Hermes family OS · 6 of 6 · the traps
Where this build goes wrong
Every one of these is a specific switch, cap, or default — and half of them fail silently.
1 · The allow-all shortcut makes your house bot public
Hermes checks gateway access in a fixed order, and per-platform
allow-all is checked first — before the pairing list, before any
allowlist. Flip it on “just to get the group working” and pairing
becomes decorative: anyone who finds the bot can DM it, and in a group,
anyone added to the group can drive an agent holding your Home
Assistant token. The tell is that everything works suspiciously smoothly on
day one. Pair each member properly (hermes pairing approve) and
test with an unapproved account — the right answer is silence.
2 · Cloning the household profile, secrets included
--clone-from household is the fast way to make a member
profile — and the fast way to hand a fifteen-year-old’s agent your
HASS_TOKEN, calendar credentials, and metered Portal access.
Profile isolation only isolates what you actually separate: after cloning,
strip the member .env, then verify from the inside by asking the
member agent to list its tools. If it can see ha_call_service,
your boundary is a suggestion. (Prompt stage 1 exists for exactly this.)
3 · One shared profile “to keep it simple”
Tempting: skip the profiles, one agent everywhere. But memory is
global per profile — one MEMORY.md (capped at
2,200 characters), one USER.md, one session history that
session_search can trawl. Sam’s Tuesday DM becomes context the
agent can casually surface in Thursday’s group brief; four people’s
preferences thrash a 2,200-character file until whoever spoke last wins.
Per-member privacy and per-member memory are the same feature, and in
Hermes that feature is spelled “separate profiles”.
4 · Treating MEMORY.md as the family database
The caps are real and truncation is quiet: 2,200 characters of
MEMORY.md holds house rules and standing preferences, not a
grocery list, a schedule, and everyone’s allergies. Anything list-shaped
lives in the vault as files a skill maintains; anything historical is already
searchable via past sessions. If the agent “forgot” something
mid-week, check whether it ever fit.
5 · Metered Portal tools × a chatty family
The cloud browser and web tools bill per use, and a family group produces
astonishing trigger volume — every “is the pool open tomorrow?”
can become a paid web_search; a nightly cart run is dozens of
metered browser_* calls; five people is five times your solo
usage pattern. Keep Portal credentials in the household profile only, make
the SOUL.md say “answer from knowledge unless asked to look it
up”, have the agent announce cart runs, and watch the first
month’s bill before adding any browser-touching cron.
6 · Letting the cart run drift toward the pay button
Browser-automated checkout fails in ways that involve money: supermarket
sites redesign monthly, substitution dialogs appear mid-flow, and a retried
click can double an order. That’s why the plan’s line is
structural, not aspirational — the agent loads the cart on request,
never unattended, never past a payment step, and no payment credential exists
anywhere in ~/.hermes/ for it to use. If saving four minutes a
week requires storing a card in an agent’s config, buy the four minutes.
7 · Cron that nags
The scheduler makes it one sentence to create a job, so people create
seven, and the family mutes the bot inside a fortnight — at which point the
clash warnings go unread too, which is the actual damage. Two fixed
broadcasts a day (07:00, 21:30), everything else exception-driven, and
hermes cron pause is reversible — pause anything contested until
the family asks where it went. Related: don’t point HA state events at
the group. watch_all on a busy house is a motion-sensor firehose;
the 30-second cooldown_seconds default is a damper, not a
strategy — scope watch_domains to what a human would mention.
8 · A member profile on the local terminal backend
execute_code and the terminal are not inherently sandboxed on
local — that’s the docs’ position, not paranoia. A
member asking their agent to “try a script for my homework” is
untrusted code execution on the box that runs your house. Member profiles get
the docker backend (capabilities dropped, no-new-privileges, process and tmpfs
caps); the container is the security boundary, and approvals.deny
plus HERMES_WRITE_SAFE_ROOT are the belt to its braces. The
hardline blocklist stops rm -rf /, but “the last line of
defense held” is not a sentence you want to say about your family
server.