What a profile is
A profile is a fully independentHERMES_HOME directory, holding its own
config, secrets file, persona, and skill set. A Kanban card selects it
through its assignee. There is one shared gateway, dispatcher, Kanban
board, and Slack bot per agent; no per-profile gateway service exists. A
profile is the entire tool/credential envelope a worker runs under, covering
MCP servers, native tools, secrets, and skills.
A profile’s config overrides the shared config; it does not merge with it.
A named profile that omits something the default profile has simply does not
get it. There is no fallback to the shared value. A job needing a tool must
have that tool named on its assignee’s profile, or the worker runs without it.
The isolation boundary is tools and credentials, not memory. Profiles of
one agent read and write the same memory bank. This is deliberate: it is what
lets a default-profile job recall a card’s findings after its assignee
moves. But it also means a narrowly scoped profile can still recall anything
any other profile of that bank ever wrote. Profile scoping is not a data
boundary.
The shared bank is the agent’s bank in the network memory provider, not the
per-directory files. It is keyed by the agent’s id, not sub-keyed by profile.
So a profile resolves to its agent’s bank unless its entry sets
memory_bank_id. The splunk-admin profile sets it, so every Splunk job
shares one Splunk bank. On the agent that owns the Splunk system, that bank is
the agent’s own bank.
The built-in MEMORY.md / USER.md files described in
Self-hosted AI agent live in each profile’s
own HERMES_HOME and are not the shared surface. Separate agents derive
separate banks and share nothing.
Kanban worker outcomes
Every Kanban worker run ends with exactly one terminal call: usekanban_complete when the task is done or kanban_block when it cannot
continue. If required access is missing or denied, block with
kind=needs_input and request that prerequisite. Keep the assigned profile and
identity; do not switch credentials. [SILENT] applies to cron delivery and
never replaces the terminal call. The kanban-lifecycle addendum ships under
soul/profiles/ in the nix-hermes bundle.
Current roster
Choosing a profile is the default action for new recurring work, not an advanced option.default is correct only for cross-domain, board-meta, or
write-bearing GitHub work.
The plugin names, their status, and the packaging rules are in the
Hermes plugins section.
github-maint is the one profile whose headline constraint is enforced by a
credential rather than by tool availability. Every write call fails at the API. Its output leaves through Slack and a
Kanban card, never a direct repository write.
Adding a new profile means scoping it by what it must not reach, not by
what it might someday need. A new capability is a new profile decision, not
a widened existing one.
See also
Self-hosted AI agent
The container, brain, and multi-agent picture this page sits underneath.