vault-sync: 2026-10-06 00:00 (jimmy)

memory-systems/agent-os/03_shared/agent-operations/problems-log.md

@@ -0,0 +1,11 @@
+---
+title: Agent Operations — Problems Log (nightly delta)
+tags: [agent-operations, problems, log]
+scope: shared
+---
+
+# Problems Log — nightly delta
+
+Appended by the **Agent problems delta (3am)** cron via
+`C:/Users/fight/AppData/Local/hermes/profiles/jimmy/scripts/problem-delta.py`.
+Newest at the bottom. Baseline: [[problems-registry]].

memory-systems/agent-os/03_shared/agent-operations/problems-registry.md

@@ -0,0 +1,170 @@
+---
+title: Agent Operations — Problems Registry
+tags: [agent-operations, problems, registry, hermes]
+scope: shared
+generated: 2026-10-06
+source: HermesHost/diagnostics/backfill/all-v1/registry.md
+---
+
+> Cross-profile (default, jimmy, leonard, verimail). Baseline backfill, day one → 2026-10-06.
+> Nightly deltas append to [[problems-log]]. Per-agent detail: [[02_agents/leonard/failure-ledger]].
+
+# Agent Operations — Problems Registry (backfill, since day one)
+
+> Generated 2026-10-06T05:51:36+00:00 · deterministic miner `problem_miner.py` + 10-agent swarm · evidence-cited.
+> Window: 2026-08-28 → 2026-10-06 (all 4 profiles: default, jimmy, leonard, verimail).
+> Sources: 3444 problem events → 192 clustered findings → 37 themes. Occurrence-weighted total: 2583.
+
+## Ranked themes
+
+| # | Theme | Occurrences | Findings | Severity | Profiles |
+|---|-------|------------:|---------:|----------|----------|
+| 1 | timeouts | 715 | 35 | high | default, jimmy, leonard, verimail |
+| 2 | generic exit codes | 444 | 8 | medium | default, jimmy, leonard |
+| 3 | path / file not found | 205 | 13 | high | default, jimmy, leonard, verimail |
+| 4 | python runtime tracebacks | 187 | 7 | high | default, jimmy, leonard |
+| 5 | config key churn / bad subcommands | 141 | 4 | medium | default, jimmy |
+| 6 | git remote / auth | 105 | 5 | high | default, jimmy, leonard |
+| 7 | terminal background/notify misuse | 105 | 7 | medium | default, jimmy, leonard |
+| 8 | patch old_string / escape drift | 85 | 6 | high | default, jimmy, leonard |
+| 9 | ripgrep / search_files | 71 | 11 | medium | default, jimmy, leonard, verimail |
+| 10 | memory at capacity | 68 | 7 | high | default, jimmy, leonard |
+| 11 | skill description budget | 61 | 7 | medium | default, jimmy, leonard |
+| 12 | approval / consent block | 51 | 10 | medium | default, jimmy, leonard |
+| 13 | user friction (corrections) | 32 | 7 | high | default, jimmy, leonard |
+| 14 | tool_call batching / bridge misuse | 27 | 6 | high | jimmy, leonard |
+| 15 | skill_manage malformed / skill not found | 27 | 6 | medium | jimmy |
+| 16 | command not found | 26 | 6 | medium | default, jimmy, leonard |
+| 17 | tailnet / SSH / VPS | 20 | 3 | high | default, jimmy, leonard |
+| 18 | uv trampoline | 20 | 1 | high | default |
+| 19 | PowerShell/cmd syntax in bash | 18 | 2 | medium | jimmy |
+| 20 | cron jobs / reminders | 17 | 2 | high | default, leonard |
+| 21 | missing python module | 15 | 3 | medium | jimmy |
+| 22 | local model load/serve | 14 | 4 | high | jimmy, leonard |
+| 23 | Hermes config write refused | 14 | 3 | medium | jimmy |
+| 24 | browser_exec / CDP hangs | 13 | 2 | medium | jimmy, leonard |
+| 25 | detector false positives | 12 | 1 | low | default |
+| 26 | memory tool misuse | 12 | 2 | medium | jimmy |
+| 27 | model/output identity errors | 10 | 5 | high | jimmy |
+| 28 | process_manage | 10 | 2 | medium | jimmy |
+| 29 | Telegram gateway down | 10 | 4 | high | jimmy, leonard |
+| 30 | memory_search zg binary missing | 10 | 1 | high | jimmy |
+| 31 | unwanted voice / TTS | 9 | 2 | medium | jimmy, leonard |
+| 32 | shell quoting / eval errors | 7 | 3 | medium | default, jimmy, leonard |
+| 33 | Docker | 6 | 2 | medium | jimmy, leonard |
+| 34 | vision_analyze | 6 | 2 | medium | jimmy, leonard |
+| 35 | write_file overwrite guard | 4 | 1 | high | jimmy |
+| 36 | secret/credential read refused | 4 | 1 | high | jimmy |
+| 37 | other | 2 | 1 | medium | leonard |
+
+## Detail (top 15)
+
+### 1. timeouts — 715 occurrences, severity high
+- **Profiles:** default, jimmy, leonard, verimail  ·  **Lanes:** default-first-week, default-rest, jimmy-recent, jimmy-w1, jimmy-w2, jimmy-w3, jimmy-w4, jimmy-w5, leonard-rest, leonard-w1
+- **Root cause:** Commands routinely exceed default timeouts and the agent neither raises timeout= nor backgrounds long jobs, so downloads, model startups and pings die mid-run.
+- **Suggested fix:** Default long commands to background=true with notify_on_complete=true and set an explicit timeout= where a foreground wait is required.
