# Merge 08 of batch read1: items read1-141 to read1-147

Inputs: the seven item results `item-read1-141` … `item-read1-147` (from `.imd/reads/artifacts/`). Each one is a JSON object holding `batch` and `plugins`. All seven were there and parsed, and **none was blocked**: every plugin row has `blocked: null`.

Below, the numbers are copied exactly as each item gives them. Total = Useful + Reliable + Polish + Creative + 2 × Beyond, out of 30. I recomputed every total from its five scores. Every given total matches its recomputed value.

## Source caveat

The plane flagged some results because sources they cite did not hold when re-read: read1-141 (5 sources), read1-142 (1), read1-143 (1), read1-144 (2), read1-145 (1). The item files I was given hold only scores and short notes, with no sources list, so I cannot tell which claims rest on those sources. The scores and best/worst notes from batches read1-141 to read1-145 should therefore be weighed with that in mind, mostly the read1-141 notes, which had 5 failed sources. No sources were flagged for read1-146 or read1-147. I did not re-check any plugin's code myself. This merge only combines what the items report.

## Entries (64 plugins, one row per item entry)

| batch | pr | name | useful | reliable | polish | creative | beyond | total | standout | blocked |
|---|---|---|---|---|---|---|---|---|---|---|
| read1-141 | 152939 | hermes-safeguard | 3 | 1 | 2 | 3 | 4 | 17 | no | — |
| read1-141 | 151167 | ticklist | 4 | 4 | 5 | 3 | 4 | 24 | no | — |
| read1-141 | 152781 | synap | 3 | 2 | 3 | 1 | 4 | 17 | no | — |
| read1-141 | 153445 | audit-lens | 2 | 2 | 3 | 2 | 3 | 15 | no | — |
| read1-141 | 151221 | rariflat | 3 | 4 | 4 | 3 | 4 | 22 | no | — |
| read1-141 | 153208 | genflick | 3 | 3 | 3 | 2 | 3 | 17 | no | — |
| read1-141 | 152814 | wavegrain | 3 | 2 | 2 | 2 | 3 | 15 | no | — |
| read1-141 | 150888 | hermes-9router | 3 | 3 | 3 | 2 | 4 | 19 | no | — |
| read1-141 | 153679 | rh-preflight | 3 | 3 | 5 | 4 | 5 | 25 | no | — |
| read1-141 | 152875 | proof-lens | 2 | 2 | 3 | 4 | 3 | 17 | no | — |
| read1-142 | 153386 | data-saver | 4 | 3 | 4 | 4 | 4 | 23 | no | — |
| read1-142 | 153501 | hermes-vnc | 4 | 4 | 5 | 4 | 5 | 27 | yes | — |
| read1-142 | 153872 | local-scout | 4 | 4 | 5 | 4 | 5 | 27 | yes | — |
| read1-142 | 153102 | z-midi-console | 3 | 2 | 5 | 4 | 5 | 24 | no | — |
| read1-142 | 150221 | bulkpublish | 3 | 3 | 4 | 2 | 3 | 18 | no | — |
| read1-142 | 153339 | recloc | 3 | 2 | 3 | 3 | 3 | 17 | no | — |
| read1-142 | 154019 | so101-arm | 3 | 4 | 5 | 5 | 4 | 25 | yes | — |
| read1-142 | 150008 | corallium | 3 | 1 | 3 | 4 | 3 | 17 | no | — |
| read1-142 | 153372 | stepup | 4 | 2 | 3 | 3 | 4 | 20 | no | — |
| read1-143 | 153481 | hermes-wake | 5 | 4 | 4 | 4 | 5 | 27 | yes | — |
| read1-143 | 151109 | warden | 3 | 4 | 3 | 4 | 4 | 22 | no | — |
| read1-143 | 153966 | call-your-shot | 3 | 4 | 4 | 4 | 4 | 23 | no | — |
| read1-143 | 151346 | google-workspace | 5 | 4 | 4 | 3 | 5 | 26 | no | — |
| read1-143 | 151013 | hermes-audio-api | 4 | 5 | 4 | 3 | 5 | 26 | no | — |
| read1-143 | 154021 | hermes-3d | 3 | 4 | 4 | 5 | 5 | 26 | no | — |
| read1-143 | 149803 | printwatch | 3 | 1 | 2 | 4 | 3 | 16 | no | — |
| read1-143 | 152684 | selaeron-paperclip-sel9 | 2 | 2 | 2 | 2 | 3 | 14 | no | — |
| read1-143 | 151293 | apple-keychain | 4 | 5 | 4 | 3 | 5 | 26 | no | — |
| read1-144 | 149331 | research-notes | 3 | 2 | 3 | 1 | 2 | 13 | no | — |
| read1-144 | 149221 | hermes-bim-studio | 3 | 4 | 4 | 4 | 3 | 21 | no | — |
| read1-144 | 151387 | omp-sessions | 4 | 4 | 5 | 4 | 5 | 27 | yes | — |
| read1-144 | 150800 | hypnos | 4 | 4 | 5 | 5 | 5 | 28 | yes | — |
| read1-144 | 152992 | chalk | 4 | 3 | 5 | 4 | 4 | 24 | no | — |
| read1-144 | 150316 | hostyourai | 3 | 4 | 4 | 2 | 4 | 21 | no | — |
| read1-144 | 150654 | motion-index | 3 | 4 | 4 | 2 | 3 | 19 | no | — |
| read1-144 | 152233 | kaggle-competitions | 3 | 1 | 3 | 2 | 3 | 15 | no | — |
| read1-144 | 151496 | webtwizz | 3 | 2 | 3 | 2 | 3 | 16 | no | — |
| read1-145 | 150155 | telegram-app | 4 | 3 | 5 | 4 | 5 | 26 | yes | — |
| read1-145 | 153879 | foundry | 3 | 4 | 5 | 5 | 5 | 27 | yes | — |
| read1-145 | 149183 | clack | 4 | 5 | 5 | 5 | 5 | 29 | yes | — |
| read1-145 | 149160 | serpkite | 4 | 4 | 4 | 2 | 4 | 22 | no | — |
| read1-145 | 150504 | buildpilot | 3 | 3 | 3 | 2 | 3 | 17 | no | — |
| read1-145 | 152404 | snippet | 3 | 2 | 4 | 2 | 3 | 17 | no | — |
| read1-145 | 152445 | decision-ledger | 3 | 4 | 5 | 4 | 4 | 24 | no | — |
| read1-145 | 153608 | chess-coach | 3 | 4 | 5 | 4 | 5 | 26 | yes | — |
| read1-145 | 152047 | attest | 4 | 5 | 5 | 5 | 5 | 29 | yes | — |
| read1-146 | 150351 | blazephoenix | 3 | 4 | 4 | 4 | 4 | 23 | no | — |
| read1-146 | 153792 | smriti | 5 | 5 | 5 | 4 | 5 | 29 | yes | — |
| read1-146 | 153758 | hermes-cobrowse | 4 | 2 | 5 | 4 | 5 | 25 | no | — |
| read1-146 | 153938 | syrinx | 4 | 5 | 5 | 5 | 5 | 29 | yes | — |
| read1-146 | 151102 | crash-test | 4 | 4 | 4 | 5 | 5 | 27 | no | — |
| read1-146 | 150189 | sequenzy | 3 | 2 | 3 | 2 | 3 | 16 | no | — |
| read1-146 | 149226 | zambo-receipts | 3 | 3 | 4 | 4 | 5 | 24 | no | — |
| read1-146 | 153520 | ghostrun | 2 | 4 | 5 | 5 | 5 | 26 | no | — |
| read1-146 | 154056 | chatgpt-style | 3 | 2 | 4 | 2 | 4 | 19 | no | — |
| read1-147 | 149719 | agentic-kingdoms | 2 | 2 | 3 | 3 | 1 | 12 | no | — |
| read1-147 | 152277 | plan-usage | 4 | 5 | 4 | 3 | 4 | 24 | no | — |
| read1-147 | 149968 | lahja | 4 | 5 | 5 | 5 | 5 | 29 | yes | — |
| read1-147 | 153580 | eta | 3 | 5 | 4 | 3 | 4 | 23 | no | — |
| read1-147 | 150059 | starlearner-nexus | 3 | 4 | 3 | 4 | 4 | 22 | no | — |
| read1-147 | 153522 | hermes-sfx-forge | 3 | 5 | 4 | 5 | 4 | 25 | yes | — |
| read1-147 | 153880 | quick-eval | 4 | 5 | 4 | 4 | 4 | 25 | no | — |
| read1-147 | 152934 | mission-control | 4 | 5 | 5 | 4 | 4 | 26 | no | — |
| read1-147 | 150810 | tone-forge | 3 | 4 | 5 | 5 | 5 | 27 | yes | — |

