From d7e69ddaef58bfe91720a8aa8bc4945b082f7738 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Mon, 14 Sep 2026 12:25:03 -0700 Subject: [PATCH] docs(nh3-dev): record the Hermes Agent gateway sidecar on 127.0.0.1:8765 Stood up hermes-gateway.service (user systemd, vendor 'hermes gateway install') for SVOS/Miranda, which cut over from Worldtree to Hermes on 2026-09-11 and aborts at boot without it. Bearer key vaulted as nh3-dev/hermes/api-server-key. Notes the wide default tool surface: with no roster config the gateway registers all 28 toolsets on the api_server platform, terminal and code_execution included. Loopback bind plus the key are the only containment until SVOS installs its svos_miranda plugin and the platform_toolsets / disabled_toolsets roster is applied. --- servers/nh3-dev/README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/servers/nh3-dev/README.md b/servers/nh3-dev/README.md index ab9d5cf..c3db07e 100644 --- a/servers/nh3-dev/README.md +++ b/servers/nh3-dev/README.md @@ -20,6 +20,18 @@ local Bash already executes here — no SSH-to-self needed for non-privileged wo behind Caddy; OSC52 clipboard shim). User systemd services under `~/.config`. - **mead-hall** — Bifrost tool-provider sidecar (`:5173`), CI-deployed from `vh/mead-hall`. +- **Hermes Agent gateway** — OpenAI-compatible agent API on `127.0.0.1:8765` + (`hermes-gateway.service`, user systemd, installed 2026-09-14 via `hermes + gateway install`). Runs the per-user install at `~/.hermes/hermes-agent` + (v0.21.1, `b88e677`); config in `~/.hermes/{.env,config.yaml}`. Stood up for + **SVOS/Miranda**, which replaced Worldtree with Hermes on 2026-09-11 and + cannot boot without it. Bearer auth is mandatory even on loopback — key + vaulted as `nh3-dev/hermes/api-server-key`. ⚠ The gateway registers Hermes's + **full** toolset by default (28 toolsets incl. `terminal`, `code_execution`, + `file`, `browser`); SVOS's security model is to strip all of them via + `platform_toolsets[api_server]` + `agent.disabled_toolsets` once its + `svos_miranda` plugin lands in `$HERMES_HOME/plugins/`. Until then the surface + is wide — loopback bind + key are the only containment. - **bloom_music dev** — `~/development/bloom_music`; its `web/` test harness uses Playwright headless Chromium for OSMD browser-geometry assertions. - **The Booth** — ephemeral media drop board (`:8090`, `booth.service`), from