capthvnsen/alans-way is a project in which the Hermes bot directly manipulates browser tabs on both a Mac and a cloud VPS from a macOS app, with Telegram attached as well, handing off between the two environments. The 2026-10-31 commit cfdb8ed added only a single document without touching runtime code. docs/qa/security-merge-plan.md grew by 288 lines, and no lines were deleted. The intent revealed in the commit message is to prepare the security migration in advance without locking down the installed connector.
This document is close to a practical merge record. The 10 security PRs (#243, #266, #267, #268, #271, #272, #273, #275, #270, #274) were rebased onto the current main and then squash-merged in a fixed order, and for each of them the verified head and the CI run number were recorded alongside. As the document makes clear, the listed test workflow passed all 8 checks, and #270 additionally passed a ninth kernel filter check in a separate one-off Linux network namespace. Credential subject cleanup was also included. The registry's botId is an invariant subject that remains in place after replacement, the per-bot bearer tokens are tied to that subject and to an isolated OS UID, and the Tailscale identity signifies only device reachability.
However, the only thing this commit changed is the document. According to the same document, no installation had the strict flag turned on, provisioning was not run, and the real machine's SSH keys, firewall, and Tailscale ACL were not touched either. Existing installations keep the legacy path as-is and wait until the operator explicitly chooses the provisioned alternative path. The document itself states that the unit tests it passed are not evidence of live OS isolation or of a provisioned forced command listener, and that the update budget timing in the Windows hermes-update-ps1.test.cjs remains an observed flake. As it reads now, the security phase has been tidied up and left behind as a document, and the actual application is still ahead.