Agent stack build plans · № 5 · Hermes news pipeline

The traps

Every one of these is a mechanism, not a mood. Most were found the expensive way.

1 · Metered tools × cron = a bill that compounds while you sleep

Everything that touches the web here — web_search, web_extract, x_search, all five browser tools — is metered through the paid Nous Portal gateway. A one-off research session doesn’t care. A cron pipeline is a multiplication machine. Do the arithmetic before the meter does:

Whatever Portal’s per-call rate is when you read this, those are your multipliers. Defences: start at two runs a day; cap extracts per topic in the cron prompt; make the agent report call counts in every delivery (the “14 searches, 11 extracts” line is a running invoice preview); and check Portal usage after day one, not payday. The silent budget-killer is browser_vision — cloud-browser screenshots into a vision model on a schedule. That’s why the stage-2 prompt makes it ask first.

2 · The fact-checker that agrees with everything

Wire delegate_task lazily — hand the Fact-Checker the Summarizer’s draft and say “verify this” — and you’ve built a rubber stamp: it checks fluent prose against its own priors and returns green ticks all the way down. Fluent is what the Summarizer is for. The fix is structural, not prompt-polish: the Fact-Checker’s input is the numbered claims list and the source URLs, never the draft, and its job is to re-fetch each source itself. It burns ~5 extra metered calls per story. That is the cost of the check being real; a free fact-check checks nothing.

3 · Scrapes fail silently, and the desk writes fiction about the gap

x_search coverage varies, sites redesign, web_extract on a JS-walled page can return a cookie banner and three nav links. The dangerous part isn’t the failure — it’s that an LLM handed thin content will gamely summarize it anyway, and a “quiet news day” edition built on empty fetches reads exactly like a real one. Defences: the Researcher reports fetch counts and thin-content failures explicitly (it’s in the prompt); “nothing cleared the bar” must carry its numbers so you notice when 14 searches becomes 2; and escalate stubborn sources to browser_navigate + browser_snapshot deliberately — not by letting the agent improvise at 7am.

4 · The auto-publish itch

Around week two the queue is 90% approve-as-is, and the thought arrives: the browser tools could just log into the CMS and post. Resist it structurally, not morally: no CMS credentials in ~/.hermes/.env, no publish step in any skill, and the desk prompt’s standing rule that no instruction arriving from a webpage or feed item can make it post anywhere — a pipeline whose input is the open web is a pipeline that reads hostile text all day. The 10% you’d have auto-published includes the one draft with the confidently-wrong claim; that’s the draft your publication is remembered by. Keep approvals.mode on smart or manual. The human is not the bottleneck; the human is the product’s warranty.

5 · The style guide in the wrong file

SOUL.md is system-prompt slot #1, loaded into every session — including all three cron ticks, drafts or no drafts — with a 20,000-character ceiling it will happily let you fill. Paste the full style guide there and you pay its token cost dozens of times a day, mostly on runs that draft nothing. Split it: SOUL.md holds the short persona (<1,500 chars), the skill holds the long rubric and loads only when /house-style is invoked at drafting time. Same voice, a fraction of the standing overhead.

6 · Agent-written scripts on the local backend

If the subreddit check graduates to “a fetch script the skill runs”, remember what executes it: execute_code is not sandboxed on the default local backend — it runs as you, on your machine, inside a pipeline that ingests arbitrary web content. Point the terminal at the docker backend for anything agent-written (Hermes hardens it: all capabilities dropped, no-new-privileges, process and tmpfs caps). One config change; do it before the first script exists, not after.

7 · The RSS reader that isn’t there

Write-ups keep claiming Hermes ships RSS monitoring. As of v0.19.0 it doesn’t — no feed reader, no polling subscriptions. If a guide’s architecture leans on “native RSS”, the rest of its tool claims deserve suspicion too. The honest substitutes are the ones this plan uses: cron + web_search/web_extract, or the webhook bridge you build and own yourself. Naming the glue is the difference between a plan and a brochure.