v8.6.0 - Enabled is not installed

v8.6.0 -- Enabled is not installed

2026-08-25. Based on v8.5.0. 160 canonical skills (+1: local-model-ops).
One new optional CLI, no new MCP servers.

v8.5.0 found that a cloned Hermes profile copies its config once and then
drifts. This one found the same shape one level down: a cloned profile copies
the list of enabled plugins and never the plugins.

---

Two cloned profiles had been running no plugins at all

Hermes resolves a user plugin at <HERMES_HOME>/plugins/<name>. For a named
profile that is profiles/<name>/plugins, which hermes profile create does
not create. Measured on the maintainer's machine:

default   disk-cleanup=bundled  ponytail=user  superpowers=user
roblox    disk-cleanup=bundled  ponytail=MISSING  superpowers=MISSING
skyrim    disk-cleanup=bundled  ponytail=MISSING  superpowers=MISSING

Both cloned profiles had enabled Ponytail and Superpowers since the day they
were created, and neither had ever loaded. Nothing reported it: an enabled
plugin that cannot be resolved simply does nothing, and every config check
passes because the config is not what is wrong.

The migration now links each profile's plugins directory back to the shared
root with a junction -- one authoritative copy, rather than duplicates that
would drift again -- and converges plugins.enabled additively. Discovery
reads what the default profile actually runs, filtered to payloads that
exist. It never enables a plugin from a hardcoded list, because enabling
something that is not there is the bug being fixed.

Verification asserts both halves: the name landed in the list and the
payload resolves.

All four of the pack's own Hermes gate hooks were dead

The same class again, from a rename. The allowlist still held consent for
...\Skyrim-AI-V5\hooks\completeness_gate.py under the old interpreter, while
the config now points at ...\Ultimate-AI-Starter-Bundle\hooks\. hermes hooks doctor was unambiguous once asked:

✗ not allowlisted -- hook will NOT fire at runtime

Consent is deliberately interactive and this pack does not forge it. The
installed-state doctor now reports it, with the command that grants it
(hermes --accept-hooks). Detect, do not silently grant.

Free web search, stated plainly

A hosted provider's own web plugin bills per search. Hermes never uses it:
web_search / web_extract are Hermes tools, so the search happens outside
the model and any model can drive it -- including a local one. With no
backend configured and no key present, Hermes rotates across several vendors'
public free tiers and fails over on rate limits.

The README now says so, and documents pip install ddgs for a backstop that
depends on no vendor account at all -- with the warning that pinning
web.search_backend disables the rotation.

A local model is now a documented, first-class option

New skill: local-model-ops. lmstudio is a first-class Hermes provider, and
one number blocks the obvious setup:

Hermes refuses any model whose context window is under 64,000 tokens and
raises before the first turn. LM Studio commonly saves 32K. The failure names
the model, not the loader, so it reads like a config problem.

Measured end to end on a 16 GB card with a 35B mixture-of-experts quant at 64K:
weights 17.08 GiB (partial CPU offload therefore mandatory), ~15.5 GiB VRAM
while generating, 41 tok/s. LM Studio's --estimate-only reports the same
figure at 32K, 64K and 128K and labels itself Confidence: LOW -- it models
weights and not the KV cache, so it cannot size a context change. The skill
ships a GGUF header parser and the KV arithmetic instead.

The local alias is deliberately not in the shipped starter config: it
names one machine's model behind a localhost endpoint, which the starter is
contractually forbidden to carry. The README/starter cross-check now encodes
that exception explicitly rather than being weakened.

RTK, with the caveat the vendor page does not carry

New optional CLI component (Apache-2.0). Measured on this repository:

Command	Raw	Through rtk	Saved
git diff HEAD~3	2,010,426 B	71,268 B	97%
git log	158,877 B	2,460 B	99%
git status	321 B	72 B	78%

It is a CLI, so it costs zero standing tokens -- the same reason this pack
prefers Forge's CLI to Forge's MCP.

On native Windows only the Hermes integration actually works. It is a
Python plugin that mutates the terminal command. The Claude Code, Cursor and
Gemini integrations are shell hooks and fall back to CLAUDE.md prompt
injection -- spending context to ask for savings. Codex and Kimi are
prompt-level by design. Grok is unsupported. Claude Code's built-in Read,
Grep and Glob never pass through the Bash hook at all, so the win is
concentrated in git, test runners and builds.

exclude_commands = ["curl"] is pinned: curl output is usually an API response
that gets parsed or hash-checked, where a filtered body is a wrong answer
rather than a smaller one. Telemetry is opt-in and stays off.

