/4/5/4/5 | 5/4/5/5/5 | 3/4/4/4/4 | 4/4/4/5/4 | 5/5/5/4/5 |

## 2. Finals: per-plugin findings (source seat in brackets)

Evidence is local execution or reading by the named seat unless a URL is given. Pinned repos the seats judged (all at raw.githubusercontent.com/<owner/repo>/<sha>/...): housemate RaYYeR220/housemate@09c1a1d0a88bfa8762cee6b3ccf94271b0f172c5; tenure otsoa-dubief/tenure@f4a62855e592b9e170ab0c54d9278aabef05f370; hermes-canvas 0xbyt4/hermes-canvas@d6eeff0d6f7ec653262537bdd7bb001cc6d3c7f8; hermes-ark medomohamed22/hermes-ark@a23e529c1f636aa49d974576cdc5cb15fc8242d3; hermes-ui-cards robbyczgw-cla/hermes-ui-cards@c40df4d41cd5439cf4902995fd4a9e5505483f25; kata opeblow/kata@cc59b08f1bbeeb02524c060faac04edb34de0564; ariadne miracle352/hermes-ariadne@128c95967a0761ad24d3d224441d1502c43bbb69; fine-print Joko-F/hermes-fine-print@7b574f1b5c8dc8eafe3ea9f87ae6b0111853f0ba; hypnos 0xNoramiya/hypnos@0a809b9085fdeaed63fd909b927afcc41de512de; shadow akinduroifedayo/shadow@38173bc9c696df3b1f87b5b9b60ccecd36a260ab; grimoire bettersandeep/grimoire@4824773040b131f3179e5896d71d1435908758a7; foreman PedValme/foreman@c15453cb2fc07fa674d6f7b548a553b3ce9e6f5d; cmi jeremiebergel/context-manager-intelligence@399468f0687c051476961e4bb045eb84263be6b1; fluent Bruno-coder21/fluent@182c4301f2437e784e9022f1f38576e1d68c3f5f; gemini-live cineglobe/hermes-gemini-live@b6c2f24354aeed1a8b5651b62944d14ed96a472d; trust-ladder merdoks/trust-ladder@fae4e9df58767e5e3832c8f65936b97868bc98fc; breadcrumbs breadcrumbs-agency/hermes-breadcrumb-plugin@b8975645e5174edbcc00d5dc86a78e536bce938b; contract-necromancer vijaygopalbalasa/hermes-necromancer@0ff7bec40aba10091a84f94025d4471984fd7386; living-spaces akinduroifedayo/living-spaces@e6145ccbd028edf55417822020426f4830343eb6; workroom Pratiikpy/workroom-for-hermes@c5f6bf334c1163951e203dc7c5777faadfe49795.

**housemate (152458).** A gateway platform adapter, TTS provider, 7 tools and a Desktop Rooms page. Old phones, browsers and laptops become wake-word room speakers, with hub-side wake word, device arbitration, persistent timers and spoken approvals through Hermes's own approval card (f01, f02, f03, f04, f06, f08, f10, f11). Catalog check passed with no warnings, enable and doctor passed (f02, x06). Called without the hub it failed cleanly with "hub not running" (f02, x06). x06 also ran a real hub: it created, listed and cancelled a 600 s timer and refused seconds=-1. Limits: heavy setup; wake phrase "Hey Jarvis" (f02); no speaker ID and non-commercial wake models (f04, f05); open LAN server (f05); anyone in earshot can talk (f01); private base-class state reads (f10); live room audio never exercised (f03, f07, f08, f11, x06).
- Test counts differ by environment. x06: 568 passed, 1 failed (a TLS minimum-version assertion) after pre-importing Hermes tools; its first run was 545 passed, 24 failed because Hermes's `tools` package was shadowed. f02: 537 passed, 28 failed, 4 errors. f09 and f10 counted 453 test functions with CI on real Hermes, and f09 could not collect the suite. f04: about 30 test files. No seat found a logic failure in the plugin apart from that TLS assertion.

