OpenHermit Agent Operations Platform

least_privilege: docs clearly separate host/docker/e2b/daytona/tenki sandboxes, flag the host backend as devops-only and requiring private access, and layer roles with policy; however safe defaults still depend on the operator tightening policy, so not full marks. user_confirmation: the policy/approval chapter defines allow/deny/require_approval, most-restrictive-wins, and timeout-as-reject, with solid evidence. data_flow_transparency: README and the Internal State table explain PostgreSQL-backed state, encrypted secrets, attachment backends, and env-only credentials. sensitive_data_handling: AES-256-GCM encryption of agent_secrets and channel credentials with credentials kept out of config, but no key rotation or audit detail, deducted. dependency_security: only top-level package.json is visible; no lockfile audit, vulnerability scanning, or SBOM evidence. external_effects: exec, MCP, and channel egress create external side effects; a policy layer exists but approval is not enforced by default, deducted. rollback: checkpoint routes and sandbox soft-delete exist, but soft-delete does not reclaim e2b/daytona remote resources, so rollback semantics are incomplete. source_attribution: README points to Amiko and the repo, but publisher identity is unverified and the FAQ's 'licence is operator-known' conflicts with the MIT declaration, deducted.

self_consistency: README, SKILL.md, and manual agree on CLI commands, env vars, and state model, but the FAQ's licence statement conflicts with LICENSE and the skill's exec backend list (docker/host/e2b) diverges from the five-backend sandbox doc, deducted. dependency_availability: Node>=20, PostgreSQL, a model API key, and optional E2B/Daytona/Tenki/S3/Supabase SDKs are documented, but no lockfile or pinned-version evidence is shown, deducted. failure_messages: the troubleshooting chapter is symptom-first with concrete checks, CLI/gateway code catches errors and sets exit codes, and a doctor command exists; coverage is good but not exhaustive.

audience_and_scenarios: separate admin and end-user skills plus a manual spanning quickstart to operations make the audience and scenarios clear. capability_boundaries: skill descriptions scope each skill and cross-reference the other, and the tool table lists default role grants, so boundaries are clear. trigger_precision: skill descriptions are single-sentence triggers, but skill-creator's own examples and rules are generic and activation relies on model judgment, deducted. environment_fit: supports local, Docker, cloud sandboxes, multiple model providers, and local Ollama, giving broad environment fit.

information_architecture: README is well structured and docs/ plus the numbered manual provide clear navigation. install_notes: global npm install, setup wizard, docker compose Postgres, and a full env var table are present. naming_stability: README uses HCF-S/openhermit while the skill file cites HCF-STUDIOS/openhermit, an inconsistency, deducted. examples_and_faq: Quick Start, CLI reference, FAQ, troubleshooting, and recipes give ample examples. known_limitations: Deep Research explicitly lists PDF unsupported, web-only sources, and manual resume after unclean restart, and the host backend risk is flagged. license: LICENSE is MIT and package.json declares MIT, consistent. versioning_changelog: monorepo version is 0.0.0 with no CHANGELOG or release policy, deducted. maintenance_responsibility: README points to Amiko and contributing guidance, but the publisher is unverified and ownership of maintenance is not clearly established, deducted.

output_usability: CLI, API, web UI, and channel adapters are all present, so outputs are directly usable for deployment and operations. marginal_value: it addresses centralized multi-agent state and sandboxed execution, a clear increment over file-based agents. cost_benefit: the Deep Research section gives per-depth token and cost caps plus a local-model path, making cost predictable, though Postgres and model spend are required, so a small deduction.

claim_traceability: most README claims trace to docs/ and source files, but some performance and cost figures lack stated measurement methods. cross_source_corroboration: README, SKILL.md, and manual corroborate each other in many places, but the repo name and licence wording are inconsistent, deducted. fact_inference_separation: docs mostly separate design from current state, but phrases like 'verified registry ids' lack a checkable source, deducted.