+- **Evidence:** `default:20260829_075244_4ffe68a7#3428`, `default:20260828_144747_49a94d46#1621`, `default:20260830_140032_70edf88c#21543`, `default:20260901_210256_6c1c52da#26838`, `default:20260901_210256_6c1c52da#26361`, `default:20260830_140032_70edf88c#19000`
+- **Example findings:** Tool command timeouts (foreground terminal + execute_code kernel); SSH access to VPS / tailnet hosts failing; BLOCKED: approval/consent timeouts on gated commands; Safety-approval gate blocks dangerous commands in unattended single-query mode
+
+### 2. generic exit codes — 444 occurrences, severity medium
+- **Profiles:** default, jimmy, leonard  ·  **Lanes:** default-first-week, jimmy-w1, jimmy-w2, jimmy-w3, jimmy-w4, jimmy-w5, leonard-rest, leonard-w1
+- **Root cause:** unclear from evidence
+- **Suggested fix:** Capture and log stderr alongside the exit code for diagnosability.
+- **Evidence:** `default:20260828_144747_49a94d46#1619`, `default:20260828_201637_807fd2ff#2548`, `default:20260828_201637_807fd2ff#2643`, `jimmy:20260903_131512_23f3ecc7#983`, `jimmy:20260903_131512_23f3ecc7#1256`, `jimmy:20260903_072353_f46f323c#383`
+- **Example findings:** Miscellaneous command failures (generic non-zero exit codes); Miscellaneous command failures (bare exit codes); Miscellaneous command failures (bare non-zero exit codes); Miscellaneous command failures (bare exit codes)
+
+### 3. path / file not found — 205 occurrences, severity high
+- **Profiles:** default, jimmy, leonard, verimail  ·  **Lanes:** default-first-week, default-rest, jimmy-recent, jimmy-w1, jimmy-w2, jimmy-w3, jimmy-w5, leonard-rest, leonard-w1
+- **Root cause:** The agent repeatedly issues MSYS/Linux-style or otherwise wrong paths on Windows (and wrong working directories), so file and cd operations fail.
+- **Suggested fix:** Resolve the real Windows path first (forward-slash native form) and confirm existence before reading/cd; prefer search_files to locate.
+- **Evidence:** `default:20260828_165853_0ff9f889#2009`, `default:20260901_210256_6c1c52da#26668`, `default:20260830_140032_70edf88c#15170`, `default:20260918_124517_372cda#36420`, `default:20260918_124517_372cda#36529`, `default:20260919_133653_cfea5b#37337`
+- **Example findings:** File/path not found on Windows (path translation failures); Referenced files, scripts, and paths do not exist; Generic command failures (bare exit_code=N); read_file 'File not found' on guessed paths
+
+### 4. python runtime tracebacks — 187 occurrences, severity high
+- **Profiles:** default, jimmy, leonard  ·  **Lanes:** default-first-week, default-rest, jimmy-w1, jimmy-w2, leonard-rest
+- **Root cause:** The agent writes Python (in execute_code and inline python) that throws syntax/name/shape errors, repeatedly burning turns on self-inflicted exceptions.
+- **Suggested fix:** Run smaller snippets, print intermediate values, and read the traceback before re-issuing; validate generated code before long batches.
+- **Evidence:** `default:20260830_100546_480c392f#9553`, `default:20260830_100546_480c392f#9762`, `default:20260830_100546_480c392f#10158`, `default:20260901_210256_6c1c52da#31880`, `default:20260901_210256_6c1c52da#31885`, `default:20260830_140032_70edf88c#15839`
+- **Example findings:** Agent-generated Python raises tracebacks in execute_code / terminal; Script data/schema errors (sqlite & JSON shape); IMAP fetches fail with traceback; execute_code cell raises runtime traceback
+
+### 5. config key churn / bad subcommands — 141 occurrences, severity medium
+- **Profiles:** default, jimmy  ·  **Lanes:** default-first-week, jimmy-recent, jimmy-w2
+- **Root cause:** The agent runs POSIX tools (python3, dig, sshpass, expect) absent from the Windows bash, and emits cmd.exe/PowerShell syntax (taskkill, Restart-Service, quotes) that bash misparses.
+- **Suggested fix:** Probe tool availability first (which/command -v) and pick Windows-native equivalents or full exe paths; avoid cmd/PowerShell-only syntax in bash.
+- **Evidence:** `default:20260901_210256_6c1c52da#27257`, `default:20260901_210256_6c1c52da#26102`, `default:20260830_140032_70edf88c#16099`, `default:20260829_135124_84d145aa#4310`, `default:20260831_154908_9c27060c#22115`, `default:20260830_140032_70edf88c#16391`
+- **Example findings:** Windows shell environment mismatch and missing CLI tools; Hermes CLI subcommand/flag misuse; agent-reach CLI given an invalid subcommand; Provider/model config churn and unsupported config keys
+
+### 6. git remote / auth — 105 occurrences, severity high
+- **Profiles:** default, jimmy, leonard  ·  **Lanes:** default-first-week, jimmy-w1, jimmy-w3, jimmy-w5, leonard-w1
+- **Root cause:** Git remotes are misconfigured (bad Gitea hostname, missing/expired HTTPS credentials, unsupported ssl-no-revoke flag) and pushes race with remote updates.
+- **Suggested fix:** Standardize the Gitea remote URL and token, drop unsupported flags, and pull/rebase before pushing.
+- **Evidence:** `default:20260901_210256_6c1c52da#26833`, `default:20260901_210256_6c1c52da#26844`, `default:20260901_210256_6c1c52da#33282`, `jimmy:20260903_072353_f46f323c#422`, `jimmy:20260903_072353_f46f323c#430`, `jimmy:20260902_110459_eb6003#1034`
+- **Example findings:** Git remote auth / push failures; PowerShell/cmd syntax executed in a bash shell; Python module/import path failures; Command not found (gh, mcporter, getent)
+
+### 7. terminal background/notify misuse — 105 occurrences, severity medium
+- **Profiles:** default, jimmy, leonard  ·  **Lanes:** default-first-week, default-rest, jimmy-recent, jimmy-w2, jimmy-w4, leonard-rest, leonard-w1
+- **Root cause:** The agent shells out with '&' or passes notify to foreground terminal calls instead of using the tool's background/notify parameters.