**tenure (153714).** Per-action-type revocable trust (starts "trusted"; always asks for money and off-machine actions per f04), file undo with HMAC, signed ledger and "autonomy passport", Desktop and dashboard pages, five locales. The largest suites in the field: f02 2,401 passed, 6 failed; f09 1,453 passed, 2 failed; f04 about 950; f05 about 760; f10 about 763 test functions (different methods, not one count). Catalog check: three private core imports (f01), a security-scan caution and private-import warnings (f02). A heuristic ~5,200-line shell classifier (f02, f09, f10). An opt-in preset can let high-stakes actions run unasked (f01); the default "trusted" start lets rm/mv run behind a 24 h undo (f04); extra friction after external reads (f08, f11); the README says the study behind the rule is pending (f02). **Disputed reliability defect: see 3.1.**

**hermes-canvas (150644).** Plan drawn as a Desktop canvas; box status set by hooks from real writes and check exit codes; mid-turn user edits; pre_verify finish gate; subagent attribution (f01, f03, f05, f09, f10). Clean catalog check (f01, f02). Real Hermes refused a forged "done" and marked a box done from its check (f07, f11). Overclaim: "the model cannot fake an exit code", when the model writes the check command (f01, f04). Shell-write detection is heuristic (f02, f03, f06, f08, f11). The veto fails open on plugin errors (f05). Test counts: 206 (f01, f10) vs 306 passed (f02, f09), not reconciled. f09 says it is already merged (single seat; unconfirmed). No CI (f10). Live Desktop interaction unexercised (f03).

**hermes-ark (149640).** Encrypted, deduplicated, versioned backups of the Hermes home; snapshots before memory and skill writes through tool_execution middleware; previewed item-level restore; keys via the secret store; Desktop page (f01, f02, f04, f06, f07, f10, f11). 174 tests passed locally (f02, f11); f10 found 123 test functions against the README's 174 (a disagreement, possibly different counting). Live S3 recovery never exercised (f03, f11); a real Hermes checkpoint worked (f11). Weak points: backup is a familiar idea (f01, f05, f08, f09, f10); passphrase optional for a local repo (f02); "agent cannot switch it off" rests on regex matching (f01); "never writes config.yaml" overstated (f09); each memory or skill write adds a synchronous checkpoint (f04); `ark_checkpoint` was not offered to the model in a fresh-home run (f01, f02); no CI (f10). Rank swings from 1st (f06, f07, f11) to 16th (f01).

**hermes-ui-cards (150556).** 17 schema-validated interactive card types for Desktop and Webapp, text fallback elsewhere, undo countdown, screenshots, two languages. About 330 tests (f01), 463 passed with 4 parity failures (f02), 332 test functions (f10); f09 could not collect. A bad card gave a clear "missing card" error (f01, f02, f11). Weak points: known generative-UI idea (f01, f09, f10); empty demo-video slot (f01, f04, f10); model-chosen image URLs leak the user's IP (f04); eventual cross-client answer locking can duplicate submissions and confirmation cards are advisory (f03, f06, f07, f08, f11); no CI (f10). f09 scores Beyond 4 ("presentation layer").

**kata (150840).** Mines repeated tool sequences into `kata_` tools after `/kata approve`, re-checks rendered argument effects, retires on schema drift; dashboard tab; CI (f01, f03, f04, f06, f08, f10). Weak points: approval reachable from an agent's terminal via the CLI (f01); a new kata is callable only from the next session (f01); dynamic `kata_*` tools absent from the manifest and it wants tool_search off (f04); timed-out workers are not cancelled (f06, f07, f11); needs strictly repeated workflows (f02, f10). Tests passed locally (f02, f08); 58 passed (f09); f10 found README badges of 50, 61 and 56 that disagree. **Possible steering:** f09 notes the repo README "echoes the judging criteria" (the plugin folder's README is five lines). f09 still concluded no plugin addressed an AI judge and applied no penalty. Under the brief's rule a plugin that tries to steer an AI judge scores Reliable 1. No other seat mentioned this; it is one seat's observation and should be checked in kata's README.

**ariadne (150596).** Records sessions to cassettes and replays them offline through llm_execution and tool middleware without running tools or a model; compare, bisect across Hermes commits, fork, hook-contract checks; Desktop page; CI against three Hermes versions (f01, f03, f04, f05, f10). It found a real Hermes bug or regression (f04, f05, f09). An offline round trip worked (f03). Weak points: 21 unit tests in one file (f01, f02, f10); audience is plugin developers and upgraders (all seats); the upgrade check downloads and installs upstream Hermes (f02); in-chat play blocks synchronously (f04); one Desktop route can block the event loop offline (f09). f08 and f11 replayed a same-build CLI recording through the TUI and got platform and tool-inventory drift reports, which f08 read as weakening the upgrade-check promise and f11 as correct behaviour.

