Hermes Approval As Revocable

hermes-approval-as-revocable

Phase 1. Replaces "we hope this regex catches all dangerous commands" with "the LLM literally cannot perform the action without holding an unrevoked cap."

Hermes signature

/Users/bob/i/hermes-agent/tools/approval.py

DANGEROUS_PATTERNS = [(r'\brm\s+...', "recursive delete"), ...]
def detect_dangerous_command(cmd) -> Optional[str]: ...
def is_command_approved(session_key, cmd) -> bool: ...
def approve_command(session_key, cmd, scope='once'|'session'|'permanent'): ...
# Per-session state: contextvars + thread-safe dict, keyed by session_key

Approval scopes: once, session, permanent (config.yaml). Smart-approval uses an auxiliary LLM to auto-approve "low-risk" commands.

Authority pattern: detect-then-prompt. Regex misses → silent escape. Approval state stored as session-keyed boolean → no built-in expiry, no cap-style attenuation, no propagation across delegation.

Goblins signature

/Users/bob/i/goblins-adapter/ — a ^revocable wrapper around any cap, with explicit lifecycle.

(define (^revocable bcom inner-cap
                    #:max-uses (n #f)
                    #:expires-at (deadline #f))
  (define uses 0)
  (define revoked? #f)
  (methods
    (* args
      (when revoked? (raise 'revoked))
      (when (and deadline (> (current-time) deadline)) (raise 'expired))
      (when (and n (>= uses n)) (raise 'exhausted))
      (set! uses (+ uses 1))
      (apply <- inner-cap args)))
  ;; Sealed revoker — only the granter holds it
  (values self (lambda () (set! revoked? #t))))

User approval = "give the agent a ^revocable wrapper around the dangerous cap, hold the revoker yourself." Once-scope = #:max-uses 1. Session-scope = revoker dropped at session end. Permanent-scope = unwrapped inner cap (with audit logging).

Translation table

Failure modes (closed by this bridge)

• Regex misses a dangerous variant — there are no patterns to miss; lack of cap is what blocks the call.
• Approval persists past intended scope — every grant carries explicit max-uses / deadline; revocation is one thunk call.
• Approval leaks across sessions — wrapper is per-spawn; cannot be cloned.
• Smart-approval LLM judge mistake — judge can only request a wrapper; granting still requires user (or upstream cap-holder) action.
• Delegated subagent inheriting parent's approvals silently — caps don't propagate unless explicitly forwarded; see hermes-delegate-as-spawn (row 2).

Failure modes (introduced; must mitigate)

• Revoker loss — if the user-side process holding the revoker crashes, cap becomes unrevokable until expiry. → require #:expires-at on every grant; no infinite-lifetime caps without re-confirmation.
• Time-skew on deadline — vat clock vs user clock; use monotonic vat-time + grace window.

Test vector

# Once-scope:
cap = approve_once(dangerous_op)
cap.invoke(args)            # OK
cap.invoke(args)            # CapError('exhausted')

# Revocation:
cap, revoke = approve_session(dangerous_op)
cap.invoke(args)            # OK
revoke()
cap.invoke(args)            # CapError('revoked')

# Time-limited:
cap = approve_for(dangerous_op, seconds=60)
sleep(61); cap.invoke(args) # CapError('expired')

# Sub-agent isolation:
parent_cap = approve(...)
delegate.spawn(child, caps=[])  # child sees nothing
delegate.spawn(child, caps=[parent_cap])  # explicit forwarding only

Capability diff

Test-harness location

~/i/goblins-adapter/tests/revocable-bisim.scm (todo) — bisim against Python entrypoint shim. Adversarial probe: regex-evading dangerous command (e.g. r''m -rf /, unicode-confusable rm, indirect via xargs) — Hermes may pass, cap version always fails (no cap held).

Status: stub

Phase 1 priority. Foundational for hermes-cred-as-sturdy (row 7) and hermes-mcp-as-sealed (row 8) — both build on the revocable-forwarder primitive.