# Hermes Agent Plugin Hackathon: root merge 3 of 5 (round 3 "deep" results)

This root merges 25 round 3 results: deep-19 to deep-24 (batch deep-d, files b10-*), deep-25 to deep-30 (deep-e, b11-*), deep-31 to deep-36 (deep-f, b12-*), deep-37 to deep-42 (deep-g, b13-*) and deep-43 (deep-h, b14-*). All 25 files were present, parsed as JSON and held results: no result is missing or empty, and no seat marked a plugin `blocked`. Together they hold **154 seat-scores of 90 distinct plugins**: 88 entries plus the two reference plugins, done-bell and Home Assistant. Each total is Useful + Reliable + Polish + Creative + 2 × Beyond. I recomputed all 154 and every one matches the seat's stated total.

How to read the figures:
- These are **raw seat totals**. PLAN.md says score.py applies a per-family curve and a correction against the two reference plugins (BASE/PLAN.md, "Changed during the run", item 1). This merge does not apply them. Seats grade at different strengths, so a raw mean here is a rough guide, not the final order.
- Within-seat ranks run 1 to 6. deep-31 and deep-41 had eight items, so theirs run 1 to 8 (they also ranked the reference plugins).
- This root has only some of round 3's seats. A plugin with one seat here may have more seats in other roots.

## 1. How each seat ran (from each result's `setup` field)

| batch | how it judged | Hermes source |
|---|---|---|
| deep-19, 20, 21, 22, 25, 26, 27, 28, 29, 31, 32, 33, 34, 35, 37, 39, 42, 43 | Real Hermes. Ran tryit.py (catalog validate, enable, doctor, a fake-LLM AIAgent chat with an empty plan, then a plan of 2–5 calls) and the plugin's own tests | fdde27e7 (where stated) |
| deep-24 | Same method | HEAD 8ec22731 |
| deep-30 | Same method | d949b43e |
| deep-36 | Same method | main 998498af (CPython 3.14.4) |
| deep-23 | **Read only.** "Hermes was not installed in this session: time/turn budget did not allow…". No plugin code or tests were run | n/a |
| deep-40 | **Read only.** The sandbox proxy refused every shell network request, so "RUN.md's uv sync and tryit.py could not run". No tests were run | n/a |
| deep-38 | Hermes installed, but "tryit.py did not complete in this sandbox". Only catalog validation and the plugins' own tests ran; no tool-call results | not stated |
| deep-41 | Hermes installed. tryit.py empty-plan runs "did not emit a report" within a 25-second bound, so no tool calls were observed. Test runs were also bounded (several are marked "failed"/"not completed" after a few tests) | not stated |

Consequence: in deep-23 and deep-40, Reliable rests on code reading and the plugins' own claims. In deep-41, failures may reflect the 25-second bound rather than the plugin. Where those seats disagree with seats that ran the code, §3 says so.

## 2. Sources that did not hold on re-check

The brief says some of these results cite sources that failed when their machines read them again: deep-19 (1), deep-21 (1), deep-22 (3), deep-30 (2), deep-31 (1), deep-33 (3), deep-34 (3), deep-35 (1), deep-36 (2) and deep-41 (1). None of the 25 result files has a sources list, so I cannot tell which source each count refers to.
- I re-requested every URL quoted inline in deep-22, deep-33 and deep-35 (pinned repository trees and raw files) and the gist's field.json on 2026-11-12. All returned HTTP 200. So the failed items are probably passages, or sources not quoted in these files, that do not say what they were cited for.
- deep-19, deep-30, deep-31, deep-34, deep-36 and deep-41 quote no URL in their result text. Their flagged sources cannot be identified at all.
- **How to weigh them:** the flagged batches' observations of their own runs (test counts, tool-call results) do not depend on outside pages. Claims they make from READMEs or docs should count less: for example, deep-22's reading of dress-rehearsal's README, or deep-36's reading of agent-pool's README against its code. The single-seat findings most exposed to this are: deep-19's omniscience overclaim and key-file reading, deep-30's nvidia-switchyard rule 11 finding, and deep-33's foreman findings. Each is one seat's claim and should be confirmed before it decides a place.

## 3. Where results disagree (total range ≥ 3, or findings that conflict)

- **sheets (152421): 27 [d21], 23 [d38], 28 [d43].** deep-38 gave Reliable 2 because "the catalog security scan flagged prompt_injection_ignore in g1abc.json and g2.json" and validation "failed". deep-21 and deep-43 ran the same pinned commit (65888b7c) and report the security scan passing ("16 successful checks", no warnings). deep-38's Hermes commit is not stated, and its tryit run hung. No seat says the flagged files try to steer a judge; they appear to be grid data files. Unresolved; the most consequential disagreement in this root. deep-21 and deep-43 independently found that a missing `sharing.json` lets chat create and read grids, although the README says chat access starts off.
- **crystallize (152544): 28 [d22], 25 [d27], 25 [d37].** deep-27 and deep-37 hit 17 test failures. Both say every failure comes from the runner hard-coding `/tmp`, which was read-only in their sandboxes. deep-22 passed 1,455 tests. deep-27 adds from reading the code: "crystal_run executes nothing (guarded dispatch is hard-coded off)". deep-22 confirms that nested replay is "deliberately disabled at this pin". deep-37 adds that it "rewrites user config and cron jobs to work" and has a manifest field Hermes rejects on load. The disagreement is over how much the disabled core feature costs, not over the facts.
- **locus-codegraph (153687): 25 [d19] vs 29 [d20].** Both passed all 146 tests. deep-19 marks down Polish and Beyond: Python-only, and the repo is buried under evidence files.
- **construct (150346): 29 [d20] vs 25 [d29].** deep-20 passed 399 tests (46 skipped). deep-29 ran 48 plugin tests (OK) but could not finish the full suite in 10 minutes. deep-29 notes it runs a headless browser, ffmpeg, FreeCAD or Blender "without asking unless confirm_runs is switched on".
- **hermes-security (149611): 28 [d21] vs 23 [d40].** deep-40 judged by reading only and calls it "a well-known idea adapted from an upstream project". deep-21 ran 654 tests (1 sandbox failure), but notes the pinned evaluation records failed discovery/agreement gates.
- **say-do-gate (149365): 28 [d21] vs 23 [d24].** Both passed all 393 tests and both saw the claim-check work live. deep-24 scores Polish 3 (no screenshots) and Beyond 4, and found that the extractor misses some claims and misreads inline code.
- **privacy-xray (150696): 23 [d24] vs 29 [d36].** Both passed 79/79 tests and saw the same behaviour. deep-24 judged the audience narrower ("privacy-minded or EU users").
- **tickover (151968): 22 [d29] vs 28 [d41].** deep-29 saw Hermes refuse to enable it as shipped (uv lock could not build its pyproject member). deep-41 never saw a tool call and its tests stopped "before the 25-second bound". deep-29's evidence is stronger.
- **agent-pool (153225): 16 [d26] vs 23 [d36].** Both say enable failed in the harness. deep-36 found that the same SHA installs and enables in a fresh Hermes home with `--yes-deps --enable`, so the failure may come from the validate-then-enable order. deep-26 found the installer builds the word sudo from fragments ("PRIV_NAME='su'\"do\"" with the comment "no literal in file"), and that a test checks the catalog scanner never sees it. It also found audits can auto-run that root script (`auto_provision` defaults to true), and gave Reliable 1. deep-36 does not report this; a third read should check it.
- **morph (152243): 22 [d27], 25 [d30], 27 [d32].** deep-27 and deep-30 saw enable refused (uv lock, a repo-root pyproject). deep-32 says the validate-before-enable sequence breaks editable staging, a harness interaction rather than a plugin defect, and gave Reliable 4. deep-27 also reports, from reading, that "a dashboard request with no session is treated as the operator, so an agent with a terminal could approve its own write". Neither other seat mentions this.
- **dress-rehearsal (151804): 25 [d22] vs 27 [d23].** deep-22 ran it in Hermes: "a scratch executable named cat performed a write before approval, yet the rehearsal report still said nothing ran" (Reliable 2). deep-23 read the code only, ran no tests, and gave Reliable 5. deep-22's observed result should prevail. deep-22 is a flagged-source batch, but this finding is its own run, not a cited page.
- **keryx (153853): 25 [d24], 25 [d40]**: same total, conflicting findings. deep-24 says the key is "read through Hermes's secret scope". deep-40 (read only) says "load_settings reads openai_api_key from plugin config before Hermes's secret store, and the approval fingerprint is recorded before the user confirms." Rule 11 is in question; unresolved.
- **understudy (149159): 25 [d24], 27 [d33], 24 [d35].** All passed 94 tests. deep-35 found that the "hard dollar cap uses past mean costs rather than reserving a worst-case charge", so it can overshoot (Reliable 3).
- **freeze (151245): 27 [d26] vs 23 [d37].** Both passed 62 tests. deep-37 marks down Polish (no screenshots or UI). It also found `hermes freeze` unavailable under `plugins.isolation: host`.
- **smart-dictation (151371): 21 [d19] vs 25 [d43].** deep-19's 3 test failures went away in deep-43 once the declared audio dependencies were installed (88 passed). deep-19 also found the dashboard manifest points to an unshipped dist/index.js, plus near-duplicate api_v0_N.py files.
- **hermes-roam (150563): 24 [d26], 25 [d34], 28 [d35].** All three agree on the facts: about 608–610 tests pass, with 2–3 failures (timing, 80-column status, the machine's environment). They differ on Useful and Creative ("a well-built take on a known idea (dotfile sync)", deep-26).
- **passkey-gate (152214): 27 [d29], 29 [d38], 26 [d41].** Test outcomes vary with the environment: 30 failures from shared challenge state (d29), proxy-routed fixtures (d38), a bounded run (d41). None reports a crypto fault.
- **workgraph (150453): 25 [d20] vs 28 [d38].** deep-20 saw the ordinary enable fail twice (uv lock) and got 56/69 tests passing. deep-38 did not run enable, and its bubblewrap tests failed in its sandbox.
- **imprint (153978): 27 [d28] vs 24 [d42].** deep-42's 29 failures came from headless Chrome in its sandbox. It also notes there is "nothing the agent can call", and the catalog check flags it for reaching into app markup outside the SDK.
- **wings (153781): 26 [d19] vs 24 [d34]**; **shadow-army (153524): 26 vs 24**; **lahja (149968): 24/25/23**; **plur1bus (151604): 22/23/22**; **cmi (151887): 28/29/28**; **living-spaces (153809): 28/28/27**: the facts agree and the totals are close. They are listed so no spread is dropped.