**fine-print (153844).** Detects Hermes's silent truncation, image downscaling and dropped results through 11 hooks and tells user and model; no extra model calls, fail-soft, dependency-free (f01, f04, f06, f08, f11). Tests: 254 fixture tests (f01, f10); 487 passed (f09). Verified-vs-fixture figures are stated differently: 16 of 81 limits live-verified (f01, f10); 19 of 35 detectors fixture-only (f04). Pinned to Hermes v0.23.0 strings (f01, f02, f04, f05, f10). Desktop cards not delivered in 0.23.0 by the README's own admission (f04, f10). A full search-page annotation was verified directly (f03). Audience seen as narrow by f02 and f09 (rank 20 in both) and broad by f06, f07, f08, f11 (ranks 3 to 4).

**hypnos (150800).** Trains a small local LoRA overnight (SFT and DPO, PEFT) from the user's approvals and corrections in a network-less Docker sandbox with an exam gate, and routes mastered turns to it through llm_execution middleware (f01, f04, f06, f08, f11). Weak points: separate trainer environment, GPU or slow CPU, unwritten MLX backend (f10); evidence is a synthetic persona and screenshots are mock-ups (f01, f04, f10); about six hard-coded habit templates (f01); real-torch training test skipped by default (f01, f02); a 0.6B model answering live turns is risky (f04). 126 test functions (f10). Called the most original entry by nearly every seat (Creative 5 in 7 of 8 sub-scoring seats).

**shadow (153955).** Replays recent turns on a candidate model, blind-judges both orders, gives a sign-test verdict, and switches the model in stages with undo through middleware. Catalog check passed (f02) with many private core imports warned (f01 says over 40; f05 "relies heavily on private Hermes internals"). Tests: f01 says the end-to-end acceptance test is a skip stub; f02 could not get the suite to collect; f09 says acceptance checks skip off macOS; f10 found about 832 test functions and CI; f04 about 70 test files. f09: a catalog entry still holds a placeholder SHA, and an exclusive mode can block other sessions. f10: it spawns a detached non-interactive Hermes child with `--ignore-rules` that the README does not disclose, and calls a private gateway function. Needs several providers and real spend (f01, f04, f06, f08).

**grimoire (152691).** Locked-down read-only DuckDB over CSV, JSON, Parquet and SQLite, 30 s query cap, a post-reply check tracing every number to a query, Desktop Data page. In Hermes it attached a CSV, answered a SELECT, refused DROP TABLE and refused /etc/passwd (f01, f02, f03, f08). Tests are one selftest script only (f02, f04, f05, f09); manifest lacks license and manifest_version (f04); committed .pyc files (f09); CI matrix (f10). SQL over files is familiar (f01, f06, f07, f10). Number matching is heuristic (f11).

**foreman (153851).** Deterministic diff gate on commit, push and PR that blocks skipped, deleted or weakened tests and committed secrets; second-model diff review via ctx.llm; merges human-only and pinned to the head SHA. About 436 tests (f01), 384 passed (f02; the one failure is its deliberately broken example), 383 passed (f09), 384 test functions plus CI and a Desktop pane (f10). Weak points: the text-matching gate is bypassable by its own admission (f03, f04, f06, f08, f10, f11); one private core import flagged (f01, f04); repo root cluttered with working documents (f05); screenshots are scripted previews (f10).

**cmi (151887).** Zero-LLM context engine that folds old tool results into recallable digests with a byte-stable cache prefix; 498 tests passed (f02, f09), 354 test functions (f10). Weak points: private compressor and pricing dependencies (f01 counts six private imports; also f03, f06, f08, f11); five-line or missing manifest and README in the catalogued folder, repo README about a Claude Code and Codex proxy, unrelated proxy and service code shipped alongside (f01, f05, f09, f10); savings are modelled or the author's replays, not measured (f01, f02, f03). **Disagreement on credentials:** f04 says the bundled console reads the auth.json credential pool, passes API keys on the command line and offers account switching, against the catalog credential rule (its rank 18, total 23). f05 only says it uses Hermes's credential pool. f06 says the separately installed Console is not credited and did not penalise it. Only f04 calls it a rule breach.

