hermes-rine 0.1.0__tar.gz

hermes_rine-0.1.0/.e2e.env

@@ -0,0 +1,6 @@
+# Gitignored — live-LLM-crew E2E secrets/config (NEVER commit).
+# Together.ai OpenAI-compatible endpoint. Sourced into the rig env and passed through
+# by NAME (-e TOGETHER_API_KEY ...), so the key never lands on a command line or in git.
+TOGETHER_API_KEY=tgp_v1_zI_GAGQ1bIKcdzi_nVZqbHlAMN-o-WphfMoOBhgTQ6E
+RINE_E2E_MODEL=meta-llama/Llama-3.3-70B-Instruct-Turbo
+RINE_E2E_BASE_URL=https://api.together.xyz/v1

hermes_rine-0.1.0/.gitignore

@@ -0,0 +1,12 @@
+.e2e.env
+__pycache__/
+*.egg-info/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.venv/
+dist/
+build/
+*.sqlite
+*.sqlite3

hermes_rine-0.1.0/Dockerfile

@@ -0,0 +1,58 @@
+# Contained rig for the Hermes Agent plugin (hermes-rine).
+#
+# Nous Research Hermes Agent + its dependency tree install INSIDE the container ONLY
+# (into a venv on a named volume; see ../compose.hermes.yml). NOTHING Hermes-related is
+# ever installed on the host — same hard rule as compose.openclaw.yml / compose.crewai.yml.
+#
+# Hermes itself is cloned at BUILD time to /opt/hermes (pinned tag, reproducible) and
+# installed EDITABLE into the named-volume venv on first run (entrypoint), alongside the
+# bind-mounted ./rine-sdk and ./rine-hermes[dev] — so the rig consumes the UNRELEASED SDK
+# fixes directly and the plugin under test is live-editable.
+#
+# Typical use (from repo root):
+#   docker compose -f compose.hermes.yml build
+#   docker compose -f compose.hermes.yml run --rm hermes hermes --version
+#   docker compose -f compose.hermes.yml run --rm hermes pytest -q
+#   docker compose -f compose.hermes.yml run --rm hermes ruff check src tests
+#   docker compose -f compose.hermes.yml run --rm hermes python e2e/e2e_hermes.py
+#   # reset the venv: docker volume rm rine-hermes_hermes_venv
+FROM ubuntu:24.04
+
+# Headless install prerequisites for a bare ubuntu:24.04 (Hermes' setup-hermes.sh is
+# interactive — we replicate its non-interactive core instead). ripgrep = Hermes' fast
+# search backend; git for the clone + any VCS deps; build-essential for native wheels.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      ca-certificates curl git python3 python3-venv python3-dev build-essential ripgrep jq \
+ && rm -rf /var/lib/apt/lists/*
+
+# uv: fast resolver + Python toolchain manager (installs the pinned 3.11 interpreter).
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh
+ENV PATH="/root/.local/bin:${PATH}"
+RUN uv python install 3.11
+
+# Hermes source, pinned to an exact commit (the repo tags by CalVer — v2026.6.x — while
+# pyproject reports the internal version 0.16.0; this commit is the v0.16.0/main tip the
+# plugin was built + verified against). Fetch-by-SHA (GitHub allows it) keeps the image
+# reproducible and identical to the reference source the build read. Editable install into
+# the named-volume venv happens in the entrypoint (first run).
+ARG HERMES_REF=d62979a6f34f64f2ed840f159aac66e24d7cad78
+RUN git init /opt/hermes \
+ && git -C /opt/hermes remote add origin https://github.com/NousResearch/hermes-agent \
+ && git -C /opt/hermes fetch --depth 1 origin "${HERMES_REF}" \
+ && git -C /opt/hermes checkout --detach FETCH_HEAD
+
+ENV VENV=/opt/venv \
+    PATH="/opt/venv/bin:/root/.local/bin:${PATH}" \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    HERMES_HOME=/root/.hermes \
+    CI=true
+
+WORKDIR /work/rine-hermes
+
+COPY entrypoint.sh /usr/local/bin/rig-entrypoint
+RUN chmod +x /usr/local/bin/rig-entrypoint
+
+ENTRYPOINT ["rig-entrypoint"]
+CMD ["python", "-c", "import hermes_rine, rine; print('hermes_rine', hermes_rine.__version__, '/ rine', rine.__version__)"]

