Executor Gateway for Hermes Box

Implementation and account-onboarding plan for the Miles / 10xN integration layer.

June 17, 2026·Updated after isolated smolvm validation

✓

Updated bottom line

Run Executor's self-host payload natively under Supervisor. Pull the exact pinned OCI image with skopeo, unpack its ARM64 layers under disposable /storage, execute its bundled Bun runtime, and persist only /workspace/executor/data. This keeps the full owner + Miles account model without relying on nested Docker.

Pinned release

v1.5.12

OCI index + ARM64 child

Runtime

Native OCI

Supervisor + bundled Bun

App port

4788

host loopback only

MCP surface

2 tools

execute + resume

Recommendation

Keep the reviewed self-host image reference pinned by version and multi-platform digest:

ghcr.io/rhyssullivan/executor-selfhost:v1.5.12
sha256:e40b2179c005b3124e794e9a8505341db46d0a9a1631e7f3fdcd023462ecf70b

linux/arm64 manifest
sha256:c089ee8bffdbd81c854c3aee47a788484398694149597bc9d8863491b07e262f

Use skopeo to resolve and copy the digest-pinned ARM64 image.
Apply layers in manifest order with path validation and OCI whiteout handling.
Keep the repullable payload and bundled Bun runtime under /storage.
Persist only Executor's /data under /workspace/executor/data.
Keep EXECUTOR_ALLOW_LOCAL_NETWORK=false.
Expose guest port 4788 only through a separately configurable smolvm loopback port.

Runtime decision

Option	Finding	Decision
Nested Docker	Fails in smolvm 1.0.4 at iptables/NAT, overlay mounts, and finally `unshare` even with bridge disabled and the VFS driver.	Reject
Executor CLI	Verified UI, API, HTTP MCP, `execute`, and `resume`. It is single-user and lacks admin/Miles accounts, invites, and per-user API keys.	Fallback only
Native self-host payload	Verified from the published OCI image: bundled ARM64 Bun launched in one second; setup UI, health, assets, and Bearer-protected MCP all worked.	Selected
Separate Executor VM	Strongest credential isolation, but adds another lifecycle, port, snapshot, and recovery surface.	Future hardening

★

Why not just use the CLI?

The CLI is sufficient for a temporary single-user Executor, but it would break the planned owner/admin + Miles + named API-key design and create avoidable re-onboarding work. Native self-host preserves the target operating model now.

Architecture

Mac browser / Computer Use
        │ host loopback :4788
        ▼
Hermes Box VM
├── Supervisor
│   ├── Executor self-host (bundled Bun)
│   └── Hermes gateway
├── /storage/executor-runtime       repullable OCI payload (~2.5 GB)
├── /workspace/executor/data        database + encrypted secret keys
├── Hermes ── local MCP ──┐
└── Codex ─── local MCP ──┴── Executor ── external services

Security boundary

Executor can enforce account and tool policies, but it cannot hide credentials from a compromised root-capable Hermes agent in the same VM. A separate Executor machine is required for true secret isolation.

No public tunnel is required initially. Computer Use can complete setup and OAuth through the Mac's loopback mapping.

Hermes Box work

Area	Planned change
Configuration	Add enable flag, host port, pinned image, and strict tag + digest validation.
Host networking	Publish guest port 4788 to host loopback and reject any public listener.
Guest bootstrap	Install `skopeo`; do not install or start Docker.
OCI installer	Resolve the pinned ARM64 manifest, copy layers, validate archive paths, apply OCI whiteouts, and atomically activate the runtime under `/storage`.
Service lifecycle	Run the bundled Bun self-host process under Supervisor before Hermes; stop it cleanly before snapshots and VM shutdown.
Persistence	Bind application state to `/workspace/executor/data`; keep the 2.5 GB runtime repullable and outside backups.
Backups	Stop services, retain Executor data and keys, exclude the runtime cache, and repull on restore when absent.
Health	Check `/api/health`, MCP authentication, Supervisor state, exact installed digest, and loopback listeners.

The implementation must remain idempotent and safe if a pull or extraction is interrupted.

