# Deterministic execution vs model inference

Implementable boundary so install/upgrade/policy never depend on model compliance and skills stay testable offline.

| Concern | Deterministic (code / CLI) | Inference (main or vision aux) |
|---------|----------------------------|--------------------------------|
| Install Docker, Compose, pins | Yes | No |
| `nemohermes onboard`, policy set, channels add, inference set, snapshot, rebuild | Yes | No |
| Provider/MCP process start, health probes | Yes | No |
| SaaS JSON → domain objects; stock thresholds; appointment gap math | Yes | No |
| Template fill for standard SMS/email skeletons | Yes | Optional paraphrase |
| “What’s important on my board today?” | Facts from tools | Ranking and wording |
| Draft tone in owner’s voice | Style pack constraints | Generation |
| Photo/video understanding | Media validation | Vision aux |
| Refuse pay / silent send / publish | OpenShell + skill hard fail | Model should refuse; not relied on alone |
| Confirm-to-remember persistence | Write only after structured confirm | Propose text to remember |
| Upgrade pull/migrate/recreate | Yes | No |
| Owner-facing “run this in a terminal” | **Forbidden** | SOUL/skills must not invent shell recipes |

Unit tests cover the deterministic column without a live model.