**fluent (150353).** Checks shell commands against installed programs' own `--help` and man text, blocks invented long options, routes destructive subcommands to Hermes approval; fails open; local backends only (all seats). Tests: f01 could not see the "542 tests" claim (69 functions plus corpus cases); f02 402 passed, 140 skipped; f09 454 passed; f10 a real-command corpus. Only five programs have tuned parsing and the "tokens saved" figure is a flat estimate (f02, f04). Creative scored 3 to 4.

**gemini-live (150251).** Full-duplex Gemini Live voice calls in Desktop and dashboard that delegate to the real agent; key read through Hermes's secret store with a single-use ephemeral browser token (f01, f02, f04, f05, f10). 126 of 127 tests passed (f02, the one failure a file-read rule on that machine); one shell-rule test failed (f09). Needs a Gemini key, and audio goes to Google (f02). The voice-picker integration needs the author's 375-line patch to Hermes Desktop (f01, f02, f04, f05, f10). **Disagreement on approval bypass:** f01 says phone writes skip Hermes approvals by default; f04 says the read-only shell is off by default; f09 and f10 say the opt-in `run_readonly` runs voice-model commands outside Hermes's approval prompt; f06 describes person-only approval handling. Read together, the bypass sits on an opt-in path, and only f01 calls it default. Live calls unexercised (f03, f06, f07, f08, f11). Thin tests, no CI, private core calls (f10).

**trust-ladder (149738).** Compiles a user correction into the strongest enforceable guard (block, post-write check, rule or approval), verified against the mistake; TLA+ specs. 95 of 96 passed (f02), 96 passed (f09), about 85 tests (f04). Inside Hermes it learned "never push straight to main", then blocked `git push origin main` and allowed `echo hello` (f02, f08, f11). The "minimal call" its tool description promises (a bare command string) is refused by its schema (f02). Install line still has an `<owner>` placeholder (f01, f04, f05, f10). Auto-learn is on by default and auto-learned guards install from chat without confirmation (f01, f04). No UI. **Disputed stall: see 3.1.**

**breadcrumbs (153020).** Content-addressed append-only memory provider plus context engine with zoom levels and recall receipts. About 680 tests (f01), 669 passed (f02, f09), 683 test functions (f10). Weak points: five private core imports flagged and the manifest under-declares what it registers (f01); the benchmark table (LoCoMo vs mem0 and others) has no harness in the repo (f01, f02, f04; f03 says not independently reproduced); hive server unauthenticated (f04); `/island` clones profile keys and skips its prompt when given a path (f05, f10); starts a thread at import and bundles a Desktop file without its TypeScript source (f09, f10). f08 and f11 report configured Hermes searches worked. **Disputed credential exposure: see 3.1.**

**contract-necromancer (152908).** Hash-locks a person's tests; pre_verify runs them itself and blocks edits to them; fail-closed; allow-listed child env; about 390 tests and CI (f01, f02, f09, f10). No UI, no network. A key file was renamed to avoid looking like a credential under catalog rule 11, and the headline figure is borrowed from another product (f01 only, a flagged seat). macOS-only testing (f04). The README names similar test-referee plugins (f02, f05, f10). f09 calls it the most fail-closed in the field (rank 3 there; rank 20 in f01).

**living-spaces (153809).** Agent-built persistent sandboxed mini-apps in a Desktop Spaces tab, with records, revisions, cron upkeep and an SSRF-safe fetcher; 394 passed with one failing on a missing module (f02), about 600 test functions (f01, f10). Catalog check flags rules 8 and 9 (raw `window.hermesDesktop` bridge, private cron modules) (f01, f02, f04, f10), and its own README says it is not catalog-approved. macOS-only qualification (f02, f08, f09). Schedules model-spending cron turns with no approval step (f01, f10). Credentials and network: forwards cookies and auth headers by default and stores Space credentials outside the secret store (f05); plaintext Space credentials and a documented WebRTC egress exception (f06, f11); can copy home-folder files and post to any public host (f02). **Disagreement:** f04 says Space internet is on by default; f11 refers to an "Internet Off" setting with a WebRTC exception. Not reconciled.