## Catalog-rule and safety findings (kept with their source batch)

Rules the catalog reviewer is known to enforce (brief): keys from Hermes's secret store, no money moved without a person's approval, no overclaiming, readable code.
- **Keys read outside Hermes's secret store (rule 11):** omniscience reads keys "from ~/.hermes/auth.json and .env" (d19). annotary reads "per-profile token files" and its own secrets.json (d39, Reliable 2). nvidia-switchyard's handling of subscription tokens "conflicts with catalog rule 11" (d30, Reliable 2). plur1bus lets "plaintext apiKey config values take priority over the secret store" (d25, d26). keryx is disputed (d40 vs d24, §3). The seats name gemini-live, hermes-ussd, keryx (d24), morph, whos-listening and plur1bus as reading keys through Hermes's secret scope or declared secrets.
- **Claims beyond the code:** omniscience says "no write endpoints" yet has POST write routes (d19). agent-pool's README contradicts its code on versions, tool count and approval (d26). syrinx's outward-action hold "fails open", contradicting "hooks can never break a turn" (d40). genui reports a benchmark "100% versus 0%" without its output (d40). kata's README cites 50 and 61 tests in different places (d29). hermes-design-studio's README still says it is unpublished and that validation passed "with CAUTION, not SAFE" (d27).
- **Code that is hard to read or audit:** local-scout ships injection-model weights without the training code (d19). plur1bus ships a .pyc and is about 25k lines carved out of a larger repo (d26, d42). locus-codegraph's and hermes-design-studio's repos are buried in evidence files (d19, d27). imprint is a 7,900-line bundled Desktop app (d42). roomsmith ships two 672 KB bundles, though the source and build script are included (d26). agent-pool obfuscates a word to evade the scanner (d26).
- **Actions without per-call human approval:** summon "replies post publicly with no approval step", and trial mode stores bot OAuth tokens on the author's relay (d29). harness-story's narrative LLM defaults to the author's LAN address `http://192.168.1.12:8080` (d27). kumi runs DAW changes without asking by default (d19). construct runs external programs unless confirm_runs is on (d29). tickover schedules cron jobs and messages a repairer without per-call approval (d29). kata runs approved routines without asking again (d29). skill-court's auto mode "spends and quarantines in the background", and its trial profiles clone the user's keys (d29). standing-orders' arming approval "rests on the tool description rather than an enforced gate" (d27). agent-pool auto-runs a root script (d26).
- **Money and spend:** no seat found a plugin moving money without approval. agentline's number purchases sit behind Hermes's approval gate (d25). understudy's spend cap can overshoot (d35). shadow has a spend cap behind capability grants (d37).
- **Steering an AI judge:** no seat reported a plugin that tries to steer an AI judge, so no Reliable score in this root was set to 1 on that ground. agent-pool's Reliable 1 (d26) is for scanner evasion and the root script. The only injection-related flag is the scan hit on sheets' data files (d38, disputed, §3). skill-court's own judge has deliberate injection resistance (d23).
- **Private core imports (rule 9 warnings), as noted by the seats:** wings, kumi (d19); living-spaces (d22, d30, d41); hermes-roam, plur1bus (d26); skill-court (d29); mandate (d25, d37); hermes-tuneup (d31, d39); foreman (d33); promise-keeper (d36); habits (7 sites) and shadow (42 sites) (d37); cmi (d39, d43); annotary (d39); nvidia-switchyard (d30); googlehome (d42); hail-hermes (d32), riah-swipe (d32, d43); hermes-lens (d38); homeassistant reference (d31).
- **Would not enable through the normal path in these runs**, mostly from uv lock "Distribution not found" on a shipped pyproject build-system: local-scout (d19); workgraph (d20); plur1bus (d25: ENOSPC; d26: uv lock); agent-pool (d26, d36); morph (d27, d30); muster (d28); tickover (d29). deep-32 and deep-36 attribute some of these failures to the validate-then-enable order, not to the plugin (§3).

## Reference plugins (calibration, deep-31 and deep-41 only)

done-bell: 19 [d31, rank 8/8], 20 [d41, rank 8/8]. Home Assistant: 24 [d31, rank 6/8], 26 [d41, rank 5/8]. deep-41 ranked eight plugins in all, including tickover (28) and cmi (29).


