Architecture
Every step is a named Hermes feature except the two marked “you build this”.
Cron scheduler (built in)
jobs live in
~/.hermes/cron/ · created in plain language with the cronjob tool · managed with hermes cron list/run/pause/resume/status↓ fires 07:15 daily
Agent run: the
/research-intern briefing skill
a skill you create at ~/.hermes/skills/research/research-intern/SKILL.md; the cron job just invokes it↓ gathers via tools
Web toolsmetered
web_search / web_extract (Firecrawl) and x_search, all through the paid Nous Portal gateway, billed per callScraper skills
the intern writes them with
skill_manage: a SKILL.md and a scripts/ folder per awkward source, run through execute_code/terminal. skills.write_approval makes each one wait for you↓ scripts execute in
Docker terminal backend: the sandbox
all capabilities dropped, no-new-privileges, 256-process limit, 512 MB tmpfs
/tmp. Required here (see the sandbox note below)↓ checked against memory
session_search
keyword search (SQLite FTS5) over past conversations in
~/.hermes/state.dbreports/ archiveyou build this
one dated markdown file per day, which the intern greps before writing↓ writes report, then delivers via
Messaging gateway:
hermes gateway
a daemon (installable under systemd/launchd) that delivers to Telegram here. Cron can deliver to any supported platformMemory
Hermes gives you two layers and you add a third.
MEMORY.md(~/.hermes/memories/MEMORY.md) holds 2,200 characters, about one screen. Put standing facts there (“beat: solid-state batteries; owner reads FT but has no API access; skip oxide-vs-sulfide explainers”). Never coverage history.session_searchis keyword search (SQLite FTS5) over every past conversation in~/.hermes/state.db.reports/is the archive: one file a day, fixed section headings, grepped before writing. It costs onemkdirand one paragraph in the briefing. If grep stops being enough, Hermes supports memory plugins like Mem0 and Honcho. Add one later.
Sandbox
execute_code runs Python that can call the agent’s
tools, which suits scrapers. On the default local backend it
runs as you, on your machine. Hermes has six backends (local, docker, ssh,
singularity, modal, daytona). Since this agent writes and runs its own code
unattended, docker is required. The docs call the container the
security boundary. The setup page switches it on.
Left out
- RSS. Have the intern write a fetch script as a skillyou build this, or wire an external RSS service to Hermes’s webhook gateway.
- Browser automation. Portal’s browser tools
(
browser_navigateand others) stay out of the daily loop because they’re slow, cost more and click around unwatched. Use them for one-off jobs you supervise.