**workroom (152651).** Word, PowerPoint and Excel figures tied to workbook cells; 31 tools, 14 hooks, owner-approved releases, a tripwire that reverts direct agent edits; excellent README; about 590 to 730 tests (f01, f02, f10). Windows-centred (all seats). The reviewer sent it back several times over slow guard patterns (f02). **Disputed reliability defect and credential-rule concern: see 3.1.**

## 3. Where the finals disagree

### 3.1 Reliability defects found by some seats and missed by others
Most seats scored tenure Reliable 4 (or gave totals only), but two found a stall:
- **tenure, catastrophic regex backtracking** in the `HERMES_VAR` matcher of `tenure/classify.py` on a short slash-run argument, reproduced locally by f06 (Reliable 1, rank 20) and f07 (Reliable 1, rank 19). Both say it lets an agent-wide terminal hook stall the process. f07 is on the flagged list (1 source), f06 is not and corroborates it. Seats that ran the suite (f02, f09) would not hit it. Likely real at this pin, though no other seat tried to reproduce it.
- **trust-ladder, ReDoS.** The compiler accepts and example-verifies `(a|aa)+$`; 40 a's followed by `!` exceeds a three-second cutoff (f03, Reliable 2, rank 20). f06 reproduced it with `^(a|aa)+$` and 36 a's (Reliable 3). Seats that ran its 95 of 96 or 96 tests did not hit it. f03 is flagged (1 source), f06 is not, and they agree.
- **workroom, unbounded `_CD` regex in `adapters/snapshotter.py`** (quadratic on newline input): f03 (300,000 newlines over a 3 s cutoff, R2), f06 (R2; says later fixes lie outside this pin), f07 (R1, reproduced even with no registered project), f11 (30,000 newlines over 4 s, R2). Four seats agree and f06 is unflagged. f02 separately says the reviewer sent it back over slow guard patterns, and f09 says each tool call scans up to 200 MB. Strong consensus for a real defect at the pin.
- **workroom, reads `.env` and key-file bytes** for its tripwire: f08 scores Reliable 1, treating it as a catalog credential-rule blocker (f08 is unflagged); f04 and f10 note the reading without scoring it that severely; f10 could not register the plugin because lxml could not be installed offline. The entrant discloses it as local-only handling (f08). Severity is disputed.
- **breadcrumbs, summarizer subprocess** (`breadcrumbs/summarize.py`) launches llama-completion without an explicit environment, so it inherits provider credentials when that optional path is active: f06 (R2) and f07 (R2, calls it a catalog blocker). Others did not read this file. Unflagged f06 agrees with f07.
These explain why tenure, trust-ladder, workroom and breadcrumbs sit lower in the seats that found them.

### 3.2 Test-count and pass/fail disagreements
These come mostly from environments: missing dependencies (yaml, lxml, aiohttp), a shadowed `tools` package, a missing `/tmp`, SQLite WAL mode, or a Git ceiling. f09 could not collect workroom, hypnos, hermes-ui-cards, housemate, shadow, hermes-ark or contract-necromancer (judged by reading). f02 could not collect shadow and timed out on contract-necromancer. A failing count in one seat is not a plugin failure unless the cause is named (it was for housemate's TLS assertion and the gemini-live shell-rule test).

### 3.3 Different readings of the same fact
- ariadne replay drift: weakness (f08) or correct behaviour (f11).
- gemini-live approval bypass: three readings (section 2).
- cmi credential-rule breach: f04 only.
- kata README echoing the judging criteria: f09 only, not penalised.
- fine-print audience: Useful 5 and Reliable 4 to 5 in f06, f07, f08, f11; Useful 3 in f01 and f09 (rank 9 to 20).

### 3.4 Judge steering
f09 states it found no plugin addressing an AI judge. No finals or deep seat scored Reliable 1 for judge steering. The kata note above is the only near case. The Reliable-1 scores in the finals are for the stall and credential-read defects in 3.1.

## 4. Deep rounds (b19 deep-x-05, b20 deep-x-06, -07, -08, -09)

Method (all five): Hermes at a84025ade22d2a4085f575d4353072e5b702635d, `uv sync --locked --python 3.14`; catalog validation, enable and doctor via `hermes plugins`; Nous's tryit.py against its scripted fake model, empty plans first, then 2 to 4 planned calls; entrants' tests run where possible. Plugin tools registered in their own toolsets did not show in the first offered tool list (x05, x08) or needed tool_search (x06); x09 disabled tool deferral in scratch to expose them. No seat had a graphical Desktop, microphone, telco account or paid provider.
Flagged: x06 (1 source), x07 (5), x08 (2), x09 (3). x05 is unflagged. Which sources failed is not identified in my inputs. The seats' local test and run observations are their own and not tied to URLs.

