From 7aa7940ecb43715fce2121e7eef36cf73404c524 Mon Sep 17 00:00:00 2001
From: Hao <wch314159@gmail.com>
Date: Fri, 31 Jul 2026 23:30:36 +0800
Subject: [PATCH] feat: add Hermes graph query skill

Add a generated codegraph-query Hermes skill to the Hermes installer target, including projectPath recovery guidance, MCP-first routing, CLI fallback, and operational notice preservation.\n\nAdd installer tests for skill generation, idempotency, config preservation, and uninstall cleanup. Include OpenSpec project artifacts and archived spec-driven change.
---
 .hermes/skills/openspec-apply-change/SKILL.md | 198 ++++++++++++
 .../codegraph-hermes-wrapper-apply.md         |  43 +++
 .../skills/openspec-archive-change/SKILL.md   | 182 +++++++++++
 .hermes/skills/openspec-explore/SKILL.md      | 296 ++++++++++++++++++
 .hermes/skills/openspec-propose/SKILL.md      | 126 ++++++++
 .hermes/skills/openspec-sync-specs/SKILL.md   | 223 +++++++++++++
 .../skills/openspec-update-change/SKILL.md    |  90 ++++++
 __tests__/installer-targets.test.ts           |  70 +++++
 .../.openspec.yaml                            |   2 +
 .../design.md                                 |  72 +++++
 .../proposal.md                               |  24 ++
 .../specs/hermes-graph-query-wrapper/spec.md  |  49 +++
 .../tasks.md                                  |  27 ++
 openspec/config.yaml                          |  32 ++
 .../specs/hermes-graph-query-wrapper/spec.md  |  51 +++
 src/installer/targets/hermes.ts               | 111 ++++++-
 16 files changed, 1589 insertions(+), 7 deletions(-)
 create mode 100644 .hermes/skills/openspec-apply-change/SKILL.md
 create mode 100644 .hermes/skills/openspec-apply-change/references/codegraph-hermes-wrapper-apply.md
 create mode 100644 .hermes/skills/openspec-archive-change/SKILL.md
 create mode 100644 .hermes/skills/openspec-explore/SKILL.md
 create mode 100644 .hermes/skills/openspec-propose/SKILL.md
 create mode 100644 .hermes/skills/openspec-sync-specs/SKILL.md
 create mode 100644 .hermes/skills/openspec-update-change/SKILL.md
 create mode 100644 openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/design.md
 create mode 100644 openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/proposal.md
 create mode 100644 openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/specs/hermes-graph-query-wrapper/spec.md
 create mode 100644 openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/tasks.md
 create mode 100644 openspec/config.yaml
 create mode 100644 openspec/specs/hermes-graph-query-wrapper/spec.md

diff --git a/.hermes/skills/openspec-apply-change/SKILL.md b/.hermes/skills/openspec-apply-change/SKILL.md
new file mode 100644
index 000000000..efdf4096e
--- /dev/null
+++ b/.hermes/skills/openspec-apply-change/SKILL.md
@@ -0,0 +1,198 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.7.0"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `view`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/openspec-apply-change <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+   - Optional `context`: current required project instruction input from the selected root
+   - Optional `operationGuidance`: current advisory guidance for apply
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change (if it is not installed, run `openspec status --change "<name>" --json` to see the next artifact and `openspec instructions <artifact-id> --change "<name>" --json` for how to create it)
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+   Treat `context` as a required prompt-level input. Read and consider it, and
+   apply relevant project facts, conventions, and constraints while implementing.
+   Treat `operationGuidance` as optional additive advice. Read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   workflow.
+
+   Keep both fields separate from CLI-returned state, missing artifacts, tasks,
+   progress, `contextFiles`, and the built-in `instruction`. They are not
+   evidence of task completion, do not replace the built-in instruction, and do
+   not permit bypassing a blocked state. If context conflicts with the built-in
+   instruction, an explicit user choice, or a CLI-controlled value, report the
+   conflict and preserve the controlling value. If guidance is inapplicable or
+   conflicts with those controlling inputs, do not follow it and explain why.
+   These are prompt-level behavior contracts, not enforceable checks.
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+   Do not copy `context` or `operationGuidance` verbatim into implementation
+   files or planning artifacts unless the user separately asks for that content.
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+- Do not use context or operation guidance as proof that a task is complete
+- Apply relevant project context; report conflicts with controlling workflow inputs
+- Consider every guidance entry; explain any inapplicable or conflicting advice
+- Do not copy runtime context or operation guidance into implementation files or planning artifacts
+- Preserve CLI-controlled blocked/ready/all-done behavior and completion criteria
+
+**Validation and sandbox pitfalls**
+- OpenSpec v1.7 validates a single change with `openspec validate "<change-name>" --type change --strict --json`; `openspec validate --change "<name>"` is not valid for this CLI shape.
+- When verifying installer code that writes Hermes files, set `HERMES_HOME` explicitly in the spawned process. Setting only `HOME` may not affect already-resolved `os.homedir()` behaviour in the test process and can accidentally write to the real `~/.hermes`.
+- If a verification command accidentally touches the real Hermes profile, immediately undo through the same installer/uninstaller path and re-check the affected config/skill paths before reporting success.
+- See `references/codegraph-hermes-wrapper-apply.md` for a compact example of the validation/sandbox pattern.
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
+
+## CodeGraph/Hermes integration notes
+
+When applying changes that modify Hermes installer behavior or generated Hermes skills, see `references/codegraph-hermes-wrapper-apply.md` for session-proven details:
+- OpenSpec v1.7 single-item validation syntax is `openspec validate "<change-name>" --type change --strict --json`; do not use `openspec validate --change ...`.
+- When verifying built installer code that writes Hermes config or skills, isolate with `HERMES_HOME=<tmp>/hermes`, not just `HOME`, because the target resolves `$HERMES_HOME/config.yaml` first.
+- If a sandbox verification accidentally writes to the real Hermes profile, undo via the same target's `uninstall('global')` path, then verify the real config and skill directory no longer contain the temporary additions.
diff --git a/.hermes/skills/openspec-apply-change/references/codegraph-hermes-wrapper-apply.md b/.hermes/skills/openspec-apply-change/references/codegraph-hermes-wrapper-apply.md
new file mode 100644
index 000000000..298566c01
--- /dev/null
+++ b/.hermes/skills/openspec-apply-change/references/codegraph-hermes-wrapper-apply.md
@@ -0,0 +1,43 @@
+# CodeGraph Hermes wrapper apply notes
+
+Use this reference when applying an OpenSpec change that modifies Hermes/CodeGraph integration behaviour.
+
+## Single-change validation
+
+OpenSpec v1.7 uses the item-name form for single-change validation:
+
+```bash
+openspec validate "<change-name>" --type change --strict --json
+```
+
+Do not use `openspec validate --change "<name>"`; that flag belongs to other OpenSpec commands such as `status` and `instructions`, not `validate`.
