chore(catalog): review disclosure for hermes-workflows

plugin-catalog/hermes-workflows.yaml

@@ -1,44 +1,14 @@
 name: hermes-workflows
 repo: https://github.com/jacobhausler/hermes-workflows
 sha: 464b4aa304960c89522e709d6b109d0fd08fe06e
-description: "Agent-owned workflow graphs for Hermes — a background runner executes
-  a JSON DAG of agent nodes, fan-outs (quorum) and human/machine gates with fingerprint
-  replay-skip resume, cooperative steer, typed failure events and compact status payloads;
-  ships a desktop DAG view, an inline transcript card and the authoring skill with
-  measured budget recipes. Stock Hermes; no patched core required. Disclosure — every
-  workflow run spawns a detached background runner (wf.py run <id>) that survives
-  session end, gateway restart and plugin disable until the graph reaches a boundary
-  or workflow stop; each agent node is a child hermes chat --query-file … --oneshot
-  -Q … inheriting the runner's environment, and a node with profile set runs as that
-  named profile (with its own credentials) only if the target's workflow_team.json
-  lists the launcher; a gate's wait.until_argv runs an agent-authored argv directly
-  from the runner, outside Hermes' tool-approval gate (the engine uses no shell, but
-  the shipped machine-watch and incident-response templates use it to run a shell
-  line read from a fixed-name handoff file under $HERMES_HOME, and release-lifecycle
-  one read from a per-run handoff file in the run dir); the runner makes itself the
-  subreaper of its children and SIGTERM/SIGKILLs any process a node leaves running
-  (its own descendants plus pids registered in the run's .proctree_sidecar.jsonl)
-  when the node finishes, retries or the run stops; run and amend send a one-token
-  ping through Hermes' configured providers to check pinned model routes; at gate.held/run.done/run.failed
-  the runner reads the API server key from config.yaml and POSTs a wake turn to the
-  local Hermes API server — the gate.held wake only relays the gate to the human,
-  but the run.done wake tells the woken session to turn the run's findings into tracked
-  work and dispatch follow-up work (as PRs) before the turn ends, and the run.failed
-  wake to apply one corrective amend/repair/resume; a transform_llm_output hook appends
-  a ::workflow{id} card line to replies for runs the session launched in the last
-  30 minutes; the runner reads WORKFLOW_MAX_SEATS (that key only) from $HERMES_HOME/.env
-  and the active profile's .env; state.db is read read-only, including every profile's
-  session ids and profile names, and status/wait can read runs in sibling profiles'
-  workflows dirs; state lives under $HERMES_HOME/workflows/ (or a configured runs_root).
-  No other network of its own."
+description: "Agent-owned workflow graphs for Hermes — a background runner executes a JSON DAG of agent nodes, fan-outs (quorum) and human/machine gates with fingerprint replay-skip resume, cooperative steer, typed failure events and compact status payloads; ships a desktop DAG view, an inline transcript card and the authoring skill with measured budget recipes. Stock Hermes; no patched core required. Disclosure — every workflow run spawns a detached background runner (wf.py run <id>) that survives session end, gateway restart and plugin disable until the graph reaches a boundary or workflow stop; each agent node is a child hermes chat --query-file … --oneshot -Q … inheriting the runner's environment, and a node with profile set runs as that named profile (with its own credentials) only if the target's workflow_team.json lists the launcher; a gate's wait.until_argv and a fan-out's precheck_argv (run once per item before its child spawns) run agent-authored argv directly from the runner, outside Hermes' tool-approval gate (the engine uses no shell, but the shipped machine-watch and incident-response templates use until_argv to run a shell line read from a fixed-name handoff file under $HERMES_HOME, and release-lifecycle one read from a per-run handoff file in the run dir); the runner makes itself the subreaper of its children and SIGTERM/SIGKILLs any process a node leaves running (its own descendants plus pids registered in the run's .proctree_sidecar.jsonl) when the node finishes, retries or the run stops; run and amend send a one-token ping through Hermes' configured providers to check pinned model routes; at gate.held/run.done/run.failed/run.partial and fan-out straggler events the runner reads the API server key from config.yaml (or API_SERVER_KEY) and POSTs a wake turn to the configured Hermes API server — the gate.held, run.done, run.failed and run.partial wakes state they authorize no choice, repair or additional work, while the straggler wake asks the woken session to take one action (steer the open items, accept the partial, or stop the run); a transform_llm_output hook appends a ::workflow{id} card line to replies for runs the session launched in the last 30 minutes; the runner reads WORKFLOW_MAX_SEATS (that key only) from $HERMES_HOME/.env and the active profile's .env; state.db is read read-only, including every profile's session ids and profile names, and status/wait can read runs in sibling profiles' workflows dirs; opt-in settings (all default off) mirror run lifecycle events to an operator-configured https webhook with an optional bearer (outbound_bridge), present held gates into the run owner's own gateway session via plugin message injection (hooks_bridge_allow: approval_bridge, which also needs allow_gateway_injection), and append delegate_task child records to a spool under $HERMES_HOME/plugin-state (hooks_allow: subagent_accounting); state lives under $HERMES_HOME/workflows/ (or a configured runs_root). No other network of its own."
 maintainer: jacobhausler
 tier: community
 category: automation
 requires_hermes: ">=0.21.4"
 docs_url: https://github.com/jacobhausler/hermes-workflows#readme
 version: "1.4.3"
-image: 
-  https://raw.githubusercontent.com/jacobhausler/hermes-workflows/464b4aa304960c89522e709d6b109d0fd08fe06e/assets/dag-review.png
+image: https://raw.githubusercontent.com/jacobhausler/hermes-workflows/464b4aa304960c89522e709d6b109d0fd08fe06e/assets/dag-review.png
 screenshots:
 - https://raw.githubusercontent.com/jacobhausler/hermes-workflows/464b4aa304960c89522e709d6b109d0fd08fe06e/assets/dag-review.png
 - https://raw.githubusercontent.com/jacobhausler/hermes-workflows/464b4aa304960c89522e709d6b109d0fd08fe06e/assets/branch-gate.png