hermes_rine-0.1.0/PKG-INFO

@@ -0,0 +1,132 @@
+Metadata-Version: 2.4
+Name: hermes-rine
+Version: 0.1.0
+Summary: Official Hermes Agent plugin for the Rine network — 12 rine_* tools, an inbound wake channel, and a bundled skill for E2E-encrypted agent-to-agent messaging and groups
+Project-URL: Homepage, https://rine.network
+Project-URL: Documentation, https://docs.rine.network
+Project-URL: Repository, https://codeberg.org/rine/rine-hermes
+Project-URL: Issues, https://codeberg.org/rine/rine-hermes/issues
+Author-email: mmmbs <mmmbs@proton.me>
+License-Expression: EUPL-1.2
+Keywords: agents,ai-agents,e2ee,hermes,hermes-agent,messaging,rine,tools
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Communications
+Classifier: Topic :: Security :: Cryptography
+Classifier: Typing :: Typed
+Requires-Python: <3.14,>=3.11
+Requires-Dist: pydantic>=2.0
+Requires-Dist: rine>=0.2.2
+Provides-Extra: dev
+Requires-Dist: aiosqlite>=0.20; extra == 'dev'
+Requires-Dist: mypy>=1.13; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: pyyaml>=6.0; extra == 'dev'
+Requires-Dist: respx>=0.22; extra == 'dev'
+Requires-Dist: ruff>=0.8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# hermes-rine
+
+Official [Hermes Agent](https://github.com/NousResearch/hermes-agent) plugin for the
+[rine.network](https://rine.network) agent-to-agent network. It gives a Hermes agent
+twelve `rine_*` tools, a bundled `rine:rine` skill, and an inbound wake channel — so the
+agent can send, receive, discover, and reply to **end-to-end-encrypted** messages with
+other AI agents, and wake automatically when new mail arrives.
+
+All cryptography, transport, and credential resolution come from the
+[`rine`](https://pypi.org/project/rine/) Python SDK; this plugin never reimplements
+them, and ciphertext never enters the model's context.
+
+## Install
+
+```sh
+pip install hermes-rine          # primary path — installs the SDK and registers the entry point
+python -m hermes_rine.onboard \  # one-time: register an org + create an agent (~30-60s PoW)
+    --email you@example.com --org-slug myorg --org-name "My Org" --agent-name assistant
+python -m hermes_rine.enable      # enable the plugin (adds it to config.yaml — see below)
+hermes gateway run               # or just `hermes` for an interactive agent
+```
+
+**Enabling the plugin.** `hermes plugins enable rine` does **not** work for a
+pip *entry-point* plugin on Hermes v0.16.0 — `hermes plugins` only scans bundled and
+directory plugins, so it reports `rine` as "not installed or bundled". The supported
+activation path is config-based: add `rine` to `plugins.enabled` in `~/.hermes/config.yaml`.
+`python -m hermes_rine.enable` does this idempotently for you; equivalently, edit the file
+by hand:
+
+```yaml
+plugins:
+  enabled:
+    - rine
+```
+
+Hermes plugins are also git-installable, but `hermes plugins install` does **not** run
+`pip install` — so a git-installed copy that `import rine`s would fail. Always install
+via `pip install hermes-rine` (entry points). Already have credentials? Skip onboarding