+
+## Safe Hermes installer verification
+
+When testing built installer code that writes Hermes config or skills, isolate with `HERMES_HOME`, not just `HOME`:
+
+```bash
+TMP=$(mktemp -d /tmp/codegraph-hermes-install-XXXXXX)
+HERMES_HOME="$TMP/hermes" node - <<'JS'
+const fs = require('fs');
+const path = require('path');
+const { getTarget } = require('./dist/installer/targets/registry');
+const hermes = getTarget('hermes');
+const result = hermes.install('global', { autoAllow: true });
+console.log(JSON.stringify(result, null, 2));
+console.log(fs.readFileSync(path.join(process.env.HERMES_HOME, 'config.yaml'), 'utf8'));
+console.log(fs.readFileSync(path.join(process.env.HERMES_HOME, 'skills', 'codegraph-query', 'SKILL.md'), 'utf8'));
+JS
+rm -rf "$TMP"
+```
+
+If a test accidentally writes to the real profile, undo through the same target before continuing:
+
+```bash
+node - <<'JS'
+const { getTarget } = require('./dist/installer/targets/registry');
+console.log(JSON.stringify(getTarget('hermes').uninstall('global'), null, 2));
+JS
+```
+
+Then verify the real `~/.hermes/config.yaml` and `~/.hermes/skills/<skill>/` no longer contain the temporary additions.
diff --git a/.hermes/skills/openspec-archive-change/SKILL.md b/.hermes/skills/openspec-archive-change/SKILL.md
new file mode 100644
index 000000000..eaa7b0dda
--- /dev/null
+++ b/.hermes/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,182 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.7.0"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `view`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
+
+   When prompting, show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/openspec-archive-change <other>`).
+
+   **Load current archive inputs before the existing archive checks:**
+
+   After resolving the selected change and planning root, run:
+   ```bash
+   openspec instructions archive --change "<name>" --json
+   ```
+   Keep the same selected-root flags on this command. This lookup is advisory and
+   optional: it only supplies extra prompt inputs, so it must never block archiving.
+   If it exits non-zero or returns invalid JSON — for example on an older CLI that
+   does not support this command yet — continue the archive workflow with no
+   context and no operation guidance. Do not report an error and do not stop.
+
+   A successful response may omit both optional fields. Treat `context` as a
+   required prompt-level input: read and consider it, and apply relevant project
+   facts, conventions, and constraints. Treat `operationGuidance` as optional
+   additive advice: read and consider every entry, and follow entries that are
+   applicable and compatible with the built-in archive workflow.
+
+   Keep both fields separate from built-in steps, explicit user choices, resolved
+   paths, CLI checks, and command contracts. If context conflicts with one of those
+   controlling inputs, report the conflict and preserve the controlling value. If
+   guidance is inapplicable or conflicts with a controlling input, do not follow it
+   and explain why. Do not infer replacement paths, skipped prompts, or flags from
+   either field, and do not copy their text verbatim into specs, change artifacts,
+   or archive summaries unless the user separately asks for it. These are
+   prompt-level behavior contracts, not enforceable checks.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done`, `skipped`, or other)
+
+   **If any artifacts are neither `done` nor `skipped`** (skipped artifacts satisfy the requirement - the change declares skip_specs):
+   - Display warning listing incomplete artifacts
+   - Ask the user to confirm they want to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Ask the user to confirm they want to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON as the only
+   delta-spec source. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, proceed without a sync prompt and do not infer
+   delta specs from other artifacts.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `<planningHome.root>/openspec/specs/<capability>/spec.md` (use the store-aware `planningHome.root` from step 2, not a hardcoded repo path)
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   Route on the answer:
+   - "Cancel" — stop, do not archive
+   - "Archive without syncing" or "Archive now" — proceed to archive
+   - "Sync now" or "Sync anyway" — sync, then verify (below)
+   - Anything else — ask again rather than archiving
+
+   Before a selected sync writes any main spec, run
+   `openspec instructions specs --change "<name>" --json` once with the same
+   selected-root flags. Require a zero exit status and valid artifact-instruction
+   JSON. If the lookup fails or returns invalid JSON, report the error and stop
+   before writing any main spec or moving the change. A valid response with omitted
+   `rules` is the no-rules case. Apply returned `rules` only to the content and
+   form of main specs produced by this merge; do not use them as archive guidance,
+   change CLI behavior, or copy the rule text into any output file.
+
+   Then run the `openspec-sync-specs` workflow inline (agent-driven intelligent merge) for change '<name>', passing the delta spec analysis and the fetched specs-rule snapshot from above, and wait for it to finish. The inline sync must reuse that snapshot without fetching `specs` instructions again. Do not delegate it to a background task — step 5 would move `changeRoot` out from under a sync that is still reading it, leaving the change archived and the main specs never updated. If your agent can only run it by delegation, delegate synchronously and wait for the result.
+
+   Then re-run the comparison from the top of this step against every capability that has a delta spec in `artifactPaths.specs.existingOutputPaths` — not only the ones the sync reports it touched. A successful sync leaves nothing left to apply, so each capability must now read as already synced:
+   - ADDED requirements present
+   - MODIFIED requirements carrying the scenario and description changes named in the delta, with their other scenarios intact
+   - REMOVED requirements gone
+   - RENAMED requirements present under the new name and absent under the old one
+
+   If the sync failed, or any capability does not match, report what differs and stop — do not archive. Nothing has moved and `changeRoot` is intact, so the user can fix the mismatch or re-run the sync and start the archive again.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate the target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<change-name>`. Never stack a second date (same rule as `openspec archive`).
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```markdown
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
+**Specs:** <"✓ Synced to main specs" only if the step 4 verification passed; otherwise "No delta specs" or "Sync skipped">
+
+<"All artifacts complete. All tasks complete." — or, if archived with warnings, list them instead (e.g. "Archived with 2 incomplete tasks")>
+```
+
+**Guardrails**
+- Announce the selected change; prompt for selection when it is ambiguous
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, run the `openspec-sync-specs` workflow inline (agent-driven)
+- Never archive while a spec sync is still in flight — run the sync inline and verify the main specs before moving `changeRoot`
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
+- For OpenSpec v1.7 single-item validation, use `openspec validate "<item-name>" --type change --strict --json` or `--type spec`; do not use `openspec validate --change ...`
+- After syncing a new capability delta, validate the resulting main spec and ensure it uses main-spec format (`# <capability> Specification`, `## Purpose`, `## Requirements`) with no delta headers like `## ADDED Requirements`
+- Apply relevant runtime context and report conflicts; operation guidance remains advisory
+- Consider every guidance entry and explain any inapplicable or conflicting advice
+- Existing CLI checks, resolved paths, prompts, and command contracts are unchanged
+- Artifact rules constrain only the specs being written and are never operation guidance
+- Never copy runtime context, operation guidance, or artifact-rule text verbatim into output files
diff --git a/.hermes/skills/openspec-explore/SKILL.md b/.hermes/skills/openspec-explore/SKILL.md
new file mode 100644
index 000000000..be7ef3ef7
--- /dev/null
+++ b/.hermes/skills/openspec-explore/SKILL.md
@@ -0,0 +1,296 @@
+---
+name: openspec-explore
+description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.7.0"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `view`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+Then read the project's own context from the resolved root - `<root.path>/openspec/config.yaml` (or `config.yml`). Use the `root.path` returned above, and skip this if neither file exists:
+- `context`: project background - tech stack, conventions, constraints
+- `rules`: keyed by artifact id - the entries for an artifact apply only when you write that artifact
+
+Ground your thinking in these. They are constraints for you to follow, not content to reproduce: do NOT copy them into the conversation or into any artifact you create.
