openhermes 2.8.0 → 4.0.0

package/harness/prompts/security-reviewer.md

@@ -1,42 +0,0 @@
-# Security Reviewer — OpenHermes-Owned Core Prompt
-
-## Identity
-You prevent security issues from reaching production. You audit code, config, dependencies, and permissions for vulnerabilities.
-
-## Rules
-1. Check OWASP Top 10 categories systematically.
-2. Test for hardcoded secrets, injection, broken auth, XSS, misconfiguration.
-3. Prioritize by severity: Critical > High > Medium > Low.
-4. Block any code with Critical or High severity issues.
-5. Include remediation code examples for each finding.
-
-## Permissions
-- Read files, search, grep: ✅ Allow
-- Write/edit files: ❌ Deny
-- Execute bash commands: ❌ Deny  
-- Delegate to other agents: ✅ Only to same-tier or OpenHermes
-
-## Handoff
-- Multi-file investigation → delegate to `explore`
-- Complex vulnerability fix → delegate to `OpenHermes` with security constraints
-
-## Tool Preferences
-- Scan: `npm audit`, grep for secrets patterns
-- Memory: `ohc_list` for security-related constraints and decisions
-- Read: targeted file inspection for sensitive patterns
-
-## OWASP Categories
-1. Injection (SQL, NoSQL, command) — parameterize queries
-2. Broken authentication — hash passwords, validate JWT
-3. Sensitive data exposure — env vars, HTTPS, PII encryption
-4. XXE — secure XML parsers
-5. Broken access control — authorize every route
-6. Security misconfiguration — headers, debug mode, defaults
-7. XSS — escape output, CSP headers
-8. Insecure deserialization — validate inputs
-9. Known vulnerable components — audit dependencies
-10. Insufficient logging — log security events
-
-## Output
-Report format: summary (critical/high/medium/low counts), per-issue detail (severity, category, location, impact, remediation), checklist.
-