+- **Suggested fix:** For servers/watchers use terminal(background=true, notify_on_complete=true); never append '&' or notify to foreground calls.
+- **Evidence:** `default:20260828_132734_85f729e5#1434`, `default:20260830_140032_70edf88c#13074`, `default:20260829_095319_cc8f7496#3860`, `default:20260919_133653_cfea5b#37645`, `jimmy:20261002_082642_504214#23706`, `jimmy:20261002_082642_504214#24680`
+- **Example findings:** Terminal backgrounding and notify parameter misuse; Foreground command with '&' backgrounding rejected; Backgrounding wrappers rejected in foreground terminal calls; Misuse of backgrounding flags and shell background wrappers
+
+### 8. patch old_string / escape drift — 85 occurrences, severity high
+- **Profiles:** default, jimmy, leonard  ·  **Lanes:** default-first-week, default-rest, jimmy-recent, jimmy-w3, jimmy-w4, leonard-rest
+- **Root cause:** The agent calls patch without required args or with stale/whitespace-mismatched old_string, so edits silently fail to apply.
+- **Suggested fix:** Read the file immediately before patching and copy an exact unique existing snippet into old_string.
+- **Evidence:** `default:20260830_100546_480c392f#8180`, `default:20260830_100546_480c392f#10654`, `default:20260829_152634_04e12a4d#5620`, `default:20260909_075338_59a09d17#36333`, `jimmy:20261002_082642_504214#24133`, `jimmy:20261002_082642_504214#24135`
+- **Example findings:** patch tool argument and old_string-match failures; patch refuses to write file failing JSON syntax validation; patch escape-drift on backslash-quote sequences; patch old_string no match / escape drift
+
+### 9. ripgrep / search_files — 71 occurrences, severity medium
+- **Profiles:** default, jimmy, leonard, verimail  ·  **Lanes:** default-rest, jimmy-recent, jimmy-w3, jimmy-w4, jimmy-w5, leonard-rest, leonard-w1
+- **Root cause:** unclear from evidence
+- **Suggested fix:** Validate the search root exists and keep patterns simple before running search_files.
+- **Evidence:** `default:20260909_075338_59a09d17#36322`, `jimmy:20261002_225522_3a575121#25229`, `jimmy:20261004_213907_6161c54d#25757`, `jimmy:20261004_213907_6161c54d#25758`, `jimmy:20261002_082642_504214#24738`, `jimmy:20260913_162527_c83fd6#14268`
+- **Example findings:** search_files ripgrep backend fails; search_files / ripgrep failures and bad paths; Referenced paths do not exist (search_files / read_file); search_files invalid regex rejected by ripgrep
+
+### 10. memory at capacity — 68 occurrences, severity high
+- **Profiles:** default, jimmy, leonard  ·  **Lanes:** default-first-week, default-rest, jimmy-recent, jimmy-w1, jimmy-w2, jimmy-w3, leonard-w1
+- **Root cause:** User memory is at its character limit and the agent submits invalid memory actions (None/view, replace without old_text).
+- **Suggested fix:** Consolidate existing entries with valid add/replace/remove actions before adding new memory.
+- **Evidence:** `default:20260831_154908_9c27060c#22341`, `default:20260829_135124_84d145aa#5008`, `default:20260828_215950_6f0dd002#3185`, `default:20260919_150025_acc966#37911`, `jimmy:20261002_082642_504214#24727`, `jimmy:20261002_082642_504214#24729`
+- **Example findings:** memory tool action errors and size-limit overruns; Memory store at capacity blocks new entries; Memory store at capacity on batch writes; Memory tool edits fail validation
+
+### 11. skill description budget — 61 occurrences, severity medium
+- **Profiles:** default, jimmy, leonard  ·  **Lanes:** default-first-week, jimmy-recent, jimmy-w1, jimmy-w3, jimmy-w4, leonard-rest, leonard-w1
+- **Root cause:** The agent submits malformed skill_manage operations and references skill names that don't exist in the profile.
+- **Suggested fix:** Validate the operations schema (name/action) and keep descriptions within budget; list skills before referencing them.
+- **Evidence:** `default:20260901_111119_3fb7ce3f#25178`, `default:20260901_210256_6c1c52da#30612`, `default:20260829_152634_04e12a4d#5559`, `jimmy:20261002_082642_504214#24211`, `jimmy:20261004_175703_fcae4d19#25665`, `jimmy:20260903_082924_ee9d9f9b#582`
+- **Example findings:** Skill tooling errors (skill_manage ops and missing skills); skill_manage rejects oversized skill descriptions; New skill descriptions exceed system-prompt budget; skill_manage description exceeds budget
+
+### 12. approval / consent block — 51 occurrences, severity medium
+- **Profiles:** default, jimmy, leonard  ·  **Lanes:** default-first-week, jimmy-recent, jimmy-w4, jimmy-w5, leonard-w1
+- **Root cause:** The agent keeps attempting to read .env/credential stores and to hand-edit Hermes config, all of which are blocked by design.
+- **Suggested fix:** Use provider tools for credentials and `hermes config`/hermes CLI instead of reading secret files or editing config directly.
+- **Evidence:** `default:20260831_154908_9c27060c#22127`, `default:20260828_165853_0ff9f889#2225`, `default:20260829_135124_84d145aa#4288`, `jimmy:20261003_161554_b72b50c7#25376`, `jimmy:cron_9fb3bd266e71_20261004_080024#25486`, `jimmy:cron_9fb3bd266e71_20261002_132706#24418`
+- **Example findings:** Blocked reads/writes of secrets and Hermes config; Cron jobs blocked or misconfigured; read_file blocked for repeating an identical call; read_file blocked from Hermes credential store
+
+### 13. user friction (corrections) — 32 occurrences, severity high
+- **Profiles:** default, jimmy, leonard  ·  **Lanes:** default-first-week, jimmy-w4, jimmy-w5, leonard-rest
+- **Root cause:** The agent kept re-engaging/returning to the Thornhill project after the user repeatedly said to drop it, forcing ~20 identical corrections.