## 4. Merged standings (raw seat totals, before score.py's curve and reference correction)

Order: mean of this root's raw seat totals, ties by seat count. Within-seat ranks are in section 5. Each figure is from the batch named beside it. These are not score.py's corrected numbers; the reference plugins (PR 0) were scored only by deep-31 and deep-41.

|#|plugin (PR)|mean|seat totals (batch)|
|---|---|---|---|
|1|no-cap (149272)|30.0|30 d38|
|2|tenure (153714)|29.0|29 d30, 29 d35|
|3|culprit (152914)|29.0|29 d32|
|4|rich-paste (152408)|29.0|29 d28|
|5|ariadne (150596)|28.5|29 d35, 28 d36|
|6|signet (153144)|28.5|28 d21, 29 d31|
|7|cmi (151887)|28.3|28 d39, 29 d41, 28 d43|
|8|hermes-time-machine (149553)|28.0|29 d28, 27 d34|
|9|retouch (153090)|28.0|28 d30, 28 d43|
|10|foreman (153851)|28.0|28 d33|
|11|hail-hermes (154028)|28.0|28 d32|
|12|housemate (152458)|28.0|28 d33|
|13|sentinel-vision (153596)|28.0|28 d32|
|14|shadow (153955)|28.0|28 d37|
|15|twring (153357)|28.0|28 d20|
|16|living-spaces (153809)|27.7|28 d22, 28 d30, 27 d41|
|17|barehand (153871)|27.5|28 d23, 27 d25|
|18|hypnos (150800)|27.5|27 d24, 28 d33|
|19|lineage (149244)|27.5|28 d34, 27 d35|
|20|passkey-gate (152214)|27.3|27 d29, 29 d38, 26 d41|
|21|xray (149414)|27.3|27 d22, 28 d31, 27 d38|
|22|construct (150346)|27.0|29 d20, 25 d29|
|23|kata (150840)|27.0|28 d22, 26 d29|
|24|locus-codegraph (153687)|27.0|25 d19, 29 d20|
|25|promise-keeper (151929)|27.0|27 d36, 27 d42|
|26|flowcanvas (153240)|27.0|27 d40|
|27|fluent (150353)|27.0|27 d36|
|28|gemini-live (150251)|27.0|27 d25|
|29|guild (151704)|27.0|27 d33|
|30|hallway-test (152475)|27.0|27 d31|
|31|home-3d-workshop (153024)|27.0|27 d39|
|32|joust (151376)|27.0|27 d23|
|33|on-air (153960)|27.0|27 d42|
|34|procgen-studio (150293)|27.0|27 d31|
|35|syrinx (153938)|27.0|27 d40|
|36|undo-send (152063)|27.0|27 d32|
|37|wake-me-when (151135)|27.0|27 d31|
|38|hermes-lens (153316)|26.5|26 d34, 27 d38|
|39|hermes-ussd (153766)|26.5|26 d26, 27 d36|
|40|project-command-center (152899)|26.5|26 d21, 27 d39|
|41|standing-orders (153113)|26.5|26 d27, 27 d33|
|42|workgraph (150453)|26.5|25 d20, 28 d38|
|43|crystallize (152544)|26.0|28 d22, 25 d27, 25 d37|
|44|riah-swipe (153647)|26.0|26 d27, 27 d32, 25 d43|
|45|sheets (152421)|26.0|27 d21, 23 d38, 28 d43|
|46|agentline (152976)|26.0|26 d25, 26 d43|
|47|dress-rehearsal (151804)|26.0|25 d22, 27 d23|
|48|privacy-xray (150696)|26.0|23 d24, 29 d36|
|49|samskara (149823)|26.0|26 d20, 26 d21|
|50|whos-listening (153867)|26.0|25 d23, 27 d34|
|51|3ds-platform (149202)|26.0|26 d28|
|52|annotary (153900)|26.0|26 d39|
|53|fine-print (153844)|26.0|26 d25|
|54|genui (152159)|26.0|26 d40|
|55|googlehome (153826)|26.0|26 d42|
|56|hermes-roam (150563)|25.7|24 d26, 25 d34, 28 d35|
|57|hermes-security (149611)|25.5|28 d21, 23 d40|
|58|imprint (153978)|25.5|27 d28, 24 d42|
|59|nvidia-switchyard (152256)|25.5|25 d30, 26 d41|
|60|say-do-gate (149365)|25.5|28 d21, 23 d24|
|61|skill-court (150873)|25.5|26 d23, 25 d29|
|62|understudy (149159)|25.3|25 d24, 27 d33, 24 d35|
|63|freeze (151245)|25.0|27 d26, 23 d37|
|64|homeassistant (ref)|25.0|24 d31, 26 d41|
|65|keryx (153853)|25.0|25 d24, 25 d40|
|66|pinpoint (149426)|25.0|26 d35, 24 d42|
|67|shadow-army (153524)|25.0|26 d28, 24 d41|
|68|tickover (151968)|25.0|22 d29, 28 d41|
|69|wings (153781)|25.0|26 d19, 24 d34|
|70|benchforge (152504)|25.0|25 d40|
|71|kumi (152258)|25.0|25 d19|
|72|roomsmith (153724)|25.0|25 d26|
|73|summon (153861)|25.0|25 d29|
|74|tironian (151281)|25.0|25 d39|
|75|vellum (152533)|25.0|25 d20|
|76|morph (152243)|24.7|22 d27, 25 d30, 27 d32|
|77|hermes-tuneup (152190)|24.5|24 d31, 25 d39|
|78|mandate (153050)|24.5|24 d25, 25 d37|
|79|lahja (149968)|24.0|24 d22, 25 d23, 23 d24|
|80|local-scout (153872)|24.0|24 d19|
|81|muster (151448)|24.0|24 d28|
|82|thoth (150497)|24.0|24 d37|
|83|hermes-design-studio (154067)|23.0|21 d27, 25 d30|
|84|smart-dictation (151371)|23.0|21 d19, 25 d43|
|85|habits (153606)|23.0|23 d37|
|86|omniscience (154025)|23.0|23 d19|
|87|plur1bus (151604)|22.3|22 d25, 23 d26, 22 d42|
|88|harness-story (154078)|21.0|21 d27|
|89|agent-pool (153225)|19.5|16 d26, 23 d36|
|90|done-bell (ref)|19.5|19 d31, 20 d41|

## 5. Per-plugin findings, every seat

Each line: batch, U/R/P/C/B=Total, within-seat rank; T = first pass/fail count in that seat's run of the plugin's own tests (other suites, skips and causes are in the input file), or its note when none was run; + = its best; − = its worst. Lines are abridged where marked …; the full text of every field (validate, inside, tests, best, worst) is in the input file for that batch, `.imd/reads/artifacts/<file>` (= `artifacts/goal/batches/deep-*/items/<batch>/result.json`). URLs inside findings are the seats' own citations.

**no-cap** (PR 149272)
- d38 5/5/5/5/5=30 r1/6. T: passed: 60 selected claim, evidence, and verification … + It makes the agent's success claims answerable to its … − It verifies evidence for a claim rather than whether the underlying work is correct, so green receipts can still support a bad outcome.

**tenure** (PR 153714)
- d30 5/4/5/5/5=29 r1/6. T: 2,402 passed, 5 failed + Revocable per-action trust, real undo snapshots … − Its large static shell classifier is explicitly not a sandbox, and private API dependencies plus the failed default cold-passport latency budget …
- d35 5/4/5/5/5=29 r3/6. T: 2402 pytest tests passed, 5 failed, 2 skipped. … + Revocable autonomy backed by real file undo, per-action … − A broad shell classifier and trust state machine create considerable safety complexity, and its tests expose read-side initialization writes …

**culprit** (PR 152914)
- d32 5/5/5/4/5=29 r1/6. T: 29 passed + Durable tool-call snapshots and real test-driven bisection … − Binary search assumes a single pass-to-fail transition, and ignored dependencies or external/container changes can make recorded states …

**rich-paste** (PR 152408)
- d28 5/5/5/4/5=29 r1/6. T: 248 passed, 0 failed + It fixes an everyday Desktop and multimodal-request problem … − Native clipboard behavior is macOS-focused, screenshot matching has a disclosed order-fallback gap, and the npm test entry point needs an …

**ariadne** (PR 150596)
- d35 4/5/5/5/5=29 r2/6. T: Passed: 21 unit tests and the real-Hermes offline … + Safe offline replay, request diffs and hook-contract checks … − The heaviest upgrade/bisect paths still require separate Hermes builds, and recordings replay through a specific surface rather than reproducing …
- d36 4/4/5/5/5=28 r2/6. T: 21/21 unit tests passed, covering cassette … + Adds genuinely offline, tool-frozen session replay and … − The CLI recording replayed through TUI and a different tool catalog, producing three drift reports even on the same Hermes checkout; upgrade …

**signet** (PR 153144)
- d21 4/5/5/4/5=28 r4/6. T: 108 Python tests plus 140 subtests passed. … + Single-use approval seals bind outgoing mail to the exact … − Its explicitly heuristic direct-mailer guard is not a sandbox, and owner-listed trusted recipients can bypass prompting; retention is strongest …
- d31 4/5/5/5/5=29 r1/8. T: 108 passed, 0 failed + It binds a person’s approval to the exact outgoing email … − No real person or mail account was present, so delivery after approval could only be checked by its local tests.

