feat(hermes): update placemat for Hermes Agent v0.21.6

[dommango]

What this changes

Daily sync for the Hermes Agent placemat: v0.21.5 (2026.9.24) → v0.21.6 (2026-10-08), the only release in that window (confirmed via the declared fallback — api.github.com is gated in this sandbox as expected, and the fallback HTML page is normally gated too for an unattached third-party repo, but WebFetch reached it successfully).

• hermes model — notes a new Local models entry (managed llama.cpp engine, fully on-device)
• New local_runtime.enabled / local_runtime.backend / local_runtime.detect_ports settings rows (new "Local models" settings group)
• hermes status — notes the new summary-first default plus --full/--all/--deep
• hermes cron — notes the new cron-store-unwritable warnings (cron status/cron list, and hermes doctor)
• hermes kanban — notes the new --workflow-template-id/--current-step-key list filters (reserved for future workflow-template routing)
• hermes plugins — notes plugins.isolation: host (per-profile plugin host)
• New plugins.isolation settings row (new "Plugins" settings group)
• Promoted mcp.discovery_concurrency off class="unverified" — now confirmed in user-guide/features/mcp.md and user-guide/multi-profile-gateways.md, with its default (4) and 0=unlimited
• Changelog FIX entry for the git-filter-hardening security fix (automatic git calls — session snapshots, subagent worktrees, kanban, worktree cleanup, hermes -w — could run clean/smudge/process filters from an untrusted repo's own config)
• sources.json inventory re-extracted and fetched bumped to 2026-10-09

Excluded per scope_denylist/scope: the dashboard-authentication security fixes (dashboard is denylisted), the email-gateway sender-hardening fix (channel-specific, same boundary as the existing hermes gateway row), spoken-voice-turn routing (voice denylisted), Desktop-only UI details (favorited/pinned models, Settings ▸ Plugins page, Discord setup wizard — desktop denylisted / channel-specific), new model-catalog entries (the placemat doesn't enumerate specific model names), and "dozens of new community plugins" (not a verifiable row).

Type

• Content correction (wrong/outdated/missing entry)

Checklist

• I read AGENTS.md's Style Guide and Content Rules
• node tests/placemat.test.js hermes passes locally (54 passed, 0 failed)
• node scripts/build-changes.js --all --check passes locally (generated files are fresh)
• No versions/*.html files were edited
• No hand-edited changes.json or feed.xml — both are generator output (node scripts/build-changes.js hermes)
• Every new/changed row is sourced from Hermes's own vendor docs, GitHub release notes, or docs raw-mirror — never copied or inferred from a sibling placemat
• Anything I could only infer carries class="unverified" (none added this sync; the one pre-existing unverified row, mcp.discovery_concurrency, is now confirmed and promoted)
• New rows have an id="i-<slug>" and a matching .row-link permalink
• Only hermes/ is touched

Source

• Release: https://github.com/NousResearch/hermes-agent/releases/tag/v0.21.6
• https://raw.githubusercontent.com/NousResearch/hermes-agent/main/website/docs/user-guide/local-models.md
• https://raw.githubusercontent.com/NousResearch/hermes-agent/main/website/docs/user-guide/features/plugins.md
• https://raw.githubusercontent.com/NousResearch/hermes-agent/main/website/docs/user-guide/features/cron.md
• https://raw.githubusercontent.com/NousResearch/hermes-agent/main/website/docs/user-guide/features/mcp.md
• https://raw.githubusercontent.com/NousResearch/hermes-agent/main/website/docs/user-guide/multi-profile-gateways.md
• https://raw.githubusercontent.com/NousResearch/hermes-agent/main/website/docs/reference/cli-commands.md

🤖 Generated with Claude Code

https://claude.ai/code/session_01LkxqPxVM5ryaw7ytvx82FM

---

Generated by Claude Code

[dommango]

Merge-gate review (code-review skill, effort: medium)

Ran independently against this PR's diff (fetched the actual vendor docs to verify each claim). 3 findings, none blocking page correctness, but all legitimate — fixed in 7cf639f:

1. hermes kanban list note was imprecise (hermes/index.html, hermes/changelog.html) — the two new list filters (--workflow-template-id, --current-step-key) target columns the docs call "reserved for v2 workflow routing," and the original wording risked implying routing/automation behavior that doesn't exist yet. Reworded to: they're real, documented filters (confirmed in features/kanban.md's own CLI reference) on columns v1 stores but doesn't act on; routing ships later.
2. Stale versioning assumption (hermes/sources.json, hermes/PIPELINE.md) — v0.21.6 is the first release tagged with plain semver and no separate date tag (a new stable-release pipeline), but version_poll.transform and the "Dual versioning" trap still assumed every tag is a date. Left uncorrected, the next sync that hits a semver-only tag would have nothing to parse as a date. Both docs now describe the pre/post-v0.21.6 split and warn not to assume tag_name is a date without checking its shape.
3. inventory.source left stale (hermes/sources.json) — the inventory note described sourcing plugins.isolation, the three local_runtime.* keys, and the mcp.discovery_concurrency promotion from four docs that were never added to the source field. Added.

Re-review after the fix, below.

---

Generated by Claude Code

[dommango]

Re-review (code-review skill, effort: medium) — after 7cf639f

Confirmed the three prior findings are resolved (kanban-filter wording, versioning-scheme docs, inventory.source completeness). One new, minor finding surfaced and is now fixed in 6742c9f:

4. providers.llamacpp named in a note but missing from inventory.settings — the key is genuinely verified (same local-models.md config example as the local_runtime.* keys it sits next to), so this wasn't a fabrication, just an audit-trail gap in the inventory this repo's tooling relies on to catch exactly that class of defect. Added to inventory.settings and to the inventory note.

No CRITICAL/HIGH findings outstanding. node tests/placemat.test.js hermes (54/54) and node scripts/build-changes.js --all --check both pass locally. Waiting on CI to go green on 6742c9f before merging per the merge gate.

---

Generated by Claude Code