## Reference plugins (pr 0, scored by every seat)

| batch | pr | name | useful | reliable | polish | creative | beyond | total | standout | blocked |
|---|---|---|---|---|---|---|---|---|---|---|
| read1-141 | 0 | done-bell | 4 | 3 | 3 | 2 | 4 | 20 | no | — |
| read1-141 | 0 | homeassistant | 4 | 5 | 4 | 3 | 5 | 26 | no | — |
| read1-142 | 0 | done-bell | 4 | 3 | 3 | 2 | 4 | 20 | no | — |
| read1-142 | 0 | homeassistant | 4 | 5 | 4 | 3 | 5 | 26 | no | — |
| read1-143 | 0 | done-bell | 4 | 4 | 3 | 2 | 4 | 21 | no | — |
| read1-143 | 0 | homeassistant | 4 | 5 | 4 | 3 | 5 | 26 | no | — |
| read1-144 | 0 | done-bell | 4 | 4 | 3 | 2 | 4 | 21 | no | — |
| read1-144 | 0 | homeassistant | 4 | 5 | 4 | 3 | 5 | 26 | no | — |
| read1-145 | 0 | done-bell | 3 | 4 | 4 | 2 | 4 | 21 | no | — |
| read1-145 | 0 | homeassistant | 5 | 4 | 5 | 3 | 5 | 27 | no | — |
| read1-146 | 0 | done-bell | 3 | 4 | 4 | 2 | 4 | 21 | no | — |
| read1-146 | 0 | homeassistant | 5 | 5 | 5 | 3 | 5 | 28 | no | — |
| read1-147 | 0 | done-bell | 3 | 4 | 3 | 2 | 4 | 20 | no | — |
| read1-147 | 0 | homeassistant | 5 | 4 | 5 | 3 | 5 | 27 | yes | — |

Where the seats disagree on the references:

- **done-bell**: totals 141=20, 142=20, 143=21, 144=21, 145=21, 146=21, 147=20 (range 20–21, mean 20.57).
- **homeassistant**: totals 141=26, 142=26, 143=26, 144=26, 145=27, 146=28, 147=27 (range 26–28, mean 26.57).

The spread on the references gives a rough sense of how much the seats differ in calibration. Because each entry was scored by one seat only, compare totals across batches with that in mind.