+- **Suggested fix:** Treat 'disregard X' as a persistent instruction: stop surfacing X in status, plans, or actions for the session.
+- **Evidence:** `default:20260901_210256_6c1c52da#25862`, `default:20260901_210256_6c1c52da#26149`, `default:20260901_210256_6c1c52da#27075`, `default:20260830_100546_480c392f#10281`, `default:20260830_100546_480c392f#10548`, `default:20260830_100546_480c392f#11253`
+- **Example findings:** Friction: repeated "Disregard Thornhill for now" corrections; Friction: repeated "fix all" corrections; Friction: wrong scope/directory for audits; User had to instruct 'fix all' after unresolved failures
+
+### 14. tool_call batching / bridge misuse — 27 occurrences, severity high
+- **Profiles:** jimmy, leonard  ·  **Lanes:** jimmy-recent, jimmy-w2, jimmy-w3, leonard-rest, leonard-w1
+- **Root cause:** Multiple or mixed local tool calls were submitted in a single tool_call batch.
+- **Suggested fix:** Send one local tool entry per tool_call and separate local from non-local calls.
+- **Evidence:** `jimmy:20261002_082642_504214#24650`, `jimmy:20260907_095044_75fc0e#6873`, `jimmy:20260907_102215_9626de50#7144`, `jimmy:20260907_210950_e5d3c500#8193`, `jimmy:20260909_091452_22e743#9314`, `jimmy:20260915_075048_45a487#15081`
+- **Example findings:** tool_call batch rule violated for local tools; tool_call argument / JSON validation errors; tool_call deferred-invocation schema errors; tool_call bridge rejects mixed/multi-local batches
+
+### 15. skill_manage malformed / skill not found — 27 occurrences, severity medium
+- **Profiles:** jimmy  ·  **Lanes:** jimmy-w1, jimmy-w2, jimmy-w3, jimmy-w4, jimmy-w5
+- **Root cause:** Agent references skill names and linked files that no longer exist.
+- **Suggested fix:** List available skills / linked files before calling skill_view with an unverified name.
+- **Evidence:** `jimmy:20260903_082924_ee9d9f9b#559`, `jimmy:20260903_082924_ee9d9f9b#698`, `jimmy:20260905_120132_7fcffe#4860`, `jimmy:20260905_120132_7fcffe#4864`, `jimmy:20260905_120132_7fcffe#4923`, `jimmy:20260907_213044_a4748a#8098`
+- **Example findings:** Stale skill and skill-file references; patch old_string mismatch aborts edits; skill_view targets skills/files that do not exist; skill_manage malformed frontmatter
+
+## Provenance
+- Miner: `C:/Users/fight/AppData/Local/HermesHost/diagnostics/problem_miner.py` (deterministic, no LLM)
+- Lanes: default-2026-08-28, default-2026-09-04, default-2026-09-18, default-2026-09-25, jimmy-2026-08-28, jimmy-2026-09-04, jimmy-2026-09-11, jimmy-2026-09-18, jimmy-2026-09-25, jimmy-2026-10-02, leonard-2026-09-11, leonard-2026-09-18, leonard-2026-09-25, leonard-2026-10-02, verimail-2026-09-18, verimail-2026-09-25
+- Phase-B cursors (epoch, per profile): `{"default": 1790980961.1927402, "jimmy": 1791265223.8813179, "leonard": 1791265215.5371597, "verimail": 1791049305.041406}`

memory-systems/agent-os/03_shared/agent-operations/remediation-backlog.md

@@ -0,0 +1,277 @@
+---
+title: Agent Operations — Remediation Backlog
+tags: [agent-operations, problems, backlog, remediation]
+scope: shared
+generated: 2026-10-06
+source: HermesHost/diagnostics/backfill/all-v1/backlog.json
+---
+
+# Agent Operations — Remediation Backlog
+
+> Derived from [[problems-registry]] (2026-10-06). Priorities: **P0** blocks automation/work, **P1** high-frequency hygiene, **P2** recurring friction, **P3** noise.
+> Owners: **Agent behavior** (fix via skill/memory/instructions) · **Config** (env/`hermes config`) · **Infra (Tony)** (external/manual). Effort: S/M/L.
+
+**Totals:** 8 P0 · 9 P1 · 18 P2 · 2 P3
+
+## P0
+
+### T01 — timeouts  ·  P0 · effort M · owner: Agent behavior
+- **Signal:** 715 occurrences across 35 finding(s) · profiles: default, jimmy, leonard, verimail
+- **Root cause:** Commands routinely exceed default timeouts and the agent neither raises timeout= nor backgrounds long jobs, so downloads, model startups and pings die mid-run.
+- **Action:** Default long/threshold-crossing commands to terminal(background=true, notify=true); set explicit timeout= only for genuine short waits. Add a pre-flight rule: 'probably >30s? background it.'
+- **Evidence:** `default:20260829_075244_4ffe68a7#3428`, `default:20260828_144747_49a94d46#1621`, `default:20260830_140032_70edf88c#21543`, `default:20260901_210256_6c1c52da#26838`
+
+### T06 — git remote / auth  ·  P0 · effort M · owner: Infra (Tony)
+- **Signal:** 105 occurrences across 5 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** Git remotes are misconfigured (bad Gitea hostname, missing/expired HTTPS credentials, unsupported ssl-no-revoke flag) and pushes race with remote updates.
+- **Action:** Standardize the Gitea remote URL + token; drop unsupported flags (ssl-no-revoke); pull/rebase before push.