An agent cannot confirm the rewrite is happening -- it reports the command it
asked for, not the one that ran. rtk gain is the out-of-band evidence, and
that is how this was verified.

---

Also

• A new gate for a bug this release actually shipped and caught. Authoring
  files through a shell heredoc into Python collapsed a doubled backslash one
  level too far, turning \venv into a vertical tab and \rtk into a carriage
  return in two separate files. Both read correctly in a diff; one was a
  command a user would paste. Every shipped text file is now scanned for stray
  control characters.
• Six new release contracts, all registered in the explicit tests list.
• The doctor's JSON report carries hermes_plugin_issues and
  hermes_hook_issues so downstream tooling can read them.

v8.5.0 - A cloned Hermes profile drifts forever

hermes profile create --clone-from default copies default once. The migration managed mcp_servers and nothing else, so nothing ever re-converged the copies. Measured on a live machine at v8.4.0:

default   fallback_providers: laguna-s / inkling / inkling-small / laguna-xs
roblox    fallback_providers: dots-3-note-preview:free, openrouter/free
skyrim    fallback_providers: dots-3-note-preview:free, openrouter/free

roblox and skyrim were still running the chain from the day they were cloned.

A fallback chain is only consulted when the primary is already failing. That is what makes this drift nasty: nothing looks wrong, no command reports an error, and the stale value surfaces at the one moment it is supposed to save you. MCP topology was correct in all three profiles the whole time, which is why every run reported "Hermes profiles already match the target architecture".

What changed

The migration now converges fallback_providers and model.aliases across every managed profile, planned before the no-op check — otherwise correct MCP topology keeps masking drifted preferences.

Two fields, two rules, because the risk differs:

Field	Rule
fallback_providers	Replaced only when absent, empty, or byte-equal to a chain this pack itself shipped. A chain you chose is reported under KEPT and left alone.
model.aliases	Additive via setdefault. An alias you already defined keeps your value.

Both are read back and verified after writing.

The starter shipped no fallback chain at all

Only a commented-out example — so a BYOK user had no failover until they wrote one by hand, and every cloned profile inherited the gap. It now ships a four-deep free chain:

poolside/laguna-s-2.1:free -> thinkingmachines/inkling:free
  -> thinkingmachines/inkling-small:free -> poolside/laguna-xs-2.1:free

Ordering is not arbitrary. laguna-s is text-only, so a vision task failing over to it loses its images; inkling takes text/image/audio and sits directly behind rather than at the bottom. A contract asserts that position, and another refuses to point the vision auxiliary at a text-only model.

Verified, not recalled

Ten new model aliases and the whole README cost ladder were checked against the live openrouter.ai/api/v1/models list — ids, prices, context windows and input modalities. Contracts keep README and starter honest in both directions: the README cannot advertise an alias the starter does not ship, and the starter cannot ship one the README never explains.

auxiliary.compression deliberately stays on a paid model: it ingests up to the 160000-token threshold and the free first choice tops out at 262K context. ~$0.006 per compression beats one truncated summary. The existing cost contract caught this when it was briefly switched to free.

A new contract also refuses to publish machine state in the starter: absolute user paths, localhost: endpoints, a local LM Studio provider, non-empty mcp_servers, or any non-ASCII byte.

Also

One bug fixed before shipping: ConvertTo-UabsPlain returns ,$items so an array survives being returned intact, and re-wrapping it in @() nested the whole chain one level deep — every fallback entry then read as Object[] and the ledger reported "user choice" for chains it should have migrated. Caught by dry-running against real profiles rather than trusting the plan.

83 release contracts (4 new, 11 mutations falsified), pack gate PASS, 5157 files manifested, 18/18 CI checks green on c445242.

v8.4.0 - The index was the bottleneck

Codex renders its skills index into a fixed ~22.3 KB block split across every entry. Measured with codex debug prompt-input on a live CODEX_HOME:

entries=255   description chars: min=14  median=16  max=18

Sixteen characters. adversarial-self-review: Use when finaliz. Roughly 19.6 KB of the budget was file paths; 4 KB was meaning. This pack routes by description, so Codex was routing on skill names alone — and the doctor had reported it as 219 entries at ~88 chars, because it counted one directory while Codex indexes every root.