Only read1-147 says done-bell's catalog.yaml still carries the placeholder sha `REPLACE_WITH_40_CHAR_COMMIT`. No other seat reports it, and I have not checked it.

## Standouts flagged by items

- read1-142 pr 153501 hermes-vnc (total 27)
- read1-142 pr 153872 local-scout (total 27)
- read1-142 pr 154019 so101-arm (total 25)
- read1-143 pr 153481 hermes-wake (total 27)
- read1-144 pr 151387 omp-sessions (total 27)
- read1-144 pr 150800 hypnos (total 28)
- read1-145 pr 150155 telegram-app (total 26)
- read1-145 pr 153879 foundry (total 27)
- read1-145 pr 149183 clack (total 29)
- read1-145 pr 153608 chess-coach (total 26)
- read1-145 pr 152047 attest (total 29)
- read1-146 pr 153792 smriti (total 29)
- read1-146 pr 153938 syrinx (total 29)
- read1-147 pr 0 homeassistant (total 27)
- read1-147 pr 149968 lahja (total 29)
- read1-147 pr 153522 hermes-sfx-forge (total 25)
- read1-147 pr 150810 tone-forge (total 27)

## Highest entry totals in this group (for orientation only, not a ranking)

- 29: clack (pr 149183, read1-145)
- 29: attest (pr 152047, read1-145)
- 29: smriti (pr 153792, read1-146)
- 29: syrinx (pr 153938, read1-146)
- 29: lahja (pr 149968, read1-147)
- 28: hypnos (pr 150800, read1-144)
- 27: hermes-vnc (pr 153501, read1-142)
- 27: local-scout (pr 153872, read1-142)
- 27: hermes-wake (pr 153481, read1-143)
- 27: omp-sessions (pr 151387, read1-144)
- 27: foundry (pr 153879, read1-145)
- 27: crash-test (pr 151102, read1-146)