+- **Evidence:** `default:20260901_210256_6c1c52da#26833`, `default:20260901_210256_6c1c52da#26844`, `default:20260901_210256_6c1c52da#33282`, `jimmy:20260903_072353_f46f323c#422`
+
+### T12 — approval / consent block  ·  P0 · effort M · owner: Config (Tony)
+- **Signal:** 51 occurrences across 10 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** The agent keeps attempting to read .env/credential stores and to hand-edit Hermes config, all of which are blocked by design.
+- **Action:** Unattended runs (cron, -q) must not raise approval prompts. Add a non-interactive allowlist / pre-approval policy, and have the agent detect unattended context before prompting.
+- **Evidence:** `default:20260831_154908_9c27060c#22127`, `default:20260828_165853_0ff9f889#2225`, `default:20260829_135124_84d145aa#4288`, `jimmy:20261003_161554_b72b50c7#25376`
+
+### T17 — tailnet / SSH / VPS  ·  P0 · effort M · owner: Infra (Tony)
+- **Signal:** 20 occurrences across 3 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** The user could not get the Tailnet Watchdog reminder stopped (the stop action/job lookup failed), repeating the request many times.
+- **Action:** Re-auth the Tailscale node (correct `tailscale up`, no --force-reauth on headless), fix the jump-host/SSH key so VPS work unblocks.
+- **Evidence:** `default:20260901_061717_10e875f4#24639`, `default:20260901_061717_10e875f4#24647`, `default:20260901_061717_10e875f4#24730`, `jimmy:20260905_173250_ca1a2ee5#5318`
+
+### T18 — uv trampoline  ·  P0 · effort S · owner: Config
+- **Signal:** 20 occurrences across 1 finding(s) · profiles: default
+- **Root cause:** uv's managed-Python trampoline cannot find or spawn the Python child process (os error 2), breaking every Python invocation routed through uv.
+- **Action:** Pin a concrete interpreter or set UV_PYTHON to a real python.exe; stop routing through the uv managed-install trampoline.
+- **Evidence:** `default:20260919_133653_cfea5b#37254`, `default:20260919_133653_cfea5b#37258`, `default:20260919_133653_cfea5b#37331`, `default:20260919_133653_cfea5b#37663`
+
+### T22 — local model load/serve  ·  P0 · effort M · owner: Config
+- **Signal:** 14 occurrences across 4 finding(s) · profiles: jimmy, leonard
+- **Root cause:** llama-server is invoked with a missing model file and malformed args/paths (backslashes stripped, producing 'C:llamallama-server.exe').
+- **Action:** Persist a known-good llama.cpp serve config (valid n_gpu_layers within free VRAM, validated JSON); pre-flight validate before every restart.
+- **Evidence:** `jimmy:20260903_153357_b3175c#1520`, `jimmy:20260903_153357_b3175c#1518`, `jimmy:20260903_153357_b3175c#1538`, `jimmy:20260903_153357_b3175c#1526`
+
+### T29 — Telegram gateway down  ·  P0 · effort M · owner: Infra (Tony)
+- **Signal:** 10 occurrences across 4 finding(s) · profiles: jimmy, leonard
+- **Root cause:** The Telegram gateway service dies/regresses repeatedly across sessions without a durable fix.
+- **Action:** Add a supervisor/health-check that restarts the gateway on failure (run the messaging-channel-diagnostics skill); recurring breakage spans weeks.
+- **Evidence:** `jimmy:20260907_213044_a4748a#8059`, `jimmy:20260907_213044_a4748a#8071`, `jimmy:20260906_095449_6093b4#8493`, `jimmy:20260926_102836_24ab5d#20785`
+
+### T30 — memory_search zg binary missing  ·  P0 · effort S · owner: Config
+- **Signal:** 10 occurrences across 1 finding(s) · profiles: jimmy
+- **Root cause:** The zg/zvec memory-search backend binary is not installed or not on PATH, so memory_search fails every call.
+- **Action:** Set jimmy's zvec `zg_bin` to the full path of zg.cmd so memory_search stops failing (already a known memory fact — apply it).
+- **Evidence:** `jimmy:20260910_230923_8a32a942#10979`, `jimmy:20260912_065518_7410d52d#11620`, `jimmy:20260912_122538_385e3988#12355`
+
+## P1
+
+### T03 — path / file not found  ·  P1 · effort S · owner: Agent behavior
+- **Signal:** 205 occurrences across 13 finding(s) · profiles: default, jimmy, leonard, verimail
+- **Root cause:** The agent repeatedly issues MSYS/Linux-style or otherwise wrong paths on Windows (and wrong working directories), so file and cd operations fail.
+- **Action:** Resolve paths before use: search_files/ls to discover, forward-slash native paths for native tools, verify existence before read/cd.
+- **Evidence:** `default:20260828_165853_0ff9f889#2009`, `default:20260901_210256_6c1c52da#26668`, `default:20260830_140032_70edf88c#15170`, `default:20260918_124517_372cda#36420`
+
+### T04 — python runtime tracebacks  ·  P1 · effort S · owner: Agent behavior
+- **Signal:** 187 occurrences across 7 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** The agent writes Python (in execute_code and inline python) that throws syntax/name/shape errors, repeatedly burning turns on self-inflicted exceptions.
+- **Action:** Smaller execute_code snippets, print intermediates, validate before long batches; run project scripts from the package root / with PYTHONPATH.
+- **Evidence:** `default:20260830_100546_480c392f#9553`, `default:20260830_100546_480c392f#9762`, `default:20260830_100546_480c392f#10158`, `default:20260901_210256_6c1c52da#31880`
+
+### T07 — terminal background/notify misuse  ·  P1 · effort S · owner: Agent behavior
+- **Signal:** 105 occurrences across 7 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** The agent shells out with '&' or passes notify to foreground terminal calls instead of using the tool's background/notify parameters.
+- **Action:** Never use '&'/nohup/notify on foreground calls; use the terminal tool's background + notify_on_complete params.