The 73-skill Other-Games mega-pack is now 8 canonical skills

It lived in four provider trees and zero repositories — no version, no backup, gone on any tree reset. 67 of 73 were single-file, and 56% of its 188 KB was byte-identical boilerplate already drifted into two variants, with 20 of 41 files silently missing the Evidence ladder (including the router every other skill told you to load first).

Every game's body is carried verbatim into a tier-3 reference file — 68 of 68 present byte-for-byte, every auxiliary payload carried. References load on demand and are never charged against the index.

	entries	median description
v8.3.0	255	16 chars
v8.4.0	196	40 chars

Deleting the pack instead would have reached ~56 chars and cost 73 games. Consolidating reaches ~40, keeps them, and gives each game its full-length text inside its reference.

Also

• Five skills that existed only in Hermes are now shipped to all four providers. Two more folded into skills that already owned the capability rather than competing at 40 visible characters.
• Identity scrubbed before publishing: a Windows SID, account name, git email, host name and absolute profile paths. A sweep over the whole canonical tree gates the release.
• roblox-docs has never been a loadable skill — its SKILL.md ends with the literal text ...[truncated] and never closes its frontmatter. It shipped that way from RobloxForge v0.1.0 into all four trees, costing an index entry while being unselectable. Fixed here and upstream.
• RETIRED-SKILLS.json gains a declared ABSORBED set: derived history cannot see skills this repository never shipped. 8 retired names -> 81.

79 release contracts (6 new, every one falsified), pack gate PASS, 5156 files manifested, 18/18 CI checks green on 13986e5.

v8.3.0 — Stop leaving things behind

v8.1.0 decided which servers a machine pays for. v8.2.0 decided how much of each. This one deals with what the installer left behind getting there.

The installer never removed a skill it stopped shipping

It copies the canonical tree into every provider's skills directory and has never deleted a skill that left that tree. A machine installed against v7 still carried the v7 names. Measured at v8.2.0 — seven retired skills across three provider trees, twenty-one directories, each one loaded and offered to the agent next to the skill that replaced it:

still installed	replaced by
skyrim-kid-distribution	kid-authoring
skyrim-spid-distribution	spid-authoring
skyrim-esp	skyrim-plugin-authoring
skyrim-papyrus / skyrim-mcm	skyrim-papyrus-modding
skyrim-skse	skse-plugin-authoring
skyrim-archive	skyrim-assets-pbr

Two skills claiming to own KID syntax, and the retired one documents the older dialect. That is wrong answers, not clutter — the exact failure this pack exists to prevent, shipped by the pack.

Backups had no ceiling

The plugin dedupe wrote a full skill-tree snapshot on every install: 160 directories, 52 MB — against 2.1 MB for every .bak file combined (86 Grok config backups, 25 Claude settings backups, ...).

TOOLS\Clean-StaleState.ps1

Removes both. Runs at the end of every successful install; dry-run by default when run by hand. Verified live on a real machine: 52 MB → 2.6 MB, 160 directories → 10, all 21 stale skills gone, second run a no-op.

Deletion is limited to what this pack created, with a contract on each guard:

• A retired skill goes only if its name is in the new BUNDLED-TOOLS/RETIRED-SKILLS.json and absent from the canonical tree and the directory has a SKILL.md.
• Backups keep the newest 3 per family, install logs the newest 5, dedupe snapshots the newest 3 per provider.
• Log retention is ValidateRange(1, 200) — it cannot be set to zero and delete the evidence of the run that deleted it.

Plugin skills, the optional mega-pack and your own files are reported, never touched. It runs after the final doctor, so a failed install keeps everything for diagnosis. -SkipCleanup opts out.

The retired set is derived from this repository's own history by TOOLS/generate_retired_skills.py, not hand-maintained.

Routing now knows what a tool costs

ai-tooling-stack routed on capability alone, so a free CLI and a ~41,768 token/turn MCP server looked equal for a job both could do.

tool	surface	standing cost
Skyrim Forge	52 subcommands, CLI	0 tokens
Spooky's AutoMod	CLI with --json	0 tokens
houseCARL	45 tools, MCP only — no CLI	~41,768 tokens/turn

Every Forge MCP tool has a CLI twin, verified against forge --help on 6.0.0. So: Forge CLI first; houseCARL only for what wins in the LIVE load order, which nothing else can answer.

The correction that makes this work: preferring a cheaper MCP server saves nothing. Its schemas are in context every turn from the moment it is registered, whether or not anything calls it. The saving comes from not registering it, or registering fewer of its tools — never from choosing differently at call time.

