Implement install stages S3–S5: package, policy, and skills sync.
Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.
This commit is contained in:
Ty
+49
-7
@@ -1,13 +1,55 @@
|
||||
# Hermes agent package (scaffold)
|
||||
# Hermes agent package
|
||||
|
||||
**Status:** Structure only until **build**.
|
||||
**Status:** Config fragments and manifest ready for S4–S5.
|
||||
|
||||
## Intended contents
|
||||
## Structure
|
||||
|
||||
| Path | Purpose |
|
||||
|------|---------|
|
||||
| `config/` | Onboard fragments (model, MCP, channels placeholders) |
|
||||
| `skills-manifest/` | Which Lumina skills ship with the profile |
|
||||
| Identity templates | SOUL / USER / assistant naming (Claire demo persona when implemented) |
|
||||
| `config/inference.yaml` | Inference config fragment (main + aux vision models) |
|
||||
| `config/mcp-servers.yaml` | MCP server config fragment (Square, QBO — enabled at S7) |
|
||||
| `config/channels.yaml` | Messaging channel config fragment (WhatsApp, Telegram, Email — enabled at S7) |
|
||||
| `skills-manifest/manifest.yaml` | Skills manifest listing all Lumina skills for sync |
|
||||
| `identity/assistant.yaml` | Identity template (name, role, capabilities, constraints) |
|
||||
|
||||
Onboard via `nemohermes onboard` using this package — never hand-edit in-sandbox config as SSOT.
|
||||
## Onboard modes
|
||||
|
||||
### Attach (default for UAT)
|
||||
|
||||
When the sandbox already exists (e.g., `hermes` on this host), S4 skips
|
||||
onboard and verifies the sandbox is healthy. Config fragments are used as
|
||||
reference only — the live config is managed by `nemohermes` sealed commands.
|
||||
|
||||
```bash
|
||||
# Attach mode: verify sandbox exists and is healthy
|
||||
nemohermes <name> status
|
||||
```
|
||||
|
||||
### Onboard (clean host)
|
||||
|
||||
On a fresh host, use `nemohermes onboard` with this agent package:
|
||||
|
||||
```bash
|
||||
# Onboard with agent package (dry-run first)
|
||||
nemohermes onboard --from-dir agents/hermes --dry-run
|
||||
|
||||
# Onboard for real
|
||||
nemohermes onboard --from-dir agents/hermes
|
||||
```
|
||||
|
||||
The onboard process:
|
||||
1. Creates the sandbox container
|
||||
2. Applies inference config from `.env`
|
||||
3. Registers the identity template
|
||||
4. Skills are synced separately in S5
|
||||
|
||||
## Platform-first
|
||||
|
||||
All config mutations use `nemohermes` sealed commands. Never hand-edit
|
||||
in-sandbox config as SSOT. The fragments in this directory are the
|
||||
product's source of truth for what gets configured.
|
||||
|
||||
## Design reference
|
||||
|
||||
- [design/DESIGN_PLAN.md §3](../../design/DESIGN_PLAN.md) — Hermes as NemoClaw-managed infrastructure
|
||||
- [design/DESIGN_PLAN.md §2](../../design/DESIGN_PLAN.md) — Host automation (no custom control API)
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
# agents/hermes/config/channels.yaml
|
||||
# Messaging channel config fragment for nemohermes onboard.
|
||||
#
|
||||
# Channels are registered via nemohermes <name> channels add, not by
|
||||
# hand-editing in-sandbox config. This file documents the planned channels.
|
||||
#
|
||||
# Platform-first: channel mutations use nemohermes <name> channels add/stop/start.
|
||||
|
||||
# Planned channels (enabled at S7 when connected):
|
||||
# - whatsapp
|
||||
# - telegram
|
||||
# - email
|
||||
|
||||
# Rules:
|
||||
# - Owner ↔ agent: full messaging
|
||||
# - Client outbound: draft-first only (no silent send/publish)
|
||||
@@ -0,0 +1,22 @@
|
||||
# agents/hermes/config/inference.yaml
|
||||
# Inference config fragment for nemohermes onboard.
|
||||
#
|
||||
# This fragment is merged into the sandbox's managed config during onboard.
|
||||
# Values are resolved from .env at install time.
|
||||
#
|
||||
# Platform-first: the actual config write is done by nemohermes inference set,
|
||||
# not by hand-editing in-sandbox files.
|
||||
|
||||
# Main model endpoint (OpenAI-compatible)
|
||||
# Resolved from LUMINA_INFERENCE_BASE_URL and LUMINA_INFERENCE_MODEL
|
||||
inference:
|
||||
provider: compatible-endpoint
|
||||
# model: set by nemohermes inference set from .env
|
||||
# base_url: set by nemohermes inference set from .env
|
||||
|
||||
# Auxiliary vision model
|
||||
# Resolved from LUMINA_VISION_MODEL
|
||||
auxiliary:
|
||||
vision:
