Hermes trial slice 1: Stage A guard scaffolding and canonical-home pivot

docs/hermes-always-on-v1.md

@@ -0,0 +1,86 @@
+# Hermes Always-On v1 Guard
+
+This repo is not trying to make Hermes fully autonomous on day one. The safe v1 sequence is:
+
+1. Run Hermes only from the dedicated macOS Standard agent account.
+2. Keep all Hermes state under `~/AgentWork/hermes`.
+3. Launch Hermes through `hermes-light`, not directly.
+4. Bootstrap isolated profiles before gateway or cron.
+5. Prove one manual Kanban profile before workers, gateway, cron, or LaunchAgent.
+
+## Commands added in this slice
+
+After `./omp-guard install-shims`, these commands are installed into `~/AgentWork/bin`:
+
+```bash
+hermes-guard doctor
+hermes-guard bootstrap-profiles
+hermes-profile-doctor chief-of-staff
+hermes-light --profile chief-of-staff --version
+hermes-gateway-light --profile chief-of-staff --foreground
+```
+
+## State layout
+
+```text
+~/AgentWork/hermes/
+  profiles/
+    chief-of-staff/
+      SOUL.md
+      profile.yml
+      home/
+      tmp/
+      xdg-config/
+      xdg-cache/
+      xdg-data/
+      logs/
+      skills/
+      memories/
+```
+
+`HERMES_HOME` is set to the profile root. `HOME`, XDG directories, and `TMPDIR` are moved inside that profile root so a Hermes worker does not inherit the normal macOS home.
+
+## Stage A target
+
+Stage A is single-profile only:
+
+```text
+chief-of-staff only
+no workers
+no cron
+no browser
+no messaging
+manual Kanban task creation only
+```
+
+Exit criteria:
+
+```text
+Can create/list/comment/archive tasks.
+Cannot run terminal.
+Cannot access personal home.
+Cannot use non-allowlisted network.
+```
+
+## First local run
+
+Run from the agent account:
+
+```bash
+cd ~/AgentWork/omp-guard
+git checkout hermes-trial-slice-1
+./omp-guard install-shims
+hermes-guard bootstrap-profiles
+hermes-profile-doctor chief-of-staff
+hermes-doctor
+```
+
+Then test from a project workspace:
+
+```bash
+mkdir -p ~/AgentWork/projects/hermes-trial
+cd ~/AgentWork/projects/hermes-trial
+hermes-light --profile chief-of-staff --version
+```
+
+Do not enable `hermes-gateway-light`, cron, or a LaunchAgent until this passes.

docs/hermes-operations-runbook.md

@@ -0,0 +1,68 @@
+# Hermes Operations Runbook
+
+## Local validation
+
+```bash
+cd ~/AgentWork/omp-guard
+./omp-guard doctor
+python3 scripts/seatbelt-selftest.py
+bash scripts/test-hermes-guard.sh
+hermes-guard bootstrap-profiles
+hermes-doctor
+```
+
+## Stage A procedure
+
+1. Confirm you are in the dedicated agent account.
+2. Confirm `OMP_GUARD_PERSONAL_HOME` points at the personal macOS account home.
+3. Install shims with `./omp-guard install-shims`.
+4. Bootstrap profiles with `hermes-guard bootstrap-profiles`.
+5. Validate `chief-of-staff` with `hermes-profile-doctor chief-of-staff`.
+6. Launch Hermes from `~/AgentWork/projects/hermes-trial` with `hermes-light --profile chief-of-staff --version`.
+
+## Gateway rule
+
+Run the gateway only in foreground until manual tests pass:
+
+```bash
+hermes-gateway-light --profile chief-of-staff --foreground
+```
+
+Do not install a LaunchAgent in this slice.
+
+## Kill switch for later stages
+
+Before enabling gateway persistence or cron, add guarded scripts for:
+
+```text
+hermes-stop-all
+hermes-disable-gateway
+hermes-disable-cron
+hermes-network-lockdown
+hermes-backup-state
+hermes-restore-state
+```
+
+Minimum manual stop while still in foreground testing:
+
+```bash
+pkill -f "hermes gateway"
+pkill -f "hermes"
+```
+
+Do not use a system daemon. Always-on v1 should use a user-level LaunchAgent in the agent account only, after multiple successful foreground runs.
+
+## Audit checks for later stages
+
+Daily audit should eventually report:
+
+```text
+blocked tasks
+long-running tasks
+tasks completed in last 24h
+tasks created by chief-of-staff
+network/tool escalation requests
+skills modified
+memory modified
+cron jobs created or changed
+```