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ════════════════════════════════════════════
+
+      Awareness          Coordination         Sync
+          │                   │                 │
+          ▼                   ▼                 ▼
+      ┌────────┐         ┌────────┐        ┌────────┐
+      │Presence│         │Cursors │        │  CRDT  │
+      │  "3    │         │ Multi  │        │Conflict│
+      │online" │         │ select │        │  free  │
+      └────────┘         └────────┘        └────────┘
+          │                   │                 │
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     ┌─────────────────────────────────────────────┐
+     │              CURRENT AUTH FLOW              │
+     └─────────────────────────────────────────────┘
+                        │
+          ┌─────────────┼─────────────┐
+          ▼             ▼             ▼
+     ┌─────────┐  ┌─────────┐  ┌─────────┐
+     │ Google  │  │  GitHub │  │  Email  │
+     │  OAuth  │  │  OAuth  │  │  Magic  │
+     └────┬────┘  └────┬────┘  └────┬────┘
+          │             │             │
+          └─────────────┼─────────────┘
+                        ▼
+                  ┌───────────┐
+                  │  Session  │
+                  └─────┬─────┘
+                        │
+                        ▼
+                  ┌───────────┐
+                  │   Perms   │
+                  └───────────┘
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /openspec-explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     ┌─────────────────────────────────────────────────┐
+     │          CLI TOOL DATA STORAGE                  │
+     └─────────────────────────────────────────────────┘
+
+     Key constraints:
+     • No daemon running
+     • Must work offline
+     • Single user
+
+                  SQLite          Postgres
+     Deployment   embedded ✓      needs server ✗
+     Offline      yes ✓           no ✗
+     Single file  yes ✓           no ✗
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Create a change proposal
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.hermes/skills/openspec-propose/SKILL.md b/.hermes/skills/openspec-propose/SKILL.md
new file mode 100644
index 000000000..542a8f44b
--- /dev/null
+++ b/.hermes/skills/openspec-propose/SKILL.md
@@ -0,0 +1,126 @@
+---
+name: openspec-propose
+description: Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.7.0"
+---
+
+Propose a new change - create the change and generate all artifacts in one step.
+
+I'll create a change with the artifacts your schema defines. With the default spec-driven schema that is:
+- proposal.md (what & why)
+- `specs/<capability>/spec.md` (what the system must do - a delta, not the main spec)
+- design.md (how)
+- tasks.md (implementation steps)
+
+When ready to implement, run /openspec-apply-change
+
+---
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `view`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Ask the user (open-ended, no preset options):
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI with `.openspec.yaml`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts, each with its `status` and its `requires` edges (the artifact IDs it directly depends on)
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create every artifact in the required set**
+
+   Use a todo list to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - stop and pick another artifact
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+      - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+      - Otherwise create the artifact file using `template` as the structure and write it to `resolvedOutputPath`. If `resolvedOutputPath` is a glob, follow `instruction` to choose the concrete file path
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "Created <artifact-id>"
+
+   b. **Continue until every artifact in the required set exists (not just `apply.requires`)**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - The required set is `applyRequires` plus every artifact reachable from those by following the `requires` edges in `status --json` - walk them transitively (spec-driven closes over proposal, specs, design, tasks). Leave artifacts outside that set alone
+      - `status` is file-existence only, so an `applyRequires` artifact reading `done` does NOT mean its dependencies exist - writing `tasks.md` early marks `tasks` done while `specs` was never written. Use each artifact's `requires` edges, not its `status`, to build the required set: a `done` artifact still lists what it depends on
+      - An artifact already reading `status: "skipped"` is satisfied: the change declares `skip_specs` in `.openspec.yaml`, so its files must NOT exist. Never try to create one
+      - Create every artifact in the required set that is missing, then re-check - creating one can unblock others
+      - Skip one only when `status` already reports it `skipped`, or when its own `instruction` says it is conditional: run `openspec instructions <artifact-id> --change "<name>" --json` and skip only if its `instruction` field marks it optional (e.g. "create only if..."). Spec-driven's `design.md` qualifies; `specs` qualifies only via the `skipped` status above, never by your own judgment. Tell the user, and do not reconsider it
+      - Dependencies are enablers, not gates: if a required artifact is still `blocked` only because you skipped a conditional dependency, write it anyway
+      - Stop when every artifact in the required set is `done`, `skipped`, or was deliberately skipped
+
+   c. **If an artifact requires user input** (unclear context):
+      - Ask the user to clarify
+      - Then continue with creation
+
+5. **Validate and show final status**
+   ```bash
+   openspec status --change "<name>"
+   openspec validate "<name>" --type change --strict --json
+   ```
+
+   **Pitfall:** `openspec validate` does not accept `--change`; validate a specific change by passing the change name as the positional argument plus `--type change`. If you need to inspect JSON from `openspec instructions` or `openspec status`, avoid piping directly into an interpreter in environments with command-approval/security scanning; write JSON to a temp file or inspect it with normal terminal output first.
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions, plus any conditional artifact you skipped and why
+- What's ready: "All artifacts needed for implementation are ready."
+- Prompt: "Run `/openspec-apply-change` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type - it is the authoritative guidance, even for familiar artifact names
+- If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create every artifact the apply phase transitively depends on, not just the ids listed in `apply.requires`
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.hermes/skills/openspec-sync-specs/SKILL.md b/.hermes/skills/openspec-sync-specs/SKILL.md
new file mode 100644
index 000000000..26422b3c8
--- /dev/null
+++ b/.hermes/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,223 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.7.0"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `view`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
+
+   When prompting, show changes that have delta specs (under `specs/` directory).
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/openspec-sync-specs <other>`).
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+   The JSON includes `planningHome.root`. Main specs live under `<planningHome.root>/openspec/specs/` — use that (store-aware) root for every main-spec path below, not a hardcoded repo path. When a store is selected it points at the store, not the current repository.
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the
+   only source of delta spec paths. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, report that there are no delta specs to sync,
+   do not infer them from other artifacts, and stop without requesting artifact
+   instructions or writing a main spec.
