For Hermes Agent · Plugin
Your agent says it learned something. Show the receipts.
Witness grades every skill Hermes writes against what actually happened in the session, then quarantines the ones that were never earned. No LLM. No cloud.
$ hermes plugins install BenCoy09/hermes-witnessthen: hermes plugins enable hermes-witness
01 · The case
Self-improvement without ground truth.
Hermes saves skills from tasks it judges successful. The judge is the agent itself. That is author, executor and inspector in one role, which is how a skill ends up trusted that nobody ever verified.
NousResearch/hermes-agent #72269
The review step wrote an unresolved failure up as a confident, validated skill, complete with a verify script that tested the wrong thing.
NousResearch/hermes-agent #25833
Users asked for a write-time quality gate because the agent grades its own work. Prompt rules alone don’t enforce anything.
02 · Receipts
Every skill, graded on evidence.
This is the output of hermes witness demo. Click a row for the receipts.
03 · Signals
Deterministic checks. Nothing to jailbreak.
| Signal | Where the evidence comes from |
|---|---|
| Failure unresolved at save time | Tool results: exit codes, tracebacks, HTTP errors |
| Same error repeated | Normalized error signatures |
| Verify script never run | Skill files against successful tool calls |
| “Verified” with no passing test | Skill text against the trail |
| Drops one of your own rules | “Only develop” and “never main” lines in MEMORY.md and USER.md |
| Fails in real use | Outcome of every later session that loads the skill, including your corrections |
04 · Response
It acts, and the agent can’t overrule it.
- Quarantine, reversibly. Grade D skills move to a holding folder. release puts them back.
- The agent is told. The next turn carries the evidence, so it cannot quietly claim the skill is verified.
- Only you can vouch. trust and release exist in the CLI only. There is no tool the agent can call.
- Tamper-evident ledger. Every grade and outcome is hash-chained. verify checks it.
05 · Commands
Everything you’ll type.
06 · Limits
What it can’t do.
- It can’t prove a skill correct. It shows when the evidence contradicts one.
- Heuristics read tool results. Unknown shapes count as success, so it misses rather than cries wolf.
- It grades skill_manage writes. Writes through other routes aren’t graded unless paired with a file watcher.
- Constraint checks understand “only …” and “never …” rules, not arbitrary prose.