DOCUMENTATION/Hermes/HermesSidecar.md (v1.2.0, updated 2026-08-01) labels provenance tainting Control 4 "(required before any channel)" (line 99) and states it "is not built yet, and the gateway must not be enabled until it is" (lines 107–108). The shipped code disagrees — it's built and wired. (For precision: the word "planned" in that doc is Control 3's label — the typed-write API, line 94 — not Control 4; the Control 4 claim is specifically "not built yet.")
HERMES/plugin/guard.py implements is_untrusted_source, injection_shapes, mark_tainted, taint_of, check_privileged, annotate__init__.py registers both pre_tool_call and transform_tool_result, so results get annotated and sessions get taintedevaluate() (guard.py ~340–350) refuses privileged tools for the remainder of a tainted session — the block is literally commented "Control 4"- the plugin test suite passes 31/31 on this install, including code-exec credential-read denials
One nuance that strengthens the drift point rather than softening it: the doc's spec for Control 4 says tainted turns "require explicit approval" for privileged calls, but the shipped code hard-refuses instead of prompting — deliberately (guard.py ~198–200: a cron turn has no human to approve). The implementation is stricter than the doc describes.
So the doc is gating a product decision on a control that already exists. Worth reconciling the doc, then making the gateway-posture call explicitly: code being present and wired isn't the same as it being adequate against a real adversary (that's a review, not a grep), but the current text sends readers away from a control that ships.
Found, incidentally, by your own VerificationGate stop hook: the assistant first described the guard from the doc, the gate contradicted the claim against transcript reality, and the forced code-read surfaced the drift. That gate earning its keep is the best advertisement in this report.
Environment: Debian 13 (headless), Claude Code 2.1.220, bun 1.3.14, fresh OS user, installed via https://ourlifeos.ai/install — page content verified byte-identical to tag v7.28.3 (36c6f01) before install. All line references are to this tag. One of four reports from the same fresh-install trial.
— Reported by Rob Pratt (@rpriven), co-authored with Kai.
DOCUMENTATION/Hermes/HermesSidecar.md(v1.2.0, updated 2026-08-01) labels provenance tainting Control 4 "(required before any channel)" (line 99) and states it "is not built yet, and the gateway must not be enabled until it is" (lines 107–108). The shipped code disagrees — it's built and wired. (For precision: the word "planned" in that doc is Control 3's label — the typed-write API, line 94 — not Control 4; the Control 4 claim is specifically "not built yet.")HERMES/plugin/guard.pyimplementsis_untrusted_source,injection_shapes,mark_tainted,taint_of,check_privileged,annotate__init__.pyregisters bothpre_tool_callandtransform_tool_result, so results get annotated and sessions get taintedevaluate()(guard.py ~340–350) refuses privileged tools for the remainder of a tainted session — the block is literally commented "Control 4"One nuance that strengthens the drift point rather than softening it: the doc's spec for Control 4 says tainted turns "require explicit approval" for privileged calls, but the shipped code hard-refuses instead of prompting — deliberately (guard.py ~198–200: a cron turn has no human to approve). The implementation is stricter than the doc describes.
So the doc is gating a product decision on a control that already exists. Worth reconciling the doc, then making the gateway-posture call explicitly: code being present and wired isn't the same as it being adequate against a real adversary (that's a review, not a grep), but the current text sends readers away from a control that ships.
Found, incidentally, by your own VerificationGate stop hook: the assistant first described the guard from the doc, the gate contradicted the claim against transcript reality, and the forced code-read surfaced the drift. That gate earning its keep is the best advertisement in this report.
Environment: Debian 13 (headless), Claude Code 2.1.220, bun 1.3.14, fresh OS user, installed via
https://ourlifeos.ai/install— page content verified byte-identical to tagv7.28.3(36c6f01) before install. All line references are to this tag. One of four reports from the same fresh-install trial.— Reported by Rob Pratt (@rpriven), co-authored with Kai.