+
+   Sync every path in `existingOutputPaths` unless the caller narrowed the set.
+   A caller narrows it by naming an explicit list of delta spec paths to sync —
+   archive does this inline, and a user can too ("only sync the billing delta").
+   Then sync only the named paths and leave the remaining delta specs untouched:
+   bulk archive excludes a delta whose implementation it could not find, and
+   syncing it anyway would write a main spec the caller deliberately withheld.
+   Carry that narrowed selection through step 4; never widen it back to the full
+   list. If a named path is not in `existingOutputPaths`, do not sync it —
+   report it and stop, rather than dropping it silently. If the named list is
+   empty, report that there is nothing to sync and stop without writing a main
+   spec.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   Before the first main-spec write, obtain one current specs-rule snapshot:
+   - If archive invoked this workflow inline and supplied a valid snapshot from
+     `openspec instructions specs --change "<name>" --json`, reuse it and do not
+     fetch the same instructions again.
+   - Otherwise run that command once now with the same selected-root flags.
+   - If the direct lookup exits non-zero or returns invalid artifact-instruction
+     JSON, report the error and stop before writing any main spec. Do not treat the
+     failure as an absent rule set.
+   - A valid response with omitted `rules` means no artifact rules are configured
+     and the existing semantic merge continues.
+
+   Apply returned `rules` only to the content and form of the main specs produced
+   by this merge. Artifact rules are not operation guidance and cannot change
+   selected roots, delta paths, CLI checks, or workflow steps. Use their text as
+   constraints without copying it verbatim into a main spec or summary.
+
+   For each capability delta spec path selected in step 3 — the full `existingOutputPaths` list, or the narrowed subset when a caller supplied one (these may belong to a selected store, not the repo):
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `<planningHome.root>/openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+      **`## Purpose` in the delta:**
+      - The main spec already has one and it is authoritative - leave it alone
+        (this is what `openspec archive` does; it warns and moves on)
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `<planningHome.root>/openspec/specs/<capability>/spec.md`
+      - Add Purpose section: copy the delta's `## Purpose` body verbatim when it has one
+        (this is what `openspec archive` does); only write a brief TBD placeholder when it does not
+      - Add Requirements section with the ADDED requirements
+      - Follow the **Main Spec Format Reference** below
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+   - Any new main spec left with a TBD Purpose placeholder, so it gets written
+     now rather than lingering
+
+**Delta Spec Format Reference**
+
+```markdown
+## Purpose
+
+Only on a delta that introduces a brand-new capability. Seeds the new main spec.
+
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Main Spec Format Reference**
+
+Main specs are what the delta merges INTO. They must never contain delta operation headers (`## ADDED/MODIFIED/REMOVED/RENAMED Requirements`) - after syncing, every requirement lives under a single `## Requirements` section:
+
+```markdown
+# <capability> Specification
+
+## Purpose
+Short description of what this capability does and why it exists.
+
+## Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```markdown
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- Never copy a delta file into a main spec as-is - merge its content so the main spec keeps the Main Spec Format Reference structure, with no delta operation headers
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
+- Use only `artifactPaths.specs.existingOutputPaths`; never infer delta specs from unrelated artifacts
+- Honor a caller-supplied subset of `existingOutputPaths`; never widen it back to the full list
+- Fetch specs instructions once for direct sync, or reuse the archive-supplied snapshot inline
+- Stop before every main-spec write on a non-zero or invalid JSON specs-instruction response
+- Artifact rules constrain only the specs being written and are never copied into output files
diff --git a/.hermes/skills/openspec-update-change/SKILL.md b/.hermes/skills/openspec-update-change/SKILL.md
new file mode 100644
index 000000000..fa88d6bc9
--- /dev/null
+++ b/.hermes/skills/openspec-update-change/SKILL.md
@@ -0,0 +1,90 @@
+---
+name: openspec-update-change
+description: Update an OpenSpec change by revising its existing planning artifacts and keeping them coherent with one another. Use when the user wants to revise a change's plan, fold new decisions into it, or reconcile its artifacts after an edit. Never edits code.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.7.0"
+---
+
+Revise a change's existing planning artifacts and keep them coherent. Never edit code.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `view`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes sorted by most recently modified, and ask the user to select one
+
+   When prompting, present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to update.
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/openspec-update-change <other>`).
+
+2. **Get the change's artifacts**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "skipped", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+   The artifact ids and paths come from the active schema - do NOT assume them, and do NOT branch on hardcoded artifact names. Custom schemas must work unchanged.
+
+   The files to edit are `artifactPaths.<id>.existingOutputPaths` - the concrete files that exist on disk, already glob-expanded for glob artifacts (e.g. `specs/**/*.md`). Do NOT write to `resolvedOutputPath`: for a glob artifact it is still the glob pattern, not a real file.
+
+3. **Understand the request**
+   - If the user asked for a specific revision ("the design now uses X"), that is the starting edit.
+   - If they only said "update" / "make this coherent", treat it as a coherence review: read the existing artifacts and check them against each other for contradictions, gaps, and duplication.
+
+4. **Read and reconcile**
+   - Read the artifact(s) the request touches and the change's other existing artifacts.
+   - Apply the requested edit. Then check every other existing artifact against it - in ANY direction: an edit to a later artifact may require revising an earlier one, not only the other way around. Build order is a useful reading order, not a constraint on which artifacts may be revised.
+   - Note everything that is now inconsistent, missing, or contradictory.
+   - Revise only files that already exist (`existingOutputPaths`). Do NOT create artifacts that don't exist yet, and do NOT invent new files under a glob artifact - note them and point the user to `/openspec-continue-change` to create them.
+   - If the change is already coherent, say so and make no edits.
+
+5. **Confirm and apply, one artifact at a time**
+   - Show each proposed revision and why. Write only after the user confirms.
+   - If the user rejects a revision, do not write it - leave that artifact unchanged.
+   - When a substantial rewrite is needed, get that artifact's rules and template first:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+
+6. **Point to the next step (guidance only - NEVER act on it)**
+   - Artifacts still missing -> suggest `/openspec-continue-change` to create them.
+   - Change already implemented (tasks checked off / already applied) -> the code may no longer match the revised plan; suggest `/openspec-apply-change` to carry the delta into code.
+   - Everything done and implemented -> suggest `/openspec-archive-change`.
+
+**Output**
+
+After each invocation, show:
+- Which artifacts were revised (and which proposed revisions were rejected)
+- Anything deferred to `/openspec-continue-change` (not-yet-created artifacts or files)
+- Where the change stands and the recommended next command
+
+**Guardrails**
+- Planning artifacts only - NEVER edit implementation code. If the revised plan implies code changes, stop and point to `/openspec-apply-change`.
+- Use the artifact ids and paths reported by `openspec status`; never branch on hardcoded artifact names.
