# Diagrams — Deep-Dive DD-08: Hermes — Layered Persistent Memory **Deep-Dive**: DD-08 — Hermes: Layered Persistent Memory **Diagram count**: 4 **Tool**: Mermaid (primary). Each diagram validated in [Mermaid Live Editor](https://mermaid.live). --- ## Diagram 1 — The Self-Evolving Skill Model **Type**: Compounding flow **Purpose**: The orientation diagram. Shows how a skill is born in one session, retrieved and reused in future sessions, and how each session compounds the skill store. This is the visual definition of "episodic memory that compounds" — the load-bearing property that makes Hermes the Module 4 reference. **Reading the diagram**: Three sessions in sequence. Session 1 writes a skill; the store persists it; Sessions 2 and 3 retrieve it and write additional skills. The skill store grows monotonically richer — each session leaves the agent more capable than the last. No other harness in the roster operates at this tier with curation and re-injection. ```mermaid flowchart TB S1["Session 1: agent learns\n'auth against internal API'"] -->|writes skill| STORE[("Persistent Skill Store")] STORE -->|available in future| S2["Session 2: skill auto-invoked"] STORE -->|compounds| S3["Session 3: more skills accumulated"] S2 -->|writes new skill| STORE S3 -->|writes new skill| STORE NOTE["Each session leaves the agent\nMORE CAPABLE than the last.\nThe deepest memory implementation\nin the roster — Module 4 tier 4 with write-back."] STORE --> NOTE style STORE fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4 style S1 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#e4e4e8 style S2 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#e4e4e8 style S3 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#e4e4e8 style NOTE fill:#08080c,stroke:#5eead4,color:#5eead4 ``` --- ## Diagram 2 — The Poisoning Surface (why depth is risk) **Type**: Attack-flow comparison **Purpose**: The load-bearing security diagram. Shows why the self-evolving skill store is the largest poisoning surface in the roster: a poisoned skill does not execute once — it activates on every future invocation. The compounding that makes skills valuable is the same compounding that makes poisoning dangerous. **Reading the diagram**: An attacker injects via an untrusted input that reaches the model. The model writes a poisoned skill to the store (model-initiated write — no gate). The poisoned skill activates on every future invocation of any similar task, compounding damage with no natural decay. Contrast against a poisoned working file (read once) — the asymmetry is the point. ```mermaid flowchart LR INJ["Attacker injects\nvia tool output / external input"] --> WRITE["Model writes POISONED SKILL\nto store (MODEL-INITIATED,\nno validation gate)"] WRITE --> STORE[("Skill Store")] STORE -->|activates on EVERY\nfuture invocation| COMPOUND["Compounding damage:\npayload fires repeatedly,\nrefines itself, spreads,\nno natural decay"] CONTRAST["Contrast: a poisoned WORKING FILE\nis read ONCE. A poisoned SKILL is\nretrieved on every similar future task.\nThe half-life is effectively unbounded."] COMPOUND --> CONTRAST style INJ fill:#08080c,stroke:rgba(240,128,128,0.4),color:#f08080 style WRITE fill:#08080c,stroke:rgba(240,128,128,0.4),color:#f08080 style STORE fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#f08080 style COMPOUND fill:#08080c,stroke:#f08080,color:#f08080 style CONTRAST fill:#08080c,stroke:#f0a868,color:#f0a868 ``` --- ## Diagram 3 — The NemoClaw Fix: Harness-Managed Write Gating **Type**: Two-track comparison (vulnerable vs hardened) **Purpose**: Shows the defense Hermes omits and NemoClaw (DD-09) provides. The write gate sits between the model's proposal and the persistent store — model proposes, harness validates, the poisoned skill is rejected. This is the single highest-value fix for Hermes's security posture. **Reading the diagram**: Top track = Hermes (model-initiated, no gate — poisoned skill persists). Bottom track = NemoClaw-style governance (model proposes, harness validates, poisoned skill rejected at the gate). The gate is the control that converts the compounding-poisoning surface into a compounding-capability surface with the risk closed. ```mermaid flowchart TB subgraph HERMES["HERMES — model-initiated writes (the gap)"] direction LR H1["Model decides\nto persist a skill"] --> H2["Write goes directly\nto store\n(NO GATE)"] H2 --> H3["Poisoned skill\npersists and compounds"] end subgraph NEMO["NEMOCLAW-STYLE — harness-managed writes (the fix)"] direction LR N1["Model PROPOSES\na skill"] --> N2["Harness VALIDATES\n(provenance, schema,\ntaint check)"] N2 -->|rejected| N3["Poisoned skill\nREJECTED at the gate"] N2 -->|approved| N4["Clean skill\npersists"] end PRINCIPLE["The gate is the difference between\ncompounding poisoning and compounding capability.\nModel proposes, harness validates — Module 4.3."] HERMES --> PRINCIPLE NEMO --> PRINCIPLE style HERMES fill:#14141f,stroke:rgba(240,128,128,0.5),color:#e4e4e8 style NEMO fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8 style H1 fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080 style H2 fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080 style H3 fill:#08080c,stroke:#f08080,color:#f08080 style N1 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4 style N2 fill:#08080c,stroke:rgba(94,234,212,0.4),color:#5eead4 style N3 fill:#08080c,stroke:#f0a868,color:#f0a868 style N4 fill:#08080c,stroke:rgba(130,224,170,0.4),color:#82e0aa style PRINCIPLE fill:#08080c,stroke:#5eead4,stroke-width:1.5px,color:#5eead4 ``` --- ## Diagram 4 — The Score Profile (depth-specialist shape) **Type**: Annotated bar profile **Purpose**: Shows the 36/60 as a profile, not a ranking. Hermes is maximum on Module 4 (Memory, 5/5) and below median on Modules 5 (Sandbox) and 6 (Permission). This is the expected shape of a harness that funds depth by sacrificing safety — read it as a depth-specialist's profile. **Reading the diagram**: The accent (teal) bar is Module 4 — the reference axis. The warn (orange) bars are Modules 5 and 6 — the sacrificed axes. The total is 36/60, but the *shape* is the point: a depth-specialist is not a low score, it is a score concentrated on one axis. ```mermaid flowchart LR M1["Module 1 Loop\n4/5"] --> M4 M2["Module 2 Tools\n4/5"] --> M4 M3["Module 3 Context\n4/5"] --> M4 M4["Module 4 Memory\n5/5 — REFERENCE"] --> M5 M5["Module 5 Sandbox\n2/5 — no container"] --> M6 M6["Module 6 Permission\n2/5 — model-initiated writes"] --> M7 M7["Modules 7-12\n3/5 avg"] --> TOTAL TOTAL["TOTAL: 36/60\nDepth-specialist shape:\nmax on one axis, below median\non the safety axes"] style M4 fill:#08080c,stroke:#5eead4,stroke-width:1.5px,color:#5eead4 style M5 fill:#08080c,stroke:#f0a868,color:#f0a868 style M6 fill:#08080c,stroke:#f0a868,color:#f0a868 style TOTAL fill:#08080c,stroke:#5eead4,stroke-width:1.5px,color:#5eead4 style M1 fill:#08080c,stroke:rgba(255,255,255,0.1),color:#9494a0 style M2 fill:#08080c,stroke:rgba(255,255,255,0.1),color:#9494a0 style M3 fill:#08080c,stroke:rgba(255,255,255,0.1),color:#9494a0 style M7 fill:#08080c,stroke:rgba(255,255,255,0.1),color:#9494a0 ``` --- ## Diagram 5 — Hermes Self-Evolving Skill Loop (n8n) **Type**: n8n workflow JSON **Purpose**: A runnable n8n workflow that models the self-evolving skill loop, including the model-initiated write risk. The executeCommand node writes the skill to the persistent store with no validation gate — the risk callout names the NemoClaw fix. **Reading the diagram**: Session start loads accumulated skills; the model reasons over task + skills; if a new skill is learned, it is written to the store (model-initiated, no gate). The notes flag the risk: a prompt-injected model can write a poisoned skill that compounds across