docs/hermes-profile-model.md

@@ -0,0 +1,58 @@
+# Hermes Profile Model
+
+Each Hermes profile is a separate identity and state boundary. Do not use one all-powerful profile.
+
+## Initial profiles
+
+```text
+chief-of-staff
+researcher
+marketer
+developer
+reviewer
+operator
+librarian
+```
+
+Create them with:
+
+```bash
+hermes-guard bootstrap-profiles
+```
+
+Validate one profile with:
+
+```bash
+hermes-profile-doctor chief-of-staff
+```
+
+## Role boundaries
+
+`chief-of-staff` orchestrates work. It should use Kanban and memory, not terminal, browser, cron creation, GitHub write, or external posting.
+
+`researcher` gathers cited information. It should not mutate repos, publish externally, or use terminal initially.
+
+`developer` implements scoped changes only in assigned workspaces or worktrees. It must not use sudo, push to GitHub, merge PRs, or edit outside the assigned workspace.
+
+`reviewer` verifies diffs and tests. It should not patch files unless explicitly assigned an implementation card.
+
+`librarian` curates wiki and proposed skills. It should not directly promote durable skills without human review.
+
+## Files per profile
+
+Each profile has:
+
+```text
+SOUL.md       role identity and behavioural constraints
+profile.yml   local manifest describing expected toolsets and policy
+home/         profile-scoped HOME
+skills/       profile-local skills area
+memories/     profile-local memory area
+logs/         profile-local launcher/proxy logs
+```
+
+Do not seed profiles with personal SSH keys, browser profiles, GitHub auth, iCloud files, or normal `~/.config` contents.
+
+## Toolset policy
+
+Toolsets are declared in `profile.yml` as a guard expectation. The manifest is not a substitute for Hermes' own config; it is an independent local safety check so the guard can fail obvious profile drift before always-on operation.

docs/progress/hermes-stage-a-canonical-home-pivot-2026-07-02.md

@@ -0,0 +1,56 @@
+# Hermes Stage A canonical-home pivot
+
+Date: 2 July 2026
+
+## Decision
+
+Stage A now uses the canonical Hermes Desktop/CLI state directory:
+
+```text
+/Users/agentlab/.hermes
+```
+
+The previous profile-local runtime model under `~/AgentWork/hermes/profiles/<profile>` is retained only as an advanced/debug path. It is no longer the default Stage A runtime.
+
+## Rationale
+
+Hermes Desktop and Hermes CLI share account-level state under `~/.hermes`, including config, auth, model caches, session DBs, logs, updates, skills, memories, and Desktop integration files. Maintaining a second profile-local Hermes home caused persistence divergence and made guarded launches fragile after Desktop or CLI activity.
+
+The safer operational decision is to keep Hermes state where Hermes expects it, and make `omp-guard` enforce the execution boundary instead.
+
+## New Stage A boundary
+
+`hermes-light --profile chief-of-staff` now treats `--profile` as an identity, policy, and logging selector. By default it does not create a separate Hermes runtime. It launches Hermes with:
+
+```text
+HERMES_HOME=$HOME/.hermes
+HOME=$HOME
+XDG_CONFIG_HOME unset
+XDG_CACHE_HOME unset
+XDG_DATA_HOME unset
+XDG_STATE_HOME unset
+TMPDIR=$OMP_GUARD_ALLOWED_ROOT/.omp-guard-tmp/hermes-light
+```
+
+The Seatbelt profile allows writes only to the current project workspace, canonical `~/.hermes`, the guard temp directory, and the guard log directory. It does not allow broad read/write access to `/Users/agentlab`.
+
+## Still not enabled
+
+This pivot does not enable gateway, cron, LaunchAgent, Kanban worker dispatch, browser automation, MCP, GitHub write, developer execution, or Stage B researcher operation.
+
+## Stage A validation target
+
+A clean Stage A pass now means:
+
+```text
+1. hermes-light launches only from ~/AgentWork/projects/<project>
+2. HERMES_HOME is /Users/agentlab/.hermes
+3. HOME is /Users/agentlab
+4. XDG state/config/cache/data are not redirected to profile-local Hermes paths
+5. Seatbelt is on in normal guarded runs
+6. Egress proxy is on in normal guarded runs
+7. token environment variables are scrubbed before launching Hermes
+8. launch logs show home_mode=canonical-hermes-home
+9. no session-store warning appears
+10. no gateway/cron/worker functionality is enabled
+```

