Bounded Autonomy: Implementing Hermes Agent as the Supervisory Head of the AI Factory

The "I Think I’m Done" Hallucination

In the world of autonomous agents, there is a recurring nightmare I’ve seen play out in production too many times: the AI confidently narrates that a task is complete while the file system remains untouched. In this Factory, "trusting the model" is how you end up with a recursive file-deletion loop or a project state that exists only in the agent's imagination. This "YOLO mode" isn't a feature—it’s a reliability breach that burns through compute and trust in equal measure.

The challenge is structural: How do we give an agent like Hermes the power to supervise the workflow without giving it the keys to destroy the warehouse? The solution, as defined in our latest implementation blueprint, is to treat the agent as a foreman who can suggest what to do, while a deterministic vault decides what is actually permitted.

The Bottom Line

The Decision: We are adopting Hermes v0.20.6 as the "Supervisory Head" of the AI Factory. This is a strategic "Adopt vs. Adapt" pivot. We leverage Hermes’ reasoning for workflow coordination but strip it of its right to self-certify success. A deterministic Factory Gateway will sit between the agent and the host, ensuring that every action is validated against evidence rather than conversational memory.

The "Adopt vs. Adapt" Strategy

The research confirms that a three-layer separation is the only way to prevent state drift and logic contamination. We are not forking Hermes; we are pinning its runtime and bounding its reach.

Boundary of Responsibilities

Layer	Role	Primary Responsibility	Main Risk
Hermes	Workflow / Supervision	Choosing next actions; managing the Kanban; coordinating specialists.	Agent hallucinating completion.
Factory	Truth / Policy	Owning PROJECT_STATE; canonical narration/SRT; brand policy.	State drift from external edits.
OpenMontage	Media Production	Execution of video/audio rendering and media engine state.	Hermes bypassing the adapter.

The Factory should not duplicate generic agent infrastructure. Hermes already provides Model Context Protocol (MCP) connectivity, isolated profile memory, and scheduled routines. We are simply putting a leash on it.

The "Wait, What?" Moment: Security and the Malicious Typosquat

A "trust but verify" mindset isn't just about code—it's about the supply chain. During research, we discovered that the OpenMontage upstream identity was being impersonated. This wasn't just a naming error; a malicious typosquat was distributing suspicious Windows binaries and malware-like executables disguised as https://github.com/calesthio/OpenMontage.

This discovery reinforces why "YOLO mode"—disabling dangerous-command approvals—is unacceptable. Hermes’ internal security controls are merely defense-in-depth. For the Factory, we require a "Deterministic Gateway" beneath the agent. If the supervisor hallucinates a shell command to download an unverified executable, the Gateway must be the one to say "No."

Implementation Specifics: Pinning the Future

To avoid "floating main" instability, the deployment is strictly versioned and physically isolated. Hermes will run natively on Windows 11 under %LOCALAPPDATA%\hermes, completely separate from the D:\codex-projects\ai-tools repository. This prevents the agent from "eating its own tail" during git operations.

We are pinning the installation to Hermes Agent v0.20.6 (Tag v2026.8.27) at SHA: 5fc308a70719a83cccdbba4c0e39c23f5a8239d5.

$HermesCommit = "5fc308a70719a83cccdbba4c0e39c23f5a8239d5"

$Installer = irm "https://raw.githubusercontent.com/NousResearch/hermes-agent/$HermesCommit/scripts/install.ps1"

& ([scriptblock]::Create($Installer)) -Commit $HermesCommit -SkipSetup

Note: The -SkipSetup flag is mandatory to ensure we apply our own profile logic before the agent goes live.

The "Deterministic Gateway": Why Prompts Aren't Enough

The Factory Capability Gateway acts as a firewall between Hermes' reasoning and the Factory's assets. We are moving away from asking the LLM to "check the file" and toward a strict Request/Result Contract utilizing a shared SQLite lease database located at D:\AI-Factory\control\factory_locks.sqlite3.

Hermes must issue requests via the factory.capability.request.v1 schema, including a mandatory idempotency_key. In return, the Factory returns a factory.capability.result.v1 payload.

The Contract Rules: * No Self-Certification: Hermes is prohibited from narrating a stage transition (e.g., "Stage is now Complete"). * Evidence-Based Truth: The Gateway returns hard evidence—file hashes, MP4 duration, and dimensions—rather than strings like "it looks good." * Strict Next Actions: The Gateway provides a next_valid_actions array. If the Factory says the next step is factory.acceptance.validate, Hermes cannot jump to youtube.upload.

Current Realities: Dealing with a "Dirty" Worktree

Let’s be clear: the current local environment (D:\codex-projects\ai-tools) is a mess. It is "dirty" with uncommitted migrations and bridge health scripts that would confuse any supervisor.

The Hard Freeze: No Hermes installation is permitted until the "OpenMontage Checkpoint" is verified. We must first clean the worktree and ensure credential-like material—specifically drive_bridge_token.expired-20260828.json—and heartbeat backups like factory_bridge_heartbeat.py and Start-AIFactory.ps1.gateway-readiness-backup-20260829-122122 are excluded via .gitignore. The Factory must be a stable baseline before we introduce an agentic foreman.

Phase One: The "Organic Orchard" Proof

The first real-world test for the supervisor is a read-only inspection of the factory-organic-orchard-generated-proof-acceptance project.

In Phase One, Hermes will poll for evidence using the factory.project.inspect tool. It is not looking for a "vibe"; it is verifying if factory_acceptance_90s.mp4 exists with a size > 0 and a valid duration.

Safety Constraints: * Read-Only: No Git mutations, no unrestricted shell access, and zero public publishing. * The Goal: Prove Hermes can correctly identify the "Next Valid Action" based on deterministic evidence rather than hallucinating success.

Conclusion: The Future of the Factory

Once this foundation is stable, the supervisory layer will manage a roster of specialists—Research, Visual QA, and Coding Repair. Each will operate in an isolated profile with restricted rights, ensuring that the Factory’s core remains protected even as the agentic workforce grows.

Memorable Takeaway: We use Hermes for its brain, but the Factory is the only one allowed to have a memory of the truth.