+- **Evidence:** `default:20260828_132734_85f729e5#1434`, `default:20260830_140032_70edf88c#13074`, `default:20260829_095319_cc8f7496#3860`, `default:20260919_133653_cfea5b#37645`
+
+### T08 — patch old_string / escape drift  ·  P1 · effort S · owner: Agent behavior
+- **Signal:** 85 occurrences across 6 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** The agent calls patch without required args or with stale/whitespace-mismatched old_string, so edits silently fail to apply.
+- **Action:** Read the exact current region immediately before patching; copy a unique anchor; do not re-escape backslashes; prefer patch over full rewrite.
+- **Evidence:** `default:20260830_100546_480c392f#8180`, `default:20260830_100546_480c392f#10654`, `default:20260829_152634_04e12a4d#5620`, `default:20260909_075338_59a09d17#36333`
+
+### T10 — memory at capacity  ·  P1 · effort S · owner: Config (Tony)
+- **Signal:** 68 occurrences across 7 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** User memory is at its character limit and the agent submits invalid memory actions (None/view, replace without old_text).
+- **Action:** Raise the memory budget, or make the agent consolidate/evict before adding. Store is full and rejecting writes.
+- **Evidence:** `default:20260831_154908_9c27060c#22341`, `default:20260829_135124_84d145aa#5008`, `default:20260828_215950_6f0dd002#3185`, `default:20260919_150025_acc966#37911`
+
+### T13 — user friction (corrections)  ·  P1 · effort M · owner: Agent behavior
+- **Signal:** 32 occurrences across 7 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** The agent kept re-engaging/returning to the Thornhill project after the user repeatedly said to drop it, forcing ~20 identical corrections.
+- **Action:** Treat 'disregard X' as persistent for the session; verify mechanism/entity before asserting; enumerate+fix all on 'fix all' in one pass.
+- **Evidence:** `default:20260901_210256_6c1c52da#25862`, `default:20260901_210256_6c1c52da#26149`, `default:20260901_210256_6c1c52da#27075`, `default:20260830_100546_480c392f#10281`
+
+### T14 — tool_call batching / bridge misuse  ·  P1 · effort S · owner: Agent behavior
+- **Signal:** 27 occurrences across 6 finding(s) · profiles: jimmy, leonard
+- **Root cause:** Multiple or mixed local tool calls were submitted in a single tool_call batch.
+- **Action:** One local tool per tool_call entry; never route already-listed/bridge tools through tool_call; validate arg types.
+- **Evidence:** `jimmy:20261002_082642_504214#24650`, `jimmy:20260907_095044_75fc0e#6873`, `jimmy:20260907_102215_9626de50#7144`, `jimmy:20260907_210950_e5d3c500#8193`
+
+### T20 — cron jobs / reminders  ·  P1 · effort M · owner: Agent behavior
+- **Signal:** 17 occurrences across 2 finding(s) · profiles: default, leonard
+- **Root cause:** The agent uses unsupported cron actions ('stop'), wrong job identifiers, and absolute script paths, so cron management calls fail.
+- **Action:** Make recurring jobs report only on change; provide reliable stop-by-name; don't schedule reminders the user didn't ask for.
+- **Evidence:** `default:20260901_061717_10e875f4#24643`, `default:20260901_061717_10e875f4#24677`, `default:20260830_140032_70edf88c#15076`, `leonard:20260921_224902_f1884ecf#4658`
+
+### T27 — model/output identity errors  ·  P1 · effort S · owner: Agent behavior
+- **Signal:** 10 occurrences across 5 finding(s) · profiles: jimmy
+- **Root cause:** Name-only search matched the wrong Google Business Profile, producing an incorrect business identity before address verification.
+- **Action:** Verify proper nouns and Google Business Profile by address/place URL, not name-only search, before building an answer.
+- **Evidence:** `jimmy:20260903_131512_23f3ecc7#968`, `jimmy:20260905_120132_7fcffe#5034`, `jimmy:20260905_120132_7fcffe#5037`, `jimmy:20260910_201835_005658c2#10811`
+
+## P2
+
+### T05 — config key churn / bad subcommands  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 141 occurrences across 4 finding(s) · profiles: default, jimmy
+- **Root cause:** The agent runs POSIX tools (python3, dig, sshpass, expect) absent from the Windows bash, and emits cmd.exe/PowerShell syntax (taskkill, Restart-Service, quotes) that bash misparses.
+- **Action:** Check `hermes config show` before get/set; use only supported subcommands. (Rule may over-capture; re-scope before acting.)
+- **Evidence:** `default:20260901_210256_6c1c52da#27257`, `default:20260901_210256_6c1c52da#26102`, `default:20260830_140032_70edf88c#16099`, `default:20260829_135124_84d145aa#4310`
+
+### T09 — ripgrep / search_files  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 71 occurrences across 11 finding(s) · profiles: default, jimmy, leonard, verimail
+- **Root cause:** Search invoked with nonexistent/incorrect paths or patterns that ripgrep could not process.
+- **Action:** Escape/validate regex (or use literal mode); exclude cache/state-snapshot dirs and unreadable paths.
+- **Evidence:** `default:20260909_075338_59a09d17#36322`, `jimmy:20261002_225522_3a575121#25229`, `jimmy:20261004_213907_6161c54d#25757`, `jimmy:20261004_213907_6161c54d#25758`
+
+### T11 — skill description budget  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 61 occurrences across 7 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** The agent submits malformed skill_manage operations and references skill names that don't exist in the profile.
+- **Action:** Keep skill descriptions to one short trigger sentence within the budget.
+- **Evidence:** `default:20260901_111119_3fb7ce3f#25178`, `default:20260901_210256_6c1c52da#30612`, `default:20260829_152634_04e12a4d#5559`, `jimmy:20261002_082642_504214#24211`
+
+### T15 — skill_manage malformed / skill not found  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 27 occurrences across 6 finding(s) · profiles: jimmy
+- **Root cause:** Agent references skill names and linked files that no longer exist.
