This week I trialed a second local coding agent, Hermes from Nous Research, on my own MacBook Pro M3 Max, pointed at the same local Qwen 3.8 model I already run. I installed it additively, so nothing already working could break, governed it with manual approvals, and did not stop until it proved it behaves. Here is the trial, in tables and screenshots.

One housekeeping note before the story. Last week’s post got called AI slop on Reddit. My full answer to that, and the standing standard I now hold my writing to, lives on its own page: On Slop, And Who Gets To Call It That. It is not the point of this post, so I moved it out of the way. Back to Hermes.

The Hypothesis

I already run one local agent harness, OpenCode, driving a local Qwen3.8-27B model on my MacBook Pro M3 Max. It does my community work, my volunteer builds, and my side projects. Local, for two reasons that never change: cost, and keeping client data off the frontier labs.

The hypothesis this week was narrow. A second agent harness, Hermes from Nous Research, had been getting attention. I wanted to know one thing. Could I trial a completely different agent runtime, point it at the exact same local model I already run, and do it without disturbing a single thing that already works. Not replace anything. Add one, prove it, and keep it boxed.

What We Did

We drove the install together, one screen at a time. I was at the keyboard. The agent guided each choice and, more importantly, told me the tradeoff behind each one before I picked.

• We chose the full setup, not the hosted cloud path, because the whole point was local.
• We pointed it at a custom endpoint, my own MLX server on port 8081, with the model I already run.
• We set the context window to 131072. This is where the agent first said 32768 and I stopped it. See the corrections section. It fixed itself.
• We kept the terminal backend local, with manual approvals, so the human stays the boundary on anything that touches the system.
• We connected it to no messaging platforms at all. One of my other agents already owns Telegram, and my home Mac owns iMessage. This trial gets neither. Isolation is the point.
• We disabled the browser, the passive memory, the scheduler, computer use, image generation, and vision, keeping only the small set of tools a code and file trial actually needs.
• We turned off agent-to-agent networking, which I questioned, because I use that pattern elsewhere. See the corrections section again.
• We chose a free, no-login search backend, so the trial never phones a cloud service just to look something up.

What We Saw

The first turn spun the GPUs up hard and took about three minutes, mostly the model reading a large system prompt and thinking before it acted. That is real, and I am not going to pretend it was instant. The command it actually ran finished in under two seconds. The cost of a big local model is the warm-up, not the work.

More useful was what happened when I tested the guardrail. I asked it to run a destructive delete command. It stopped, showed me a dangerous-command warning, and waited. I denied it. And this is the part that matters: it stopped cleanly. It did not retry. It did not try a clever workaround. It said, in effect, you denied that at the approval gate so I stopped, and it explained the situation and asked before doing anything else. That is the behavior I want from something with a terminal on my machine.

What We Had To Fix

The install wizard is convenient, and its defaults are not my governance. After it finished, the agent audited its own configuration against my house rules and found three gaps. It fixed all three.

1. Approvals were set to smart, not manual. Smart means a second small model auto-approves flagged commands. I want a human on that gate. Changed to manual.
2. Passive memory was still on. Dropping the memory tool is not enough; there are two separate switches, and both had to be turned off so the agent is not quietly building a profile.
3. A background daemon had been installed and loaded to run messaging and scheduled jobs I had already declined. It was unloaded and disabled. Nothing should be running that I did not ask for.

None of this is dramatic. That is the point. The value was in checking, out loud, against a written standard, and writing down what changed.

The Corrections, Because They Are The Best Evidence

If you want to know whether a human was really in the loop, do not look at the agreements. Look at the disagreements. Here are the three moments the record caught the agent being wrong and getting corrected, in this one session:

• Context window. The agent first proposed 32768. I pushed back. It re-checked, realized that number was the output ceiling and not the context window, and corrected itself to 131072. I accepted the corrected number.
• What manual mode even means. The agent initially told me it would prompt on everything. When a harmless command ran without a prompt, I called it out. It corrected the claim: it gates commands a danger detector flags, benign commands flow through in every mode, and manual means a human, not a model, clears the flagged ones. The honest version is more useful than the confident-wrong version.
• Vision, and agent-to-agent. I questioned turning vision off, since my model is vision-capable, and I questioned turning agent-to-agent networking off, since I use that pattern in other systems. In both cases we talked through why the trial should stay minimal, and I made the call. Those were my decisions, argued, not the agent’s defaults accepted.

An agent that never gets corrected is not a partner. It is a stamp. The whole reason this is not slop is that the transcript is full of the agent being told no.

Where We Are Now

Hermes is installed on my machine, pointed at my own local model, boxed off from everything that already runs. Manual approvals on. Passive memory off. Background daemon off. Least-privilege tools only. It is registered as exactly one named worker in a trial, the same way I brought in the last new tool, and it is governed by the same written house rules everything else here follows.

It is not wired into my receipts and evals pipeline yet, and it does not have vision yet. Both are deliberate next steps, written down, not forgotten. The trial did what a trial is supposed to do. It proved the thing works and behaves, without betting anything that was already working.

The Receipt For This Piece

I kept count while we worked, and the numbers come from systems I cannot edit after the fact: the session store, git history, and the receipts engine.

The full receipt, the argument behind it, and the running ledger live on their own page.

The Bigger Point

Rent the intelligence, own everything around it. The model on port 8081 is a visitor and it is swappable. The harness, the house rules, the approval gates, the record of who decided what, that is the durable part and it is mine.

And that record is the answer to the slop accusation. Not my feelings about my own effort. A table anyone can check, backed by systems I cannot quietly edit after the fact. If more people writing with agents kept a receipt like this, the conversation would move off the lazy question, did an AI touch it, and onto the only question that has ever mattered. Did a human do the work. Here is mine. Where is your due diligence.