### 4.1 Deep-round scores (U/R/P/C/B, total, rank in its batch of 6)

| Plugin (PR) | Seat | U/R/P/C/B | Total | Rank |
|---|---|---|---|---|
| permission-canvas (151341) | x06 | 4/4/5/5/5 | 28 | 2 |
| housemate (152458) | x06 | 5/3/5/4/5 | 27 | 1 |
| confidential-mode (151301) | x06 | 4/4/4/5/5 | 27 | 3 |
| redactgate (152764) | x06 | 5/3/4/4/5 | 26 | 4 |
| helm (150160) | x06 | 4/4/5/3/5 | 26 | 5 |
| patient-research (153640) | x06 | not judged | 0 | 6 |
| ussd-platform (152850) | x07 | 3/5/5/5/5 | 28 | 1 |
| vellum (152533) | x07 | 3/4/5/5/5 | 27 | 2 |
| redactgate | x07 | 5/3/4/4/5 | 26 | 3 |
| shadow-army (153524) | x07 | 4/3/5/4/5 | 26 | 4 |
| lahja (149968) | x07 | 3/4/5/3/5 | 25 | 5 |
| patient-research | x07 | not judged | 0 | 6 |
| heats (152450) | x08 | 5/4/5/4/5 | 28 | 1 |
| redactgate | x08 | 5/4/5/4/5 | 28 | 2 |
| undo-send (152063) | x08 | 5/4/5/4/5 | 28 | 3 |
| ussd-platform | x08 | 3/5/5/5/5 | 28 | 4 |
| habits (153606) | x08 | 4/3/5/5/5 | 27 | 5 |
| hermes-regress (153146) | x08 | 4/2/3/4/5 | 23 | 6 |
| augur (154055) | x09 | 4/4/5/4/5 | 27 | 1 |
| ussd-platform | x09 | 3/5/5/5/5 | 28 | 2 |
| on-air (153960) | x09 | 3/4/5/4/5 | 26 | 3 |
| workgraph (150453) | x09 | 4/2/5/4/5 | 25 | 4 |
| clearvoice (149978) | x09 | 3/2/4/4/5 | 23 | 5 |
| hermes-regress | x09 | 4/2/3/4/5 | 23 | 6 |
| locus-codegraph (153687) | x05 | 4/4/5/4/4 | 25 | 1 |
| 3ds-platform (149202) | x05 | 2/4/5/5/5 | 26 | 2 |
| excubitor (150261) | x05 | 4/4/4/3/4 | 23 | 3 |
| guild (151704) | x05 | 4/3/4/4/4 | 23 | 4 |
| helm | x05 | 3/3/5/4/4 | 23 | 5 |
| patient-research | x05 | not judged | 0 | 6 |

Batch ranks are not always score order. x09 ranked augur (27) above ussd-platform (28) on retention (daily use by existing Hermes users, no carrier provisioning) and clearvoice above hermes-regress at the same 23 because its approval boundary held while regress has demonstrated raw-secret capture gaps. x06 says its scores are not the sole ordering key and puts housemate (27) above permission-canvas (28). x05 put locus (25) above 3ds-platform (26). Batches are different groups of six, so ranks do not compare across seats.