+- **Action:** Validate operations schema (name/action/frontmatter); list skills before referencing them.
+- **Evidence:** `jimmy:20260903_082924_ee9d9f9b#559`, `jimmy:20260903_082924_ee9d9f9b#698`, `jimmy:20260905_120132_7fcffe#4860`, `jimmy:20260905_120132_7fcffe#4864`
+
+### T16 — command not found  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 26 occurrences across 6 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** himalaya and python3 are not installed or not on the shell PATH in this environment (python3 reported missing system-wide).
+- **Action:** Probe with `command -v` first; on this Windows box use `python` not `python3`; avoid cmd/PowerShell-only tools in bash.
+- **Evidence:** `default:20260919_142434_7cb946#37817`, `default:20260919_150025_acc966#37918`, `default:20260919_150025_acc966#37955`, `jimmy:20260903_080446_2f43283a#462`
+
+### T19 — PowerShell/cmd syntax in bash  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 18 occurrences across 2 finding(s) · profiles: jimmy
+- **Root cause:** Complex quoting and PowerShell one-liners embedded in bash `eval` lines break on nested quotes/parentheses.
+- **Action:** Do not emit cmdlet/TASKKILL syntax into bash; translate to POSIX or invoke powershell.exe explicitly with correct quoting.
+- **Evidence:** `jimmy:20260915_111917_cc2921ae#15759`, `jimmy:20260912_065518_7410d52d#11756`, `jimmy:20260917_123729_e9614fe8#17162`, `jimmy:20260917_135440_f2b27db0#17407`
+
+### T21 — missing python module  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 15 occurrences across 3 finding(s) · profiles: jimmy
+- **Root cause:** Ad-hoc Python scripts assumed modules (yaml/ruamel.yaml) and internal APIs that were not present in the executing interpreter.
+- **Action:** Install/verify deps and run in the correct venv before invoking scripts.
+- **Evidence:** `jimmy:20261004_213907_6161c54d#25762`, `jimmy:20261004_213907_6161c54d#25864`, `jimmy:20261002_082642_504214#24692`, `jimmy:20260903_080446_2f43283a#466`
+
+### T23 — Hermes config write refused  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 14 occurrences across 3 finding(s) · profiles: jimmy
+- **Root cause:** Agent repeatedly reads Hermes credential stores and patches security-sensitive config files, which defense-in-depth blocks.
+- **Action:** Use `hermes config set`/`edit`; never patch config files directly.
+- **Evidence:** `jimmy:20260902_110459_eb6003#47`, `jimmy:20260903_082924_ee9d9f9b#527`, `jimmy:20260903_222951_274ed782#1993`, `jimmy:20260903_172646_b9fc938d#1794`
+
+### T24 — browser_exec / CDP hangs  ·  P2 · effort M · owner: Config
+- **Signal:** 13 occurrences across 2 finding(s) · profiles: jimmy, leonard
+- **Root cause:** Backslashes/spaces in Windows paths were stripped by shell quoting, producing invalid cwd/package names.
+- **Action:** Standardize Chrome launch with a fixed --remote-debugging-port; readiness-check the CDP endpoint; retry before failing.
+- **Evidence:** `jimmy:20260919_210613_826bba58#18854`, `jimmy:20260923_112841_2aedda1f#19705`, `jimmy:20260923_112841_2aedda1f#19760`, `jimmy:20260919_210613_826bba58#18865`
+
+### T25 — detector false positives  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 12 occurrences across 1 finding(s) · profiles: default
+- **Root cause:** The failure classifier matches on substrings inside otherwise-successful command output (env dumps, sent-message previews, file content), producing false-positive tool failures.
+- **Action:** (Miner already tightened.) Keep keying failures on explicit markers/exit codes, not error-like text in successful output.
+- **Evidence:** `default:20260918_141823_9eed89#36924`, `default:20260918_141823_9eed89#36972`, `default:20260919_142434_7cb946#37828`, `default:20260919_142434_7cb946#37843`
+
+### T26 — memory tool misuse  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 12 occurrences across 2 finding(s) · profiles: jimmy
+- **Root cause:** skill_manage ops are missing required content or descriptions exceed the frontmatter budget.
+- **Action:** Use valid actions + matching old_text; pass required fields; consolidate in the same batch.
+- **Evidence:** `jimmy:20260905_120132_7fcffe#4830`, `jimmy:20260905_120132_7fcffe#4834`, `jimmy:20260910_201835_005658c2#10663`, `jimmy:20260907_213044_a4748a#8098`
+
+### T28 — process_manage  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 10 occurrences across 2 finding(s) · profiles: jimmy
+- **Root cause:** A process(action='poll', ...) tool call is serialized into the terminal command stream instead of being dispatched as a tool.
+- **Action:** Capture background session_id before polling; re-list processes instead of reusing stale IDs.
+- **Evidence:** `jimmy:20260906_095449_6093b4#6458`, `jimmy:20260906_095449_6093b4#6474`, `jimmy:20260906_095449_6093b4#6466`, `jimmy:20260924_205652_a3b4ea51#20774`
+
+### T31 — unwanted voice / TTS  ·  P2 · effort S · owner: Config
+- **Signal:** 9 occurrences across 2 finding(s) · profiles: jimmy, leonard
+- **Root cause:** Audio output was produced/enabled by default and had to be manually stopped by the user.
+- **Action:** Default TTS to off in this profile, or confirm intent before emitting audio.
+- **Evidence:** `jimmy:20261002_225522_3a575121#25301`, `jimmy:20261003_161554_b72b50c7#25381`, `leonard:20260913_092836_48cdb0d8#888`, `leonard:20260913_092836_48cdb0d8#902`
+
+### T32 — shell quoting / eval errors  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 7 occurrences across 3 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** Multi-line/single-quoted shell commands are malformed, leaving unbalanced quotes that break bash parsing.
