TironianWhat it reads
- Your Hermes history. The profile's
state.db, opened read only, on first use and when you runhermes tironian import. Tironian never writes to it. - Each turn as it happens. The request Hermes sends to your model and the response, tool results, approvals and session events, through Hermes's public plugin hooks.
- Its own settings and the Modal token, through Hermes's config and secret store. It never reads
.env,auth.jsonor other tools' credentials directly.
What it stores
Everything lives in <HERMES_HOME>/plugin-data/tironian/ on your computer:
- masked request contexts and responses, tool outcomes and grades (
tironian.db), - datasets you build, in the Hermes ShareGPT format,
- training job folders and the models you train, as GGUF files.
Recorded contexts older than retention_days (90) are dropped; counts and grades are kept so your statistics stay correct.
What it masks
| Kind | Examples |
|---|---|
| Provider keys | OpenAI, Anthropic, OpenRouter, Google, Stripe, Hugging Face, Modal |
| Tokens | GitHub, AWS access keys, Slack, JWTs, bearer tokens |
| Private keys | Any BEGIN ... PRIVATE KEY block |
| Credentials in text | password=, token:, user:pass@ inside URLs |
| Random strings | Long, high-entropy values that look like secrets |
| Personal details | Emails, phone numbers, card numbers (Luhn checked), IBANs |
| Your machine | Your home folder and login name |
Masks look like [REDACTED:email]. Git hashes, UUIDs, dates, version numbers and file paths are left alone on purpose, because they are useful and not secret. A step with more than five masked secrets or personal details is kept for statistics but never trained on.
What it sends
During normal use: nothing. The router only talks to student_endpoint, which is Hermes's own local model server on 127.0.0.1 by default.
When you start a training run: Tironian's separate trainer process uploads that one family's masked training examples to a private Volume in your own Modal account, trains there, downloads the model and deletes the job's files from the Volume. Held-out examples used for testing never leave your machine.
If you switch on the judge (off by default): held-out examples are sent to whichever model you assign to the "Tironian judge" slot in Hermes. While a family is in shadow mode, that model also gets the request and both answers whenever they differ, up to a daily budget you set.
There is no telemetry, no analytics and no account.
Your controls
| Do this | To |
|---|---|
/tironian off | Stop learning from the current conversation and exclude what was captured |
| Delete a session in Hermes | Delete everything Tironian kept from it |
capture_enabled: false | Stop capture everywhere |
exclude_platforms | Never learn from chosen platforms (cron and kanban by default) |
hermes tironian purge --yes | Delete everything Tironian captured |
Promises about answers
- Your usual model is called at most once per request, and any failure inside Tironian falls through to it.
- A small model answers only after passing a held-out test on your own sessions, and only for its own task.
- Every answer it gives must parse, use a tool the request offers and pass that tool's schema; otherwise your model answers.
- After any failed or blocked step, your model finishes the turn.
- Hermes's approvals apply to the small model's tool calls exactly as they do to your model's.
- A model that falls back too often, or that you mark bad twice, is demoted to shadow mode by itself.
What it runs
Inside Hermes, Tironian uses only the Python standard library and installs nothing. hermes tironian trainer setup, which you run yourself, creates a separate environment in the plugin's data folder and installs the Modal client from PyPI (--local also installs the training libraries). Training runs there as its own process, only when you start it. Cron jobs, the gateway and model turns can never start a training run.
Reporting a problem
Found something that leaks, or a secret that wasn't masked? Please open an issue without including the secret itself, and describe its shape instead (for example "a key starting with xyz_ followed by 40 letters").