## Per-entry notes as the items give them (does / best / worst)

- **read1-141 · 152939 · hermes-safeguard**: Intercepts financial tool calls and applies EVM transaction policies, simulation checks, threat lists and optional operator confirmations. *Best:* The plugin implements substantial policy, trace-inspection and emergency-stop logic with extensive security-focused test files. *Worst:* Execution enables auto-broadcast by default without universal Hermes approval, can start a mock RPC when localhost is unavailable, and Telegram credential handling loads a local .env instead of scoped secrets.
- **read1-141 · 151167 · ticklist**: Adds persistent Desktop checklists that users can tick while six agent tools read and edit the same lists, with actions optionally posted into chat. *Best:* A complete local UI provides tabs, pinning, reorder, undo, export and a mute toggle, backed by persistence and API tests. *Worst:* File locking is POSIX-only and disappears on Windows, weakening the cross-process consistency claim; every row is rendered and notices can consume model turns.
- **read1-141 · 152781 · synap**: Registers Synap as an OpenAI-compatible model provider with live model discovery and six fallback model IDs. *Best:* Uses Hermes provider profiles directly with no dependencies or custom credential persistence. *Worst:* The pinned manifest omits requires_env for SYNAP_API_KEY, leaving installer key setup undeclared, and its three stub-based tests verify profile constants rather than real Hermes integration.
- **read1-141 · 153445 · audit-lens**: Offers Solidity pattern checks, Sourcify source retrieval, public issue-class matching and formatted finding drafts through four tools. *Best:* Returns source lines and remediation suggestions without dependencies and repeatedly warns that heuristic findings need manual verification. *Worst:* The delegatecall check examines calldata arguments rather than the target expression, and regex-based parsing cannot substantiate several semantic security labels; source fetching selects the largest file.
- **read1-141 · 151221 · rariflat**: Tracks tool outcomes locally, recommends previously observed tools by lexical fit and usage metrics, and offers Desktop status cards and an opt-in retry guard. *Best:* Public pre/post-tool hooks support measured feedback and loop blocking, with redaction, profile-scoped storage and Python/Desktop contract tests. *Worst:* Recommendations use fixed lexical and rarity weights without evidence that they improve task outcomes, and have no useful history at installation; success detection is heuristic.
- **read1-141 · 153208 · genflick**: Connects Hermes to the hosted Genflick creative workspace MCP endpoint and bundles two workflow and account-connection skills. *Best:* The connector explicitly keeps remote tools untrusted and documents the native Hermes OAuth workaround, spending boundaries and limited read-only qualification. *Worst:* The pinned tree contains only connector manifests and skills, so creative execution and service-side approval claims cannot be inspected, and sign-in requires manual native configuration.
- **read1-141 · 152814 · wavegrain**: Declares a hosted Wavegrain MCP connection and a skill for social carousel creation, editing, scheduling and export. *Best:* A small readable connector marks the server untrusted, while the skill describes spending limits and idempotent paid-call retries. *Worst:* The pinned package has no server implementation or tests and its README supplies other-client setup rather than a Hermes authentication flow; the Hermes MCP entry includes neither OAuth configuration nor access-key wiring.
- **read1-141 · 150888 · hermes-9router**: Adds a Hermes dashboard tab showing 9Router model groups, saved probe results, latency and optional provider connection health. *Best:* User-triggered tests cap each batch at 25 models and use scoped secrets, with status classification, redaction and request-limit tests. *Worst:* Concurrent test requests share an unlocked JSON state file and fixed temporary filename, and malformed success responses can escape handling; live gateway integration is not established.
- **read1-141 · 153679 · rh-preflight**: Checks public Robinhood Chain builder and ecosystem records before detected tool actions, applies user rules through Hermes approvals, and records local evidence cards. *Best:* A real approval hook uses fresh check keys, blocks unattended execution by default and fails closed on check or ledger errors, with extensive capture-backed tests and Desktop history. *Worst:* Detection covers only chain 4663 and recognized tool/argument patterns; its private Hermes approval-presence imports are a compatibility weakness and a requested catalog fix at this pin.
- **read1-141 · 152875 · proof-lens**: Provides a local Desktop pane that checks RUP proof additions from CNF/DRAT files and displays refutation depth and a clause-depth histogram. *Best:* Implements inspectable unit propagation and depth accounting locally, with a focused UI and no network or credential requirements. *Worst:* Parsing silently skips malformed tokens, a capped prefix may still return valid without checking the remaining trace, and the only test file is an argument-driven CLI harness without assertions or bundled cases.
- **read1-142 · 153386 · data-saver**: Forecasts command download sizes, gates expensive downloads and meters network usage against configurable data budgets. *Best:* Registry size forecasts and approval middleware address a concrete problem for users on metered connections. *Worst:* The ledger stores raw command or URL prefixes without redaction, potentially retaining embedded secrets; system-wide counters also limit attribution accuracy.
- **read1-142 · 153501 · hermes-vnc**: Provides a VNC computer-use backend and optional Desktop live viewer for controlling another computer through Hermes. *Best:* Native computer-use integration, scoped password lookup and scripted RFB fault tests make remote hardware control unusually complete. *Worst:* A handshake timeout raises before retaining or closing the pending connection, and text input remains limited to ASCII or Latin-1 clipboard transfer.
- **read1-142 · 153872 · local-scout**: Locally masks detected personal data and secrets in Hermes text paths, flags injection and optionally answers calibrated ticket classifications without a model call. *Best:* Consent-controlled middleware changes actual provider payloads, with broad regression coverage and candid detector-quality documentation. *Worst:* Masking is irreversible and incomplete, can withhold user image messages, and does not prevent transfer of the underlying unmasked files.
- **read1-142 · 153102 · z-midi-console**: Builds a Desktop MIDI control surface with hardware learning, modulation, recording, MIDI export and agent-operated controls. *Best:* A substantial hardware engine and editable multi-device UI integrate live controls, modulation and recording. *Worst:* The chat endpoint obtains raw provider credentials through resolve_runtime_provider and constructs subscription Authorization headers instead of using the catalog-required credentialed_provider_request route.
- **read1-142 · 150221 · bulkpublish**: Connects Hermes to BulkPublish’s hosted social publishing MCP service and supplies workflow skills. *Best:* The portable manifest explicitly marks the remote server untrusted, supporting human approval for write tools. *Worst:* The pinned deliverable contains configuration and skills only, with no server implementation or automated tests to substantiate the advertised remote capabilities.
- **read1-142 · 153339 · recloc**: Sends address-bearing brrr notifications for an iPhone Shortcut to create location-triggered Apple Reminders. *Best:* It keeps live geofence monitoring on the phone and distinguishes push acceptance from confirmed delivery. *Worst:* The promised address redaction returns addresses of 28 characters or fewer unchanged, while reminder listing always returns an empty list and cancellation cannot recall delivery.
- **read1-142 · 154019 · so101-arm**: Gives Hermes named robot-arm operations, simulated vision and rehearsal, plus fault detection and repair through a local SO-101 host. *Best:* Simulation rehearsal and a deterministic watchdog produce a distinctive inspect-correct-repair loop with integration tests and visual demonstrations. *Worst:* The real-arm driver is only mock-tested, and the freeze boundary can be bypassed by other same-user tools that access the host socket.
