$npx -y skills add s0heyl/hermes-loop-master --skill hermes-loop-masterUse when a Hermes Agent coding task is multi-step, risky, long-running, production-facing, security-sensitive, or likely to span multiple sessions. Enforces a spec-first loop, one-slice implementation, real verification evidence, adversarial diff review, context-budget discipline
| 1 | # Hermes Loop Master |
| 2 | |
| 3 | ## Overview |
| 4 | |
| 5 | Hermes Loop Master is a disciplined operating loop for coding with Hermes Agent. It is built for work where "looks done" is not good enough: production fixes, multi-step features, refactors, security-sensitive changes, and any task that may continue across sessions. |
| 6 | |
| 7 | The skill changes the agent's behavior in five ways: |
| 8 | |
| 9 | 1. **Spec first** — write a compact execution contract before editing code. |
| 10 | 2. **One slice at a time** — implement the smallest meaningful increment, not a bundle of nearby improvements. |
| 11 | 3. **Verify with evidence** — run real commands and record what returned. |
| 12 | 4. **Review adversarially** — inspect the diff for fake-done shortcuts before declaring success. |
| 13 | 5. **Leave a handoff** — make the next session able to resume without guessing. |
| 14 | |
| 15 | The loop is intentionally file-backed. Durable task files survive context compression, new sessions, model switches, and interrupted runs. |
| 16 | |
| 17 | ## When to Use |
| 18 | |
| 19 | Use this skill when the user asks Hermes to: |
| 20 | |
| 21 | - build or modify a feature with more than two steps, |
| 22 | - fix a bug that needs reproduction and verification, |
| 23 | - work in a production or public repository, |
| 24 | - touch authentication, authorization, payment, data migrations, secrets, user data, or deployment paths, |
| 25 | - refactor code where scope creep is likely, |
| 26 | - continue work from a previous session, |
| 27 | - coordinate with subagents or external coding tools, |
| 28 | - prepare a PR or public release. |
| 29 | |
| 30 | Use the **Tiny Change Path** instead of the full loop when the task is a one-file typo, formatting-only change, comment update, or trivial documentation fix. Even then, verify the exact file changed and report the diff. |
| 31 | |
| 32 | Do not use this skill to bypass user approval, hide uncertainty, or perform destructive operations without confirmation. |
| 33 | |
| 34 | ## Adaptive Modes |
| 35 | |
| 36 | Classify once during the safety gate, then use the lightest mode that can still prove the work: |
| 37 | |
| 38 | | Mode | Trigger | Required loop | Efficiency target | |
| 39 | |---|---|---|---| |
| 40 | | **Tiny** | One-file typo, copy, comment, or mechanical low-risk edit | Read → patch → cheapest relevant check → diff summary. Full artifacts are optional unless the repository already uses them. | Target no more than 8 tool calls. | |
| 41 | | **Standard** | Normal bug fix, bounded feature, or refactor | Compact `LOOP.md`, RED→GREEN when behavior changes, targeted test, broader regression check, diff review, short handoff. | Target no more than 20 tool calls. | |
| 42 | | **Critical** | Security, auth, payment, migration, user data, production, or irreversible risk | Full artifacts, RED→GREEN evidence, positive/negative/preservation/failure coverage, Independent Oracle where available, broader verification, adversarial review, handoff. | No fixed cap; evidence completeness wins. | |
| 43 | |
| 44 | Budgets are diagnostics, not permission to stop early. Reuse already-read context, batch independent reads/checks, avoid duplicate broad scans, and update artifacts at meaningful checkpoints. If correctness requires more work, continue and record why the budget was exceeded in the Evidence Log. |
| 45 | |
| 46 | The machine-readable defaults live in `scripts/artifact_contract.py`. For every Critical task, read `references/behavioral-verification.md` before writing tests and build its security boundary matrix when untrusted input or integrity is involved. Its exact seven evidence labels and canonical result tokens are part of the contract, not optional prose. |
| 47 | |
| 48 | ## Core Artifacts |
| 49 | |
| 50 | Create a private project-local directory unless the repository already has an accepted convention: |
| 51 | |
| 52 | ```text |
| 53 | .hermes-loop/ |
| 54 | LOOP.md # current task contract and progress |
| 55 | HANDOFF.md # end-of-session state |
| 56 | REVIEW.md # adversarial review notes |
| 57 | FEATURES.json # optional for large multi-feature projects |
| 58 | ``` |
| 59 | |
| 60 | Never commit `.hermes-loop/` if it contains private notes, customer data, secrets, or local-only paths. If the project wants public task state, sanitize it and place it under `docs/agent-loop/` instead. |
| 61 | |
| 62 | ## Phase 0 — Scope and Safety Gate |
| 63 | |
| 64 | Before editing, determine whether the task is safe to execute immediately. |
| 65 | |
| 66 | Stop and ask for clarification if any of these are true: |
| 67 | |
| 68 | - the requested repository/path is unknown, |
| 69 | - the operation could delete data, reset history, publish secrets, spend money, or affect production traffic, |
| 70 | - credentials or private keys may |