Hermes Outpost deliberately delegates only through administrator-configured SSH endpoints. It is not a general remote-shell tool.

The controller model may choose only a configured host alias. The administrator controls what each alias maps to, which workspace tree is allowed, which remote profiles may be selected, and the maximum turn/time budgets.

The remote Hermes installation is an independent trust domain with its own credentials, configuration, plugins, filesystem permissions, and model provider.

Authentication and host verification belong to OpenSSH.

Outpost:

• does not parse SSH private keys;
• does not collect SSH passwords;
• keeps normal OpenSSH host-key verification enabled;
• uses BatchMode=yes;
• does not forward controller model/API credentials;
• passes ssh_host as one argv element;
• rejects host values beginning with - or containing whitespace/control characters.

Task content never enters the SSH argv.

OpenSSH executes a configured remote command through the account's login shell. v0.1.0 therefore requires a POSIX-compatible remote shell.

Configured remote values are shell-quoted. Untrusted goal/context text is not part of the command; it is written to SSH stdin and consumed by Hermes with --query-file -.

When workspace_root is configured, Outpost performs two checks:

1. A controller-side POSIX path containment check rejects .. traversal and paths outside the configured root.
2. The remote command changes directory and validates the physical path with pwd -P before Hermes starts.

The second check prevents a symlink inside the configured root from silently redirecting the worker outside that tree.

If no workspace_root is configured, a caller cannot select arbitrary workspaces. An administrator may still configure one fixed absolute default_workspace.

A caller cannot switch to an arbitrary remote Hermes profile. The configured default profile is allowed; additional profile overrides must appear in allowed_profiles.

Job data lives under:

$HERMES_HOME/plugin-data/hermes-outpost/

Raw remote event/stderr logs may contain data produced by the remote worker and should be treated as sensitive local operational data.

The task payload is briefly written to a mode-0600 controller-side file and deleted after the runner hands it to SSH stdin.

Cancellation signals the detached controller runner, which terminates its owned SSH process. A remote process that deliberately detaches itself from the SSH session is outside the v0.1.0 cancellation guarantee. Normal foreground Hermes execution is the supported model.

Hermes Outpost contains no self-updater and does not download replacement plugin code at runtime. Catalog releases are intended to be installed from an exact Hermes-reviewed commit SHA. Updates should occur only through a new catalog SHA-bump review.

Do not publish credential material, private SSH configuration, or exploit details in public logs. Report reproducible security concerns through the repository's GitHub security reporting surface when available, or open a minimal issue that omits sensitive details.