- **read1-142 · 150008 · corallium**: Exposes a shared claim graph with publishing, review votes, evidence verification, task leases and offline reads. *Best:* Claims can become contested or suspect as reviews and withdrawn ancestors change the graph, making shared knowledge revisable. *Worst:* The client reads read_token and write_token directly from config.yaml or os.environ rather than Hermes’s secret scope, violating the catalog credential rule.
- **read1-142 · 153372 · stepup**: Adds expiring TOTP unlocks for selected tools on messaging platforms while consuming unlock messages before the model sees them. *Best:* A small standard-library implementation adds replay protection, sender lockouts and scoped-secret lookup without replacing Hermes approvals. *Worst:* The guard explicitly allows protected tools when session identity is absent or evicted, so its security boundary fails open on missing lifecycle context.
- **read1-143 · 153481 · hermes-wake**: Persists watches on systemd units, processes or output files and wakes the originating messaging chat through kanban completion. *Best:* Solves the agent promising to report back on detached work with persisted, chat-scoped watches, atomic claims and retry tests. *Worst:* Requires a running messaging gateway and kanban notifications; a crash after completion but before recording success can cause a duplicate wake.
- **read1-143 · 151109 · warden**: Adds scoped security scans, an agent action ledger, evidence-backed investigations, campaign correlation and containment planning. *Best:* Operator-owned scopes, canonicalized targets, bounded scanner execution and real Hermes dispatch tests give its six-tool security workflow substance. *Worst:* Containment cannot execute, scanners need separate installation, and correlation quality is established on a synthetic corpus rather than field data.
- **read1-143 · 153966 · call-your-shot**: Measures the agent's predicted tool-call count and duration against hook-observed work and feeds back a persistent calibration record. *Best:* Uses measured tool-loop activity and SQLite history to turn effort estimates into a feedback loop with no external service. *Worst:* Participation still depends on a prompt the model can ignore, and wall-clock measurements include approval delays while excluding delegated subagent calls.
- **read1-143 · 151346 · google-workspace**: Adds a Desktop workspace and forty tools for Gmail, Calendar, Drive, Docs, Sheets and Contacts with cross-app workflows. *Best:* Broad everyday utility comes with Hermes-managed OAuth, write-approval hooks, review dialogs, careful retry behavior and substantial Python and UI tests. *Worst:* Google Cloud OAuth setup is demanding, and the README acknowledges that RSVP and actions inside a running Desktop have not been tested live.
- **read1-143 · 151013 · hermes-audio-api**: Serves authenticated OpenAI-compatible transcription and speech endpoints using the profile's configured Hermes voice providers. *Best:* A gateway-managed listener makes Hermes voice providers reusable by other clients, with scoped credentials, streaming limits, codec checks and discovery tests. *Worst:* Depends on private Hermes voice entry points and optional ffmpeg; concurrent listeners across multiplexed profiles are not covered by tests.
- **read1-143 · 154021 · hermes-3d**: Mirrors Hermes activity, schedules and optional profile metadata into a local explorable 3D world embedded in Desktop. *Best:* A distinctive Desktop experience has a real event bridge, sandboxed frame, verified engine download and queued approval-gated cron actions. *Worst:* The separate Node engine and optional private database reads add setup and compatibility burden, while end-to-end first-run tests use a fake engine release.
- **read1-143 · 149803 · printwatch**: Implements LAN status, file upload, print control and camera tools for Anycubic, Bambu and Moonraker printers. *Best:* The clean-room Anycubic handshake and firmware-specific G-code packaging address a concrete own-hardware workflow. *Worst:* register stores PluginContext as _agent, but credential lookup expects its nonexistent secret_scope attribute and returns empty configuration; there are no tests or enforced print-start approval hooks.
- **read1-143 · 152684 · selaeron-paperclip-sel9**: Posts a comment to an operator-allowlisted Paperclip issue after looking up its single current live run. *Best:* The registered handler obtains run identity from a read-only lookup and refuses missing or ambiguous runs, with scoped credentials and comment-only writes. *Worst:* The duplicate key includes summary text and exists only in memory, so changing the summary or restarting permits another comment for the same run despite the one-comment claim.
- **read1-143 · 151293 · apple-keychain**: Adds a macOS Keychain SecretSource plus operator commands for setup, diagnosis, secret rotation and recovery. *Best:* Improves Hermes credential handling through its actual SecretSource interface, bounded noninteractive native reads and recovery-aware writes backed by discovery and disposable-Keychain tests. *Worst:* macOS developer tools and service-identity Keychain authorization are required; helper rebuilds can require reauthorization and several Hermes imports are private.
- **read1-144 · 149331 · research-notes**: Fetches public web pages and stores, searches, lists and deletes local tagged JSON notes. *Best:* URL access fails closed without Hermes SSRF protection and note writes use atomic replacement. *Worst:* No tests are shipped, concurrent note updates can overwrite each other, and the response-size check happens after the HTTP client has buffered the body.
- **read1-144 · 149221 · hermes-bim-studio**: Inspects local IFC building models, exports traceable quantity and optional priced reports, and generates an interactive offline 3D viewer. *Best:* Quantity coverage and IFC-unit conversion are explicit, with security tests, confined output paths and vendored viewer assets. *Worst:* The pinned README still describes arbitrary output paths and silent overwrites despite the security fix, and rendering is limited to 150 elements.
- **read1-144 · 151387 · omp-sessions**: Delegates coding tasks to local omp sessions with queues, scheduling, kanban integration, notifications and a Desktop/dashboard supervision page. *Best:* Approval-aware delegation, persistent card/session links and extensive integration tests make it a substantive extension of Hermes workflows. *Worst:* Requires separately installed omp and omp-sessions runtimes and relies on undocumented Hermes kanban internals, making setup and compatibility more fragile.
- **read1-144 · 150800 · hypnos**: Learns procedural habits from agent feedback through local LoRA training, gated model promotion and middleware routing to a personal model. *Best:* Real SFT/DPO code, sandboxed rehearsal, promotion exams, fallback routing and lineage-based forgetting go well beyond prompt-level memory. *Worst:* The demonstrated gains are synthetic and narrow, while real use requires a separate training environment and considerable compute; broad learning effectiveness remains unproven.
- **read1-144 · 152992 · chalk**: Renders narrated, animated chalkboard lessons inline in Hermes Desktop, with replay and video export. *Best:* A structured lesson format, automatic layout and the existing Hermes TTS route turn explanations into a distinctive multimodal teaching surface. *Worst:* Only four Python tests cover validation and basic creation; the large canvas renderer, TTS integration and chunked video export lack automated coverage.
- **read1-144 · 150316 · hostyourai**: Registers HostYourAI as a model provider with task/policy routing hints, optional automatic task classification and private balance reporting. *Best:* Scoped-key handling, redirect refusal, bounded automatic classification and detailed tests support a well-documented provider integration. *Worst:* Most model selection happens in a proprietary external service, and routing preferences are shared across every chat on the profile.