+- **Action:** Write scripts to a file instead of long inline quoted one-liners.
+- **Evidence:** `default:20260918_124517_372cda#36710`, `default:20260918_124517_372cda#36880`, `jimmy:20261002_082642_504214#23681`, `jimmy:20261002_225522_3a575121#25244`
+
+### T33 — Docker  ·  P2 · effort S · owner: Infra (Tony)
+- **Signal:** 6 occurrences across 2 finding(s) · profiles: jimmy, leonard
+- **Root cause:** Docker Desktop daemon was not reachable and compose/build configs were stale or used unsupported features.
+- **Action:** Start/verify Docker Desktop before builds; drop the obsolete compose `version` key.
+- **Evidence:** `jimmy:20260923_112841_2aedda1f#19707`, `jimmy:20260923_112841_2aedda1f#19725`, `jimmy:20260923_112841_2aedda1f#19703`, `jimmy:20260924_144306_45473ab6#20176`
+
+### T34 — vision_analyze  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 6 occurrences across 2 finding(s) · profiles: jimmy, leonard
+- **Root cause:** vision_analyze is called with a zero-area region [0,0,0,0] instead of valid pixel bounds.
+- **Action:** Pass a valid region (or omit for full image); route to a vision-capable provider.
+- **Evidence:** `jimmy:20260927_081444_46159a5f#21271`, `jimmy:20260927_081444_46159a5f#21272`, `jimmy:20260927_081444_46159a5f#21296`, `leonard:20260919_222213_f5f35580#4069`
+
+### T35 — write_file overwrite guard  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 4 occurrences across 1 finding(s) · profiles: jimmy
+- **Root cause:** The agent attempted full-file writes on files it had only partially read or never fully read, tripping the overwrite-safety guard.
+- **Action:** Read the full file (every page) or use `patch` before overwriting.
+- **Evidence:** `jimmy:20261002_225522_3a575121#25153`, `jimmy:20261002_225522_3a575121#25157`, `jimmy:20261005_221424_59c8c77f#25938`, `jimmy:20261005_221424_59c8c77f#25944`
+
+### T36 — secret/credential read refused  ·  P2 · effort S · owner: Agent behavior
+- **Signal:** 4 occurrences across 1 finding(s) · profiles: jimmy
+- **Root cause:** Required API keys were not present in the environment/credential store for the invoked provider or subcommand.
+- **Action:** Use provider tools / `hermes config`; never read .env or credential stores directly.
+- **Evidence:** `jimmy:20260924_140422_dca6ec#20045`, `jimmy:20260924_140422_dca6ec#20060`, `jimmy:20260924_140422_dca6ec#20043`, `jimmy:20260919_210613_826bba58#18975`
+
+## P3
+
+### T02 — generic exit codes  ·  P3 · effort S · owner: Noise
+- **Signal:** 444 occurrences across 8 finding(s) · profiles: default, jimmy, leonard
+- **Root cause:** Command exits with non-zero codes reported without a descriptive error message.
+- **Action:** Mostly signal noise (bare exit_code with no stderr). Capture stderr on non-zero exit; suppress in the delta.
+- **Evidence:** `default:20260828_144747_49a94d46#1619`, `default:20260828_201637_807fd2ff#2548`, `default:20260828_201637_807fd2ff#2643`, `jimmy:20260903_131512_23f3ecc7#983`
+
+### T37 — other  ·  P3 · effort S · owner: Noise
+- **Signal:** 2 occurrences across 1 finding(s) · profiles: leonard
+- **Root cause:** the agent misidentified its execution host (treated the machine as remote/other) when it was actually running on the user's own PC.
+- **Action:** Uncategorised single item; review if it recurs.
+- **Evidence:** `leonard:20260915_094133_975cbcdc#1713`, `leonard:20260915_094133_975cbcdc#1729`
+
+
+---
+
+## Status — 2026-10-06 "fix all" sweep
+
+**Fixed (behavioral, always-on):** T01 T03 T04 T07 T08 T13 T14 T19
+→ new `[DISCIPLINE]` memory rule + a "Defects confirmed by the 2026-08→10 trace backfill"
+block in the `hermes-windows-local-setup` skill (python3 vs python, cmd/PowerShell-in-bash,
+native paths, background long commands, patch/write_file guard).
+
+**Fixed (environment/memory accuracy):** T10 mitigated (memory consolidated 2196→2192/2200);
+stale tailnet identity corrected in memory (this box = `tonyb` @ 100.96.158.89, not
+`desktop-81cbtv2`).
+
+**Verified already resolved (live check):**
+- T30 memory_search / zg binary — `memory_search` returns hits; `zg_bin` correct.
+- T31 unwanted TTS — `voice.auto_tts: false` on disk.
+- T22 local model serve — gemma12 answering on `127.0.0.1:1923`.
+- T06 git remote/auth — `agent-os` origin correct, gitea HTTP 200, publish job `last_status: ok`.
+- T29 Telegram gateway — all platforms `connected` (was recurring historically; see below).
+
+**Open — needs Tony / investigation:**
+- T12 approval/consent block in unattended (-q / cron) runs → needs a non-interactive
+  allowlist/approval policy (config).
+- T18 uv trampoline permanent fix → edit `home` in the install venv `pyvenv.cfg`
+  (file change → approval). Workaround already documented in the skill.
+- T17 tailnet — peers offline (`desktop-81cbtv2*` 56/70d, `muse-1` 3d); node re-auth is manual.
+- T29 recurring Telegram gateway — root-cause in code; **do NOT add a watchdog** (the repo's
+  documented principle: fix the command, not the environment around it).
+- T10 deeper fix → raise `memory.memory_char_limit` 2200→3000 in `/hermes/config.yaml`
+  (global; affects all profiles) — one-line change, awaiting go.
+- T02 generic exit codes — noise bucket, monitored not fixed.