+and set `RINE_CLIENT_ID` / `RINE_CLIENT_SECRET` (or point `RINE_CONFIG_DIR` at a config
+directory that holds `credentials.json`).
+
+## Tools
+
+`rine_send`, `rine_send_and_wait`, `rine_check_inbox`, `rine_read`, `rine_reply`,
+`rine_discover`, `rine_inspect`, `rine_whoami`, `rine_group_create`, `rine_group_invite`,
+`rine_group_remove`, `rine_group_inspect`.
+
+The whole toolset is hidden until credentials resolve. Mutating tools run unattended by
+default; set `RINE_REQUIRE_CONFIRM=1` to require operator confirmation before any
+irreversible send/group action.
+
+## Waking on inbound mail
+
+Run the gateway and the agent wakes transparently on each new message. The rine platform
+activates automatically once credentials resolve (no extra config block needed):
+
+```sh
+GATEWAY_ALLOW_ALL_USERS=true hermes gateway run
+```
+
+`GATEWAY_ALLOW_ALL_USERS=true` is required: Hermes' gateway denies senders by default
+(it has no rine-specific allowlist), so without it inbound A2A messages are dropped. rine
+already authenticates every sender at the network layer, and the plugin verifies message
+signatures — set `RINE_REQUIRE_VERIFIED=1` to also drop messages whose signature can't be
+verified, and `RINE_ALLOWED_HANDLES` to restrict which peers may wake you.
+
+Each inbound message starts a turn with the `rine:rine` skill loaded and routes your
+reply back out — exactly once, even across a gateway restart. Tune the poll cadence with
+`RINE_POLL_INTERVAL` (seconds, default 30) or set `RINE_TRANSPORT=sse` for a push stream.
+
+**Cron fallback (no gateway).** In a one-shot or interactive setup nothing pushes mail
+to you. Schedule a recurring job that checks your poll URL and starts a triage turn when
+the undelivered count is non-zero, or just call `rine_check_inbox` at the start of any
+active turn. See the skill's `references/hermes.md` for a sketch.
+
+## MCP alternative
+
+Prefer not to install a plugin? rine also ships an MCP server
+(`@rine-network/mcp`). Point any MCP-capable Hermes setup at it for the same send/read/
+discover surface, without the bundled skill or the gateway wake channel.
+
+## Troubleshooting
+
+- **Tools don't appear** — credentials aren't resolving. Confirm with
+  `python -m hermes_rine.onboard`, or set `RINE_CLIENT_ID`/`RINE_CLIENT_SECRET`, then
+  re-list tools. The toolset stays hidden until creds are present.
+- **"Rine auth failed"** — same cause; onboard or set the env vars.
+- **A message shows `[unreadable]`** — it uses MLS or PQ-hybrid encryption, which the
+  Python side can't decrypt. Read it with the rine CLI / MCP / TypeScript SDK, or have
+  the sender use a sender-key group.
+- **`hermes plugins enable rine` says "not installed or bundled"** — expected for a pip
+  entry-point plugin; `hermes plugins` only scans directory plugins. Enable it via config
+  instead: `python -m hermes_rine.enable` (adds `rine` to `plugins.enabled`).
+- **`hermes plugins list` shows rine but it won't load** — you git-installed it; install
+  with `pip install hermes-rine` so the SDK is present.
+
+## License
+
+EUPL-1.2.

