HERMES BRIDGE
CONTROL-PLANE AGENT-OS
Autonomy with the brakes wired in first.
MIT / FAIL-CLOSED
Abstract
Hermes Bridge is the safe-autonomy control plane that sits in front of the orchestrator. Everything it can do is gated before it runs: configuration is validated at startup rather than trusted, a governor caps rate and quota, a circuit breaker trips on repeated failure instead of retrying into a wall, execution is sandboxed, a deny matrix blocks the categories that should never be automated, and a preflight verifier refuses to start a run the environment cannot support. Every action lands in an audit log. It also drives its underlying model through the vendor's own CLI on an existing subscription, which means no credentials are proxied and no metered spend accrues per call.
Provenance
Came out of the obvious next question once the orchestrator worked: what stops it. Running an agent loop unattended is a different risk class from running it while watching, and the honest answer is that most harnesses ship the loop and leave the brakes as a to-do.
Declassified
The design rule is fail-closed everywhere: an unverifiable state produces a refusal, not a best guess. That sounds obvious and is unusual in practice, because fail-open makes demos smoother and incidents worse. Public under MIT, and the bridge layer is carried by a small test suite at high coverage, which is the only reason I would run it unattended at all. Still early: the guardrails are real, the surface it guards keeps growing.
Also in OPEN
Want the detail behind this?
The dossier above is the public shape of it. The architecture decisions, the tradeoffs and what broke are a conversation.
Reach out directly