Hermes Agent
Hermes proposes workstream-scoped Hindsight recall without claiming isolation
A new Hermes proposal derives Desktop recall tags from the session's working directory. It explicitly treats the mechanism as relevance filtering, not authorization: it uses existing tags, keeps baseline fallbacks and disables the override during asynchronous prefetch.
A September 11 Hermes proposal tackles a specific memory problem: Desktop sessions sharing a Hindsight bank can retrieve material from unrelated projects when they use one static filter. The proposed opt-in route derives a domain from the session's configured working directory below desktop_context_root and maps that domain to existing memory tags. It resolves the directory per recall call rather than assuming the process working directory is the right session context.
The contributor is unusually explicit about what this is not. It is a relevance selector inside an existing bank, not a new authorization boundary or automatic tagging system. A match replaces the configured tag filter rather than intersecting with it. Missing configuration and unmatched paths preserve the existing baseline. The branch also introduces a thread-routing table independently of the Desktop setting, so enabling the table is not accurately described as having no effect unless the new root is configured.
The facts
- PR #107802 limits the Desktop domain branch to the desktop platform, with synchronous recall enabled and no prior platform/thread override. - The route uses the first path component below the configured root after canonical path resolution; equal-root and outside-root directories do not match. - any_strict admits memories with at least one selected tag, including shared multi-tag memories, while excluding untagged entries. - The proposal neither backfills memory tags nor changes retain/write routing. - Asynchronous prefetch disables the Desktop override and keeps baseline behavior; async cache fencing is not implemented. - The contributor reports 40 focused cases passing with fake recall/reflect clients, plus three broader environment-dependent failures that also reproduce on the cited upstream base.
Why it matters
Memory systems face two different questions: which information is useful here, and which information is this session allowed to access? A directory-derived tag filter can help with the first without solving the second. That distinction matters when a personal assistant grows into multiple workstreams or shares one memory bank across profiles. A convenient relevance feature should not silently become the justification for placing confidential projects in a shared store.
Current
Inspected on 2026-09-11. The Hermes Agent release baseline is v2026.9.7 published 2026-09-07T22:17:01Z. The main source was open (not merged) when captured. Release metadata bounds availability; proposals, merged mainline changes and packaged releases are not interchangeable.
Evidence
Primary evidence: NousResearch/hermes-agent PR #107802 (https://github.com/NousResearch/hermes-agent/pull/107802). Supporting context: Hermes proposal branch — Hindsight Desktop workstream recall (https://raw.githubusercontent.com/NousResearch/hermes-agent/36cb8f1e1bfffc382c855bbb5ed56f2cf7babaf5/plugins/memory/hindsight/README.md); Hermes — persistent memory and session-search guide (https://hermes-agent.nousresearch.com/docs/user-guide/features/memory/). These pages were inspected directly. Linked documentation establishes the product contract; it does not independently reproduce contributor or author experiments.
Operator take
Evaluate with two interleaved Desktop sessions and already-tagged test memories, then inspect the outgoing filter for each call. Include malformed routing, paths outside the root and asynchronous recall in the test matrix. Keep access control separate and document that configuration changes require provider reinitialization. The proposal's explicit fallback and source boundaries make it reviewable, but do not turn mocked client tests into evidence of live-bank isolation.
Caveat
The PR was open at capture. Reported tests use fake clients, not a live memory bank. The selector replaces a baseline filter on a match, and fallback behavior is deliberately not a confidentiality guarantee. No new storage or security configuration was applied here.
The PR was open at capture. Reported tests use fake clients, not a live memory bank. The selector replaces a baseline filter on a match, and fallback behavior is deliberately not a confidentiality guarantee. No new storage or security configuration was applied here.