Hermes Fleet Ops

Last checked 13 Oct 2026Template updated 15 Sept 2026

HERDR-style multi-Mac Hermes fleet ops desk: keep Hermes updated, memory health fail-loud, homogenize hosts, Bitwarden fleet SSOT + .env scrub, HTTP :8642 orchestration connectors, Grok Bot computer update survival for Tailscale, Tailscale fleet macOS ops, optional DarkBloom provider ops. Sisters: API Fleet (:8642) and SSH Relay (Desktop-primary only).

Memories0Facts it already knows

Nothing listed yet.

Skills13Playbooks it can run

hermes-fleet-messaging-token-isolation

use this when documenting Hermes fleet Bitwarden secrets for messaging bots — never share one TELEGRAM_BOT_TOKEN across hosts; use TELEGRAM_BOT_TOKEN_<PROFILE> so Hermes auto-aliases per active profile

Hermes fleet BWS inventory

Use when inventorying or verifying Bitwarden Secrets Manager (bws) on Hermes Macs, or when API_SERVER_KEY/auth drifts — never assume every host has BWS.

Hermes HTTP-only talk path

Use when talking to fleet Hermes, wiring hermes-* connectors, or anytime SSH relay tempts as a fallback — SOLE PATH is HTTP :8642.

Wire Hermes native API

Use when an installer needs to enable Hermes :8642, verify health, or add a Tailscale-reachable hermes-<hostname> connector in Grok Bot.

hermes-bridge-method-chooser

Use when deciding between Hermes SSH Relay and Hermes API Fleet (:8642) for putting Hermes inside Grok Bot — fleet default is HTTP-only.

Paste to Hermes skill

Use when turning messy notes, an SOP, checklist, email thread, or playbook into a Hermes-ready SKILL.md — open paste-to-skill, Hermes flavor, install under ~/.hermes/skills/.

Fleet post-sprint hygiene

Use after Hermes/Grok sprints before DONE or marketplace Share→Update — clean orphan browsers, stuck CLI harnesses, leftover SSH ask paths; HTTP :8642 only; long jobs via /v1/runs when MCP ~120s times out.

herdr-delegate-troubleshooting

Use when HERDR must not burn Grok tokens on troubleshooting — delegate backend/admin/logs digs to a Hermes Fable 5.1 or Codex Astra session (Cursor cloud Codex for tip PRs).

desktop-v1-runs-escape

Use when a Grok connector ask to Desktop-primary Hermes dies around ~120s (-32001) — escape via host-local POST /v1/runs; not a fleet ask path.

inference-provider-relogin-cua

Use when Tier-A inference-provider-relogin already ran status/BWS/refresh and a provider still needs a single account-chooser click via CUA/vision (Safari preferred) — not for fresh Turnstile/passkey/device login.

Herdr remote Hermes ops

Use when editing Hermes/Herdr on fleet Macs over SSH — research-first, then skill, then act; backups, remote scripts, plugins/LCM, gateway, hermes-<hostname> Desktop-primary.

Grok Bot computer update survival (Tailscale)

Use when setting up Tailscale (or any installed tool, daemon, or key) on the Grok Bot computer, after a possible Computer Update/Reset, or when the bot can't reach tailnet hosts. Makes setup survive an update and self-restore with no human step.

Tailscale fleet macOS

Use when managing or recovering Tailscale fleet nodes (key expiry, Tailnet Lock, MagicDNS, ACL tags, system extension, greyed Remove in admin console, or Tailscale SSH between Hermes hosts).

Routines0Jobs that run on their own