Hermes Agent
Hermes opens pip-installed providers—and adds a data-use warning
Hermes Agent proposes entry-point discovery so pip-installed model providers actually register, while a second patch warns before selecting a discounted Meta tier that trains on prompts and completions. A closed local-Qwen fallback experiment shows the same direction: provider choice is becoming policy, not plumbing.
NousResearch/hermes-agent PR #81419 is the inspected primary source: “feat(providers): discover pip-installed model providers via entry points.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- NousResearch/hermes-agent PR #81419 was created 2026-08-08T00:53:27Z and was open at inspection; its title is “feat(providers): discover pip-installed model providers via entry points.” - NousResearch/hermes-agent PR #81416 was created 2026-08-08T00:50:04Z and was open at inspection; its title is “feat(models): warn on data-training tiers at model selection.” - NousResearch/hermes-agent PR #81412 was created 2026-08-08T00:40:26Z and was closed at inspection; its title is “Add policy fallback delegation to local Qwen.” - The repository reported 227093 stars, 29506 open issues, default branch main, and last push 2026-08-08T00:40:17Z. - The latest tagged-release baseline checked was v2026.8.3 published 2026-08-03T16:57:52Z.
What changed
NousResearch/hermes-agent PR #81419 reports: What does this PR do? Makes model-provider plugins installable via **pip entry points**, closing a gap between the documented behavior and the actual behavior. Model-provider discovery (providers/__init__.py._discover_providers()) was filesystem-only: it scanned bundled plugins and $HERMES_HOME/plugins/model-providers/, but never entry points. The general PluginManager *does* scan the hermes_agent.plugins entry-point group, but it deliberately **skips importing** kind: model-provider manifests (provider lifecycle is owned by providers/). Net result: a pip installed provider was recorded for introspection but its register_provider() was never called — so it never appeared in hermes model / /model, despite the docs' "Distribute via pip" section saying it would. This adds an entry-point discovery step so pip-distributed providers actually register. It supports both a module:func callable target and a bare self-registering module target. The scan runs **before** filesystem plugins so bundled / $HERMES_HOME profiles keep last-writer-wins precedence — a pip package can add a new provider but cannot silently hijack a first-party provider id. Related Issue
NousResearch/hermes-agent PR #81416 reports: What does this PR do? Adds a **data-policy confirmation** at model selection, so users don't unknowingly opt into a tier that trains on their data. Meta's muse-spark-1.2-contributor is heavily discounted ($0.10 in / $0.20 out per 1M vs. $1.25 / $4.25 standard) **because** Meta uses your prompts and completions to train future models (per Meta's pricing docs). Selecting it for the price without realising the data trade-off is a footgun. This mirrors the existing expensive-model guard (hermes_cli/model_cost_guard.py): a new model_data_policy_guard.py returns a warning payload for models whose tier trains on user data, surfaced as a [y/N] confirm in the model picker, chained right after the cost guard. The rule set is a small **vendor-agnostic table** so future data-collection tiers slot in without new call sites. Because the training status is not machine-readable anywhere (neither /v1/models nor models.dev expose a training/retention flag), the v1 rule keys on the documented -contributor model id — so it fires
NousResearch/hermes-agent PR #81412 reports: What changed add policy-only fallback routing from the primary orchestrator to a local Qwen subagent distinguish model-reported policy restrictions from provider policy blocks persist idempotent fallback jobs, leases, consultation state, verification results, hashes, and bounded summaries add host-owned ask_gpt and record_gpt_verification tools with consultation budgets and semantic blocked-question deduplication enforce Proxmox/network/tool restrictions for fallback workers add startup, hourly, and opportunistic retention cleanup merge Qwen completed and remaining work back into the primary result without dropping unresolved items Why This lets Hermes recover the precise policy-blocked portion of a task without resending the full request, while keeping local-agent output untrusted and subject to normal execution controls. Validation scripts/run_tests.sh tests/agent/test_policy_fallback.py — 6 passed scripts/run_tests.sh tests/tools/test_delegate.py — 62 passed scripts/run_tests.sh tests/tools/test_browser_ssrf_local.py — 20 passed scripts/run_tests.sh tests/tools/test_browser_private_page_action_guard.py — 9 passed git diff --check live Qwen API smoke
Why it matters
A provider ecosystem is only useful when discovery precedence, failure isolation and data policy remain visible. The patches keep filesystem profiles authoritative and make one otherwise hidden pricing-for-training trade explicit at selection time. The operator test is whether the visible result, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was open when captured on 2026-08-08. The release baseline was v2026.8.3 published 2026-08-03T16:57:52Z. Repository metadata, source bodies, pull requests, issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/NousResearch/hermes-agent/pull/81419. Supporting records are https://github.com/NousResearch/hermes-agent/pull/81416 and https://github.com/NousResearch/hermes-agent/pull/81412. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Test broken and conflicting entry points, keep vendor data rules in an auditable table, and require every fallback to preserve the original tool and network restrictions. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.