What problem does it solve? Operators of Hermes infrastructure lack a deterministic way to prove runtime security posture, detect configuration drift, and gate skill installs against signed security advisories. This Skill generates canonical attestation artifacts, verifies them fail-closed, and classifies baseline drift by severity. ## Core Features & Use Cases - Deterministic Attestation Generation: Emits canonical JSON posture artifacts covering gateway flags, risky toggles, feed verification status, watched files, and trust anchors with SHA-256 digests. - Fail-Closed Verification: Validates schema, canonical digest binding, optional detached signatures, and authenticated baseline diffs with stable severity classification (critical/high/medium/low/info). - Signed Advisory Feed Gating: Verifies Ed25519-signed advisory feeds with checksum manifests and blocks skill installs matching advisories unless the operator explicitly confirms. - Use Case: An operator schedules recurring attestation runs via the managed cron helper, then uses the guarded verification gate before installing any new skill so that a candidate matching a known advisory exits with code 42 until explicitly acknowledged. ## Quick Start Ask the agent to generate a Hermes attestation and verify it against your authenticated baseline, then run the guarded advisory check before installing a new skill.