- **read1-144 · 150654 · motion-index**: Provides a Desktop browser and agent search tools for 49 motion-design styles, generating briefs and submitting suggestions. *Best:* A bundled offline catalog, practical input validation and handler tests make style discovery accessible through both tools and Desktop. *Worst:* Its core output is a substituted prompt template; building or rendering the actual animation is left to other tools or skills.
- **read1-144 · 152233 · kaggle-competitions**: Tracks Kaggle submission snapshots, score history, completed-result changes and leaderboards through CLI-backed tools and a Desktop board. *Best:* A baseline-aware watch distinguishes pending submissions that finish from old results on first installation. *Worst:* Credential fallback permits the Kaggle CLI to read its own token file, violating catalog policy; there are no tests, CLI failures are ignored, and best score always means maximum.
- **read1-144 · 151496 · webtwizz**: Connects Hermes to a hosted website-building MCP service through a pinned mcp-remote launcher and browser OAuth. *Best:* The package explicitly marks the remote server untrusted and clearly discloses credit use, browser sign-in and user-confirmed publishing. *Worst:* The pinned tree contains only configuration and docs, leaving server behavior and tests unreviewable, while OAuth tokens are stored by mcp-remote outside Hermes.
- **read1-145 · 150155 · telegram-app**: Provides an authenticated Telegram Mini App dashboard for Hermes sessions, status, cron, logs, knowledge, messaging, and alerts. *Best:* It gives Hermes a substantial phone-first control surface through Telegram, with Telegram initData verification and an explicit allowlist-based login. *Worst:* Its implementation reaches into private Hermes internals and runs a polling alert thread; the wide control surface increases compatibility and operational risk.
- **read1-145 · 153879 · foundry**: Runs a creator workflow whose bots share a durable ledger of brand identity, sourced evidence, drafts, feedback, performance, and money, with dashboard and Desktop views. *Best:* The shared ledger links sourced evidence and revisions to drafts and performance, while the dashboard and Desktop app make the state inspectable; approval and posting are disabled. *Worst:* It is a narrowly targeted creator workflow, and its agent-supplied research has no live web-search surface in this Hermes version.
- **read1-145 · 149183 · clack**: Adds end-to-end-encrypted agent-to-agent messaging over a relay, with identity enrollment, explicit acceptance, polling, reconciliation, and durable acknowledgements. *Best:* This is a substantial new communication capability with encrypted messages, relay identity pinning, explicit human acceptance, and extensive offline adversarial/regression tests. *Worst:* It requires a separate relay and peer enrollment, and its vendored pure-Python cryptography is explicitly not constant-time against a local timing adversary.
- **read1-145 · 149160 · serpkite**: Registers SerpKite as Hermes’s web search and page-extraction provider, returning search results and extracted page content. *Best:* It plugs search and extraction into Hermes’s existing web-provider interface and reads its API key through Hermes’s provider environment/secret lookup. *Worst:* It depends on a paid third-party service and sends user queries and requested URLs to that service; the functionality is a backend option for familiar web tools.
- **read1-145 · 150504 · buildpilot**: Provides local SQLite-backed tools to track projects, tasks, task status, and progress checkpoints across sessions. *Best:* The small toolset directly supports durable project context and checkpoint retrieval without external services or credentials. *Worst:* The implementation is a conventional CRUD tracker with limited surfaced error handling and relatively basic documentation and tests.
- **read1-145 · 152404 · snippet**: Connects Hermes to Snippet’s hosted MCP service for creator brand deals, sponsorships, and correspondence. *Best:* A compact portable package exposes useful creator workflows through a hosted MCP service without a local runtime or dependency. *Worst:* The package contains no service implementation, its live tools can change independently of the pin, and the README says the portable-package login path does not work and requires a separate native OAuth connection.
- **read1-145 · 152445 · decision-ledger**: Stores proposed decisions and human-confirmed receipts with exact scope, conditions, replacements, and revocations across Hermes sessions. *Best:* The code separates model draft/read operations from a foreground human confirmation flow, records durable receipts, and clearly explains its limits as recordkeeping rather than an execution gate. *Worst:* It is a specialist governance ledger with a manual Linux foreground-console workflow; its own documentation says same-user database access can bypass application checks.
- **read1-145 · 153608 · chess-coach**: Adds a native Desktop chessboard for games and mate puzzles, backed by legal-move tools, local solving, and saved game state. *Best:* Legal moves, puzzle validation, and replies are computed locally, with a polished board and Hermes opponent/review available when requested; it includes Python and UI tests. *Worst:* It serves a niche audience, needs the python-chess dependency, and makes no claim to provide systematic strategy instruction or reliable evaluation of arbitrary positions.
- **read1-145 · 152047 · attest**: Gives Hermes a paper-trading account whose locally stored ledger prices simulated orders from public quotes, enforces risk checks, and can flag contradictory financial figures in replies. *Best:* It combines an authoritative Decimal/SQLite ledger, fresh-quote and loss/order limits, duplicate protection, optional fail-closed interception of one named order tool, and extensive isolated self-checks. *Worst:* It is deliberately paper-only and its live marks depend on external public exchange endpoints; the output claim checker is heuristic and only adds a note.
- **read1-146 · 150351 · blazephoenix**: Gets DEX swap quotes through the user's RPC and locally checks unsigned router calldata before signing. *Best:* It never signs or handles keys and cross-checks its hosted decode and calldata against a user-configured RPC response. *Worst:* Quotes still rely on BlazePhoenix's hosted prepare/decode service and an independently configured RPC endpoint.
- **read1-146 · 153792 · smriti**: Provides local MCP personal memory with scoped, dated facts, history, retrieval, and source evidence. *Best:* Its local SQLite MCP server preserves corrections and temporal evidence while validating inputs and containing database access. *Worst:* Memory capture remains explicit tool use, so it does not automatically retain a conversation the agent never sends to it.
- **read1-146 · 153758 · hermes-cobrowse**: Runs multi-window Playwright browsing in a live local canvas where a person can take over and resume the agent. *Best:* It implements a polished, real multi-session browser canvas with CDP frames, telemetry, and a tested human 2FA handoff. *Worst:* Its agent tools still expose unrestricted browser clicking and page JavaScript, with no code-enforced approval or handoff gate for sensitive actions.
- **read1-146 · 153938 · syrinx**: Uses Hermes hooks to defer agent questions, hold outward actions during focus time, and return a counted catch-up. *Best:* It turns runtime hooks into a carefully tested attention-control layer with safe outward-action holds, receipts, Desktop UI, and pet feedback. *Worst:* Its outward-action classifier is necessarily a fixed heuristic, so unrecognized tools or command forms can evade a hold.
- **read1-146 · 151102 · crash-test**: Injects bounded one-turn tool failures and rates how an agent retries, works around them, or reports uncertainty. *Best:* Its per-session, one-turn harness blocks loud failures before execution and restricts silent corruption to eligible reads, backed by full-hook tests. *Worst:* The final rating infers honesty from transparent reply-pattern heuristics, so unusual but honest wording can be scored incorrectly.
