Capability is not what blocks production.

Read before you buy

The authority contract, the skill-vetting model, and a worked example that validates clean — free. If they do not change how you think about what your agent may touch, the rest will not either.

• authority-contract.mdThe full contract and the reasoning behind each field.
• skill-vetting.mdThe four tiers, and the questions worth the reading time at each.
• traceability.mdWhich obligations apply, which do not, and where the kit stops.
• authority.example.ymlA worked contract that validates clean.

Questions

Isn't this what the security hardening guide covers?

Read that first — it is free, it is from the people who build Hermes, and this kit assumes you have. It tells you which knobs exist. This tells you where your boundary should be, how to review 118 bundled skills without reading all of them every release, and what to do at 2am when the agent has already crossed a line.

Does it send anything anywhere?

No. The validator is Python standard library only. No network requests, no account, no upload, no telemetry. Your contracts describe what your agent may touch, which is precisely the file you would least want leaving the machine.

How is it delivered?

After Stripe confirms the exact live payment, nyk.dev opens the private v1.0.0 ZIP and emails the same recovery link. If checkout is unavailable the page falls back to an email alert and cannot take payment.

What does the validator actually check?

Coherence, not shape. A contract can be perfectly well-formed and say nothing: write access equal to read access, a standing credential with no justification, an allowed path nested inside a never-touch boundary, retention set to indefinite. Those pass any schema and defeat the point of writing the contract. A skill whose declared tier contradicts its own capability flags is rejected outright.

Does this make us compliant with the EU AI Act?

No, and be wary of anyone selling that. Article 26 binds deployers of high-risk systems, and most internal coding-agent deployments are not high-risk — whether yours is depends on what it does and where. What the kit gives you is the artefacts a reviewer asks for: a written authority contract, capability-sorted skill vetting, a retention policy, and run evidence. 07-traceability maps each obligation to the file that answers it, and says plainly which rows the kit does not cover. It also flags the conflict most deployments miss: Article 26(6) wants at least six months of operational logs, while short episodic-memory retention is the safer default, and those are different data.

Is this affiliated with Nous Research?

No. Hermes Agent is their open-source project and stays under its own licence; nothing here restricts it, and awesome-hermes-agent remains free and CC BY 4.0. This is an independent kit for running it in production. If you need a hands-on audit rather than files, the consulting Reliability audit is the separate option.