future sessions. ```json { "name": "Hermes Self-Evolving Skills — DD-08", "nodes": [ { "parameters": { "assignments": { "assignments": [{ "id": "t", "name": "task", "value": "authenticate against internal API", "type": "string" },{ "id": "skills", "name": "existing_skills", "value": "[]", "type": "string" }]}, "options": {} }, "id": "init", "name": "Session Start (load skills)", "type": "n8n-nodes-base.set", "typeVersion": 3.4, "position": [160, 300], "notesInFlow": true, "notes": "Session start: load ALL accumulated skills from persistent store. This is Hermes's memory advantage." }, { "parameters": { "model": "gpt-4o-mini", "messages": "={{ [{role:'system',content:'You have these skills: ' + $json.existing_skills + '. Learn new procedures and write them as skills for future sessions.'},{role:'user',content:$json.task}] }}", "options": {} }, "id": "model", "name": "Model (task + skills)", "type": "@n8n/n8n-nodes-langchain.toolExecuteTool", "typeVersion": 1.1, "position": [400, 300] }, { "parameters": { "conditions": { "combinator": "any", "conditions": [{ "id": "newskill", "leftValue": "={{ $json.choices[0].message.content.includes('NEW SKILL:') }}", "rightValue": true, "operator": { "type": "boolean", "operation": "true" } }] } }, "id": "check", "name": "New skill learned?", "type": "n8n-nodes-base.if", "typeVersion": 2.2, "position": [640, 300], "notesInFlow": true, "notes": "Did the model learn a new procedure? If yes, write it to the persistent skill store." }, { "parameters": { "command": "={{ 'echo ' + '\"' + $json.choices[0].message.content + '\"' + ' >> /tmp/skills.jsonl' }}", "executeOnce": true }, "id": "write", "name": "Write Skill to Store (MODEL-INITIATED)", "type": "n8n-nodes-base.executeCommand", "typeVersion": 1, "position": [880, 200], "notesInFlow": true, "notes": "RISK: model-initiated write. No validation gate. A prompt-injected model can write a POISONED SKILL that compounds across future sessions. The NemoClaw fix: harness-managed writes (model proposes, harness validates)." }, { "parameters": { "content": "={{ JSON.stringify({ result: 'task done', skills_total: 'grown', security_note: 'model-initiated writes = poisoning surface (Module 4.3)' }) }}", "options": {} }, "id": "out", "name": "Output", "type": "n8n-nodes-base.respondToWebhook", "typeVersion": 1, "position": [1120, 300] } ], "connections": { "Session Start (load skills)": { "main": [ [ { "node": "Model (task + skills)", "type": "main", "index": 0 } ] ] }, "Model (task + skills)": { "main": [ [ { "node": "New skill learned?", "type": "main", "index": 0 } ] ] }, "New skill learned?": { "main": [ [ { "node": "Write Skill to Store (MODEL-INITIATED)", "type": "main", "index": 0 } ], [ { "node": "Output", "type": "main", "index": 0 } ] ] }, "Write Skill to Store (MODEL-INITIATED)": { "main": [ [ { "node": "Output", "type": "main", "index": 0 } ] ] } }, "settings": { "executionOrder": "v1" }, "meta": { "templateCreatedBy": "Harness Engineering Master Course — DD-08 Hermes" } } ``` --- ## Validation notes - All diagrams use the course design system colors: `#14141f` panel fill, `#08080c` deep background for nested nodes, `#5eead4` teal accent for the capability/reference surface and principle nodes, `#f0a868` warn for the contrast/risk-transitions, `#f08080` danger for the poisoning surface and impact. `#e4e4e8` / `#9494a0` for text. - Paste each Mermaid block into [Mermaid Live Editor](https://mermaid.live) to render. All use stable Mermaid syntax (`flowchart TB/LR`, `subgraph`) supported in current Mermaid (v10.4+). - The teal/warn/danger color coding is consistent across diagrams: teal = the capability surface (the feature); warn = the contrast and transitions; danger = the poisoning surface (the cost of the feature). This mapping is load-bearing — it lets the reader track which side of the feature/vulnerability tension a node belongs to.