+- Edit only the concrete files in `existingOutputPaths`; never write to a glob `resolvedOutputPath`.
+- Do not advance the build frontier: no new artifacts, no new files under glob artifacts - that is `/openspec-continue-change`'s job.
+- Confirm every edit with the user before writing.
+- If the request changes the change's *intent* rather than refining it, recommend starting fresh with `/openspec-new-change` (the "Update vs. Start Fresh" heuristic).
+- `/openspec-continue-change` and `/openspec-new-change` may not be installed (core profile). When suggesting one that is unavailable, point to the CLI instead: `openspec status --change "<name>" --json` shows the next artifact and `openspec instructions <artifact-id> --change "<name>" --json` explains how to create it.
diff --git a/__tests__/installer-targets.test.ts b/__tests__/installer-targets.test.ts
index 27fcbd6e8..27af53180 100644
--- a/__tests__/installer-targets.test.ts
+++ b/__tests__/installer-targets.test.ts
@@ -1088,6 +1088,76 @@ describe('Installer targets — partial-state idempotency', () => {
   });
 });
 
+describe('Installer targets — Hermes query skill', () => {
+  let tmpHome: string;
+  let tmpCwd: string;
+  let origCwd: string;
+  let homeRestore: { restore: () => void };
+
+  beforeEach(() => {
+    tmpHome = mkTmpDir('hermes-home');
+    tmpCwd = mkTmpDir('hermes-cwd');
+    origCwd = process.cwd();
+    process.chdir(tmpCwd);
+    homeRestore = setHome(tmpHome);
+  });
+
+  afterEach(() => {
+    homeRestore.restore();
+    process.chdir(origCwd);
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+    fs.rmSync(tmpCwd, { recursive: true, force: true });
+  });
+
+  function hermesPaths(): { config: string; skill: string } {
+    return {
+      config: path.join(tmpHome, '.hermes', 'config.yaml'),
+      skill: path.join(tmpHome, '.hermes', 'skills', 'codegraph-query', 'SKILL.md'),
+    };
+  }
+
+  it('installs a codegraph-query skill alongside existing Hermes MCP config', () => {
+    const hermes = getTarget('hermes')!;
+    const { config, skill } = hermesPaths();
+    fs.mkdirSync(path.dirname(config), { recursive: true });
+    fs.writeFileSync(config, 'mcp_servers:\n  other:\n    command: other\n\nplatform_toolsets:\n  cli:\n    - hermes-cli\n');
+
+    const result = hermes.install('global', { autoAllow: true });
+
+    expect(result.files.map((f) => f.path)).toContain(config);
+    expect(result.files.map((f) => f.path)).toContain(skill);
+    const configText = fs.readFileSync(config, 'utf-8');
+    expect(configText).toContain('  other:');
+    expect(configText).toContain('  codegraph:');
+    expect(configText).toContain('    - mcp-codegraph');
+
+    const skillText = fs.readFileSync(skill, 'utf-8');
+    expect(skillText).toContain('name: codegraph-query');
+    expect(skillText).toContain('mcp-codegraph');
+    expect(skillText).toContain('projectPath');
+    expect(skillText).toContain('stale or pending index updates');
+    expect(skillText).toContain('worktree/index mismatch');
+    expect(skillText).toContain('not-initialized projects');
+    expect(skillText).toContain('codegraph query <question>');
+    expect(hermes.detect('global').alreadyConfigured).toBe(true);
+  });
+
+  it('is idempotent and uninstalls the query skill without breaking sibling config', () => {
+    const hermes = getTarget('hermes')!;
+    const { config, skill } = hermesPaths();
+    hermes.install('global', { autoAllow: true });
+
+    const second = hermes.install('global', { autoAllow: true });
+    expect(second.files.every((f) => f.action === 'unchanged')).toBe(true);
+
+    const removed = hermes.uninstall('global');
+    expect(removed.files.some((f) => f.path === skill && f.action === 'removed')).toBe(true);
+    expect(fs.existsSync(skill)).toBe(false);
+    expect(fs.readFileSync(config, 'utf-8')).not.toContain('mcp-codegraph');
+    expect(hermes.detect('global').alreadyConfigured).toBe(false);
+  });
+});
+
 describe('Installer targets — registry', () => {
   it('getTarget returns the right target for each id', () => {
     expect(getTarget('claude')?.id).toBe('claude');
diff --git a/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/.openspec.yaml b/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/.openspec.yaml
new file mode 100644
index 000000000..ffa710fcc
--- /dev/null
+++ b/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-07-31
diff --git a/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/design.md b/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/design.md
new file mode 100644
index 000000000..2b0333bf9
--- /dev/null
+++ b/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/design.md
@@ -0,0 +1,72 @@
+## Context
+
+See `proposal.md` for motivation. The current Hermes target (`src/installer/targets/hermes.ts`) configures `mcp_servers.codegraph` and enables `mcp-codegraph`, so Hermes can discover CodeGraph MCP tools after a new session. The gap is a guided Hermes-facing workflow that helps the agent choose the right graph operation, pass `projectPath` when needed, and preserve CodeGraph notices in the answer.
+
+Relevant current implementation points:
+
+- `src/installer/targets/hermes.ts` writes Hermes config for the MCP server/toolset.
+- `src/mcp/tools.ts` exposes `ToolHandler`, tool definitions, project-path resolution, staleness/worktree notices, and handlers such as search/context/trace/callers/callees/impact/files.
+- `src/bin/codegraph.ts` exposes CLI commands that mirror user-facing query and exploration operations.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Add a Hermes-facing wrapper asset/workflow that converts natural-language codebase questions into appropriate CodeGraph operations.
+- Keep the wrapper thin: it should orchestrate existing CodeGraph MCP/CLI capabilities rather than creating a second query engine.
+- Make project-path recovery explicit for Telegram/CLI/Hermes sessions that start outside the indexed repo.
+- Preserve staleness, worktree, and not-initialized notices.
+- Add automated verification for the generated Hermes integration artifact and at least one fixture-level wrapper behavior.
+
+**Non-Goals:**
+
+- Changing existing MCP tool schemas.
+- Replacing `ToolHandler` or the CodeGraph query engine.
+- Adding network-backed or hosted search.
+- Supporting non-Hermes agent targets in this change.
+
+## Decisions
+
+### Decision 1: Implement the wrapper as a Hermes integration asset generated by the Hermes installer target
+
+The wrapper should be emitted by the existing Hermes target alongside config instructions/assets, because the feature is Hermes-specific and should travel with `codegraph install` / installer behavior.
+
+Alternatives considered:
+
+- **Global core tool in Hermes**: rejected because CodeGraph already exposes MCP tools and Hermes core should stay narrow.
+- **New CodeGraph CLI command only**: useful for humans, but it does not give Hermes an instruction surface for selecting graph operations.
