Hermes Coding Gateway

Hermes Coding Gateway — Governed Multi-CLI Coding Fabric

First milestone of arifOS coding-fabric doctrine (2026-08-25, F13 SOVEREIGN). Hermes is the control-plane / orchestrator. CLI workers (qwen, claude, codex, kimi, gh) are specialist executors. Hermes NEVER executes coding work itself. It routes, gates, and verifies.

Why this exists

CPU-only VPS is not a blocker. Worker CLIs use provider / cloud models externally; only Hermes + the F13 wrapper live on the VPS. Isolation, policy gate, observability, and F13 approval are the local concerns.

Do NOT bind opencode-ai/opencode. Upstream repo archived 2025-09-18, moved to Crush. Quarantined at /root/.quarantine/2026-08-25-opencode-archived/.

Architecture

Telegram / Cron / Webhook / AAA cockpit | v Hermes Router (this gateway)

• Task classifier
• Policy engine (routing.yaml)
• F13 approval gate (gate-f13.sh)
• State + audit log (VAULT999 + arifFlow)
• Delegation broker | +-- qwen (default autonomous coding worker) +-- claude (premium implementation / review) +-- codex (OpenAI-flavour worker) +-- kimi (media-input specialist) +-- F13 wrapper -> /usr/bin/gh (GitHub write gate) | v Isolated git worktree / sandbox | v Diff + tests + lint + commit SHA + PR URL | +-- Hermes reports structured artifact to caller

Routing policy (routing.yaml)

# Default worker for general autonomous coding
default:
  worker: qwen
  mode: headless
  reason: "Multi-provider, MCP-native, subagents, SDK, Telegram channel"

implementation:
  worker: codex
  fallback: claude
  requirements:
    - isolated_worktree
    - test_before_return

architecture_review:
  worker: claude
  requirements:
    - read_only_first
    - produce_risks_and_tradeoffs

research_or_media:
  worker: kimi
  requirements:
    - preserve_source_links
    - no_external_write

ssh_remote_maintenance:
  worker: antigravity
  requirements:
    - command_allowlist
    - interactive_confirmation

github_operations:
  worker: gh
  requirements:
    - read_only_default
    - f13_for_write
  f13_required_subcommands:
    - pr merge
    - pr close
    - release create
    - release delete
    - repo delete
    - secret set
    - secret delete
    - variable delete
    - workflow dispatch production

Mandatory output schema

Every worker invocation MUST return this structured envelope. Hermes NEVER accepts free-form done text.

{
  "status": "ok | partial | failed | requires_f13",
  "plan": "<one-line intent>",
  "worker": "qwen | claude | codex | kimi | gh | antigravity",
  "session_id": "<hermes session id>",
  "worker_session_id": "<CLI worker session id>",
  "files_changed": ["path1", "path2"],
  "diff_summary": "<short diff narrative>",
  "tests_run": ["pytest tests/x.py::test_y"],
  "test_result": "pass | fail | skipped | not_applicable",
  "lint_result": "pass | fail | not_applicable",
  "commit_sha": "<git sha or empty>",
  "pr_url": "<url or empty>",
  "cost_usd": 0.0,
  "duration_ms": 0,
  "risk_level": "low | medium | high | irreversible",
  "requires_f13": false,
  "proposed_irreversible_actions": [],
  "verification_commands": [
    {"cmd": "pytest -q tests/x.py", "expected": "exit 0"}
  ],
  "evidence_paths": ["/path/to/diff", "/path/to/log"],
  "f1_snapshot": "/root/.local/share/arifos/snapshots/<ts>/"
}

Spawn pattern (worker invocation)

# Qwen headless — default autonomous worker
qwen -p '<TASK>' --max-turns 15 --output-format json \
  --permission-mode plan --cwd <isolated_worktree>

# Codex headless
codex exec --json '<TASK>' --cd <isolated_worktree>

# Claude Code print mode
claude -p '<TASK>' --max-turns 15 --output-format json \
  --allowedTools 'Read,Edit,Glob,Grep,Bash(git diff),Bash(pytest)' \
  --permission-mode plan

# Kimi media-first
kimi --print '<TASK>' --output-format json --max-turns 10

# GitHub write via wrapper (exits 42 -> F13 approval)
gh-shim pr create --title ... --body ...

F13 enforcement — wrapper executable (NOT prompt-only)

gate-f13.sh is a shell wrapper that intercepts T3-class commands and exits with code 42 to signal F13 approval is required. Hermes detects the exit code, sends the proposal (target + exact command + diff + reversibility) to Telegram, and waits for Arif reply. On approval, Hermes executes the SAME COMMAND VERBATIM — never a silently-improved version.

F13 enforcement matrix