**cmi** (PR 151887)
- d39 5/4/5/4/5=28 r1/6. T: 498 passed + A reversible, cache-aware context engine with searchable … − Undocumented compressor and pricing imports are a compatibility risk, and this seat did not reproduce the README's percentage savings on real …
- d41 5/4/5/5/5=29 r1/8. T: 314 passed, 1 failed + A deterministic context engine changes how Hermes retains … − One concurrent persistence test failed in the supplied environment.
- d43 5/4/4/5/5=28 r1/6. T: Passed from the plugin repository: 501 tests, 6 … + Deterministic context selection with exact recall changes … − Catalog rule-9 warnings identify private Hermes imports that create upgrade fragility despite passing admission and current runtime checks.

**hermes-time-machine** (PR 149553)
- d28 5/4/5/5/5=29 r2/6. T: The documented unittest runner passed all 122 tests … + Keeping irreversible-effect memory after chat rollback or … − Effect classification uses session cwd while checkpoints honor the configured workspace, producing a false outside-workspace approval gate when …
- d34 5/3/4/5/5=27 r3/6. T: Passed 122 unittest tests, including real Hermes … + Agent-visible checkpoints plus approval gates and … − Effect classification uses session cwd instead of the configured protected workspace, falsely treating a protected-file edit as irreversible …

**retouch** (PR 153090)
- d30 4/5/5/4/5=28 r3/6. T: Passed: 266 Python unit/integration tests, 6 … + Mark-specific agent sessions, pixel-checked regional edits … − Object replacement depends on an external image provider and sends picture content to configured models, while the end-to-end Desktop …
- d43 4/5/5/4/5=28 r3/6. T: Passed: 272 tests across tests/ and verify/, including … + User-drawn regions, exact outside-mask preservation … − The verified guarantee covers unchanged outside pixels, while convincing removals and seam-free generated edits still depend on an untested …

**foreman** (PR 153851)
- d33 5/4/5/4/5=28 r1/6. T: 381 passed, 2 failed + Broadly useful deterministic hooks stop visible test … − A nonexistent supplied path can silently check the enclosing repository, long SARIF error paths lose the filename, and one private Hermes import …

**hail-hermes** (PR 154028)
- d32 4/4/5/5/5=28 r2/6. T: 379 passed + A substantial voice and wearable platform gives a … − Speech, Desktop and real-watch behavior remain unverified here, and numerous private core imports make the otherwise well-tested platform …

**housemate** (PR 152458)
- d33 4/5/5/4/5=28 r2/6. T: 569 passed + A substantial new Hermes voice platform reuses ordinary … − It needs an always-running gateway plus STT/TTS and continuous microphone streaming, and real-device speech latency and approvals were not …

**sentinel-vision** (PR 153596)
- d32 4/4/5/5/5=28 r3/6. T: 1484 passed + A persistent, budgeted visual event loop adds … − Its live value depends on a capable vision model and correctly routed alerts, while Desktop/chat-photo delivery and latest cost controls lack …

**shadow** (PR 153955)
- d37 4/4/5/5/5=28 r1/6. T: 1458 passed, 0 failed + Replays your own recent turns on a candidate model and your … − It imports 42 private Hermes internals that can break on any release, needs three providers before it does anything, and 436 of its tests are …

**twring** (PR 153357)
- d20 5/4/5/4/5=28 r3/6. T: Passed: python -m pytest -p pytest_asyncio.plugin … + It makes the user's existing Hermes reachable by live call … − The complete experience requires a Twring account, phone app and running gateway/server, whose real audio and ringing path remains unverified …

**living-spaces** (PR 153809)
- d22 5/3/5/5/5=28 r1/6. T: Passed: 395 Python tests plus 1,017 subtests; 261 … + Persistent agent-built apps with shared records, revision … − Catalog validation warns about private cron/session imports and a raw Desktop bridge; Desktop-only bot context and the live GUI/upkeep path …
- d30 5/4/5/4/5=28 r2/6. T: Passed 395 Python tests plus 1,017 subtests and 261 … + Persistent Desktop mini-apps share revisioned files and … − Private cron/session APIs and a raw Desktop bridge add upgrade risk, and the documented Internet Off switch does not promise to prevent WebRTC …
- d41 4/3/5/5/5=27 r3/8. T: none found in the plugin package; not run + Persistent, sandboxed canvases with records, revisions … − The package documents dependence on private cron and Desktop interfaces and carries no executable package tests.

**barehand** (PR 153871)
- d23 4/4/5/5/5=28 r1/6. T: present, not run here: .github/workflows/ci.yml plus a … + The most novel and on-theme entry: a real computer_use … − Needs QEMU plus UEFI firmware and a vision-capable model, so day-one install friction is real even though the capability is strong; not run live …
- d25 3/4/5/5/5=27 r2/6. T: 729 passed, 6 failed + Gives Hermes a computer_use provider over QEMU QMP/VNC with … − Its audience is people with QEMU VMs or VNC consoles; nothing could be driven end to end here without QEMU, and a few transport tests fail …

**hypnos** (PR 150800)
- d24 3/4/5/5/5=27 r1/6. T: 229 passed + Captures approvals, denials and corrections through nine … − The core loop needs a separate torch trainer and ideally a GPU; on CPU here a tiny-model night did not finish in 7 minutes, and its headline …
- d33 4/4/5/5/5=28 r3/6. T: 229 passed + Hypnos changes Hermes itself through personal LoRA … − Its strongest benefit remains unverified on real weights here, while supported habit extraction and the separate trainer/model setup narrow the …

**lineage** (PR 149244)
- d34 4/5/5/4/5=28 r1/6. T: Passed 19 Python tests and 2 Node Desktop … + Automatic, verifiable provenance receipts and a usable … − A source read earlier is only an explicitly labelled inference, and the local HMAC signature is not an independent third-party attestation.
- d35 4/4/5/4/5=27 r4/6. T: Passed: 19 pytest tests after installing test-only … + Automatic provenance receipts distinguish observed … − URL refetch validates only the initial URL before urllib follows redirects, leaving a gap in the advertised public-host-only protection …

**passkey-gate** (PR 152214)
- d29 4/4/4/5/5=27 r1/6. T: 324 passed, 30 failed + Real WebAuthn approval of the exact action and tool call … − Full use needs Tailscale or your own HTTPS plus a phone, the README admits regex patterns can be routed around and direct config edits bypass …
- d38 4/5/5/5/5=29 r2/6. T: 256 passed, 47 failed, 51 errors + It binds a human passkey approval to the exact sensitive … − It needs phone, HTTPS reachability, and a setup flow, so its strongest protection is not a one-click install for every user.
- d41 4/3/5/4/5=26 r4/8. T: 1 passed, 1 failed + It binds risky agent actions to a person’s passkey approval … − It needs phone/HTTPS setup and its audit suite failed early in this environment.

**xray** (PR 149414)
- d22 4/4/4/5/5=27 r4/6. T: Passed: 13/13 unittest tests, including clock-warp … + Time-warped honeytoken detonation and attributed runtime … − Its Python audit hooks are bypassable by native code, and opt-in bait occupies real credential paths, so GREEN is diagnostic evidence rather …
- d31 4/4/5/5/5=28 r2/8. T: 13 passed, 0 failed + It tests installed plugins with bait and clock shifts, then … − Its child process is a Python audit tripwire running as the user, so native code can bypass its egress and spawn checks.
- d38 4/4/4/5/5=27 r4/6. T: 13 passed + It gives Hermes a distinctive behavioral supply-chain check … − Its detonation is only a Python-level tripwire, not an operating-system sandbox, and the integration runner could not finish here.