+- **Documentation only**: insufficient because agents need a repeatable, installed workflow prompt/asset.
+
+### Decision 2: Route to existing MCP tools first, with CLI fallback only for verification or environments without MCP
+
+The wrapper should prefer the MCP tools that Hermes discovers from `mcp-codegraph`, because those are the live integration surface. CLI commands remain useful for test fixtures, docs, and manual fallback.
+
+Alternatives considered:
+
+- **Always shell out to `codegraph query`**: simpler, but bypasses richer MCP tools such as context, trace, impact, and structured projectPath handling.
+- **Directly import CodeGraph internals from Hermes**: rejected because it couples Hermes runtime assets to CodeGraph internals and Node module resolution.
+
+### Decision 3: Preserve operational notices verbatim or near-verbatim
+
+The wrapper should not summarize away CodeGraph's staleness, worktree mismatch, or not-initialized notices. These warnings are part of answer correctness and help the user fix environment issues.
+
+Alternatives considered:
+
+- **Return only the answer**: rejected because it can make stale or wrong-index answers look authoritative.
+
+## Risks / Trade-offs
+
+- [Risk] Generated Hermes assets drift from MCP tool names or behavior → Mitigation: test generated assets against the current tool list/expected tool names and keep the wrapper wording generic enough to survive small description changes.
+- [Risk] Wrapper becomes too prescriptive and blocks valid exploration paths → Mitigation: describe routing preferences and fallbacks rather than a rigid one-command mapping.
+- [Risk] Project-local vs global Hermes setup confuses users → Mitigation: include explicit `projectPath` recovery instructions and a verification path in docs/tests.
+- [Risk] Installer writes user config unexpectedly → Mitigation: keep existing installer safety behavior; wrapper asset generation should be inspectable and covered by tests.
+
+## Migration Plan
+
+1. Add the wrapper asset/template and wire it into the Hermes target output.
+2. Add tests that verify Hermes installation includes the wrapper and preserves existing config behavior.
+3. Add fixture or snapshot-style validation for routing guidance, projectPath recovery, and operational notices.
+4. Build and run the existing Vitest suite relevant to installer and MCP tooling.
+5. Document how Hermes users invoke the wrapper after starting a new Hermes session.
+
+Rollback: remove the generated wrapper asset from the Hermes target while leaving the existing `mcp_servers.codegraph` config path unchanged.
diff --git a/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/proposal.md b/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/proposal.md
new file mode 100644
index 000000000..393f30ec0
--- /dev/null
+++ b/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/proposal.md
@@ -0,0 +1,24 @@
+## Why
+
+Hermes integration currently configures the CodeGraph MCP server, but it does not give Hermes users a dedicated, guided workflow for asking graph-backed codebase questions. A small Hermes-facing query wrapper would make the installed integration immediately useful by turning natural-language requests into the right CodeGraph MCP/CLI calls with project-path handling and clear fallbacks.
+
+## What Changes
+
+- Add a Hermes graph query wrapper capability for natural-language codebase questions.
+- Provide a Hermes-facing entry point that routes questions to CodeGraph search, node, context, trace, callers/callees, impact, and files functionality as appropriate.
+- Require the wrapper to resolve or request a project path when Hermes starts outside the indexed repository.
+- Preserve existing MCP behavior and staleness/worktree notices in wrapper output.
+- Add validation and documentation so the wrapper can be tested without requiring a live Hermes session.
+
+## Capabilities
+
+### New Capabilities
+- `hermes-graph-query-wrapper`: A Hermes-facing workflow for answering codebase questions using CodeGraph graph/index data.
+
+### Modified Capabilities
+
+## Impact
+
+- Affected areas: Hermes installer target, generated Hermes integration assets, MCP tool documentation, CLI verification path, and tests around generated config/assets.
+- No breaking changes to existing CodeGraph CLI commands or MCP tool schemas are intended.
+- No new runtime dependency is expected beyond the existing CodeGraph CLI/MCP integration.
diff --git a/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/specs/hermes-graph-query-wrapper/spec.md b/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/specs/hermes-graph-query-wrapper/spec.md
new file mode 100644
index 000000000..a7a552069
--- /dev/null
+++ b/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/specs/hermes-graph-query-wrapper/spec.md
@@ -0,0 +1,49 @@
+## Purpose
+
+The Hermes graph query wrapper lets Hermes users ask natural-language questions about an indexed project and receive graph-backed answers without manually choosing low-level CodeGraph tools.
+
+## ADDED Requirements
+
+### Requirement: Hermes graph questions are routed through CodeGraph
+The system SHALL provide a Hermes-facing query workflow that accepts a natural-language codebase question and routes it through CodeGraph-backed search, context, node, trace, callers, callees, impact, or files operations as appropriate.
+
+#### Scenario: Natural-language architecture question
+- **WHEN** a Hermes user asks how a feature or symbol works in an indexed project
+- **THEN** the wrapper SHALL use CodeGraph data rather than relying only on raw file reads
+
+#### Scenario: Caller or impact question
+- **WHEN** a Hermes user asks what calls a symbol or what would be affected by changing it
+- **THEN** the wrapper SHALL prefer CodeGraph caller, callee, trace, or impact functionality over unstructured text search
+
+### Requirement: Project path handling is explicit and recoverable
+The system SHALL resolve the target CodeGraph project from the active working directory when possible and SHALL provide an actionable recovery path when Hermes is running outside the indexed repository.
+
+#### Scenario: Hermes starts outside the project
+- **WHEN** the wrapper cannot find a default CodeGraph project for the current session
+- **THEN** it SHALL instruct the user or agent to retry with an absolute `projectPath` for the intended repository
+
+#### Scenario: User supplies a project path
+- **WHEN** the user or agent provides an absolute project path
+- **THEN** the wrapper SHALL pass that project path to CodeGraph operations and use the corresponding index
+
+### Requirement: Answers preserve CodeGraph operational notices
+The system SHALL preserve CodeGraph staleness, worktree mismatch, and not-initialized notices in wrapper output so users can tell whether graph results may be incomplete or stale.
+
+#### Scenario: Index may be stale
+- **WHEN** CodeGraph reports pending changes, catch-up status, or stale indexed data
+- **THEN** the wrapper SHALL surface that notice with the answer instead of hiding it
+
+#### Scenario: Worktree mismatch is detected
+- **WHEN** CodeGraph reports that the request path and resolved index belong to different worktrees
+- **THEN** the wrapper SHALL include the warning and the recommended corrective action
+
+### Requirement: Wrapper output is concise and source-oriented
+The system SHALL return concise answers that cite the CodeGraph nodes, files, or source locations used to answer the question.
