MalloryEstate Briefing
M·042Approved — ready for plan
← All briefings

Q & Hermes

Q — Command Center

A new top-level R&D surface — Watch, Delegate, Talk — turning the purposeless ?view=hermes panel into a live channel to Q, the persona over Hermes.

Dated 2026-06-16Programme Q & Hermes

Situation

Mallory could hold context and delegate to Hermes, but there was no single place to watch the estate's in-flight work, hand Q trusted tasks, or just talk to it. Q is the user-facing persona for Hermes (the dev-driver on the Tower) — the Bond-films naming holds because Gareth Mallory *is* M, and Q is the quartermaster who builds the gadgets, exactly Hermes' role.

v1 does three things: Watch (a Sit Rep of what Mallory and Q are doing now/queued/done), Delegate (queue → Q proposes a plan → Alex approves → Q runs → PR/note lands), and Talk (voice-first, persona-filtered dialogue with Q). It absorbs the standalone Hermes feed while keeping its cron backstop, and reuses Task Workspace, Composer, teaser/voicing and the Updates pipeline to keep the build tractable.

Key decisions

New nav tab, not a tray sheet

Bottom nav graduates to Home · Intel · Loops · R&D; Intel/Loops move from the tray-sheet toggle to real tabs, R&D is the fourth.

Q is a persona label, backend unchanged

Hermes' services, hermes_events, /hermes routes and the Tower itself are untouched — Q is a persona over them, exactly as Mallory is a persona over the edge Worker.

Delegation is the "C" model

queue → Q proposes a plan → Alex approves → Q runs. The PR/note is the deep review; no autonomous writes before approval.

Tower dials out to a QHub Durable Object

A hibernatable-WebSocket DO relay; clients connect via CF Access cookie, the Tower connects via CN-gated service token — no inbound Tower port, invariant intact.

Hermes feed absorbed, dual-producer

The live socket and the existing */30 /hermes/digest cron both write to hermes_events; INSERT OR IGNORE on dedupe_key guarantees no doubles regardless of which producer lands first.

Safety: ship as-is, harden later

Q keeps Alex's existing alexhansford identity, broad token, --yolo. The only gates are plan-approval and PR/note review; scoped-identity hardening is an explicit deferred future round.

Architecture

A single QHub Durable Object is the live relay; D1 stays the system of record so Sit Rep survives DO cold-starts and Tower downtime degrades gracefully.

QHub Durable Object
Hibernatable WS hub; relays client↔Q messages, tracks Q presence, writes through to D1 on every durable event.
migration 018 (q_tasks, q_messages)
Task lifecycle (awaiting_plan → plan_ready → approved → running → needs_you → done/failed/cancelled) and the per-task/general conversation transcript.
Worker routes (/q/socket, /q/tasks, /q/thread, /q/presence)
CF-Access-gated for clients, CN-gated for the Tower peer; REST is the cold-load/offline fallback to the live socket.
Tower Q-gateway (mallory-runtime)
Durable systemd service dialing out to the DO; on approve runs hermes -z --yolo, streams progress, posts the result PR/note URL back.
Web Sit Rep + Q conversation
Three lanes (in-motion/queued/done) landing page; per-task conversation reuses TaskWorkspace.svelte + MessageView, plan renders as a steps strip.
Persona voicing (edge-side)
Q's raw Tower output is voiced via the existing Haiku composeTeaser layer at the edge, keeping brand voice centrally controlled.

Risks & guardrails

Broad identity running unattended

The residual risk after collapsing prompt-injection (delegated tasks are Alex-authored/trusted) is mitigated by the two human gates (plan approval, PR/note review) — full hardening is parked as a future round.

Tower downtime

No Q peer connected → presence shows offline, delegated tasks still queue in D1, Talk shows a pending message — Mallory's core is unaffected; strictly better than the prior */30 poll lag.

Open build-time decisions

Hermes gateway plugin vs. a standalone Node relay (spike first), the exact CN constant for the Tower socket, and whether persona voicing runs edge- or Tower-side are all deferred to plan time.

Delivery

P1 — nav-bar shell

Graduate Intel/Loops to tabs, add the R&D tab + ?view=rnd deep-link, retire/redirect ?view=hermes.

P2 — data + REST + Sit Rep

Migration 018, q_tasks/q_messages helpers, REST routes, Sit Rep read surface (no live yet).

P3 — DO + WebSocket transport

QHub DO, /q/socket (CF-Access + CN auth), presence, broadcast, write-through — live updates begin.

P4 — Tower gateway

Durable service, dial-out + reconnect, task → plan → approve → run, result post-back, dry-run + tests.

P5 — Talk + persona + voice + live activity

General Talk-to-Q thread, per-task conversation polish, persona voicing, Q-speaks-first via Updates/nudge, dual-producer activity.

P6 — verify + design review

On-device verify checklist, design-consistency review, capability-registry entry, docs.

Out of scope

Dev-driver hardening (scoped bot identity, lane-narrowing, branch protection)Command-center actions beyond delegate/approve (reprioritise, edit, kick off digs from R&D)Mode-aware Q behaviour (per-hat task routing)vLLM / cost-routing for Q
spec · docs/superpowers/specs/2026-06-16-rnd-surface-q-command-center-design.md
plan · docs/superpowers/plans/2026-06-16-rnd-surface-q-command-center.md
Mallory · Estate briefing