01 · Local AI · Systems

Owning everything around the model.

Hermaeus is a native .NET workspace where runtime state, retrieved evidence, memory, and agent actions stay inspectable. Chat is only the visible end of that system.

The engineering

The easy part is sending JSON.

The awkward part is making a local model dependable after the demo. Hermaeus separates desktop presentation and view models from core contracts, RAG, agents, and service integrations. Local llama.cpp, Ollama, and compatible remote providers meet behind provider-aware interfaces; capability checks remain explicit because not every endpoint supports constrained output, reasoning transport, or the same context controls.

A managed runtime, not a mystery process

For llama.cpp, Hermaeus owns process launch, loopback binding, model profiles, health, logs, GPU tuning, and shutdown. Arguments are passed without a shell. Downloads are SHA-256 verified and complete model families can include shards, vision projectors, and MTP draft heads. Draft-model compatibility is checked before launch; n-gram and draft-model speculation can be composed rather than hidden behind a speed toggle.

Retrieval has receipts

Ingestion uses structure-aware chunking for documents, Markdown, code, and PDF. Query planning produces multiple retrieval variants; dense and lexical candidates are fused, optionally reranked with an ONNX model, and packed against the available token budget. Citations and retrieval traces retain the relationship between answer and source. Watched sources expose stale indexes, while index size is shown against the in-memory budget before a corpus quietly becomes an operational problem.

Context construction also has to arbitrate system instructions, project defaults, conversation history, attachments, retrieved chunks, and durable memories. The budget is a boundary, not a suggestion. A per-answer receipt exposes what made the cut.

Memory and agents need stronger boundaries

Durable memories live in a reviewable, scoped store and use hybrid retrieval. They are visible data, not silent prompt mutation. The Agent Workbench follows the same posture: read-first execution, an explicit review queue, approval gates for actions, workspace rules, traces, and a completion record naming files, commands, approvals, and unknowns. Constrained output is enforced by providers that support grammar sampling; providers that cannot enforce it do not get described as equivalent.

Trust boundary: managed services bind locally, secrets use operating-system storage with an encrypted fallback, and destructive agent actions remain approval-gated. “Local” is not treated as a synonym for “trusted”.

Where reality still wins

This is alpha software. Windows is exercised more heavily than Linux, binaries are unsigned, OCR remains unfinished, and some platform integration is uneven. The system’s response is observability: Doctor checks, Activity outcomes, runtime logs, traces, benchmark histories, and explicit capability evidence. None of that makes failure impossible. It makes failure diagnosable.