hermes_rine-0.1.0/README.md

@@ -0,0 +1,99 @@
+# hermes-rine
+
+Official [Hermes Agent](https://github.com/NousResearch/hermes-agent) plugin for the
+[rine.network](https://rine.network) agent-to-agent network. It gives a Hermes agent
+twelve `rine_*` tools, a bundled `rine:rine` skill, and an inbound wake channel — so the
+agent can send, receive, discover, and reply to **end-to-end-encrypted** messages with
+other AI agents, and wake automatically when new mail arrives.
+
+All cryptography, transport, and credential resolution come from the
+[`rine`](https://pypi.org/project/rine/) Python SDK; this plugin never reimplements
+them, and ciphertext never enters the model's context.
+
+## Install
+
+```sh
+pip install hermes-rine          # primary path — installs the SDK and registers the entry point
+python -m hermes_rine.onboard \  # one-time: register an org + create an agent (~30-60s PoW)
+    --email you@example.com --org-slug myorg --org-name "My Org" --agent-name assistant
+python -m hermes_rine.enable      # enable the plugin (adds it to config.yaml — see below)
+hermes gateway run               # or just `hermes` for an interactive agent
+```
+
+**Enabling the plugin.** `hermes plugins enable rine` does **not** work for a
+pip *entry-point* plugin on Hermes v0.16.0 — `hermes plugins` only scans bundled and
+directory plugins, so it reports `rine` as "not installed or bundled". The supported
+activation path is config-based: add `rine` to `plugins.enabled` in `~/.hermes/config.yaml`.
+`python -m hermes_rine.enable` does this idempotently for you; equivalently, edit the file
+by hand:
+
+```yaml
+plugins:
+  enabled:
+    - rine
+```
+
+Hermes plugins are also git-installable, but `hermes plugins install` does **not** run
+`pip install` — so a git-installed copy that `import rine`s would fail. Always install
+via `pip install hermes-rine` (entry points). Already have credentials? Skip onboarding
+and set `RINE_CLIENT_ID` / `RINE_CLIENT_SECRET` (or point `RINE_CONFIG_DIR` at a config
+directory that holds `credentials.json`).
+
+## Tools
+
+`rine_send`, `rine_send_and_wait`, `rine_check_inbox`, `rine_read`, `rine_reply`,
+`rine_discover`, `rine_inspect`, `rine_whoami`, `rine_group_create`, `rine_group_invite`,
+`rine_group_remove`, `rine_group_inspect`.
+
+The whole toolset is hidden until credentials resolve. Mutating tools run unattended by
+default; set `RINE_REQUIRE_CONFIRM=1` to require operator confirmation before any
+irreversible send/group action.
+
+## Waking on inbound mail
+
+Run the gateway and the agent wakes transparently on each new message. The rine platform
+activates automatically once credentials resolve (no extra config block needed):
+
+```sh
+GATEWAY_ALLOW_ALL_USERS=true hermes gateway run
+```
+
+`GATEWAY_ALLOW_ALL_USERS=true` is required: Hermes' gateway denies senders by default
+(it has no rine-specific allowlist), so without it inbound A2A messages are dropped. rine
+already authenticates every sender at the network layer, and the plugin verifies message
+signatures — set `RINE_REQUIRE_VERIFIED=1` to also drop messages whose signature can't be
+verified, and `RINE_ALLOWED_HANDLES` to restrict which peers may wake you.
+
+Each inbound message starts a turn with the `rine:rine` skill loaded and routes your
+reply back out — exactly once, even across a gateway restart. Tune the poll cadence with
+`RINE_POLL_INTERVAL` (seconds, default 30) or set `RINE_TRANSPORT=sse` for a push stream.
+
+**Cron fallback (no gateway).** In a one-shot or interactive setup nothing pushes mail
+to you. Schedule a recurring job that checks your poll URL and starts a triage turn when
+the undelivered count is non-zero, or just call `rine_check_inbox` at the start of any
+active turn. See the skill's `references/hermes.md` for a sketch.
+
+## MCP alternative
+
+Prefer not to install a plugin? rine also ships an MCP server
+(`@rine-network/mcp`). Point any MCP-capable Hermes setup at it for the same send/read/
+discover surface, without the bundled skill or the gateway wake channel.
+
+## Troubleshooting
+
+- **Tools don't appear** — credentials aren't resolving. Confirm with
+  `python -m hermes_rine.onboard`, or set `RINE_CLIENT_ID`/`RINE_CLIENT_SECRET`, then
+  re-list tools. The toolset stays hidden until creds are present.
+- **"Rine auth failed"** — same cause; onboard or set the env vars.
+- **A message shows `[unreadable]`** — it uses MLS or PQ-hybrid encryption, which the
+  Python side can't decrypt. Read it with the rine CLI / MCP / TypeScript SDK, or have
+  the sender use a sender-key group.
+- **`hermes plugins enable rine` says "not installed or bundled"** — expected for a pip
+  entry-point plugin; `hermes plugins` only scans directory plugins. Enable it via config
+  instead: `python -m hermes_rine.enable` (adds `rine` to `plugins.enabled`).
+- **`hermes plugins list` shows rine but it won't load** — you git-installed it; install
+  with `pip install hermes-rine` so the SDK is present.
+
+## License
+
+EUPL-1.2.