### 4.2 Plugins judged by more than one deep seat
- **ussd-platform** (GodlyDeveloper1/hermes@f5f69e215dad54c06d2977320a080ab1c68f10ca): x07, x08 and x09 all give 3/5/5/5/5 = 28. All three: 15 catalog checks passed with no warnings, enable and doctor passed; 23 tests passed (17 engine, 6 live adapter, after installing aiohttp); a real platform-registry round trip returned the expected CON reply; a malformed caller got HTTP 400 and a wrong secret 404 (x08, x09), with zero agent dispatches on the bad callback (x07); a weak webhook secret was refused at startup (x07). Limits: needs an aggregator and short code; USSD and SMS expose text to telecoms; in-memory inboxes lost on restart; no live telco tested. Strong three-seat agreement, though all three seats are on the flagged list for some source.
- **redactgate** (ctmakc/hermes-redactgate@d4bb87d78381d0514cd8dd74525fea98a5b46d62): x06 26 (R3), x07 26 (R3), x08 28 (R4, P5). All: 63 tests passed including 4 real-Hermes integration tests; the four recorded main-model requests held no raw synthetic name or email; the local file kept the originals. **Disagreement on a collision defect:** x06 found two of 2,414 distinct synthetic emails sharing a six-hex EMAIL token (`SessionVault.token` keeps an existing token without checking its value), the later one restoring to the earlier email; x07 found a collision at 7,908 distinct emails with a fixed key; x08 did not probe collisions, scored Reliable 4, and verified round-trip restoration and `/redact verify` (four events, intact chain). Two independent reproductions of a 24-bit token collision; x08 did not test for it. All agree auxiliary calls (titles, compression) bypass request middleware unless hardened.
- **hermes-regress** (harishkotra/hermes-regress@877c6dfdfd5e80bb1dca79a67b3081f9764545b5): x08 and x09 both 4/2/3/4/5 = 23, rank 6. Both: 18 tests passed; a synthetic password canary was redacted in tool results but persisted in the prompt, assistant answer and tool arguments, against the README's redaction claim. In-process replay served a recorded read and blocked an unrecorded write. Native CLI replay could not start the gateway here, so no end-to-end replay is claimed. x09 adds that `args_key` keeps path but drops `limit` (a recorded limit=1 replayed as exact at limit=999).
- **housemate**: x06 gave 27 (R3, rank 1 of its batch); the finals average 28.0.
- **helm** (ASV-Labs/hermes-helm@0f68da9b485870059be2bef71f284a81ad771fdd): x05 23 (3/3/5/4/4), x06 26 (4/4/5/3/5). Both: node smoke test 31 contributions, 13 rendered; 191 sprites; path traversal refused. **Disagreement:** x05 says the catalog warning is about 27 app-markup selectors in desktop/plugin.js, that it auto-sets profile avatars every minute despite the README listing that among click-only actions, and that a code comment admits shaping code to avoid the install scanner's obfuscation flags (Reliable 3). x06 says the selectors are theme CSS, not DOM access, and does not mention the avatar or comment findings (Reliable 4). The avatar and comment findings come from one seat and were not contradicted, but x06 did not look for them; confirm before relying on them.
- **patient-research**: section 0.