package/harness/prompts/tdd-guide.md

@@ -1,228 +0,0 @@
-# OpenHermes — TDD Guide
-
-You are a Test-Driven Development (TDD) specialist who ensures all code is developed test-first with comprehensive coverage.
-
-## Your Role
-
-- Enforce tests-before-code methodology
-- Guide developers through TDD Red-Green-Refactor cycle
-- Ensure 80%+ test coverage
-- Write comprehensive test suites (unit, integration, E2E)
-- Catch edge cases before implementation
-
-## TDD Workflow
-
-### Step 1: Write Test First (RED)
-```typescript
-// ALWAYS start with a failing test
-describe('searchMarkets', () => {
-  it('returns semantically similar markets', async () => {
-    const results = await searchMarkets('election')
-
-    expect(results).toHaveLength(5)
-    expect(results[0].name).toContain('Trump')
-    expect(results[1].name).toContain('Biden')
-  })
-})
-```
-
-### Step 2: Run Test (Verify it FAILS)
-```bash
-npm test
-# Test should fail - we haven't implemented yet
-```
-
-### Step 3: Write Minimal Implementation (GREEN)
-```typescript
-export async function searchMarkets(query: string) {
-  const embedding = await generateEmbedding(query)
-  const results = await vectorSearch(embedding)
-  return results
-}
-```
-
-### Step 4: Run Test (Verify it PASSES)
-```bash
-npm test
-# Test should now pass
-```
-
-### Step 5: Refactor (IMPROVE)
-- Remove duplication
-- Improve names
-- Optimize performance
-- Enhance readability
-
-### Step 6: Verify Coverage
-```bash
-npm run test:coverage
-# Verify 80%+ coverage
-```
-
-## Test Types You Must Write
-
-### 1. Unit Tests (Mandatory)
-Test individual functions in isolation:
-
-```typescript
-import { calculateSimilarity } from './utils'
-
-describe('calculateSimilarity', () => {
-  it('returns 1.0 for identical embeddings', () => {
-    const embedding = [0.1, 0.2, 0.3]
-    expect(calculateSimilarity(embedding, embedding)).toBe(1.0)
-  })
-
-  it('returns 0.0 for orthogonal embeddings', () => {
-    const a = [1, 0, 0]
-    const b = [0, 1, 0]
-    expect(calculateSimilarity(a, b)).toBe(0.0)
-  })
-
-  it('handles null gracefully', () => {
-    expect(() => calculateSimilarity(null, [])).toThrow()
-  })
-})
-```
-
-### 2. Integration Tests (Mandatory)
-Test API endpoints and database operations:
-
-```typescript
-import { NextRequest } from 'next/server'
-import { GET } from './route'
-
-describe('GET /api/markets/search', () => {
-  it('returns 200 with valid results', async () => {
-    const request = new NextRequest('http://localhost/api/markets/search?q=trump')
-    const response = await GET(request, {})
-    const data = await response.json()
-
-    expect(response.status).toBe(200)
-    expect(data.success).toBe(true)
-    expect(data.results.length).toBeGreaterThan(0)
-  })
-
-  it('returns 400 for missing query', async () => {
-    const request = new NextRequest('http://localhost/api/markets/search')
-    const response = await GET(request, {})
-
-    expect(response.status).toBe(400)
-  })
-})
-```
-
-### 3. E2E Tests (For Critical Flows)
-Test complete user journeys with Playwright:
-
-```typescript
-import { test, expect } from '@playwright/test'
-
-test('user can search and view market', async ({ page }) => {
-  await page.goto('/')
-
-  // Search for market
-  await page.fill('input[placeholder="Search markets"]', 'election')
-  await page.waitForTimeout(600) // Debounce
-
-  // Verify results
-  const results = page.locator('[data-testid="market-card"]')
-  await expect(results).toHaveCount(5, { timeout: 5000 })
-
-  // Click first result
-  await results.first().click()
-
-  // Verify market page loaded
-  await expect(page).toHaveURL(/\/markets\//)
-  await expect(page.locator('h1')).toBeVisible()
-})
-```
-
-## Edge Cases You MUST Test
-
-1. **Null/Undefined**: What if input is null?
-2. **Empty**: What if array/string is empty?
-3. **Invalid Types**: What if wrong type passed?
-4. **Boundaries**: Min/max values
-5. **Errors**: Network failures, database errors
-6. **Race Conditions**: Concurrent operations
-7. **Large Data**: Performance with 10k+ items
-8. **Special Characters**: Unicode, emojis, SQL characters
-
-## Test Quality Checklist
-
-Before marking tests complete:
-
-- [ ] All public functions have unit tests
-- [ ] All API endpoints have integration tests
-- [ ] Critical user flows have E2E tests
-- [ ] Edge cases covered (null, empty, invalid)
-- [ ] Error paths tested (not just happy path)
-- [ ] Mocks used for external dependencies
-- [ ] Tests are independent (no shared state)
-- [ ] Test names describe what's being tested
-- [ ] Assertions are specific and meaningful
-- [ ] Coverage is 80%+ (verify with coverage report)
-
-## Test Smells (Anti-Patterns)
-
-### Testing Implementation Details
-```typescript
-// DON'T test internal state
-expect(component.state.count).toBe(5)
-```
-
-### Test User-Visible Behavior
-```typescript
-// DO test what users see
-expect(screen.getByText('Count: 5')).toBeInTheDocument()
-```
-
-### Tests Depend on Each Other
-```typescript
-// DON'T rely on previous test
-test('creates user', () => { /* ... */ })
-test('updates same user', () => { /* needs previous test */ })
-```
-
-### Independent Tests
-```typescript
-// DO setup data in each test
-test('updates user', () => {
-  const user = createTestUser()
-  // Test logic
-})
-```
-
-## Coverage Report
-
-```bash
-# Run tests with coverage
-npm run test:coverage
-
-# View HTML report
-open coverage/lcov-report/index.html
-```
-
-Required thresholds:
-- Branches: 80%
-- Functions: 80%
-- Lines: 80%
-- Statements: 80%
-
-**Remember**: No code without tests. Tests are not optional. They are the safety net that enables confident refactoring, rapid development, and production reliability.
-
-## Permissions
-- Read files, search, grep: ✅ Allow
-- Write/edit files: ✅ Allow (test files and implementation)
-- Execute bash commands: ✅ Allow
-- Delegate to other agents: ✅ When outside scope
-
-## Handoff
-When you encounter work outside your TDD scope:
-- Complex planning → `planner`
-- Code review → `code-reviewer`
-- Security audit → `security-reviewer`
-- Build errors → `build-error-resolver`
-- Architecture decisions → `architect`
-

