hermes-gpt: Instructions file for Codex

AGENTS.md

These instructions apply to the entire hermes-gpt repository.

Start here

Before changing code or documentation:

1. Read docs/README.md for the documentation authority map.
2. Read pyproject.toml for the checked-out package version and shipped modules/docs.
3. Read the current operational document for the subsystem you are touching.
4. Inspect the implementation module and its tests before changing behavioral claims.

Do not treat docs/design/*, docs/releases/*, or FEASIBILITY.md as current runtime instructions. They preserve design and release history.

Source-of-truth precedence

When sources disagree:

1. current implementation and tests;
2. current operational docs;
3. current release notes / CHANGELOG;
4. historical design, risk, counsel, release-plan, and feasibility artifacts.

Never change runtime behavior solely to make it match a historical plan. First determine whether the implementation or the documentation is the intended current contract.

Product invariants

Preserve these unless the task explicitly changes the security model and includes corresponding tests/docs:

• local loopback is the default network boundary;
• public unauthenticated Operator hosting is unsupported;
• default behavior is read-only;
• mutating Operator actions are opt-in and dry-run-first;
• direct mutation requires server direct mode plus per-call gates;
• Owner Mode is break-glass and does not bypass secret-path protections;
• .env, auth/token stores, SSH/AWS secrets, vault secrets, and secret-looking files remain denied;
• protected subprocess paths use fixed argv and shell=False;
• raw prompts are not persisted in Operator audit records;
• Mission Control excludes raw messages, memory bodies, transcripts, request dumps, credentials, and profile-secret bodies;
• Work Contract completion is validated from observed state and fails closed when evidence is missing;
• Swarm orchestration has bounded concurrency/rework and a final human approval gate;
• Codex may review Swarm work but is never an implementation owner.