// Replace Hermes' regex-based dangerous-command detector + per-session approval state with a Goblins revocable forwarder — every authority grant has explicit lifecycle (count-limited, time-limited, user-revocable). Approval becomes a cap operation, not a string-pattern guess.
| name | hermes-approval-as-revocable |
| description | Replace Hermes' regex-based dangerous-command detector + per-session approval state with a Goblins revocable forwarder — every authority grant has explicit lifecycle (count-limited, time-limited, user-revocable). Approval becomes a cap operation, not a string-pattern guess. |
| type | bridge |
| parent | hermes-goblins-bridge |
| row | 15 |
| proto | R |
| polarity | -1 |
| status | stub |
Phase 1. Replaces "we hope this regex catches all dangerous commands" with "the LLM literally cannot perform the action without holding an unrevoked cap."
/Users/bob/i/hermes-agent/tools/approval.py
DANGEROUS_PATTERNS = [(r'\brm\s+...', "recursive delete"), ...]
def detect_dangerous_command(cmd) -> Optional[str]: ...
def is_command_approved(session_key, cmd) -> bool: ...
def approve_command(session_key, cmd, scope='once'|'session'|'permanent'): ...
# Per-session state: contextvars + thread-safe dict, keyed by session_key
Approval scopes: once, session, permanent (config.yaml). Smart-approval uses an auxiliary LLM to auto-approve "low-risk" commands.
Authority pattern: detect-then-prompt. Regex misses → silent escape. Approval state stored as session-keyed boolean → no built-in expiry, no cap-style attenuation, no propagation across delegation.
/Users/bob/i/goblins-adapter/ — a ^revocable wrapper around any cap, with explicit lifecycle.
(define (^revocable bcom inner-cap
#:max-uses (n #f)
#:expires-at (deadline #f))
(define uses 0)
(define revoked? #f)
(methods
(* args
(when revoked? (raise 'revoked))
(when (and deadline (> (current-time) deadline)) (raise 'expired))
(when (and n (>= uses n)) (raise 'exhausted))
(set! uses (+ uses 1))
(apply <- inner-cap args)))
;; Sealed revoker — only the granter holds it
(values self (lambda () (set! revoked? #t))))
User approval = "give the agent a ^revocable wrapper around the dangerous cap, hold the revoker yourself." Once-scope = #:max-uses 1. Session-scope = revoker dropped at session end. Permanent-scope = unwrapped inner cap (with audit logging).
| Hermes call | Goblins message | Notes |
|---|---|---|
detect_dangerous_command(cmd) | (deleted) | dangerous == "no cap held"; not a string property |
approve_command(sk, cmd, 'once') | (spawn ^revocable inner #:max-uses 1) | LLM gets the wrapper; user gets the revoker |
approve_command(sk, cmd, 'session') | (spawn ^revocable inner) + drop-at-session-end | session lifecycle = revoker scope |
approve_command(sk, cmd, 'permanent') | grant raw inner cap (with audit forwarder) | persisted in SturdyRef store (hermes-cred-as-sturdy) |
| smart-approval (aux LLM) | unchanged — but the LLM-judge produces a proposed cap, user-approves | judge cannot grant authority, only request it |
| revoke approval | (revoker) thunk | atomic; subsequent calls raise 'revoked |
max-uses / deadline; revocation is one thunk call.hermes-delegate-as-spawn (row 2).#:expires-at on every grant; no infinite-lifetime caps without re-confirmation.deadline — vat clock vs user clock; use monotonic vat-time + grace window.# Once-scope:
cap = approve_once(dangerous_op)
cap.invoke(args) # OK
cap.invoke(args) # CapError('exhausted')
# Revocation:
cap, revoke = approve_session(dangerous_op)
cap.invoke(args) # OK
revoke()
cap.invoke(args) # CapError('revoked')
# Time-limited:
cap = approve_for(dangerous_op, seconds=60)
sleep(61); cap.invoke(args) # CapError('expired')
# Sub-agent isolation:
parent_cap = approve(...)
delegate.spawn(child, caps=[]) # child sees nothing
delegate.spawn(child, caps=[parent_cap]) # explicit forwarding only
| Property | Hermes (status quo) | Goblins (this bridge) |
|---|---|---|
| Authority decision | regex-pattern match | cap presence/absence |
| Granularity | per-command-string | per-cap-reference |
| Expiry | none (or session-scoped) | max-uses + deadline first-class |
| Revocation | manual session-state edit | one revoker thunk |
| Inheritance to sub-agents | implicit (session_key sharing) | explicit forwarding only |
| Audit | "approved at T" | full call ledger via vat |
| Failure mode | regex-miss = silent escalation | no cap = no call |
~/i/goblins-adapter/tests/revocable-bisim.scm (todo) — bisim against Python entrypoint shim. Adversarial probe: regex-evading dangerous command (e.g. r''m -rf /, unicode-confusable rm, indirect via xargs) — Hermes may pass, cap version always fails (no cap held).
Phase 1 priority. Foundational for hermes-cred-as-sturdy (row 7) and hermes-mcp-as-sealed (row 8) — both build on the revocable-forwarder primitive.