Agent stack build plans · № 4

Hermes as a CI/CD healing agent

A workflow fails at 2am. GitHub posts a webhook. By morning there’s a tested pull request waiting — and you still review the diff.

hermes-agent · Nous Research MIT · 219k GitHub stars v0.19.0 · July 2026 model-agnostic — bring your own keys needs Docker + a reachable endpoint

Hermes is Nous Research’s open-source agent — a terminal agent plus a hermes gateway background service that listens on messaging platforms and, crucially for this plan, on webhooks. GitHub Actions failure notifications are a documented gateway use case; this plan pushes one step further than notification. The loop: a failed workflow fires a webhook → a Hermes route turns the payload into a prompt → the agent fetches the failing job’s logs with the gh CLI → checks out the broken branch inside a hardened Docker sandbox → fixes, runs the tests locally → opens a PR with gh pr create and reports back via a GitHub comment (or Telegram, or Discord).

Honest effort: an evening if you already have a VPS or homelab box running Docker; a weekend if you’re starting from a laptop behind NAT, because GitHub has to be able to reach your gateway and that endpoint is yours to provide. Honest cost: every failed workflow becomes an LLM run over CI logs. Hermes is model-agnostic (Nous Portal, OpenRouter, OpenAI, your own endpoint), so you can point triage at a cheap model — but a chatty monorepo failing nightly against a frontier model is real money. The traps page does that arithmetic.

The plan, in six parts

1What you getthe “healed overnight” timeline — a mock of the PR your team wakes up to 2Product specwho this is for, a day in the life, and what it deliberately never does (merge) 3Architecturewebhook route → agent → Docker sandbox → PR, with the “you build this” parts marked 4Set it upinstall, expose port 8644, the webhook config, the sandbox image, approvals 5The promptsstaged and paste-able — including the route’s prompt template, the real artifact here 6The trapsforged webhooks, the agent “fixing” the test, self-triggering PR loops, secrets in logs

Is this for you?

Yes, if your repo has a real test suite and your failures are mostly code failures — a broken import after a refactor, a fixture that drifted, a nightly build that someone’s Friday commit quietly killed. Yes, even in degraded form: the notify-and-diagnose version (failure → diagnosis in Telegram, no PR) is worth having on its own. Skip it if your CI failures are mostly infra flakes — a retry button is cheaper than an agent — or if you can’t host an endpoint GitHub can reach. This plan covers one GitHub repo end to end. It deliberately does not cover GitLab (Hermes validates GitLab webhook tokens too, but the gh-CLI glue here is GitHub-shaped), monorepo multi-service routing, or auto-merge — nothing in this plan merges anything, ever. For the general “which terminal agent” question, see № 1 in this series.