|
||||
# model: set from LUMINA_VISION_MODEL (often same as main if multimodal)
|
||||
pass
|
||||
@@ -0,0 +1,40 @@
|
||||
# agents/hermes/config/mcp-servers.yaml
|
||||
# MCP server config fragment for nemohermes onboard.
|
||||
#
|
||||
# Lists MCP servers that may be registered at S7 (SaaS connections).
|
||||
# At S3–S5, this is a placeholder — no live MCP servers are configured.
|
||||
#
|
||||
# Platform-first: MCP registration is done via nemohermes <name> mcp add,
|
||||
# not by hand-editing in-sandbox config.
|
||||
|
||||
mcp_servers:
|
||||
# Square — remote MCP (enabled at S7 when connected)
|
||||
# - name: square
|
||||
# url: ${SQUARE_MCP_URL}
|
||||
# tools:
|
||||
# include:
|
||||
# - bookings.*
|
||||
# - customers.*
|
||||
# - catalog.*
|
||||
# - inventory.*
|
||||
# exclude:
|
||||
# - payments.*
|
||||
# - refunds.*
|
||||
# - cards.*
|
||||
# - checkout.*
|
||||
# - payouts.*
|
||||
|
||||
# QuickBooks Online — local MCP (enabled at S7 when connected)
|
||||
# - name: qbo
|
||||
# url: http://lumina-qbo-mcp:3000 # compose service
|
||||
# tools:
|
||||
# include:
|
||||
# - reports.*
|
||||
# - search.*
|
||||
# - get.*
|
||||
# exclude:
|
||||
# - create_payment.*
|
||||
# - bill_payment.*
|
||||
# - write.*
|
||||
# - update.*
|
||||
# - delete.*
|
||||
@@ -0,0 +1,30 @@
|
||||
# agents/hermes/identity/assistant.yaml
|
||||
# Lumina identity template — minimal, product-safe.
|
||||
#
|
||||
# This template defines the assistant's identity for the Hermes sandbox.
|
||||
# The owner's chosen name replaces the default at onboard time.
|
||||
#
|
||||
# Rules:
|
||||
# - Default name: "Lumina" (generic; owner renames at setup)
|
||||
# - No hardcoded persona details (demo "Claire" is a fixture, not identity)
|
||||
# - Owner name/profile persists across upgrades (volume-backed)
|
||||
|
||||
identity:
|
||||
# Default display name (overridden by owner at setup)
|
||||
name: Lumina
|
||||
# Role description
|
||||
role: "Salon and spa owner assistant"
|
||||
# Capabilities summary (used in intro messages)
|
||||
capabilities:
|
||||
- daily operations board
|
||||
- appointment availability
|
||||
- client management
|
||||
- books and finance overview
|
||||
- social media drafts
|
||||
- vendor communications
|
||||
# Safety constraints
|
||||
constraints:
|
||||
- draft-first outbound messaging
|
||||
- no agent payments
|
||||
- no silent send or publish
|
||||
- deterministic facts from tools; inference for wording only
|
||||
@@ -0,0 +1,82 @@
|
||||
# agents/hermes/skills-manifest/manifest.yaml
|
||||
# Lumina skills manifest — which skills ship with the Hermes profile.
|
||||
#
|
||||
# This manifest is used by the install script (S5) to determine which
|
||||
# skill directories to sync into the sandbox via nemohermes skill install.
|
||||
#
|
||||
# Skills are organized by domain. Each entry maps to a directory under
|
||||
# skills/ in the repository root.
|
||||
|
||||
skills:
|
||||
# ── Daily operations ──────────────────────────────────────────────────
|
||||
- name: daily-board
|
||||
domain: operations
|
||||
description: "Today's salon board: appointments, tasks, priorities"
|
||||
|
||||
- name: availability
|
||||
domain: operations
|
||||
description: "Check and display appointment availability"
|
||||
|
||||
- name: service-menu
|
||||
domain: operations
|
||||
description: "Service catalog and pricing"
|
||||
|
||||
- name: retail-stock
|
||||
domain: operations
|
||||
description: "Retail product inventory levels"
|
||||
|
||||
# ── Client management ─────────────────────────────────────────────────
|
||||
- name: client-card
|
||||
domain: clients
|
||||
description: "Client profile and history"
|
||||
|
||||
- name: draft-client-message
|
||||
domain: clients
|
||||
description: "Draft outbound messages to clients (draft-first)"
|
||||
|
||||
# ── Books / finance ───────────────────────────────────────────────────
|
||||
- name: books-snapshot
|
||||
domain: books
|
||||
description: "QuickBooks snapshot: P&L, balance, cash"
|
||||
|
||||
- name: ar-open-invoices
|
||||
domain: books
|
||||
description: "Accounts receivable: open invoices"
|
||||
|
||||
- name: ap-bills-due
|
||||
domain: books
|
||||
description: "Accounts payable: bills due"
|
||||
|
||||
- name: vendor-spend
|
||||
domain: books
|
||||
description: "Vendor spending summary"
|
||||
|
||||
- name: vendor-inbox
|
||||
domain: books
|
||||
description: "Vendor communications and documents"
|
||||
|
||||
- name: draft-invoice
|
||||
domain: books
|
||||
description: "Draft invoices for clients (draft-first)"
|
||||
|
||||
# ── Social / marketing ────────────────────────────────────────────────
|
||||
- name: social-draft
|
||||
domain: social
|
||||
description: "Draft social media posts (draft-first; vision aux)"
|
||||
|
||||
- name: weekly-digest
|
||||
domain: social
|
||||
description: "Weekly business digest for the owner"
|
||||
|
||||
# ── System ────────────────────────────────────────────────────────────
|
||||
- name: remember-forget
|
||||
domain: system
|
||||
description: "Confirm-to-remember persistence; forget entries"
|
||||
|
||||
- name: setup-education
|
||||
domain: system
|
||||
description: "Owner-safe connect education and capability report"
|
||||
|
||||
- name: publish-boundary-test
|
||||
domain: system
|
||||
description: "Boundary test: verify publish/send denials"
|
||||
Reference in New Issue
Block a user