From 4e0eafc9df099eef4bee09e6582c4324db7d55a3 Mon Sep 17 00:00:00 2001 From: Ty Date: Mon, 27 Jul 2026 16:07:31 +0000 Subject: [PATCH] docs: NemoClaw/Hermes platform research notes --- design/research/platform-notes.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 design/research/platform-notes.md diff --git a/design/research/platform-notes.md b/design/research/platform-notes.md new file mode 100644 index 0000000..fa9ed77 --- /dev/null +++ b/design/research/platform-notes.md @@ -0,0 +1,26 @@ +# Platform research notes (NemoClaw / Hermes) + +Normative links for implementers. Prefer platform-native operations over bespoke control planes. + +## NemoClaw + +- [Hermes architecture](https://docs.nvidia.com/nemoclaw/latest/user-guide/hermes/reference/architecture.md) — CLI, blueprint, OpenShell gateway, sandbox, L7 credential injection +- [Understand Runtime Changes](https://docs.nvidia.com/nemoclaw/latest/user-guide/hermes/manage-sandboxes/configure-sandboxes/understand-runtime-changes.md) — what hot-reloads vs rebuild +- [Manage Messaging Channels](https://docs.nvidia.com/nemoclaw/latest/user-guide/hermes/manage-sandboxes/messaging-channels/manage-messaging-channels) + +Key host commands: `nemohermes onboard`, `inference set`, `config set`, `policy-add`/`policy-remove`, `channels add`, `snapshot create`, `rebuild`, `shields up/down`, `gateway restart`. + +In-sandbox source of truth: `/sandbox/.hermes/config.yaml` + `.env` (trust-anchored; do not hand-edit expecting trust). + +## Hermes + +- [Security](https://hermes-agent.nousresearch.com/docs/user-guide/security) — write safety, approvals, gateway allowlists, MCP env filtering +- [Configuration](https://hermes-agent.nousresearch.com/docs/user-guide/configuration) +- [MCP config](https://hermes-agent.nousresearch.com/docs/reference/mcp-config-reference) — `tools.include` / `exclude` +- [Configuring Models](https://hermes-agent.nousresearch.com/docs/user-guide/configuring-models) — main + auxiliary (vision) + +File write safety blocks credential/`config.yaml` self-edits via agent tools. Mutations belong on the **host** via NemoClaw sealed commands. + +## Decision + +No parallel control API. Product scripts wrap `nemohermes` / `openshell` only.