**construct** (PR 150346)
- d20 4/5/5/5/5=29 r2/6. T: Passed: python -m pytest construct_hologram -q, 399 … + One checked named-part scene becomes both a self-contained … − Physical print quality and native Desktop presentation remain unverified here, while CAD, film and live NetLogo paths require optional external …
- d29 3/4/5/5/4=25 r4/6. T: Hermes-plugin suites (test_hermes_plugin … + A research-to-checked-3D pipeline (hologram in chat … − Very large and niche, and by default it runs a headless browser, ffmpeg, FreeCAD or Blender on the machine without asking unless confirm_runs is …

**kata** (PR 150840)
- d22 5/4/5/4/5=28 r2/6. T: Passed: 61 pytest tests (units, admission, mining … + It actually turns repeated real Hermes calls into a … − Its shell effect classifier has an incomplete dangerous-flag allowlist, and timed-out worker threads cannot be cancelled, limiting the safety …
- d29 4/4/4/4/5=26 r2/6. T: 61 passed, 0 failed + Mines tool routines the agent repeats and, only after the … − Once approved, local-write routines run without asking each time, its read-only shell classifier has gaps (rg --pre, git diff --output), and it …

**locus-codegraph** (PR 153687)
- d19 4/5/4/4/4=25 r2/6. T: 146 ran OK + Rehearses a Python signature change against every … − Depth is Python-only, and the repository buries the plugin under a large pile of evidence files that is hard to audit.
- d20 5/5/5/4/5=29 r1/6. T: Passed using the documented runner: python -m unittest … + Rehearsal and immediate caller-specific edit feedback … − Its checks depend on statically proven Python bindings and the active project directory, so dynamic/decorated calls remain outside the guarantee …

**promise-keeper** (PR 151929)
- d36 5/3/5/4/5=27 r4/6. T: 660 passed, 15 failed + Turns a user's persistent rules into deterministic checks … − Fifteen red-team assertions fail, leaving material gaps in the broad shell-enforcement surface despite successful direct-file protection.
- d42 5/4/4/4/5=27 r1/6. T: 664 passed, 11 failed + Deterministic, model-independent enforcement of the user's … − Its own red-team suite fails 11 Windows-shell and trailing-dot evasions, so the 'best effort' terminal layer still has documented holes.

**flowcanvas** (PR 153240)
- d40 4/4/5/4/5=27 r1/6. T: not run; the suite is large: 49 unittest files in … + A full visual workflow canvas inside Hermes Desktop … − Media presets depend on a third-party MCP (@nanogpt/mcp) and paid provider calls, and register() itself has no guard, so a backend import …

**fluent** (PR 150353)
- d36 5/3/5/4/5=27 r3/6. T: 435 passed, 1 failed + Learns the exact installed CLI and intercepts shell … − The high-confidence guard rejects valid git diff --staged, so a common legitimate workflow is blocked even after successful adoption.

**gemini-live** (PR 150251)
- d25 4/4/5/4/5=27 r1/6. T: 126 passed, 1 failed + Full-duplex voice calls with your own Hermes agent in … − Needs a Gemini key and sends call audio and, by default, the open chat's context to Google; its opt-in run_readonly does not path-check git …

**guild** (PR 151704)
- d33 4/4/5/4/5=27 r5/6. T: 10 passed + Guild turns independently learned skills into a reviewed … − Its read-only protection inspects ordinary tool arguments rather than arbitrary executed code, and reviewer policy still needs remote branch …

**hallway-test** (PR 152475)
- d31 3/4/5/5/5=27 r4/8. T: 35 passed, 0 failed + Code-enforced accessibility personas drove a real browser … − The browser needs a separate matching Chromium install and a full five-person run makes many model calls.

**home-3d-workshop** (PR 153024)
- d39 3/4/5/5/5=27 r3/6. T: 970 passed, 1 failed + A printer becomes a shared household agent with … − It serves a hardware-specific audience, and the watcher-state test fails while physical printer behavior and one slow connectivity test remain …

**joust** (PR 151376)
- d23 4/4/5/4/5=27 r3/6. T: present, not run here: tests/ has 8 files plus a … + Git-worktree isolation plus a 'Crossfire' cross-testing … − Narrower day-one audience than the batch's top two: useful mainly to developers running multi-contender coding benchmarks, and judged from …

**on-air** (PR 153960)
- d42 3/4/5/5/5=27 r2/6. T: 2330 passed, 1 failed + A guarded AI co-host for live streams as a Hermes platform … − A large, complex surface (24 tools, 2,300+ tests, many docs) for a streamer niche, and none of its setup tools answer outside an owner CLI or …

**procgen-studio** (PR 150293)
- d31 4/3/5/5/5=27 r3/8. T: 177 passed, 1 failed + It plugs a local, reproducible code-rendering backend into … − The renderer has a Python 3.14 NamedTuple compatibility failure, and the scripted model could not complete a real Hermes render.

**syrinx** (PR 153938)
- d40 4/3/5/5/5=27 r2/6. T: not run; tests/ has 6 pytest files (argus, backend … + A new idea for agents: it decides when the agent's … − The outward-action hold fails open: if hold_directive raises, pre_tool_call logs at debug level and returns None, so the push goes through. That …

**undo-send** (PR 152063)
- d32 5/4/4/4/5=27 r4/6. T: 64 passed + A real tool-execution grace window can prevent irreversible … − Name/regex classification misses some publishing forms, and normal error returns can be misleadingly recorded as sent rather than failed.

**wake-me-when** (PR 151135)
- d31 3/4/5/5/5=27 r5/8. T: 112 passed, 3 failed + It adds persistent live audio-video monitoring with … − The full end-to-end suite showed order-sensitive failures, and the short Hermes run did not verify an emitted alert.

**hermes-lens** (PR 153316)
- d34 3/4/5/4/5=26 r6/6. T: Passed 67 Python tests, including HTTP adapter … + A polished glasses-and-iPhone channel connects the user’s … − It requires compatible glasses, an iPhone build, Gemini access and HTTPS setup, and the live hardware path remains unverified here.
- d38 3/4/5/5/5=27 r5/6. T: 66 passed, 1 failed + It gives a personal Hermes agent a carefully gated … − It is tied to Ray-Ban Meta hardware, an iPhone, and Gemini Live, while also relying on private Hermes approval imports.

**hermes-ussd** (PR 153766)
- d26 3/4/4/5/5=26 r2/6. T: 300 passed + Adds a new Hermes platform that serves feature phones with … − Only users with an Africa's Talking account in supported African markets can use it, and nothing past config and status can be checked without …
- d36 3/5/5/4/5=27 r5/6. T: Passed all 300 tests (300 collected; full pytest run … + Extends Hermes to ordinary feature phones with an … − Its audience is constrained by a regional carrier integration and operator provisioning, and actual carrier delivery remains unverified without …

**project-command-center** (PR 152899)
- d21 4/4/5/3/5=26 r5/6. T: Pytest collected no tests because the Python suites … + A polished native Desktop workbench connects projects … − Its value concentrates on Desktop/GitHub development workflows, live authenticated behavior was not verified, and six graph tests depend on an …
- d39 4/5/5/3/5=27 r2/6. T: All 8 standalone Python suites passed (448 check … + A shared SQLite board, session-aware agent tools, automatic … − Its strongest value is for Desktop users already organizing GitHub projects, and six real-history graph tests require fixtures absent from a …

**standing-orders** (PR 153113)
- d27 3/4/4/5/5=26 r2/6. T: 170 passed + Plain-English camera triggers: a local cascade (change … − It needs a webcam and a running gateway, so it serves a narrower audience. Arming 'only after the user approved' rests on the tool description …
- d33 3/4/5/5/5=27 r6/6. T: 170 passed + Plain-language camera watches become budgeted, backtestable … − The pinned implementation explicitly lacks Linux and Windows camera support, and neither a live watch nor the vision-model path was demonstrated …

**workgraph** (PR 150453)
- d20 4/2/4/5/5=25 r6/6. T: Failed: python -m unittest discover -s tests -v ran 69 … + Its saved product-state tree, data-aware branching and … − The ordinary enable command failed, so even the successful manually enabled versioning path is not a dependable day-one installation; its …
- d38 4/4/5/5/5=28 r3/6. T: 9 passed, 9 failed + It turns exploratory agent coding into a persistent … − The core verification path depends on bubblewrap, which makes installation and use less portable and could not run under this sandbox.