- **read1-146 · 150189 · sequenzy**: Connects Hermes to Sequenzy's hosted email-marketing MCP service and bundles operating instructions. *Best:* It uses OAuth, labels the remote server untrusted, and documents that writes and sends need approval. *Worst:* The pinned package contains no implementation or tests; it downloads an npx bridge and delegates its changing tool set to a hosted service outside the commit.
- **read1-146 · 149226 · zambo-receipts**: Journals Hermes tool calls and creates public, verifiable Zambo session receipts. *Best:* It uses lifecycle hooks, hash-only journaling by default, bounded durable retry buffering, and tests its receipt lifecycle. *Worst:* Automatic journaling and wrapping send session metadata to an external service and publish a receipt by default, making its value dependent on a third party and careful user configuration.
- **read1-146 · 153520 · ghostrun**: Builds a GPU-assisted pipeline for observing NES games, training a player, isolating a reference oracle, and validating editable recreations. *Best:* It is an unusually complete plugin runtime with durable stages, reference/builder isolation, a black-box oracle, a CUDA training pipeline, and extensive adversarial tests. *Worst:* It is an early-preview workflow for a very narrow audience that requires a user-supplied ROM, Linux, NVIDIA CUDA, and substantial local setup.
- **read1-146 · 154056 · chatgpt-style**: Adds a ChatGPT/Codex-inspired light and dark visual theme to Hermes Desktop. *Best:* It is a substantial, well-documented theme that uses the Desktop theme API without network, storage, or agent-side privileges. *Worst:* It has no tests and relies on many Desktop data-slot and class selectors that can silently break as the host UI changes.
- **read1-147 · 149719 · agentic-kingdoms**: A thin bundle (MCP server pointer plus a skill document) that lets the agent play a third-party-hosted browser MMO via a hosted MCP server, with no plugin-authored code at all. *Best:* The underlying game concept (agents playing a persistent MMO, 'Humans vs AI war') is a creative idea, and the README is transparent about its limited scope and risks. *Worst:* By its own admission ('There is no executable code and nothing that downloads or updates itself') this is just an MCP passthrough plus a skill file — all logic lives on a third party's server, so a skill/MCP config alone could reproduce it, and it runs game actions including attacks on other players without per-action approval by default.
- **read1-147 · 152277 · plan-usage**: A Hermes Desktop status-bar/dashboard plugin that aggregates plan-usage percentages across the user's Claude/ChatGPT credential pool, Nous Portal credits, and optional Anthropic/OpenAI org API spend. *Best:* Unusually rigorous reliability: secrets read exclusively through Hermes's secret-scope API (never os.environ/.env), enforced by both a runtime test and a static AST test that bans raw env/token access, plus a redirect-refusal test proving admin-key headers can't leak via HTTP redirects. *Worst:* The underlying idea (a usage dashboard) is not novel — the README itself lists six competing catalog plugins it differentiates against — and it ships no screenshots despite a full desktop UI.
- **read1-147 · 149968 · lahja**: A fully local, dialect-aware Arabic speech-to-text provider for Hermes built on whisper.cpp, with hallucination filtering, a user-teachable correction system, and automatic routing of non-Arabic audio to a secondary model. *Best:* Genuinely novel, narrow-domain engineering: registers a real TranscriptionProvider subclass, runs subprocesses with a minimal explicit environment so API keys can't leak to whisper-cli/ffmpeg, SHA-256-verifies downloaded models, and is self-critical in its own benchmark (admits it is worse than stock Whisper on some dialects). *Worst:* A minor documentation inconsistency: the README claims '99 tests' while a plain count of test functions in the repo's test files comes to about 69 (likely explained by parametrized cases, but not verified).
- **read1-147 · 153580 · eta**: A deterministic statistical ETA calculator for agent/kanban/cron work that tracks run history in a local SQLite file and computes likely/worst-case time ranges with percentile and queueing math. *Best:* No network calls, shell commands, or credentials at all; opens Hermes's own kanban/cron/session databases strictly read-only (mode=ro, query_only pragma), and the README is candid about its own limitations and past bugs found via backtesting. *Worst:* The underlying feature category (time estimation for work queues) is fairly common, and there is no visual/UI polish (no screenshots, no desktop UI) despite thorough text documentation.
- **read1-147 · 150059 · starlearner-nexus**: Fetches a user's starred GitHub repositories, keeps an incremental ledger, categorizes them (optionally via the host LLM), and auto-generates/registers new Hermes skills from templates. *Best:* A creative 'GitHub stars into reusable skills' pipeline with correctly-implemented secret handling (agent.secret_scope.get_secret, never raw env reads, verified by its own tests) and genuine new-skill-registration capability. *Worst:* The README and code comments are saturated with self-referential rule-ID justifications (e.g. 'R05', 'R11', 'R16') and a forensic git-log provenance dispute about a sibling project, reading like it was engineered to satisfy an automated catalog-rule checker rather than to explain the plugin to a user — a polish/trust concern worth a human judge's attention.
- **read1-147 · 153522 · hermes-sfx-forge**: A deterministic procedural sound-effect synthesizer that generates short one-shot WAV files (hits, pickups, etc.) from named presets and an integer seed using real DSP, then verifies output against a fixed numeric QA gate. *Best:* Strongest security posture reviewed: path-traversal and symlink-attack defenses (O_NOFOLLOW, dir_fd-anchored opens, advisory locks) backed by a dedicated adversarial test file, plus fully deterministic, reproducible-by-seed audio generation with zero network/credential surface. *Worst:* Narrow usefulness — only game-sound generation, Linux-only (explicitly unsupported on macOS/Windows because of an fcntl dependency), and no visual demo since audio output isn't screenshot-able.
- **read1-147 · 153880 · quick-eval**: After an agent reply, sends the user's last question to other configured models (cloud or local) for a side-by-side second opinion, lets the user mark good answers, and logs results for a growing personal eval dataset. *Best:* Requires explicit one-time user permission before calling other models, uses parameterized SQL with a read-only connection, and has a real end-to-end test that spins up an actual Hermes subprocess plus a fake model server. *Worst:* No screenshots/visual assets found beyond demo-GIF test scaffolding, and 'comparing LLM outputs side-by-side' is a known pattern even if the zero-config chat-command UX is a thoughtful original touch.
- **read1-147 · 152934 · mission-control**: A live, read-only observability dashboard for Hermes Desktop that streams tool calls, model calls, subagents, and approval events into a cost/token meter, call waterfall, and loop detector. *Best:* Purely observer-based (8 lifecycle hooks, 'never written to: no tools, no middleware, no approval answers'), every hook fails open, no credentials or network calls at all, and ships a banner image and dashboard screenshot plus a Node-based UI smoke test under React 19. *Worst:* It adds no new agent capability beyond observability — useful for operators but not something that changes what the agent itself can do (lower on 'beyond a prompt' than plugins that add real tools/providers).
- **read1-147 · 150810 · tone-forge**: Generates guitar-amp tone recipes from natural-language descriptions or reference-audio analysis, stores them as versioned presets, and can send real MIDI Control-Change messages to drive AmpliTube 5. *Best:* Genuine hardware integration (ctypes bindings to winmm.dll for real MIDI I/O, a hand-rolled pure-Python FFT for reference-audio analysis) with careful safety design: MIDI never sent to an unselected port, sends labeled 'unverified' rather than claiming success, and SSRF-guarded URL/subprocess handling for reference-track fetches. *Worst:* Niche audience (guitarists using AmpliTube 5 with MIDI gear) and the README itself admits no screenshots or recordings are committed yet and that actual AmpliTube receipt of MIDI messages hasn't been verified on the build machine.

