I begin with context, not interruption.
Every fifteen minutes, the deterministic Nyx Assistant Plane refreshes bounded collectors and reduces current context into source health, freshness, opaque opportunity IDs and timing horizons. It can recognize a preparation need, explain the consequence of a failed capability, and close the loop when it recovers. This plane belongs to the wider installation, not to the Nexus plugin hooks.
Nyx ranks at most one opportunity per run, sends no more than four messages per day, and keeps non-urgent items silent from 22:00–07:00 Amsterdam time. Freshness, privacy, relevance, lifecycle state and existing specialist-watchdog scopes are checked first. When nothing material changed, the correct output is nothing at all.
Private context stays close to home.
Outside the plugin, calendar details are fetched into a local RAM-backed cache. Public news and route results are cached there too. They can disappear on restart because they are rebuildable. Sessions, configuration, memories and tamper-evident receipts remain persistent because they are not disposable.
Recurring query patterns may be learned only as aggregate categories. The raw questions are not retained for that purpose. Sensitive calendar content is used locally to establish relevance—not copied into public status artifacts or sent to a model just to decide whether an alert matters.
Useful intelligence is not measured by how often it speaks.
It is measured by whether it noticed the right change, understood the real context, and spoke early enough for you to do something about it.
That is why Nexus is silent by default, source-grounded, confidence-aware, freshness-aware and explicit when evidence is missing.
Nexus adds context. Hermes keeps authority.
When a message reaches an authenticated agent turn, Nexus deterministically labels privacy signals, risk and a suggested capability family. It also adds the selected identity's role and style. These labels become advisory context for the model; they are not a routing decision or an authorization result.
The /identity command takes a deliberately careful path. Before authentication, pre_gateway_dispatch may rewrite it into an inert marker but cannot change state. The selection is committed only later, in pre_llm_call, after the turn has reached Hermes. For high-risk matches, transform_llm_output may ask a local reviewer for one bounded revision after generation.
I can wear many faces without splitting authority.
The immutable catalog contains 25 named identities, of which 19 are selectable. In automatic mode, deterministic intent rules choose an identity independently for each turn: Home for host-authorized Home Assistant context, Analyst for supplied metrics or data sources, Steward for supplied financial information, and equivalent bounded routes for the other selectable identities. Nyx is the fallback.
An identity is a presentation layer added to one model turn—not a permanent hidden process or a privileged agent. It cannot grant tools, change models or providers, weaken approvals, override user instructions or authorize an action.
- RewriteTurn
/identity nameinto an inert marker before authentication. - SelectChoose automatically per turn, unless the conversation has an explicit pinned identity.
- PresentAppend the selected identity's bounded role and style to the current model turn.
- InheritLeave tools, privacy, providers and approvals under Hermes control.
/identity auto.Capability is not permission.
Proactive intelligence may observe, rank and notify. It may not silently purchase, book, deploy, alter security policy or take control of the physical world. External communications, destructive changes, private adapters and improvement proposals remain human-gated.
Every proactive decision can leave a minimal, allowlisted receipt linked by hash. The receipt proves continuity without copying the private event into an audit trail. These approval and receipt controls belong to the surrounding Hermes installation; the ordinary Nexus plugin cannot authorize or block a tool action.
At quiet hours, I examine patterns—not your private life.
Outside the plugin, failures and outcomes can be reduced into metadata-only signals. Canaries test whether invariants still hold. A monthly advanced-model review receives a sanitized improvement packet, not raw conversations. It may propose a change. It cannot apply one.
Preference observations follow the same rule: they become pending proposals. Stable choices can be remembered when appropriate, but safety policy cannot weaken itself because convenience appeared to improve.
- ObserveRecord bounded outcome and failure metadata.
- TestRun deterministic canaries and regression contracts.
- ProposeCreate a sanitized advisory packet with evidence and limits.
- WaitA human approves, rejects or reshapes the proposed change.
Change the voice, not the authority.
Automatic mode chooses an identity from each request and falls back to Nyx when no bounded intent matches. Send /identity hex to pin Hex for the current conversation. Send /identity auto to remove the pin and resume automatic per-turn selection.
Nexus registers no privileged command handler and no middleware. It uses the stock plugin hook API only. Installation health can be checked with Hermes Plugin Doctor; the standalone contract tests verify registration, deferred identity selection and advisory review behavior.
Privacy signals are labels, not a firewall.
Nexus scans the current user message with deterministic patterns for credentials, private keys, email, phone, IBAN, address, health and financial signals. It separately detects a small set of elevated-risk requests and suggests a capability family such as coding, research or automation.
The resulting labels and identity context are appended to the turn sent to the active model. Nexus itself does not choose that model, prevent cloud exposure or disable fallback. Those protections—when configured—belong to Hermes and its active host policy.
- User message
- Deterministic signal classifiers
- Identity selection
- Hashed conversation binding
- Signals + identity
- Advisory context for active model
- High-risk answer
- Optional one-pass local review
- Models / tools
- Selected and authorized by Hermes
- Streaming / transcript
- Controlled by Hermes, not Nexus
For high-risk matches, the plugin temporarily keeps the current message in process so the output hook can review the answer. The review is post-generation and may occur after streaming; if the local reviewer fails, Nexus returns control to normal host behavior rather than blocking the answer.
The honest ledger.
A capable system should know the difference between code that exists, a control that is enforcing, and an idea that still lacks an approved source.
pre_llm_call.