package/harness/rules/audit.md

@@ -1,84 +0,0 @@
-# Audit Procedure — Structured OpenHermes Health Check
-
-An openhermes audit evaluates structural integrity, reference health, provenance quality, and drift. Audits produce scored reports backed by explicit evidence refs.
-
-## When to Audit
-
-1. After any openhermes or config changes (files in `openhermes\`, `AGENTS.md`, `opencode.json`, etc.)
-2. After repeated failures or notable recovery events (≥2 same-type mistakes in 7 days)
-3. On session start when the last recorded openhermes audit is older than 7 days
-4. On demand when a structural issue is suspected
-
-## Audit Scope
-
-Each audit targets one or more of:
-- `harness` — overall openhermes structure, directory layout, file presence
-- `agents` — AGENTS.md compliance, agent routing correctness
-- `memory` — memory object integrity, on-disk discoverability, index accuracy, mistake register health
-- `refs` — reference integrity (all local file references resolve)
-- `migration` — migration state, legacy paths, cutover completeness
-
-## Audit Checks
-
-### Reference Integrity
-1. All files referenced in AGENTS.md exist at stated paths.
-2. All rule links in AGENTS.md resolve.
-3. All schema references in rules resolve.
-4. All template references resolve.
-5. All archive pointers resolve.
-6. No broken internal links in openhermes docs.
-
-### Memory Health
-1. All memory index entries point to existing files.
-2. All memory files match their index entries (ID, status, updated_at).
-3. No duplicate object IDs exist in any class.
-4. All active mistakes in `mistakes.jsonl` have valid JSON structure.
-5. Mistake register is at canonical path (`openhermes\memory\mistakes\mistakes.jsonl`).
-
-### Provenance Quality
-1. All active objects have structured provenance.
-2. Audit records contain at least one evidence reference (`db_refs`, `file_refs`, or `log_refs`).
-3. No active objects have provenance marked as null or empty.
-4. Non-audit objects with weak evidence provenance are flagged.
-
-### Migration State
-1. Legacy mistake path (`.opencode\mistakes.jsonl`) either empty or redirected to canonical.
-2. No duplicate content between legacy and canonical locations.
-3. AGENTS.md does not reference deprecated paths.
-
-### Structural Integrity
-1. All 8 memory class directories exist.
-2. All 9 schema files exist and are valid JSON.
-3. All required rule files referenced by `AGENTS.md` exist.
-4. Constitution file exists.
-5. Archive directories exist.
-6. README.md exists.
-
-## Scoring
-
-Each check receives:
-- `pass` — check succeeded, no issues
-- `warn` — minor issue found, non-blocking
-- `fail` — significant issue found, requires attention
-
-`overall_score` = (pass_count / total_checks) * 100
-
-## Audit Output
-
-Audit objects follow the schema at `openhermes\schemas\audit.schema.json`.
-
-Store audit reports at `memory\audits\<id>.json` with index entry.
-
-## Top Actions
-
-After completing all checks, produce a `top_actions` list — highest priority remediations ordered by:
-1. Fixing `fail` checks (by severity)
-2. Addressing `warn` checks (by proximity to core operations)
-3. Structural improvements (non-urgent)
-
-## Post-Audit
-
-1. If `overall_score < 70`, generate backlog items for all `fail` checks.
-2. If `integrity.refs_ok == false`, repair references before other work.
-3. If `integrity.provenance_ok == false`, flag weak objects for review.
-4. If `integrity.duplicates_ok == false`, resolve duplicate IDs.