## Reference notes

- **read1-141 · done-bell**, *worst:* The README uses a developer-specific Windows install path and manual Desktop copy step, while the small test suite does not exercise the renderer or real OS notifications.
- **read1-141 · homeassistant**, *worst:* Useful mainly to Home Assistant owners, with substantial token and event-filter configuration and no dedicated Desktop control surface.
- **read1-142 · done-bell**, *worst:* Setup uses an author-specific Windows path and manual pane copying; tests cover Python state but not the Desktop notification path.
- **read1-142 · homeassistant**, *worst:* Entity allowlists are opt-in, and allowed scripts or scenes can have effects beyond the explicitly named entity.
- **read1-143 · done-bell**, *worst:* Setup requires a manual Windows Desktop file copy, and the small Python suite does not verify the Desktop notification path.
- **read1-143 · homeassistant**, *worst:* Entity restrictions are opt-in and cannot constrain the effects of an allowed script or scene inside Home Assistant.
- **read1-144 · done-bell**, *worst:* Installation docs use the author's local Windows path and require a manual Desktop copy, while tests cover only the Python side.
- **read1-144 · homeassistant**, *worst:* Automation remains powerful: entity restrictions are opt-in and event content from the authenticated instance is trusted inbound.
- **read1-145 · done-bell**, *worst:* Its install instructions require manual Desktop file copying, and broad exception swallowing can hide notification or persistence failures.
- **read1-145 · homeassistant**, *worst:* It handles physical devices, so users must carefully scope entity access and protect the long-lived access token; setup depends on a running Home Assistant instance.
- **read1-146 · done-bell**, *worst:* Its notification-only benefit is narrow and its documented Desktop pane setup still needs a manual copy step.
- **read1-146 · homeassistant**, *worst:* It necessarily depends on a high-privilege Home Assistant token and instance-specific configuration.
- **read1-147 · done-bell**, *worst:* The idea itself (notify when agent is done) is a common utility pattern, and the catalog.yaml still has a placeholder 'REPLACE_WITH_40_CHAR_COMMIT' sha, suggesting the submission wasn't fully finalized.
- **read1-147 · homeassistant**, *worst:* ha_call_service can directly act on real physical devices (locks, climate, etc.) with no plugin-level human-approval step of its own; it relies entirely on Hermes core's own approval system plus its own blocklist, a risk the README is transparent about but doesn't eliminate.