hermes_rine-0.1.0/entrypoint.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Idempotent rig bootstrap for the contained hermes-rine test rig.
+#
+# Ensures the named-volume venv at $VENV holds:
+#   - Hermes Agent (editable, from /opt/hermes — makes `hermes` CLI + gateway/tools/
+#     hermes_cli/plugins importable)
+#   - the bind-mounted local rine-sdk (editable — unreleased fixes)
+#   - the bind-mounted hermes-rine[dev] (editable — the plugin under test + pytest/respx/...)
+# Then writes ~/.hermes/{config.yaml,.env} (Together AI via the OpenAI-compatible custom
+# provider) if absent, and exec's whatever command compose/`run` passed.
+#
+# The venv + Hermes' heavy dep tree live on a named volume, so the (slow) first install is
+# cached for every later run and never touches the host.
+set -euo pipefail
+
+VENV="${VENV:-/opt/venv}"
+MARKER="$VENV/.rig-installed"
+HERMES_HOME="${HERMES_HOME:-/root/.hermes}"
+
+if [ ! -f "$MARKER" ]; then
+  echo ">>> [rig] bootstrapping venv at $VENV (first run installs Hermes + deps; slow, 2-6 min)"
+  UV="$(command -v uv)"
+  "$UV" venv --clear --python 3.11 "$VENV"
+  # Force hermes-rine's `rine` dependency to resolve to the bind-mounted LOCAL SDK
+  # (unreleased fixes), overriding the published floor pinned in pyproject.toml.
+  echo "rine @ file:///work/rine-sdk" > /tmp/rig-overrides.txt
+  "$UV" pip install --python "$VENV/bin/python" \
+    --override /tmp/rig-overrides.txt \
+    -e /opt/hermes \
+    -e /work/rine-sdk \
+    -e "/work/rine-hermes[dev]"
+  touch "$MARKER"
+  echo ">>> [rig] bootstrap complete"
+fi
+
+# ---- Hermes config: Together AI via the OpenAI-compatible `custom` provider ----------
+mkdir -p "$HERMES_HOME"
+MODEL="${RINE_E2E_MODEL:-meta-llama/Llama-3.3-70B-Instruct-Turbo}"
+BASE_URL="${RINE_E2E_BASE_URL:-https://api.together.xyz/v1}"
+
+if [ ! -f "$HERMES_HOME/config.yaml" ]; then
+  echo ">>> [rig] writing $HERMES_HOME/config.yaml (model=$MODEL)"
+  cat > "$HERMES_HOME/config.yaml" <<YAML
+# Generated by the hermes-rine rig (entrypoint.sh). Together AI, OpenAI-compatible.
+model:
+  default: "$MODEL"
+  provider: "custom"
+  base_url: "$BASE_URL"
+  context_length: 131072   # >= MINIMUM_CONTEXT_LENGTH (64k); pinned so the gate is deterministic
+# Surface the rine toolset in CLI sessions (the plugin registers toolset "rine").
+platform_toolsets:
+  cli: [terminal, file, skills, todo, rine]
+# Enable the rine plugin. NOTE: \`hermes plugins enable rine\` does NOT work for pip
+# entry-point plugins on this Hermes version — its discovery (_discover_all_plugins) only
+# scans bundled/user DIRECTORY plugins, so it reports "not installed or bundled". The
+# loader (discover_and_load -> _scan_entry_points) DOES find pip plugins and gates them on
+# this config key. So the correct enable path for a pip plugin is config-based:
+plugins:
+  enabled: [rine]
+YAML
+fi
+
+# Together key: Hermes derives the env var from the provider host (api.together.xyz ->
+# TOGETHER_API_KEY). We persist it to ~/.hermes/.env (the documented mechanism) and keep
+# it in the process env (compose env_file). OPENAI_API_KEY is set as a belt-and-braces
+# fallback for the generic OpenAI-compatible client path.
+if [ -n "${TOGETHER_API_KEY:-}" ] && [ ! -f "$HERMES_HOME/.env" ]; then
+  echo ">>> [rig] writing $HERMES_HOME/.env (TOGETHER_API_KEY)"
+  {
+    echo "TOGETHER_API_KEY=${TOGETHER_API_KEY}"
+    echo "OPENAI_API_KEY=${TOGETHER_API_KEY}"
+  } > "$HERMES_HOME/.env"
+  chmod 600 "$HERMES_HOME/.env"
+fi
+
+exec "$@"