### 4.3 Single-seat deep findings
- **permission-canvas** (TANGBUDU/permission-canvas@3a3086066051f5cc7a6ee52c20d62395b814da3f), x06: 15 catalog checks passed, safe scan; 314 passed, 9 skipped; a computer-use provider with element-level screenshot and accessibility redaction and one-use human approvals; real-Hermes loader tests showed a yellow click withheld, a human approval consumed once, a repeat re-asked. Native Linux paths gave structured missing-driver diagnostics, with no real desktop operation verified; terminal, file and browser tools can bypass the backend boundary.
- **confidential-mode** (ainsleys/hermes-confidential-mode@e407486a2227be8cafe7b4350586f3016ebff573), x06: 31 private-core import sites (warning, disclosed); the on-host lock stopped an unattended off-host web_search before dispatch; 3084 passed, 4 failed, 8 skipped, 6 xfailed (failures environment-related: WAL, hard-coded /tmp, five yb_* tools absent from this Hermes checkout); excludes shell and code traffic and off-tier auxiliary calls; vendor attestation never run live.
- **vellum** (0xsaltylollipop/vellum@286b44d587500bd4792decdc73370791262aec0b), x07: 16 checks passed; 73 tests passed; four tools refused outside a user-opened paper turn (controlled refusals, not crashes); no Desktop, drawing or TTS exercised; depends on Desktop, arXiv HTML and voice services.
- **shadow-army** (SilentKnight87/shadow-army@aa340f06ffe10dce5c63cfabc0e0c6de3e9d1e41), x07: 154 of 157 passed (3 setup, context and terminal-scope failures; 28 of 30 host-probe tests passed); an unbound PASS refused; the publish guard fails open on parse errors; no real two-provider run.
- **lahja** (Tarekkharsa/hermes-lahja@a7a43b1389a1ae169ff5c7401e9ec2ec9a53b51d), x07: Arabic-dialect local STT provider; 99 passed, 6 skipped; whisper.cpp and models absent, so the main path and the entrant's WER gain were not reproduced.
- **heats** (EconLearn/hermes-heats@2bcee10e9ca6489b7fd23bb0362a36eacdae269f), x08: 211 tests passed (after a Git ceiling fix; the first run had 5 fixture failures); a full lifecycle in a real Hermes child: baseline failed, the child changed answer.py in an isolated worktree, the check passed, the original checkout stayed unchanged until `/heats apply`; an untrusted-repo run was refused cleanly. The policy is not an OS sandbox; the author's small-model benchmark gain did not replicate.
- **undo-send** (helenn-szn/undo-send@10d388c951245ceeabc1101bb8ff65e75f4f6737), x08: 64 tests passed; a one-second window held an action, `/unsend all` cancelled it with the downstream callback never run, and a read bypassed the hold; classification is heuristic and it fails open.
- **habits** (emiwltz/hermes-habits@c2e32395e0e3461fe56c7d68b7bc993ee0954277), x08: full suite 4,896 passed, 14 failed, 28 skipped (5 hidden-path, 8 permission-switch, 1 secret fixture, attributed to environment differences; a clean environment gave 339 passed, 1 failure); a saved file-reading reflex returned Hermes's dedup sentinel instead of content on reuse (a repeat-use correctness gap); private Hermes imports warned.
- **augur** (Bruno-coder21/augur@6e775b23e2a322c8eee32db4074a44cb85e86e89), x09: 16 checks passed; 100 of 101 tests passed (one timing assertion: 1.39 s concurrent, 0.31 to 0.32 s focused, against a 0.3 s limit); the classifier adds a call on every substantial request; no real-model classification benchmark.
- **clearvoice** (thebangarang/clearvoice-hermes-plugin@d4bc366ec72d4f2af1a1772b3a94f48bd0e0b156), x09: 158 passed, 4 failed; three failures show the package omits `clearvoice_engine/data/piper_voices.json`, so non-English voice defaults do not resolve despite the 17-language README; the fourth is environment-dependent.
- **on-air** (HomunculusLabs/hermes-on-air@d40b6ef97e34cd5bd89e8434cad2538a3c1080c3), x09: 16 checks passed; 24 owner tools; 2320 passed, 11 failed (ten timing tests passed on isolated rerun; one needs a gateway the machine could not start); no Twitch, OBS or voice.
- **workgraph** (aliiqbal24/workgraph@37c7280a514d3fa23e7193f44b5123d1f9c90163), x09: catalog admission passed but standard `enable` failed twice (uv lock could not find the staged editable distribution), so the required tryit calls hit tool-not-found; a manual-enable supplemental run worked; 57 passed, 12 failed (bubblewrap/netlink restriction on that machine), 68 of 69 with the documented unsafe flag.
- **locus-codegraph** (x05): 146 unittest tests passed plus 10 node tests; `locus_rehearse` correctly flagged a breaking caller; indexing is synchronous on every edit; non-Python is regex-level.
- **3ds-platform** (x05): 212 passed, 26 skipped; Noise-IK pairing; adapter not driven (no 3DS); Useful 2 (few users); keys in plain 0600 files and an unauthenticated plaintext LAN mode the README does not mention.
- **excubitor** (x05): 94 passed, 2 skipped; Hermes's own loop guard fired before its threshold; webhook and ntfy targets sit in plain config, not the secret store.
- **guild** (x05): its own suite 2 passed, 8 failed against current Hermes (HERMES_HOME swap); the same path worked in a real home. Code reading: `approve()` merges whatever is on a force-pushable proposal branch, `reject()` skips the reviewer check, and sync's `git clean` can delete untracked library files.

### 4.4 Deep-round standouts (merger tally)
By total: permission-canvas, ussd-platform, heats, redactgate (x08 only), undo-send (all 28); housemate, confidential-mode, vellum, augur, habits (27). By number of agreeing seats: ussd-platform (three seats at 28) and redactgate (26, 26, 28) are the best corroborated. housemate is the only plugin seen in both rounds.
Reliability-capped in the deep seats: hermes-regress (R2, two seats), clearvoice (R2), workgraph (R2), redactgate (R3 in two seats, collision), housemate (R3 in x06 only), habits (R3), shadow-army (R3), guild (R3), helm (R3 in x05).

## 5. What could not be found or checked
- final-12 ran nothing. patient-research's source was unreachable to three seats.
- No seat saw a real Desktop session, live audio (housemate, gemini-live, clearvoice, lahja), telco delivery (ussd-platform), live S3 (ark), paid model providers (shadow, confidential-mode) or real GPU training (hypnos).
- Entrant benchmark claims (breadcrumbs vs mem0, cmi savings, lahja WER, heats gain, hypnos results, fluent "tokens saved") were not reproduced by any seat.
- The flagged-source lists give counts only; I could not tell which claims relied on which failed URL.
- Sub-scores are missing for final-02, final-04 and final-05.
- The means and mean ranks in Section 1 were tallied by hand from the seats' files, not by code, and may be off in the last decimal.