**crystallize** (PR 152544)
- d22 5/4/5/4/5=28 r3/6. T: Passed: 1,455 pytest tests, 2 skipped; covers SDK … + Working context cleaning, duplicate-result suppression and … − Automatic nested routine replay is deliberately disabled at this pin because guarded dispatch is unverified, and paid helper quality, billing …
- d27 4/3/4/4/5=25 r3/6. T: 1438 passed, 17 failed + It changes how Hermes itself spends tokens, through request … − Read in the code: crystal_run executes nothing (guarded dispatch is hard-coded off), some hooks are on by default (stream buffering, stripping …
- d37 4/3/4/4/5=25 r3/6. T: 1438 passed, 17 failed + Attacks the real bill with llm_request middleware that … − Sixty-odd modules (auction, rent, rhythm, brake, blind) behind a dense, hedged README that retires its own earlier savings tables, a manifest …

**riah-swipe** (PR 153647)
- d27 4/5/5/4/4=26 r1/6. T: 307 ran OK + A real human-in-the-loop review surface (local PWA board … − Value depends on the user generating batches of options; the board is a local web server whose phone mode needs LAN setup, and one test was …
- d32 4/4/5/4/5=27 r6/6. T: 250 passed + A bundled phone-friendly review board and chat feedback … − The full suite exposed intermittent note-order reversal, and Telegram-specific behavior plus private Hermes imports add maintenance and upgrade …
- d43 4/4/5/4/4=25 r6/6. T: Initial documented unittest runner: 307 tests, 249 … + A bundled swipe board turns generated batches into … − Same-timestamp decisions can reorder feedback notes, and private core imports add upgrade risk to an otherwise polished review workflow.

**sheets** (PR 152421)
- d21 4/4/5/4/5=27 r3/6. T: 14/14 Python tests passed; 161/161 Node workspace … + A product-like agentic spreadsheet makes research and … − Missing sharing.json is treated as permission to create and read chat grids despite the starts-off promise, and a stale README paragraph still …
- d38 4/2/5/4/4=23 r6/6. T: passed: 14 Python tool tests passed; the Node … + Its reviewed write-back model makes agent-collected … − It fails the catalog admission security scan, which caps reliability regardless of the passing unit tests.
- d43 5/4/5/4/5=28 r2/6. T: Passed: 14 Python tool tests; 161 Node workspace … + A local agent spreadsheet makes research and classification … − A fresh profile allowed chat create/read before any sharing preference existed, although the README says chat access starts off.

**agentline** (PR 152976)
- d25 4/4/4/4/5=26 r4/6. T: 38 passed + Adds a real phone line as a Hermes platform (text or call … − Everything runs through one commercial service (agentline.cloud, the author's listed name) with paid numbers, so nothing works without that …
- d43 3/5/4/4/5=26 r4/6. T: Passed: 38 standard-library unit tests and 26 … + A real bidirectional phone/SMS platform extends where … − A paid external service limited to US and Canadian numbers narrows day-one adoption, and its actual voice quality remains unverified.

**dress-rehearsal** (PR 151804)
- d22 5/2/4/4/5=25 r5/6. T: Passed: 84 pytest cases using the documented … + Exact recorded-call replay, editable steps, diffs and … − While armed it trusts command basenames: a scratch executable named cat performed a write before approval, yet the rehearsal report still said …
- d23 4/5/4/4/5=27 r2/6. T: present, not run here: README states '84 tests cover … + Simple, dependency-free, fail-closed hook design … − The read-only shell classifier is explicitly conservative and will over-record benign commands it doesn't recognize, and none of the 84 tests …

**privacy-xray** (PR 150696)
- d24 3/4/4/4/4=23 r5/6. T: 79 ran OK + Hooks every main and auxiliary model request to show, as … − Mostly for privacy-minded or EU users, and find fails closed whenever Hermes does not report a local surface, as in this run.
- d36 5/5/5/4/5=29 r1/6. T: Passed: 79/79 using the supplied unittest script … + Makes Hermes's otherwise hidden main and auxiliary data … − Cannot block auxiliary requests or observe independent tool network traffic, and the finder was unavailable through this harness's unresolved …

**samskara** (PR 149823)
- d20 4/4/4/4/5=26 r4/6. T: 150 passed + A real memory-provider integration gives Hermes … − Writes require a separate reindex before graph recall sees them, and the embedded backend supports only a narrow set of query shapes …
- d21 4/4/4/4/5=26 r6/6. T: 150/150 offline pytest tests passed, including graph … + A real Hermes memory-provider extension adds graph-path … − Embedded recall is deliberately read-only, journaled facts need external reindexing to become graph recall, and automatic semantic extraction is …

**whos-listening** (PR 153867)
- d23 4/4/4/3/5=25 r5/6. T: present, not run here: tests/ has 20 files … + Broadly useful to almost any Hermes user and reads its one … − The private/shared memory-tiering idea itself is a refinement of an existing concept (memory providers with access tiers) rather than something …
- d34 5/4/4/4/5=27 r2/6. T: Passed all 524 Python tests, covering provider/guard … + Provider-, gateway- and platform-aware memory filtering … − Privacy depends on correct setup and tagged-memory boundaries; ordinary user text, model paraphrases and auxiliary calls are not a general …

**3ds-platform** (PR 149202)
- d28 3/3/5/5/5=26 r5/6. T: 226 passed, 12 failed + A source-readable encrypted handheld platform with native … − Its audience requires a homebrew-capable 3DS, and both Python audio timing tests and the C decoder comparison against ffmpeg failed while …

**annotary** (PR 153900)
- d39 5/2/5/4/5=26 r4/6. T: 331 passed + Persistent line comments, versions and consent-controlled … − Direct file-based owner/profile credential reads conflict with catalog rule 11 even though automated validation passes, so I rate Reliability 2 …

**fine-print** (PR 153844)
- d25 4/4/5/5/4=26 r3/6. T: 487 passed + Makes Hermes's silent limits (truncated pages, downscaled … − It only observes and explains; the value is diagnostic and some users will find cards noisy, and running its suite needs the exact README …

**genui** (PR 152159)
- d40 4/4/4/4/5=26 r3/6. T: not run; there are no tests inside the plugin/ folder … + Live, schema-validated UI cards in Hermes Desktop (PR … − Only renders in Desktop. show and update handlers have no try/except, and the plugin's tests and benchmark sit outside the catalog folder, with …

**googlehome** (PR 153826)
- d42 3/4/5/4/5=26 r3/6. T: 293 passed + Puts a Hermes profile's voice on a Cast-only Google Home … − It leans on private Hermes internals and a raw Desktop bridge the catalog check warns about, and the speaker can only talk, never listen.

**hermes-roam** (PR 150563)
- d26 4/4/4/4/4=24 r3/6. T: 609 passed, 3 failed + Encrypted, signed sync of the Hermes home (skills … − Setup has friction: `push` before `init` fails, and init says to run --create-remote though a plain push then worked. It uses a private Hermes …
- d34 4/4/4/3/5=25 r4/6. T: 608 passed, 2 failed + Encrypted, host-aware home sync combines previewable … − CLI status still violates its 80-column test, cloud backends were not exercised against live services, and multi-device setup requires key and …
- d35 5/5/4/4/5=28 r1/6. T: 610 passed, 2 failed + Encrypted, conflict-aware sync of the user's real Hermes … − The human status-width test fails and a large-home timing target missed here; real S3/R2/Git behavior remains supported by read code and tests …

**hermes-security** (PR 149611)
- d21 5/4/5/4/5=28 r2/6. T: 654 passed, 1 failed + A substantial native security-review system preserves … − A successful scan start does not establish detection quality: the pinned evaluation records failed development discovery/agreement gates and …
- d40 4/4/4/3/4=23 r6/6. T: not run; tests/ and evals/ folders exist and the … + A careful repository security reviewer: evidence-backed … − An LLM security review is a well-known idea adapted from an upstream project. Its tests need a hermes-agent checkout on PYTHONPATH, and the …

**imprint** (PR 153978)
- d28 4/4/5/4/5=27 r3/6. T: 692 passed, 5 failed + A coherent source notebook and branded publishing studio … − Its most ambitious browser-rendered design workflow remains unverified here, and number/quote matching cannot establish whether a generated …
- d42 4/3/5/4/4=24 r4/6. T: 698 passed, 29 failed + A full NotebookLM-style notebook inside Hermes Desktop on … − Nothing the agent can call: it is a 7,900-line bundled Desktop app that the catalog check flags for reaching into app markup outside the SDK …

**nvidia-switchyard** (PR 152256)
- d30 4/2/5/4/5=25 r4/6. T: Passed all 174 distinct Python tests in the documented … + Verification-gated local/cloud routing, provider presets … − Subscription-token handling conflicts with catalog rule 11, and the default local decision budget can delay a request for 30 minutes while cloud …
- d41 4/3/5/4/5=26 r6/8. T: 9 passed, 1 failed + Local-first verification-gated routing changes Hermes’s … − It is explicitly beta, requires local and cloud model configuration, and had a parity-test failure.