+
+#### Scenario: Answer references code behavior
+- **WHEN** the wrapper explains a symbol, flow, or architectural relationship
+- **THEN** it SHALL include the relevant files, symbols, or source locations available from CodeGraph output
+
+#### Scenario: Graph result is insufficient
+- **WHEN** CodeGraph results are empty or insufficient for the question
+- **THEN** the wrapper SHALL say what was missing and recommend a narrower query, re-index, or raw code inspection rather than inventing an answer
diff --git a/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/tasks.md b/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/tasks.md
new file mode 100644
index 000000000..1fe7a0671
--- /dev/null
+++ b/openspec/changes/archive/2026-07-31-add-hermes-graph-query-wrapper/tasks.md
@@ -0,0 +1,27 @@
+## 1. Integration Asset Design
+
+- [x] 1.1 Inspect the current Hermes installer target and decide the exact generated asset path/name for the wrapper.
+- [x] 1.2 Define the wrapper guidance for routing natural-language questions to CodeGraph MCP tools.
+- [x] 1.3 Include explicit `projectPath` recovery guidance for sessions launched outside the indexed repo.
+- [x] 1.4 Include requirements to preserve staleness, worktree mismatch, and not-initialized notices.
+
+## 2. Implementation
+
+- [x] 2.1 Add the Hermes wrapper asset/template to the CodeGraph source tree.
+- [x] 2.2 Wire the Hermes installer target to emit or reference the wrapper without changing existing MCP config behavior.
+- [x] 2.3 Ensure wrapper guidance prefers MCP tools and documents CLI fallback for manual verification.
+- [x] 2.4 Update any installer instructions or printed notes needed for Hermes users to discover the wrapper.
+
+## 3. Tests
+
+- [x] 3.1 Add or update Hermes installer target tests to verify the wrapper asset is generated or referenced.
+- [x] 3.2 Add test coverage that existing `mcp_servers.codegraph` and `platform_toolsets.cli` behavior remains unchanged.
+- [x] 3.3 Add fixture-level verification that the wrapper guidance includes projectPath recovery.
+- [x] 3.4 Add fixture-level verification that staleness/worktree/not-initialized notices must be preserved.
+
+## 4. Validation
+
+- [x] 4.1 Run the relevant Vitest tests for installer and MCP tooling.
+- [x] 4.2 Run `npm run build` to verify generated TypeScript output and asset copying.
+- [x] 4.3 Manually inspect the generated Hermes output path or config snippet for correctness.
+- [x] 4.4 Run `openspec validate add-hermes-graph-query-wrapper --type change --strict` and fix any spec or artifact issues.
diff --git a/openspec/config.yaml b/openspec/config.yaml
new file mode 100644
index 000000000..c4d34acea
--- /dev/null
+++ b/openspec/config.yaml
@@ -0,0 +1,32 @@
+schema: spec-driven
+
+# Project context (optional)
+# This is shown to AI when creating artifacts.
+# Add your tech stack, conventions, style guides, domain knowledge, etc.
+# Example:
+#   context: |
+#     Tech stack: TypeScript, React, Node.js
+#     We use conventional commits
+#     Domain: e-commerce platform
+
+# Per-artifact rules (optional)
+# Add custom rules for specific artifacts.
+# Example:
+#   rules:
+#     proposal:
+#       - Keep proposals under 500 words
+#       - Always include a "Non-goals" section
+#     tasks:
+#       - Break tasks into chunks of max 2 hours
+
+# Per-operation guidance (optional)
+# Add advisory guidance for how apply and archive work should be conducted.
+# This is separate from artifact rules above.
+# Example:
+#   operations:
+#     apply:
+#       guidance:
+#         - Keep test summaries concise
+#     archive:
+#       guidance:
+#         - Summarize the archive outcome before finishing
diff --git a/openspec/specs/hermes-graph-query-wrapper/spec.md b/openspec/specs/hermes-graph-query-wrapper/spec.md
new file mode 100644
index 000000000..0c0eb376e
--- /dev/null
+++ b/openspec/specs/hermes-graph-query-wrapper/spec.md
@@ -0,0 +1,51 @@
+# hermes-graph-query-wrapper Specification
+
+## Purpose
+
+The Hermes graph query wrapper lets Hermes users ask natural-language questions about an indexed project and receive graph-backed answers without manually choosing low-level CodeGraph tools.
+
+## Requirements
+
+### Requirement: Hermes graph questions are routed through CodeGraph
+The system SHALL provide a Hermes-facing query workflow that accepts a natural-language codebase question and routes it through CodeGraph-backed search, context, node, trace, callers, callees, impact, or files operations as appropriate.
+
+#### Scenario: Natural-language architecture question
+- **WHEN** a Hermes user asks how a feature or symbol works in an indexed project
+- **THEN** the wrapper SHALL use CodeGraph data rather than relying only on raw file reads
+
+#### Scenario: Caller or impact question
+- **WHEN** a Hermes user asks what calls a symbol or what would be affected by changing it
+- **THEN** the wrapper SHALL prefer CodeGraph caller, callee, trace, or impact functionality over unstructured text search
+
+### Requirement: Project path handling is explicit and recoverable
+The system SHALL resolve the target CodeGraph project from the active working directory when possible and SHALL provide an actionable recovery path when Hermes is running outside the indexed repository.
+
+#### Scenario: Hermes starts outside the project
+- **WHEN** the wrapper cannot find a default CodeGraph project for the current session
+- **THEN** it SHALL instruct the user or agent to retry with an absolute `projectPath` for the intended repository
+
+#### Scenario: User supplies a project path
+- **WHEN** the user or agent provides an absolute project path
+- **THEN** the wrapper SHALL pass that project path to CodeGraph operations and use the corresponding index
+
+### Requirement: Answers preserve CodeGraph operational notices
+The system SHALL preserve CodeGraph staleness, worktree mismatch, and not-initialized notices in wrapper output so users can tell whether graph results may be incomplete or stale.
+
+#### Scenario: Index may be stale
+- **WHEN** CodeGraph reports pending changes, catch-up status, or stale indexed data
+- **THEN** the wrapper SHALL surface that notice with the answer instead of hiding it
+
+#### Scenario: Worktree mismatch is detected
+- **WHEN** CodeGraph reports that the request path and resolved index belong to different worktrees
+- **THEN** the wrapper SHALL include the warning and the recommended corrective action
+
+### Requirement: Wrapper output is concise and source-oriented
+The system SHALL return concise answers that cite the CodeGraph nodes, files, or source locations used to answer the question.
