Hydra is not the proof engine and not the long-term memory engine. Its role is operational: place the agent behind a controlled sandbox boundary, route model access through managed infrastructure, classify actions and keep operator control over continuous work.
The repository architecture keeps provider credentials host-side. Hermes receives a managed inference route rather than the raw provider secret. Installation and destructive operations are gated explicitly rather than being part of an unrestricted agent loop.
Action classes are divided into GREEN, YELLOW and RED paths. Sending, publishing, production deploys and money movement are treated as RED operations in the documented control plane.
The repository defines a worker cycle with a daily prompt cap, minimum interval, circuit breaker, stop file and sanitized reports. The design goal is to make continuous agent operation interruptible and observable.
Hydra's repository documents validated baseline/runtime checks and sanitized evidence. This page does not turn that into a universal production-readiness claim.
The public Hydra repository documents an active Contabo/QEMU host connected privately through Tailscale, with the NemoClaw/Hermes baseline validated by a runtime PASS and a controlled first-prompt PASS. Hermes runs inside the hydra-hermes-lab OpenShell sandbox while model routing and provider credentials stay on the host.
The raw NVIDIA_INFERENCE_API_KEY is not passed into Hermes. For the baseline, web search, messaging, MCP servers and custom plugins are disabled, reducing the capability surface before broader tooling is introduced.
The documented worker design includes a daily prompt cap, fixed interval controls, a circuit breaker and an operator STOP file. A single touch $HERMES_WORKER_STATE_DIR/STOP pauses the loop. Full model output is not written to disk by the worker; reports are sanitized instead.
The control plane also exposes permission classification, durable queue state and approval-aware operator commands through scripts/hermesctl. This matters because continuous execution is not equivalent to unrestricted execution.
SOUL.md acts as the operational constitution and its SHA-256 is stamped on journal records. The operator surface can check health, classify permissions, inspect waiting approvals and verify the ledger hash chain.
This evidence proves the documented control path and baseline validation. It does not establish universal production readiness for every model, plugin or future host topology.