**say-do-gate** (PR 149365)
- d21 5/5/4/4/5=28 r1/6. T: 393/393 pytest tests passed after setting documented … + A tiny dependency-free runtime extension catches … − It recognizes a bounded deterministic claim/command vocabulary, checks only final replies, and default observe mode defers correction until a …
- d24 4/4/3/4/4=23 r4/6. T: 393 passed + Deterministically checks the final reply's claims against a … − The claim extractor misses some claims and misreads inline code, and the README has no screenshots or demo beyond a text example.

**skill-court** (PR 150873)
- d23 4/4/4/4/5=26 r4/6. T: present, not run here: tests/ has 12 files … + A genuinely new capability (blind pairwise before/after … − Scores were produced by reading the pinned commit only; its 12 test files and 9,000-skill benchmark were not executed in this session.
- d29 3/3/4/5/5=25 r5/6. T: 130 passed, 0 failed + Measures whether each agent-written skill actually helps by … − Leans on private Hermes internals the catalog check warns about, trial profiles are clones of the user's profile including keys, and auto mode …

**understudy** (PR 149159)
- d24 4/5/4/4/4=25 r2/6. T: 94 passed + Replays the user's real Hermes decisions on cheaper … − It needs real history and spends real tokens, so nothing beyond the estimate could be shown here, and it is read-only advice rather than a …
- d33 5/5/5/4/4=27 r4/6. T: 94 passed + A polished, consent-aware replay harness gives Hermes users … − A one-step replay cannot prove a cheaper model will finish an entire task, and useful conclusions require sufficient history plus additional …
- d35 4/3/5/4/4=24 r6/6. T: Passed: 94 pytest tests, covering corpus sampling … + Auditioning cheaper models against the user's own session … − The advertised hard dollar cap uses past mean costs rather than reserving a worst-case charge, so expensive or unpriced in-flight calls can …

**freeze** (PR 151245)
- d26 4/4/4/5/5=27 r1/6. T: 62 passed + Changes how Hermes runs recurring work: it records a turn's … − The compile-and-replay core could not be run here without a real model, so it rests on its 62 tests; it has no screenshots or UI beyond the …
- d37 4/4/3/4/4=23 r5/6. T: 62 passed, 0 failed + Freezes a finished agent turn into a checked, model-free … − No screenshots, demo or Desktop UI, the compile path could not be verified here, and 'hermes freeze' is unavailable under plugins.isolation …

**homeassistant** (PR reference plugin)
- d31 4/4/4/2/5=24 r6/8. T: 212 passed, 0 failed + It gives Hermes a full Home Assistant event platform and … − It needs a Home Assistant token and instance to expose its tools, and catalog validation flagged one private core import.
- d41 5/4/4/3/5=26 r5/8. T: not run; no focused suite was run + A mature platform adapter gives Hermes real smart-home … − It requires a configured Home Assistant service and access token.

**keryx** (PR 153853)
- d24 3/4/5/5/4=25 r3/6. T: 75 passed, 3 failed + Lets Hermes place real phone calls from the user's own … − Needs Linux with PipeWire 1.4 HFP, a paired phone and an OpenAI realtime key, so few users can run it, and 3 of its tests assume that hardware …
- d40 3/3/4/5/5=25 r5/6. T: not run; repo-root tests/ (outside the keryx/ catalog … + Hermes places real phone calls from the user's own phone … − Heavy setup (Linux, PipeWire 1.4+, WirePlumber config, OpenAI key). load_settings reads openai_api_key from plugin config before Hermes's secret …

**pinpoint** (PR 149426)
- d35 3/4/5/4/5=26 r5/6. T: 306 Python/build tests passed, 5 skipped, 9 subtests … + Measured pins and conservative fixed/gone/not-rechecked … − It serves Desktop web-building users only, and its own README discloses a failing desktop-only scenario plus missing session/window correlation …
- d42 3/4/5/4/4=24 r5/6. T: 298 passed, 6 errors + Gives the agent measured evidence (contrast ratios, sizes … − Useful only to people doing web work in Hermes Desktop's Browser pane, and its end-to-end path is verified on Windows only.

**shadow-army** (PR 153524)
- d28 4/3/5/4/5=26 r4/6. T: 151 passed, 6 failed + Code-bound, expiring independent-review receipts and … − Its session and board context dependencies produce compatibility failures in the current Hermes tests, and the full host dispatch probe did not …
- d41 4/3/5/4/4=24 r7/8. T: 3 passed, 1 failed + Independent-model verification before closing code work is … − It depends on a separately configured verifier route, and its suite had an early failure.

**tickover** (PR 151968)
- d29 3/2/4/5/4=22 r6/6. T: 168 passed, 9 failed + Gives Hermes ears for real hardware: hear a clip, verify an … − Hermes refused to enable it as shipped because its pyproject dependency member failed to build, its first real use downloads an 87 MB model, and …
- d41 5/3/5/5/5=28 r2/8. T: not completed: 9 tests passed before the 25-second … + It gives Hermes local, testable acoustic verification and … − Its large runtime/model dependency path prevented a complete in-Hermes run here.

**wings** (PR 153781)
- d19 4/3/4/5/5=26 r1/6. T: repo tests/ scripts run standalone: test_core … + It changes where Hermes runs and is reached: a no-account … − A heavy root footprint (sudo/pkexec helper, nftables, systemd, a trusted CA, /etc/hosts) that the dashboard can start via 'setup -y', revoking a …
- d34 4/2/4/4/5=24 r5/6. T: Seven standalone Python test scripts passed (core … + WireGuard pairing, device identity and Desktop/phone access … − Revoking before setup hits a caught KeyError and returns only 'devices'; privileged installation and real network recovery remain unverified.