docs/progress/hermes-stage-a-pivot-and-stop-point-2026-07-02.md

@@ -0,0 +1,88 @@
+# Hermes Stage A pivot and stop point
+
+Date: 2 July 2026
+
+## Status
+
+Stage A is not ready to progress to Stage B.
+
+Hermes Desktop is usable inside the protected `agentlab` account, and the Hermes project can be anchored under `~/AgentWork/projects`. However, guarded interactive Hermes through `hermes-light` plus Seatbelt plus the egress proxy is not yet stable enough to rely on.
+
+## What was validated
+
+- Hermes Desktop runs from the standard `agentlab` macOS account.
+- Hermes CLI/runtime state is account-local to `agentlab`.
+- Hermes Desktop and CLI expect canonical state under `/Users/agentlab/.hermes`.
+- Hermes projects should be anchored under `/Users/agentlab/AgentWork/projects`.
+- `hermes-light --profile chief-of-staff --version` can launch quickly in canonical-home mode.
+- Launch logs show canonical-home mode, project cwd, Seatbelt status, egress proxy status, and token-scrub status.
+
+## What did not pass
+
+The real interactive guarded path did not pass cleanly.
+
+A fast `--version` run is not enough. Stage A requires interactive Hermes to connect to the model provider, persist the session, work through the egress proxy, remain responsive, and resume cleanly.
+
+During the latest interactive test, Hermes was slow to boot and produced a connection error. That is a stop signal.
+
+## Architecture decision
+
+Stage A should use canonical Hermes state:
+
+```text
+/Users/agentlab/.hermes
+```
+
+The earlier profile-local Hermes runtime tree should be treated as advanced/debug only:
+
+```text
+/Users/agentlab/AgentWork/hermes/profiles/<profile>
+```
+
+The guard should protect the execution boundary rather than trying to make Hermes maintain a duplicate default runtime.
+
+## Operating decision
+
+For now:
+
+- use Hermes Desktop manually inside `agentlab`;
+- keep Hermes projects under `/Users/agentlab/AgentWork/projects`;
+- do not rely on interactive `hermes-light` Seatbelt mode yet;
+- do not start Stage B;
+- do not enable gateway, cron, LaunchAgent, workers, browser automation, MCP, GitHub write, developer execution, or external publishing.
+
+## Next implementation slice
+
+Before this PR is marked ready or merged, add a deliberate Stage A simplification and validation patch:
+
+1. make canonical `/Users/agentlab/.hermes` mode the explicit Stage A default;
+2. keep profile-local runtime mode as advanced/debug only;
+3. keep project-root enforcement;
+4. keep token scrubbing;
+5. keep launch logging;
+6. keep egress proxy controls;
+7. add explicit provider-connectivity validation;
+8. replace brittle SQLite-only smoke tests with real interactive launch validation;
+9. document the weaker Seatbelt-off fallback for controlled learning;
+10. ensure tests reflect the Hermes Desktop / CLI / Xcode / SQLite findings from this debugging session.
+
+## New Stage A pass gate
+
+A clean Stage A pass requires:
+
+1. Hermes Desktop works in `agentlab`.
+2. The Hermes project is anchored under `~/AgentWork/projects`.
+3. `hermes-light --profile chief-of-staff --version` works quickly.
+4. `hermes-light --profile chief-of-staff` launches interactively without a session-store warning.
+5. A harmless model call succeeds without a connection error.
+6. Launch logs show the correct project cwd.
+7. Launch logs show token scrubbing.
+8. Launch logs show either guarded mode with Seatbelt and egress proxy on, or an explicit documented fallback mode.
+9. No personal home, iCloud, Downloads, Desktop, or Documents path is used as a workspace.
+10. The repo tests reflect the real validation path.
+
+## Bottom line
+
+The separate `agentlab` account remains the durable safety boundary. Seatbelt is useful, but it should not be treated as the load-bearing foundation until the real interactive Hermes path is stable.
+
+Do not proceed to Stage B until Stage A has a stable, boring, repeatable operating mode.