Q & Hermes
Q — Command Center
A new top-level R&D surface — Watch, Delegate, Talk — turning the purposeless ?view=hermes panel into a live channel to Q, the persona over Hermes.
Situation
Mallory could hold context and delegate to Hermes, but there was no single place to watch the estate's in-flight work, hand Q trusted tasks, or just talk to it. Q is the user-facing persona for Hermes (the dev-driver on the Tower) — the Bond-films naming holds because Gareth Mallory *is* M, and Q is the quartermaster who builds the gadgets, exactly Hermes' role.
v1 does three things: Watch (a Sit Rep of what Mallory and Q are doing now/queued/done), Delegate (queue → Q proposes a plan → Alex approves → Q runs → PR/note lands), and Talk (voice-first, persona-filtered dialogue with Q). It absorbs the standalone Hermes feed while keeping its cron backstop, and reuses Task Workspace, Composer, teaser/voicing and the Updates pipeline to keep the build tractable.
Key decisions
New nav tab, not a tray sheet
Bottom nav graduates to Home · Intel · Loops · R&D; Intel/Loops move from the tray-sheet toggle to real tabs, R&D is the fourth.
Q is a persona label, backend unchanged
Hermes' services, hermes_events, /hermes routes and the Tower itself are untouched — Q is a persona over them, exactly as Mallory is a persona over the edge Worker.
Delegation is the "C" model
queue → Q proposes a plan → Alex approves → Q runs. The PR/note is the deep review; no autonomous writes before approval.
Tower dials out to a QHub Durable Object
A hibernatable-WebSocket DO relay; clients connect via CF Access cookie, the Tower connects via CN-gated service token — no inbound Tower port, invariant intact.
Hermes feed absorbed, dual-producer
The live socket and the existing */30 /hermes/digest cron both write to hermes_events; INSERT OR IGNORE on dedupe_key guarantees no doubles regardless of which producer lands first.
Safety: ship as-is, harden later
Q keeps Alex's existing alexhansford identity, broad token, --yolo. The only gates are plan-approval and PR/note review; scoped-identity hardening is an explicit deferred future round.
Architecture
A single QHub Durable Object is the live relay; D1 stays the system of record so Sit Rep survives DO cold-starts and Tower downtime degrades gracefully.
awaiting_plan → plan_ready → approved → running → needs_you → done/failed/cancelled) and the per-task/general conversation transcript.hermes -z --yolo, streams progress, posts the result PR/note URL back.TaskWorkspace.svelte + MessageView, plan renders as a steps strip.composeTeaser layer at the edge, keeping brand voice centrally controlled.Risks & guardrails
Broad identity running unattended
The residual risk after collapsing prompt-injection (delegated tasks are Alex-authored/trusted) is mitigated by the two human gates (plan approval, PR/note review) — full hardening is parked as a future round.
Tower downtime
No Q peer connected → presence shows offline, delegated tasks still queue in D1, Talk shows a pending message — Mallory's core is unaffected; strictly better than the prior */30 poll lag.
Open build-time decisions
Hermes gateway plugin vs. a standalone Node relay (spike first), the exact CN constant for the Tower socket, and whether persona voicing runs edge- or Tower-side are all deferred to plan time.
Delivery
P1 — nav-bar shell
Graduate Intel/Loops to tabs, add the R&D tab + ?view=rnd deep-link, retire/redirect ?view=hermes.
P2 — data + REST + Sit Rep
Migration 018, q_tasks/q_messages helpers, REST routes, Sit Rep read surface (no live yet).
P3 — DO + WebSocket transport
QHub DO, /q/socket (CF-Access + CN auth), presence, broadcast, write-through — live updates begin.
P4 — Tower gateway
Durable service, dial-out + reconnect, task → plan → approve → run, result post-back, dry-run + tests.
P5 — Talk + persona + voice + live activity
General Talk-to-Q thread, per-task conversation polish, persona voicing, Q-speaks-first via Updates/nudge, dual-producer activity.
P6 — verify + design review
On-device verify checklist, design-consistency review, capability-registry entry, docs.
Out of scope
docs/superpowers/specs/2026-06-16-rnd-surface-q-command-center-design.mdplan ·
docs/superpowers/plans/2026-06-16-rnd-surface-q-command-center.md