**benchforge** (PR 152504)
- d40 3/4/5/5/4=25 r4/6. T: not run; tests/ plus 5 golden benches (10 sketches) … + It tests AI-written Arduino firmware on a simulated … − Niche (Uno only). The flash gate matches terminal commands by keyword, so other upload paths could bypass it, and progress updates sleep up to …

**kumi** (PR 152258)
- d19 3/4/5/5/4=25 r3/6. T: python -m unittest discover -s hermes-plugin/tests … + Puts Hermes inside Ableton Live, REAPER and Renoise with … − Nothing useful works without a 31.5 MB downloaded runtime binary and a DAW, DAW changes run without asking by default, and it uses a private …

**roomsmith** (PR 153724)
- d26 3/4/5/5/4=25 r4/6. T: 255 passed + Gives the user and Hermes one shared 3D room editor … − Home-furnishing planning is a niche for an agent, and it ships two 672 KB esbuild bundles with three.js inside, though the web/ source and build …

**summon** (PR 153861)
- d29 4/3/4/4/5=25 r3/6. T: 32 ran OK + A real X platform adapter that lets the owner tag their bot … − Replies post publicly with no approval step, trial mode routes threads and stores bot OAuth tokens on the author's own Cloudflare relay, a …

**tironian** (PR 151281)
- d39 4/2/4/5/5=25 r6/6. T: 104 passed + Capturing actual Hermes work, testing personal students on … − An unknown family in the documented dataset CLI produces an uncaught exception, so Reliability is capped at 2; actual GPU training remains …

**vellum** (PR 152533)
- d20 3/3/4/5/5=25 r5/6. T: 72 passed, 1 failed + A canvas embedded under the highlighted paper passage … − The long-stream regression test failed repeatedly, including timer-thread exhaustion, and the live Desktop drawing/voice experience was not …

**morph** (PR 152243)
- d27 3/2/5/4/4=22 r4/6. T: 281 passed, 0 failed + Serious engineering: propose-then-human-approve writes with … − Hermes refused to enable it at the pinned commit (its dev pyproject.toml breaks plugin dependency locking), so no tool ran; by reading, a …
- d30 4/2/5/4/5=25 r6/6. T: 281 Python unit/integration/security tests passed in a … + Schema-derived cross-application workspaces combine useful … − Fresh enable repeatedly failed in the supplied Hermes dependency-publication workflow despite a passing catalog check, so the working reused …
- d32 4/4/5/4/5=27 r5/6. T: 281 passed + Schema-derived workspaces combine genuine application … − The supplied validation-before-enable sequence breaks editable-package staging, and GitHub/OpenAPI usefulness still depends on connector setup …

**hermes-tuneup** (PR 152190)
- d31 4/3/5/4/4=24 r7/8. T: 320 passed, 0 failed + It turns Hermes compaction and cost configuration into … − Its many private-core imports drew a catalog warning and could break when Hermes internals change.
- d39 5/4/5/3/4=25 r5/6. T: 314 passed, 6 failed + Makes Hermes's actual compaction rules understandable and … − It is an excellent advisor rather than a new agent capability, and dependence on many undocumented resolver functions makes upgrades fragile.

**mandate** (PR 153050)
- d25 3/4/5/4/4=24 r5/6. T: 161 passed, 1 failed + Learns a least-privilege policy for unattended cron jobs … − Useful mainly to people running unattended cron jobs, and it leans on a private Hermes core import (cron.jobs) that the catalog check flags.
- d37 4/4/5/4/4=25 r2/6. T: 156 passed, 0 failed + A per-job, argument-level least-privilege policy learned … − Its value shows only for users running unattended cron jobs, the status tool does nothing until a job is bound, and validate warns on private …

**lahja** (PR 149968)
- d22 3/4/4/3/5=24 r6/6. T: Passed: 99 tests; 6 real-engine cases skipped because … + A native, local Arabic-dialect transcription provider … − It serves a language-specific audience and requires external whisper.cpp, ffmpeg and large model downloads; actual transcription and the …
- d23 3/4/4/4/5=25 r6/6. T: present, not run here: tests/ has 6 files … + Adds a genuinely new model capability to Hermes … − Narrowest addressable audience in the batch (Arabic-dialect speech users specifically), and its reported WER gains were taken from the README …
- d24 3/4/4/4/4=23 r6/6. T: 99 passed + Plugs a local dialect-tuned Whisper into Hermes's … − Serves a niche of Arabic-dialect voice users, and its setup hints are macOS-centric (brew, Metal); the real engine path could not be exercised …

**local-scout** (PR 153872)
- d19 4/2/4/4/5=24 r5/6. T: pytest (folder copied as 'plugin', as its tests import … + A fail-closed local privacy layer that masks detected … − Hermes refused to enable it here (dependency lock failed on its editable pyproject package), so none of its tools reached the model, and it pins …

**muster** (PR 151448)
- d28 4/2/5/3/5=24 r6/6. T: 34 passed, 0 failed + A durable fleet ledger with health states, user-priced … − The pinned package could not be enabled through the normal CLI in this Hermes build, so its strong unit tests and developer-mode launch cannot …

**thoth** (PR 150497)
- d37 4/3/5/4/4=24 r4/6. T: 75 passed, 2 failed + Turns Hermes into the coordinator of a real multi-agent … − Two of its own tests fail at the pinned commit, the main path needs Claude Code or Codex installed and paid for, and thoth_init silently adopted …

**hermes-design-studio** (PR 154067)
- d27 3/3/3/4/4=21 r6/6. T: 354 passed, 1 failed + A real non-destructive shader stack in Desktop. The agent … − Without an open Desktop renderer the agent can do little. The repo is buried in 232 evidence files and P1-P3 contract reports, and its README …
- d30 3/4/4/4/5=25 r5/6. T: Passed 355 Python tests (8 multiprocessing/fork … + A real revision-checked Desktop image/shader workshop … − Its core visual result still needs a connected WebGL2 Desktop renderer, and the source-install documentation remains burdened by local …

**smart-dictation** (PR 151371)
- d19 3/3/4/3/4=21 r6/6. T: 85 passed, 3 failed + A local, offline faster-whisper speech provider for … − It adds no tool, its dashboard manifest points to a dist/index.js that is not shipped, four near-duplicate api_v0_N.py files remain, and 3 of …
- d43 4/4/4/3/5=25 r5/6. T: Passed after installing declared … + Native transcription registration plus consent-aware … − Fresh installation needs pre-cached model weights and profile preparation, while provider availability can be true even though transcription …

**habits** (PR 153606)
- d37 4/3/4/4/4=23 r6/6. T: 4902 passed, 9 failed + Reflexes run as written with no model turn between steps … − Nine of its own tests fail at the pinned commit around the permissions/flagged-command switch, it leans on seven private Hermes imports, and …

**omniscience** (PR 154025)
- d19 4/2/5/4/4=23 r4/6. T: 792 passed, 1 failed + A live, replayable map of what the agent did, recorded … − It claims 'Local, private, read-only' and 'no write endpoints', yet its viewer has POST write routes and its insight feature reads keys from …

**plur1bus** (PR 151604)
- d25 4/2/3/3/5=22 r6/6. T: none in the catalog folder (the repository has a … + A full local long-term memory provider for Hermes with … − Its __init__.py only works once the pyproject package plur1bus_hermes and a heavy ML stack are installed, so it did not load here, and plaintext …
- d26 4/2/3/4/5=23 r5/6. T: none in the catalog folder; its source package … + A full memory-provider replacement for Hermes (semantic … − Hermes refused to enable it here (uv lock metadata failure). It is ~25k lines of Python (domain.py 4.7k, runtime.py 2.5k) carved out of a much …
- d42 4/2/3/3/5=22 r6/6. T: not run: the Python tests live outside the catalog … + A full persistent memory provider for Hermes (semantic … − Hermes refused to enable it in this run, and the catalog folder is a slice of a 2,150-file OpenClaw-era repo whose __init__ only works once a …

**harness-story** (PR 154078)
- d27 3/3/3/4/4=21 r5/6. T: 5 passed + It turns the hooks and state.db into a readable causal … − The narrative LLM defaults to the author's LAN address http://192.168.1.12:8080 rather than Hermes's own model, so by default session …

**agent-pool** (PR 153225)
- d26 2/1/3/4/3=16 r6/6. T: 413 passed, 47 failed, 5 errors + Original idea: friends pool their agents into a team over … − install-deps.sh writes PRIV_NAME='su'"do" with the comment 'no literal in file', and a test enforces that the catalog scanner never sees the …
- d36 3/2/4/4/5=23 r6/6. T: 412 passed, 48 failed + Builds a private agent-team collaboration platform with … − The validation-then-enable route fails on this Hermes runtime, and the loaded status still labels ledger and identity ready while service …

**done-bell** (PR reference plugin)
- d31 4/3/2/2/4=19 r8/8. T: 9 passed, 0 failed + A small hook and Desktop integration gives completion and … − Its README centers on a local Windows developer path, and the scripted run did not verify actual notifications.
- d41 3/5/4/2/3=20 r8/8. T: 9 passed + A small, privacy-conscious completion notifier with passing … − It improves notification ergonomics but does not materially extend agent capability.