Hermes family OS · 2 of 6 · product spec

The product spec

A coordination layer for a household, not a robot butler. The spec is mostly about restraint.

Who it’s for

A household where coordination already happens in a group chat, and where one person is the de-facto scheduler — the one who notices the clash, keeps the list, remembers bin day. That person becomes the household lead: they run the box, hold the credentials, and approve pairings. Everyone else is a member: they talk to the system in the group or DM their own agent, and never touch YAML. If nobody in your house will message a bot, stop here — this stack’s value is proportional to how many people actually use it.

The cast (yours will differ)

Priya — household lead. Runs the always-on box, paired with the full-capability household profile, the only human who sees its approvals. Presses “pay”.

Dele — member. Uses the group chat only. Wants exactly two things: the morning brief and never being double-booked for the school run.

Sam, 15 — member with a DM line. Paired with their own trimmed profile, sam-agent: homework questions and grocery adds, private memory, no house credentials, sandboxed terminal.

Mira, 8 — not paired. Talks to the agent only where everyone can see: the family group. Requests that touch the house (lights, snacks on the list) work fine there; that visibility is the safety model.

The jobs, ranked

Daily brief + clash resolution. One message at 07:00. Reads the calendar (wired via MCP), finds conflicts, proposes a resolution, waits for a human reaction. Never rebooks anything itself.
The grocery list that keeps itself. Mentions in the group (“we’re out of stock cubes”) and member adds accumulate all week; one consolidation at 16:00; pushed somewhere shared (Notion). Optional: cart pre-loading in a cloud browser — never payment.
Smart home on request + a few learned scenes. Lights, heating, “film lights” — via the Home Assistant gateway and ha_* tools. Depth lives in the smart home plan.
A private line per member. Sam’s DMs are Sam’s. This is a job, not a nice-to-have — it’s the reason the architecture uses separate profiles at all.

The house rules (the contract the agent runs under)

Written into the household profile’s SOUL.md — its persona file, injected first into the system prompt — and enforced by config where config can enforce it (architecture maps which is which):

Quiet hours. Nothing proactive before 07:00 or after 21:30. Answering when spoken to is always fine.
Propose, don’t act — for anything with a cost, a booking, or another person’s time. Lights are reversible; calendars and money are not.
Exceptions only. Routine actions (heating pre-warm) happen silently. The group hears about changes, clashes, and failures — not successes.
Members’ DMs are private. The household agent never quotes a member’s DM into the group; member agents can’t see the group at all unless invited.
A human presses pay. No card details in any config, ever.

What it deliberately does not do

No per-member memory inside the group chat. Hermes keeps one MEMORY.md/USER.md per profile, globally — it does not ship per-sender memory in groups, and this plan doesn’t pretend otherwise. The workaround (a members/ notes convention a skill maintains) is glue you build — see architecture.
No surveillance. The lead can’t read Sam’s DMs through the stack; profile isolation cuts both ways, on purpose. If you want a monitoring tool, this is the wrong plan.
No autonomous purchases, bookings, or messages to people outside the family. The blast radius of a wrong grocery order is comedy; the blast radius of a wrongly cancelled dentist appointment is not.
Not a group moderator. Reactions, threads, and rate-limits at community scale are the community manager plan; a family group needs the opposite instinct — speak rarely.