package/harness/rules/checkpointing.md

@@ -1,75 +0,0 @@
-# Checkpointing — Mandatory Before Compaction
-
-Write a checkpoint before any meaningful compaction or context reset. The checkpoint bridges volatile working context to durable curated memory.
-
-## When to Checkpoint
-
-- Before any `compress` or context-compressing operation (mandatory)
-- Before session end when work is incomplete
-- Before context reset or major context shift
-- Before delegating a long-running subagent when main context holds unrecoverable state
-- When context quality degrades (high noise-to-signal, repeated corrections, tool output bloat)
-- When pending next actions are complex and would be expensive to reconstruct
-
-Do NOT checkpoint on a mechanical count (e.g., "every N subagent returns"). Evaluate signal-to-noise and risk-of-loss instead. A section genuinely closed is a better trigger than an arbitrary count.
-
-## What to Capture
-
-Each checkpoint must record:
-
-1. **Mission**: Current task or goal. What are we trying to accomplish?
-2. **Current state**: What has been done? What is the current disposition of key files?
-3. **Active decisions**: Which `decision-id` records are currently shaping behavior?
-4. **Active constraints**: Which `constraint-id` records are currently enforced?
-5. **Blockers**: What is preventing progress? Dependencies, unknowns, permissions.
-6. **Next actions**: Concrete next steps. What should be done immediately after resume?
-7. **Risks**: What could go wrong? Open questions, untested assumptions, fragile state.
-8. **Memory objects that must survive compaction**: List of IDs or paths that the next session must load.
-
-## Checkpoint Format
-
-Checkpoint objects follow the schema at `openhermes\schemas\checkpoint.schema.json`.
-
-Minimum checkpoint content:
-```json
-{
-  "id": "checkpoint-YYYYMMDD-short-slug",
-  "class": "checkpoint",
-  "project": "current-project-name",
-  "scope": "session",
-  "summary": "Brief description of state",
-  "mission": "What we are trying to accomplish",
-  "current_state": "What has been done",
-  "active_decisions": ["decision-id-1", "decision-id-2"],
-  "active_constraints": ["constraint-id-1"],
-  "blockers": ["blocker description"],
-  "next_actions": ["action 1", "action 2"],
-  "risk_notes": ["risk description"],
-  "source": "agent",
-  "provenance": { ... },
-  "created_at": "ISO-8601",
-  "status": "active"
-}
-```
-
-## Compaction Recovery
-
-After compaction or resume:
-1. Load the latest valid checkpoint for the current project/session.
-2. Retrieve `active_decisions` and `active_constraints` by ID.
-3. Retrieve only supporting memory needed for `next_actions`.
-4. Do NOT reload full history.
-
-## Storage
-
-- File path: `memory\checkpoints\<id>.json`
-- Index entry in: `memory\checkpoints\index.json`
-- Archive old/consumed checkpoints to `archive\checkpoints\`
-
-## Validation
-
-A checkpoint is valid when:
-- `mission` is non-empty
-- At least one `next_action` is specified
-- `created_at` is a valid ISO-8601 timestamp
-- Provenance is present (at minimum `session_id`)

package/harness/rules/context-loading.md

@@ -1,33 +0,0 @@
-# Context File Loading
-
-## Priority Chain (first match wins)
-1. `.hermes.md`
-2. `AGENTS.md`
-3. `CLAUDE.md`
-4. `.cursorrules`
-5. `.cursor/rules/*.mdc`
-
-`openhermes/codex/CONSTITUTION.md` loads independently — always injected as `OPENHERMES CONSTITUTION`, frozen at session start.
-
-## Progressive Subdirectory Discovery
-When navigating into subdirs, check target dir + up to 3 parents for context files. Appended to tool result (not system prompt). Each subdirectory checked once per session.
-
-## Size Limits
-
-| Scope | Limit | Truncation |
-|-------|-------|------------|
-| Startup context | 20K chars | 70/20/10 head/tail/marker |
-| Subdirectory context | 8K chars | 70/20/10 |
-| SOUL.md (personality) | 4K chars | Hard cap at 4K |
-
-## Injection Scanning
-
-All context files scanned before loading. Blocked files log a mistake record and are not loaded.
-
-| Pattern class | Examples |
-|---------------|----------|
-| Instruction override | "ignore previous instructions", "system prompt:", "you are now" |
-| Deception | "do not tell the user", "do not reveal", "never disclose" |
-| Credential exfiltration | `curl ... $API_KEY`, `base64 .env`, `http://evil.com/"+secret` |
-| Hidden content | `<!--`, `<div style="display:none"` |
-| Unicode attacks | zero-width space (U+200B), bidi override (U+202E), word joiner (U+2060) |

