hermes-config

hermes-config is a repository that provides a production best-practices configuration for Hermes Agent. It includes SOUL.md identity, role personas, a 9-layer security model, sandboxing tooling, an automated readiness audit, and a full disaster-recovery runbook. It is built and verified on WSL2 / Ubuntu 26.04 LTS with OpenCode Zen (deepseek-v4-flash-free).

This repository is the single source of truth for a hardened, production-grade Hermes Agent installation. Everything is version-controlled and machine-checkable: if the machine is lost, the whole system can be rebuilt and re-verified with the commands in § 1-Click Recovery.

The security model uses defense in depth with 9 layers: prompt rules, Hermes config permissions, OS user permissions, filesystem boundaries, command policy, sandbox/container, git/version control, human approval, and audit logs. The config includes approvals.deny with 164 forbidden command patterns enforced by Hermes at the tool layer.

It provides sandboxing tooling (Docker, bubblewrap), an automated readiness audit, and backup/disaster recovery. The repository layout includes prompts, references, sandbox, plugins, and scripts.