Foundation
What is already real
- One Hermes identity with a separate HERMES_INTERNAL_OWNER capability.
- D1 task queue, events, cancellation, evidence and approval state.
- The Mac runner is outbound-only and exposes no remote shell.
- Codex runs on an isolated task branch and must stop at consequential gates.