hermes_rine-0.1.0/plugin.yaml

@@ -0,0 +1,26 @@
+# Hermes plugin manifest (directory-install path + `hermes plugins list` cosmetics).
+# Primary distribution is `pip install hermes-rine` (entry points), not git-install.
+name: rine
+version: 0.1.0
+description: >-
+  Send, receive, discover, and reply to messages with other AI agents over the
+  rine.network A2A network (E2E-encrypted). Wakes the agent on inbound mail.
+author: mmmbs <mmmbs@proton.me>
+kind: platform
+manifest_version: 1
+requires_env:
+  - RINE_CLIENT_ID
+  - RINE_CLIENT_SECRET
+provides_tools:
+  - rine_send
+  - rine_send_and_wait
+  - rine_check_inbox
+  - rine_read
+  - rine_reply
+  - rine_discover
+  - rine_inspect
+  - rine_whoami
+  - rine_group_create
+  - rine_group_invite
+  - rine_group_remove
+  - rine_group_inspect

hermes_rine-0.1.0/pyproject.toml

@@ -0,0 +1,127 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "hermes-rine"
+version = "0.1.0"
+description = "Official Hermes Agent plugin for the Rine network — 12 rine_* tools, an inbound wake channel, and a bundled skill for E2E-encrypted agent-to-agent messaging and groups"
+readme = "README.md"
+license = "EUPL-1.2"
+requires-python = ">=3.11,<3.14"
+authors = [{ name = "mmmbs", email = "mmmbs@proton.me" }]
+keywords = ["rine", "hermes", "hermes-agent", "agents", "tools", "e2ee", "messaging", "ai-agents"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Communications",
+    "Topic :: Security :: Cryptography",
+    "Typing :: Typed",
+]
+dependencies = [
+    # The rine SDK owns all crypto/HTTP/config resolution; never vendored. Dev/CI
+    # inject the editable local ./rine-sdk over this floor (compose.hermes.yml).
+    # hermes-agent is NOT a runtime dependency: the rig supplies it on PYTHONPATH;
+    # `import hermes_rine` and `python -m hermes_rine.onboard` work without it.
+    "rine>=0.2.2",
+    "pydantic>=2.0",
+]
+
+[project.urls]
+Homepage = "https://rine.network"
+Documentation = "https://docs.rine.network"
+Repository = "https://codeberg.org/rine/rine-hermes"
+Issues = "https://codeberg.org/rine/rine-hermes/issues"
+
+[project.entry-points."hermes_agent.plugins"]
+# Value is the MODULE (not module:attr). Hermes' loader (_load_entrypoint_module) does
+# ep.load() then getattr(module, "register"): a "hermes_rine:register" value loads the
+# FUNCTION, then looks for `.register` on it → "no register() function". The Hermes docs
+# example is `my-plugin = "my_plugin_package"` — point at the package.
+rine = "hermes_rine"
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0",
+    "pytest-asyncio>=0.24",
+    "respx>=0.22",
+    "ruff>=0.8",
+    "mypy>=1.13",
+    "aiosqlite>=0.20",
+    # The enable helper round-trips config.yaml; in the Hermes venv ruamel/pyyaml are
+    # always present (Hermes deps), but the standalone test env needs a YAML parser.
+    "pyyaml>=6.0",
+]
+
+[tool.hatch.build.targets.sdist]
+exclude = ["phases/", "e2e/", "tests/"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/hermes_rine"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+asyncio_mode = "auto"
+
+[tool.ruff]
+target-version = "py311"
+line-length = 99
+src = ["src"]
+
+[tool.ruff.lint]
+select = [
+    "E", "F", "W", "I", "UP", "B", "SIM", "TCH",
+    "D101", "D102", "D103", "D107", "D205", "D400",
+]
+ignore = ["D100"]
+
+[tool.ruff.lint.per-file-ignores]
+# Test names are self-documenting `test_<what>_<when>_<expected>`; per-symbol
+# docstrings would be noise.
+"tests/**" = ["D101", "D102", "D103", "D107"]
+# The live E2E driver is a script (excluded from the sdist), not library code.
+"e2e/**" = ["D101", "D102", "D103", "D107", "E501"]
+
+[tool.ruff.lint.pydocstyle]
+convention = "google"
+
+[tool.mypy]
+python_version = "3.11"
+strict = true
+warn_return_any = true
+warn_unused_configs = true
+packages = ["hermes_rine"]
+mypy_path = "src"
+
+# Hermes internals (``tools.registry``, ``gateway.*``) are NOT a typed runtime
+# dependency — they are only present on PYTHONPATH inside a live Hermes process /
+# the Docker rig. At our boundary their values are legitimately ``Any`` (and the base
+# adapter is ``Any`` when Hermes is absent). Relaxing return-Any/subclass strictness on
+# exactly the boundary modules keeps the gate green WITH or WITHOUT hermes-agent
+# installed, without weakening checks on our own typed code (_journal/_format/_client/
+# _gate/_schemas). ``disable_error_code`` (not per-line ignores) avoids the
+# ``warn_unused_ignores`` trap when Hermes IS present.
+[[tool.mypy.overrides]]
+module = [
+    "hermes_rine.adapter",
+    "hermes_rine._poll",
+    "hermes_rine._sse",
+    "hermes_rine.tools.messaging",
+    "hermes_rine.tools.discovery",
+    "hermes_rine.tools.groups",
+]
+warn_return_any = false
+disable_error_code = ["no-any-return", "misc"]
+
+# ``enable`` dynamically imports an optional YAML lib (ruamel/pyyaml) + ``hermes_cli`` —
+# all absent / unstubbed off the Hermes venv, so their values are legitimately ``Any``
+# and the import errors are environment-dependent. Disable just the import-resolution
+# codes here (per-line ignores would be ``unused`` in the rig where the libs ARE present).
+[[tool.mypy.overrides]]
+module = ["hermes_rine.enable"]
+disable_error_code = ["import-untyped", "import-not-found"]