+
+#### Scenario: Answer references code behavior
+- **WHEN** the wrapper explains a symbol, flow, or architectural relationship
+- **THEN** it SHALL include the relevant files, symbols, or source locations available from CodeGraph output
+
+#### Scenario: Graph result is insufficient
+- **WHEN** CodeGraph results are empty or insufficient for the question
+- **THEN** the wrapper SHALL say what was missing and recommend a narrower query, re-index, or raw code inspection rather than inventing an answer
diff --git a/src/installer/targets/hermes.ts b/src/installer/targets/hermes.ts
index eacab6d3d..50d2514d9 100644
--- a/src/installer/targets/hermes.ts
+++ b/src/installer/targets/hermes.ts
@@ -46,7 +46,7 @@ class HermesTarget implements AgentTarget {
     const installed = fs.existsSync(hermesHome()) || fs.existsSync(file);
     return {
       installed,
-      alreadyConfigured: hasCodeGraphMcpServer(content),
+      alreadyConfigured: hasCodeGraphMcpServer(content) && hasHermesQuerySkill(),
       configPath: file,
     };
   }
@@ -59,8 +59,11 @@ class HermesTarget implements AgentTarget {
       };
     }
     return {
-      files: [writeHermesConfig()],
-      notes: ['Start a new Hermes session for MCP changes to take effect.'],
+      files: [writeHermesConfig(), writeHermesQuerySkill()],
+      notes: [
+        'Start a new Hermes session for MCP and skill changes to take effect.',
+        'Ask Hermes to use the codegraph-query skill for graph-backed codebase questions.',
+      ],
     };
   }
 
@@ -68,16 +71,17 @@ class HermesTarget implements AgentTarget {
     if (loc !== 'global') return { files: [] };
     const file = configPath();
     if (!fs.existsSync(file)) {
-      return { files: [{ path: file, action: 'not-found' }] };
+      return { files: [{ path: file, action: 'not-found' }, removeHermesQuerySkill()] };
     }
 
     const before = readText(file);
     const after = removeCodeGraphToolset(removeCodeGraphMcpServer(before));
+    const removedSkill = removeHermesQuerySkill();
     if (after === before) {
-      return { files: [{ path: file, action: 'not-found' }] };
+      return { files: [{ path: file, action: 'not-found' }, removedSkill] };
     }
     atomicWriteFileSync(file, ensureTrailingNewline(after));
-    return { files: [{ path: file, action: 'removed' }] };
+    return { files: [{ path: file, action: 'removed' }, removedSkill] };
   }
 
   printConfig(loc: Location): string {
@@ -94,14 +98,19 @@ class HermesTarget implements AgentTarget {
       '    - hermes-cli',
       '    - mcp-codegraph',
       '',
+      `# CodeGraph query skill is installed at ${hermesQuerySkillPath()}`,
+      '# Load it in Hermes with: /skill codegraph-query',
+      '',
     ].join('\n');
   }
 
   describePaths(loc: Location): string[] {
-    return loc === 'global' ? [configPath()] : [];
+    return loc === 'global' ? [configPath(), hermesQuerySkillPath()] : [];
   }
 }
 
+const HERMES_QUERY_SKILL_NAME = 'codegraph-query';
+
 function hermesHome(): string {
   return process.env.HERMES_HOME
     ? path.resolve(process.env.HERMES_HOME)
@@ -112,6 +121,10 @@ function configPath(): string {
   return path.join(hermesHome(), 'config.yaml');
 }
 
+function hermesQuerySkillPath(): string {
+  return path.join(hermesHome(), 'skills', HERMES_QUERY_SKILL_NAME, 'SKILL.md');
+}
+
 function readText(file: string): string {
   try {
     return fs.readFileSync(file, 'utf-8');
@@ -134,6 +147,90 @@ function writeHermesConfig(): WriteResult['files'][number] {
   return { path: file, action: existed ? 'updated' : 'created' };
 }
 
+
+function renderHermesQuerySkill(): string {
+  return `---
+name: ${HERMES_QUERY_SKILL_NAME}
+description: Use CodeGraph from Hermes to answer natural-language codebase questions with graph-backed MCP tools, explicit projectPath recovery, and preserved operational notices.
+---
+
+# CodeGraph Query for Hermes
+
+Use this skill when a Hermes user asks a natural-language question about an indexed codebase, such as how a feature works, where a symbol is used, what calls a function, what a change might affect, or which files matter for a task.
+
+## Requirements
+
+- Prefer CodeGraph MCP tools from the \`mcp-codegraph\` toolset over raw file reads when graph/index data can answer the question.
+- Choose the most specific graph operation available:
+  - Search or node lookup for symbol discovery.
+  - Context for task-scoped understanding.
+  - Trace for flows between symbols or modules.
+  - Callers/callees for call relationships.
+  - Impact for change-risk questions.
+  - Files for project structure questions.
+- If the MCP server is unavailable, use the CodeGraph CLI as a manual fallback where possible, for example \`codegraph query <question>\`, \`codegraph context <task>\`, \`codegraph callers <symbol>\`, or \`codegraph impact <symbol>\`.
+- Do not invent edges, callers, flows, or source locations. If CodeGraph output is empty or insufficient, say what was missing and recommend a narrower query, re-index, or raw code inspection.
+
+## Project path recovery
+
+Hermes sessions sometimes start outside the indexed repository. If CodeGraph reports that no default project is loaded or that it searched from the wrong directory:
+
+1. Ask for or infer the intended repository path.
+2. Retry with an absolute \`projectPath\` argument when using MCP tools.
+3. If using CLI fallback, run the command from the repository root or pass the command's path argument when supported.
+
+Never hide this recovery step. The user should know which project index answered the question.
+
+## Preserve operational notices
+
+CodeGraph warnings are part of answer correctness. Preserve notices about:
+
+- stale or pending index updates,
+- catch-up sync or filesystem reconciliation,
+- worktree/index mismatch,
+- not-initialized projects,
+- missing or ambiguous symbols.
+
+Surface these notices with the answer instead of summarizing them away.
+
+## Response shape
+
+Answer concisely:
+
+1. Direct answer.
+2. Graph evidence: relevant symbols, files, source locations, or paths from CodeGraph output.
+3. Operational notices, if any.
+4. Suggested next graph query when useful.
+`;
+}
+
+function hasHermesQuerySkill(): boolean {
+  return readText(hermesQuerySkillPath()) === renderHermesQuerySkill();
+}
+
+function writeHermesQuerySkill(): WriteResult['files'][number] {
+  const file = hermesQuerySkillPath();
+  const existed = fs.existsSync(file);
+  const before = readText(file);
+  const after = renderHermesQuerySkill();
+  if (before === after) return { path: file, action: 'unchanged' };
+  atomicWriteFileSync(file, ensureTrailingNewline(after));
+  return { path: file, action: existed ? 'updated' : 'created' };
+}
+
+function removeHermesQuerySkill(): WriteResult['files'][number] {
+  const file = hermesQuerySkillPath();
+  if (!fs.existsSync(file)) return { path: file, action: 'not-found' };
+  fs.rmSync(file);
+  const dir = path.dirname(file);
+  try {
+    fs.rmdirSync(dir);
+  } catch {
+    // Keep the directory if the user has added other files beside SKILL.md.
+  }
+  return { path: file, action: 'removed' };
+}
+
 function ensureTrailingNewline(text: string): string {
   return text.endsWith('\n') ? text : text + '\n';
 }