Acceptance criteria

/api/health returns 200 and the setup UI renders without console errors.
Unauthenticated /mcp returns 401 with a Bearer challenge.
Authenticated MCP advertises only execute and resume.
The first admin, Miles user, API keys, and account state survive VM restart.
Snapshot/restore preserves Executor data and authentication while repulling disposable runtime files when needed.
The installed ARM64 manifest matches the configured digest.
make check passes and Git contains no generated state or credentials.

Account model

Create two Executor users:

Owner / admin: Infrastructure administration only
Miles: Personal business connections and the Hermes API key

Under Miles, create separate keys named hermes-miles and codex-onboarding. Revoke the onboarding key after configuration if Codex does not need durable access.

google-ben-10xn
google-miles-primary
notion-10xn-ops
discord-10xn

Record service, identity, connection name, owner, scopes, and a harmless validation query. Never record the credential itself.

Starter bundle

Service	Executor path	Initial policy	Status
Gmail, Calendar, Drive, Docs, Sheets	Built-in Google bundle	Default-deny with explicit reads	First
Notion	Official remote MCP	Read first; approval for pipeline writes	First
Discord	Trimmed Discord v10 OpenAPI + bot	Read/search; approval for posting	First
Airtable	Vetted minimal OpenAPI + scoped PAT	Exact base; read first	After CRM choice

Initial guardrails

Google: allow search/get/list/free-busy and document reads; block send, delete, sharing, creation, and mutation.
Notion: validate search/read first; gate canonical-pipeline writes behind approval.
Discord: dedicated bot only; no user token, Administrator, moderation, roles, bans, or webhook management.
Airtable: if selected later, restrict the PAT to exact API scopes and bases.

Codex + Computer Use setup runbook

Implement and validate the native OCI runtime in a disposable Hermes Box.
Verify the pinned digest, loopback listener, health endpoint, setup UI, and MCP challenge.
Exercise restart and snapshot/restore before creating real accounts.
Deploy to the target Hermes Box and create the infrastructure admin.
Invite Miles and mint hermes-miles plus codex-onboarding.
Connect Hermes to the organization-pinned local MCP URL shown by Executor.
Create one Google OAuth application using Executor's displayed callback URL.
Add Google, Notion, and Discord accounts one at a time, validating harmless reads after each.
Inspect generated tool paths before creating default-deny policies.
Verify reads work, blocked mutations are absent, direct blocked invocation fails, and approvals pause correctly.
Save a sanitized inventory, take a cold Executor backup, then snapshot Hermes Box.

★

Browser automation rules

Use password-manager or browser autofill. Never paste secrets into chat, shell history, screenshots, Git, or reports. Work one account at a time and verify identity immediately after each OAuth flow.

Rollout phases

Infrastructure: native OCI lifecycle, loopback UI, health checks, restart, and backup behavior.
Daily coordination: onboard Google, Notion, and Discord with default-deny policies.
Canonical CRM: choose Notion or Airtable, then enable only narrow approved writes.
Analytics: add YouTube Data, YouTube Analytics, and approved social APIs.
Commercial operations: add prospecting, e-signature, and read-only accounting integrations.
Automation: add a separate event plane for webhooks, schedules, and deadline triggers.

Operations

Back up Executor data only while the service is stopped.
Treat Executor backups and Hermes Box snapshots as credential archives.
Before upgrades: stop, back up data, stage a new pinned OCI runtime, health-check it, atomically activate it, and smoke-test MCP.
Rollback by restoring the pre-upgrade data backup and prior runtime digest; database migrations may make an old runtime unsafe against upgraded data.
Delete and repull /storage/executor-runtime when verifying reproducible recovery.
Periodically review connected accounts, OAuth scopes, API keys, policies, and bot permissions.

Recommended next step

✓

Implement the native OCI runtime now

Replace the current Docker-specific Hermes Box work with skopeo installation, an atomic digest-aware layer extractor, and a Supervisor-managed native self-host runner. Then hand it to an independent agent for the full admin → Miles API key → authenticated MCP → restart → snapshot/restore test before touching the Miles box.

This keeps the next change narrowly scoped to infrastructure and gives the later account-connection phase a stable, tested foundation.