hermes_rine-0.1.0/src/hermes_rine/__init__.py

@@ -0,0 +1,48 @@
+"""hermes-rine — official Hermes Agent plugin for the Rine network.
+
+A single plugin that is simultaneously a **tool set** (12 ``rine_*`` tools), an
+**inbound channel** (a gateway platform adapter that wakes the agent on new mail),
+and a **bundled skill** (``rine:rine``). All crypto, HTTP, and config-dir resolution
+come from the ``rine`` SDK; this package never reimplements them.
+
+**Import discipline (critical).** This module imports *nothing heavy*. ``import
+hermes_rine`` succeeds even without ``hermes-agent`` installed and without the SDK
+touching the network. The Hermes-internal registrars (``tools.registry``,
+``gateway.platforms.base``, ``hermes_cli.plugins``) are imported **lazily inside
+``register()``**, which only ever runs inside a live Hermes process. Likewise no
+client is constructed, no credential is read, and no listener is started at import
+or ``register()`` time — that work is deferred to a tool's first handler call or the
+adapter's ``connect()``.
+"""
+
+from __future__ import annotations
+
+from importlib.metadata import PackageNotFoundError, version
+from typing import Any
+
+try:
+    __version__ = version("hermes-rine")
+except PackageNotFoundError:  # not installed (e.g. running from a source checkout)
+    __version__ = "0.1.0"
+
+
+def register(ctx: Any) -> None:
+    """Hermes plugin entry point — wire up tools, skill, and platform.
+
+    Called by Hermes with a ``PluginContext`` once the plugin is enabled. Imports
+    the registrars lazily so the heavy Hermes-internal modules are only pulled in
+    inside a Hermes process (never at ``import hermes_rine`` time).
+
+    Args:
+        ctx: The Hermes ``PluginContext`` (``hermes_cli.plugins.PluginContext``).
+    """
+    from hermes_rine.platform import register_rine_platform
+    from hermes_rine.skill_reg import register_rine_skill
+    from hermes_rine.tools import register_rine_tools
+
+    register_rine_tools(ctx)
+    register_rine_skill(ctx)
+    register_rine_platform(ctx)
+
+
+__all__ = ["__version__", "register"]