What I dropped and why

Part 4 of this series, dated 2026-02-05, says "The repo already has a declarative Firecracker VM configuration" for the Hermes agent under nix/vms/hermes/. The first commit that touches that directory is 6b7e85b, dated 2026-06-23, about four and a half months after the post. I do not know why the post date and the commit date disagree, and I will not guess. Either way, I published a design as a fact, and this post checks these claims against the repository.

As of 2026-10-15 my dotfiles repo has no uncommitted changes. Where the repo records no reason for a decision, I write "no reason recorded".

gVisor sandbox

Part 4's original description said agents run "inside gVisor sandboxes, holding zero secrets". Part 5 (2026-02-12) scheduled it: "Q3 2026: Milestones 0-3 of the autonomous agent runner (gVisor + broker + egress)".

The repo has the design and the plan, nothing else. nix/autonomous-agents-plan.md says: "Planning only (as of 2026-06-25). None of the 12 tasks have been implemented." It also says no nix/agents/ directory or nix/home/autonomous-agents.nix exists. Both are still absent:

$ ls nix/agents nix/home/autonomous-agents.nix
ls: nix/agents: No such file or directory
ls: nix/home/autonomous-agents.nix: No such file or directory

No reason recorded for not building it. The only related statement is in Part 5's current text, which says the supervisor was dropped because the machine is macOS. What replaced the sandbox is a Lima VM, covered in the NixOS VM post, which says neither gVisor nor Firecracker ever ran.

Firecracker microVMs

Part 4 called Firecracker "Phase 2". Part 5's original text said the target was "Firecracker microVMs, which give you hardware-level isolation". The only Firecracker artifact is nix/autonomous-agents-firecracker-handoff.md, whose status line says "Future work." Part 5's current text adds that Firecracker needs KVM, which macOS does not have.

No reason recorded in the repo beyond the handoff document's own "future work" label.

krops deploy and the Hermes VM

Part 5 (2026-02-12) listed nixosConfigurations.hermes-vm, packages.krops-hermes-deploy, packages.hermes-vm-image and services.firecracker-hermes, and said the VM would be "plenty" for the ops agent "once it's actually running".

nix flake show ./nix --all-systems lists these NixOS configurations and no others: default, iso and opencode-lima. The only VM package is opencode-lima-image. Searching nix/vms and nix/home for hermes or autonomous returns nothing. The history of the directory:

$ git log --format='%h %ad %s' --date=short -- nix/vms/hermes
034ada7 2026-09-25 nix: split mac-extras, dedupe nixpkgs eval, remove Hermes VM, brew-drift-check
6c34055 2026-08-26 docs: gate hermes VM FIXME as not-deployed ...
6b7e85b 2026-06-23 hermes: add Firecracker microVM setup for Hermes Agent

Six commits touch the path. The list shows the first, the not-deployed note and the removal.

The stated reasons are in three places. On 2026-08-17, commit 2876ffa set enableHermes = false on both machines, "until ready to use". On 2026-08-26, commit 6c34055 added a header to the VM's network file: "NOT CURRENTLY DEPLOYED". On 2026-09-25, the 2026-09 audit flagged that the krops input had "zero commits since 2024-01-11" and described the workflow as "dormant". Commit 034ada7 removed nixosConfigurations.hermes-vm, the krops input, home/hermes-host.nix and the systemd units.

The same commit says it left a "different, still-active" Hermes setup alone, the one defined in lima/hermes.yaml. Its header says the agent reads a database and a ticket tracker with no host credential mounts. I did not boot it, so I cannot say whether it works today.

Heracles

Part 5 described "a full agent platform called Heracles" with a web UI, scheduled runs, a tool registry and token tracking. I searched the working tree for the name and found no file. git log --all --grep for it returns no commits.

$ rg -il heracles . --glob '!*.lock'
$ git log --oneline -i --all --grep='heracles'

Both commands print nothing. No reason recorded.

OrbStack

Part 8 (2026-06-27) said "For Maven TestContainers ... I use OrbStack instead of Docker Desktop". Commit b8a4d25 of the same day added it.

A comment in nix/hosts/mac/default.nix gives the reason for removal: "OrbStack was tried but never actually used (confirmed: not running, no docker.sock)" and was removed. My session notes from 2026-08-13 record how I checked, with docker context ls, pgrep and a look for the OrbStack socket, against a Lima socket that existed. Commit f87ed63 (2026-08-14) removed the cask. Docker runs in a Lima VM defined in lima/docker.yaml. Part 8 now carries a correction note dated 2026-09-30.

Per-job Bedrock minting

Part 4 designed minting at job start: "the host mints a short-term Amazon Bedrock API key and injects it into the sandbox as AWS_BEARER_TOKEN_BEDROCK". The Bedrock credentials post searched for that variable and found no use. What runs is a launchd job that refreshes one shared credentials file every 50 minutes, and a VM start job that copies it in. There is no per-job step. That post lists "Per-job minting as described in Part 4" among the things it could not verify, because no code exists.

No reason recorded for the change from per-job to shared. There was no job boundary to mint at, because no sandbox was built.

The NixOS agent image

This one exists. nix flake show lists opencode-lima-image and nixosConfigurations.opencode-lima. The VM post covers what it does and where its mounts disagree with its YAML.

Git-restricted MCP server

I removed the git-restricted MCP server on 2026-10-15 (commit 8697dd5, recoverable from git history). The reason is recorded in my handoff note. It was never registered with OpenCode, so agent prompts described tools the agents did not have. It never constrained bash, it only governed calls to its own six tools, and most of its blocklist was dead config. It also had a bypass: a push of fix/x:main passed its branch check. Git protection is now declarative dcg policy, described in the post on declarative git policy. Details are in the restricted MCP servers post.

The webfetch-filter MCP server

The webfetch-filter MCP server is not dropped. It was not registered for a long time, and it has been registered for the research agent since 2026-10-16 (commit 1c5bc88). Its sanitiser also protects the built-in webfetch through the plugin webfetch-sanitize.js.

The laya approval gate, shield and critic

The laya approval gate was removed on 2026-09-30 (commit 5edcb95) with no reason recorded. On 2026-10-15 I also measured laya as a prompt shield and as a critic and rejected it as a blocker in both roles. The figures are in the command guards post.

The stale pin script

Part 5 pointed at scripts/pin-skill-hashes.sh as the pinning mechanism. Its header still tells me to paste values into nix/home/ai-tools.nix, a file that no longer exists after the 2026-09-25 split into nix/home/ai-tools/. The skill pinning post covers it. I did not fix the script.

Claimed versus shipped

What I do differently now

Part 4 now opens with "This post is a design. None of it is built", and Part 5 has an update note dated 2026-09-30 and a status column in its milestone table. Part 8 has a dated correction note. The blog repo state is now squashed. I did not verify that Parts 4, 5 or 15 link to this post, and I can see no status banner of a fixed format on Part 15.

In my recent posts I say in the first paragraph whether something is built or only designed.

What I could not verify

• Why the blog dates and the commit dates for the Hermes VM disagree.
• Whether the Lima Hermes agent in lima/hermes.yaml runs today.
• Any reason for dropping gVisor, Firecracker and Heracles, since none is recorded.
• Which stale git-restricted MCP references remain in the repo, and whether an older session registered it in a project-level config I did not find.