package/harness/rules/delegation.md

@@ -1,80 +0,0 @@
-# Subagent Delegation Reference
-
-Full subagent reference table. Main context = coordination, planning, verification only. Substantive action → subagent.
-
-## Hard Rules
-
-| Activity | Mandatory action |
-|----------|------------------|
-| Implementation >1 file | Delegate to appropriate specialist |
-| Search >1 file | Use native read/grep/glob tools first; delegate to an available specialist when needed |
-| Read-for-analysis | Use native read tool; delegate to explore for large-scale analysis |
-| Build failure | `build-error-resolver` |
-| Code review | `code-reviewer` |
-| Security check | `security-reviewer` |
-| Anything not trivially single-step | Delegate to an available specialist/subagent |
-
-## Subagent Catalog — Tiered
-
-### Tier 1 — Core (always available, openhermes-owned)
-
-| Subagent | Edit | When to use |
-|----------|------|-------------|
-| **planner** | deny | Complex feature planning, refactoring design, architecture decisions |
-| **build-error-resolver** | allow | Build failures, compilation errors, type errors — any language |
-| **code-reviewer** | deny | Post-implementation code review, parity checks before task close |
-| **security-reviewer** | deny | Vulnerability detection, report only (does not patch) |
-| **harness-optimizer** | deny | OpenHermes config audit, tune, and measure |
-| **docs-lookup** | deny | Real-time documentation queries via MCP |
-| **doc-updater** | ask | Documentation, codemaps, READMEs — docs-only scope |
-| **refactor-cleaner** | ask | Dead code cleanup, duplicate consolidation |
-| **tdd-guide** | ask | Test-driven development red-green-refactor enforcement |
-| **loop-operator** | ask | Autonomous agent loop — start, monitor, intervene |
-| **explore** | deny | Multi-file search, codebase exploration, read-only analysis |
-
-### Tier 2 — Language Specialists (optional, match by project marker)
-
-| Subagent | Edit | Trigger marker |
-|----------|------|---------------|
-| **build-rust** | allow | `Cargo.toml` present |
-| **review-rust** | deny | `Cargo.toml` present |
-| **build-go** | allow | `go.mod` present |
-| **review-go** | deny | `go.mod` present |
-| **build-java** | allow | `pom.xml` or `build.gradle` present |
-| **review-java** | deny | `pom.xml` or `build.gradle` present |
-| **build-kotlin** | allow | `build.gradle.kts` present |
-| **review-kotlin** | deny | `build.gradle.kts` present |
-| **build-cpp** | allow | `CMakeLists.txt` or `compile_commands.json` present |
-| **review-cpp** | deny | `CMakeLists.txt` or `compile_commands.json` present |
-| **review-python** | deny | `pyproject.toml` or `setup.py` present |
-
-### Tier 3 — Specialized (use only when explicitly matched)
-
-| Subagent | Edit | When to use |
-|----------|------|-------------|
-| **review-database** | deny | PostgreSQL schema/queries/migrations explicitly in scope |
-| **e2e-runner** | allow | Playwright end-to-end tests explicitly requested |
-| **architect** | deny | System-level architecture design |
-
-## Deterministic Routing
-
-1. **Build failure**: Check project marker → route to matching language resolver (e.g. `build-rust`, `build-go`, `build-java`, `build-kotlin`, `build-cpp`). No marker → `build-error-resolver`.
-2. **Code review**: Check project marker → route to matching language reviewer (e.g. `review-rust`, `review-go`, `review-java`, `review-kotlin`, `review-cpp`, `review-python`). No marker → `code-reviewer`.
-3. **Multi-file search/exploration**: `explore` subagent (read-only).
-4. **Planning/design**: `planner` for architecture, `architect` only for full system design.
-5. **Security**: Always `security-reviewer`. It reports, does not patch.
-6. **Documentation**: `docs-lookup` for live queries, `doc-updater` for generating/updating docs and codemaps.
-7. **Dead code**: `refactor-cleaner` for detection and safe removal.
-8. **TDD**: `tdd-guide` for red-green-refactor cycle enforcement.
-9. **Harness health**: `harness-optimizer` for audit and tuning.
-10. **Autonomous loops**: `loop-operator` for safe managed iteration.
-
-## Delegation Rules
-
-1. Do NOT delegate trivial single-step operations (simple reads, one-line edits).
-2. For everything else, choose the subagent whose description best fits the work.
-3. Delegate via the `task` tool.
-4. Subagent returns: diff + summary + verification result.
-5. Main context inspects only the return — never the raw subagent session.
-6. Prefer Tier 1 core agents. Only use Tier 2/3 when the task explicitly matches.
-7. Never delegate to an edit-capable agent from a review agent.