Thirty lessons in, you can hold the entire system in one view. Alembic is an engine that turns raw sources into validated knowledge and feeds finished work back into itself — a closed loop. The Hermes fusion added the missing pieces to make that loop self-improving: a memory to write to, a gated learning pass to write through, and a curator to prune what goes stale. This capstone draws the full circuit, lists what shipped and what is deliberately parked, and ends with a cross-cutting quiz over everything you've learned. No new facts — just the assembled picture.
Every subsystem and invariant in this course exists to make one circuit turn safely: distill → learn → sediment → prune. Sources are distilled into Learnings (the funnel, T0→T3); a finished run proposes durable writes (the learning pass); approved writes sediment into memory and skills; and the curator prunes what goes unused — feeding back into what the next run knows.
Notice the gate sitting in the LEARN box. That's the keystone (ADR-0018): the loop is Validator-gated, never auto-apply. Without it, a self-improving system drifts on its own bad outputs. The gate is what makes "learns from itself" safe rather than a feedback catastrophe.
Counts are source-verified by the course's own foundation (Lesson 01): the complete-map recorded 19 workspace packages + 1 app at 415 tests, which grew to ~565 after @alembic/hermes landed — the same 565 the case study in Lesson 6 verifies green with an empty pgrep. [uncertain] the exact current total may differ by a few as tests are added; treat ~565 as the as-built figure when hermes shipped.
| Subsystem | Disposition | What it gives the loop | Lesson |
|---|---|---|---|
| memory | CLONE | the durable store writes sediment into | 7 |
| learning | ADAPT | the gated propose→dispose pass — the keystone | 8 |
| curator | CLONE | active→stale→archived pruning (never deletes) | 9 |
| clarify | CLONE | the T4 human-gate ask-surface | 10 |
| web | CLONE | search/extract over an injected backend | 11 |
| skills | CLONE | procedural memory with progressive disclosure | 12 |
| media | CLONE | cloud transcribe/vision over injected backends | 13 |
Honest engineering names what isn't done. The fusion matrix marks several capabilities as not-yet-shipped — on purpose, with reasons:
@alembic/harness) — Alembic is an MCP server (read-only) but cannot yet consume external MCP servers. The matrix flags this as a high-value MERGE; the TS SDK makes it cleaner than the Python original. Parked, not rejected.And what was deliberately IGNORED (not parked — decided against): subagent delegation (the swarm already does it better, Lesson 19), neural local TTS and local faster-whisper (Python-only ML, no clean Node port), and the 23 messaging-platform adapters (out of scope for an internal engine, ADR-0001). Lesson 3 and 21 walk these verdicts.
A system that ships everything at once ships nothing well. The fusion drew a tight boundary — the seven subsystems that close the self-improving loop — and explicitly deferred the rest with dated reasons. Parked work is recoverable (it's in the matrix with a disposition); rejected work is justified (an IGNORE with a reason). Both beat a vague backlog. This is the portfolio doctrine (ADR-0016) in miniature: bounded WIP, everything tracked.
If you take one idea from thirty lessons, take this: the engine's power comes from its constraints, not around them. Never-throws (ADR-0009) makes fan-out safe. Injected ports make everything testable and replayable. Fail-closed defaults (DEFAULT_TIER = T4, the budget guard) make the unknown case deny. The Validator gate makes self-improvement safe. The plan-VM ban makes replay honest. Each constraint removes a class of failure, and together they let an autonomous system run without a human watching every step — which was the whole goal.
retryable flag at the waist; the swarm re-establishes the never-throws boundary with runSwarmSafe. The orchestrator only ever sees uniform discriminated results — that's why one provider's failure degrades a lane, not the run.MemoryStore is over budget. The same run then re-proposes a fact already in memory. Where do the two land?failed = gate approved but store refused (over budget). A re-proposed existing fact is a no-op success counted as applied — "reinforce, don't duplicate" (L8/L23). Three buckets exist precisely to keep these distinct.Date.now() in its alembic.plan.ts for an id, then run the suite via bare vitest with a test that opens a socket. Two things go wrong. What?Clock/id factory), and test:safe — not bare vitest — is what kills the worker group + sweeps. The recipe (L29) bakes both into "done."AIAgent to fork; and, "more importantly," the emission-gate principle). 0006 forbids un-gated sediment and 0009 forbids throwing, so the only shape left is the gated, ports-based pass — the constraints determine the design (L24).You can now read any @alembic/hermes subsystem and predict its shape before you open it; trace a model call through the waist and a corpus through the funnel; defend every fusion verdict; diagnose an orphaned-worker leak; and follow the recipe to add a subsystem of your own. The parked frontier — the MCP client, the corpus backfill, the design and GTM surfaces — is the natural next work, and the matrix already says how to approach each. The loop is built; making it turn faster and wider is the road ahead.
packages/hermes/src/ and read a subsystem end to end; you'll find it reads exactly as you now expect.