The encoding gate was watching four file types

Scripts only. Everything the pack copies onto a machine was unguarded — including AIO-INSTRUCTION.txt, which had already been mojibake-corrupted once in v7.5.6, with nothing watching it afterwards. Five deployed artifacts are now pure ASCII, and the gate checks each by name plus a repo-wide U+FFFD sweep. Falsified before shipping: one em dash appended to BOOTSTRAP.txt fails it.

Deliberately not converted: 2,405 shipped files contain non-ASCII and nearly all of it is intentional — check marks in skill prose, box drawing in banners, CJK in a vendored skill. A .md an agent reads has no encoding problem. build_release.py keeps its omega, a fixture proving the builder survives a Unicode temp path.

---

Verified on 2b43262: 18/18 checks green, 73/73 release contracts under both runners, pack gate PASS, hermes bootstrap 5/5, MANIFEST 4423 files / 0 mismatch, installer exit 0 with doctor PASS and the cleanup running automatically.

Full detail: docs/history/V8.3.0-CHANGELOG.md

v8.2.0 — Register a tool budget, not a server

v8.1.0 decided which servers a machine pays for. This one decides how much of each.

Hermes filters at the tool level, and nothing was using it

The assumption going in was that Hermes is the hardest provider to control, because its MCP servers are not togglable the way Codex's are. That is backwards — tools/mcp_tool.py:

tools.include — whitelist: only matching tool names are registered
tools.exclude — blacklist: all tools EXCEPT matching ones are registered
entries may be exact names or fnmatch globs

Enforced at tool registration, on both the live-discovery and schema-cache paths, so a filtered tool's schema never reaches the model. Claude, Codex, Grok and Kimi can only toggle whole servers. Hermes is the most controllable provider in the pack — and the one where it matters most, because BYOK bills every turn.

houseCARL, by the tool

45 tools, 167,072 bytes, ~41,768 tokens on every turn — about 21% of a 200k window gone before the first user message. Schema size is wildly uneven, which is the whole opportunity:

housecarl_bulk_create     14,655 bytes
housecarl_create_record   14,548
housecarl_bulk_apply      12,393    → 41,596 between them: 25% of the server,
...                                   and more than the whole of Skyrim Forge
housecarl_bsa_list           856

Three named sets now ship in CATALOG.json with their measurements:

set	tools	tokens/turn	saving
Full	45	~41,768	—
Lean (default)	42	~31,369	25%
ReadOnly	27	~17,604	58%

TOOLS\Migrate-HermesProfiles.ps1 -SkyrimToolset ReadOnly -Apply
hermes -p skyrim mcp configure housecarl    # or pick by hand

Lean excludes and ReadOnly includes, deliberately: an upstream update should add new tools to Lean, and must never be able to add a write tool to a set whose promise is that nothing writes.

The filter is yours, not the installer's

hermes mcp configure writes tools.include by hand. The migrator fills that field when absent and never overwrites it — the same rule connect_timeout already had. -SkyrimToolset passed explicitly overrides.

The doctor prints the bill, and refuses to invent one

A tool filter was invisible in every existing view: hermes mcp test reports what the server advertises, not what Hermes registers.

==> Hermes profile tool budgets
  OK  skyrim   housecarl    42/45 tools  ~31369 tok/turn  [Lean] full is ~41768, saving ~10399

The first cut of that line averaged schema bytes across tools and reported ~38,983 for a set that measures 31,369 — a 3.7× error in the saving, in the format of a real measurement. It reports the recorded per-set figure now, and prints cost unmeasured for a hand-picked selection.

Also fixed

• -SkyrimToolset Full reported "already matches" while the previous filter was still installed. Found by running the round trip Lean → Full → ReadOnly → Lean on a live config, not by reading the code.
• 167,118 vs 167,072 were both in flight for one measurement (46 bytes of JSON array framing), in the release built to stop restated numbers drifting. Reconciled to one basis with a cross-source contract.

What this does not fix

The dollar saving is smaller than list price implies — tool schemas sit in the cached prompt prefix. The context-window saving is unconditional: ~10,399 tokens back on Lean, ~24,164 on ReadOnly, every turn, cached or not.

---

Verified on 18b74a1: 18/18 checks green, 70/70 release contracts under both runners, pack gate PASS, provider-detection gate PASS, hermes bootstrap 5/5, MANIFEST 4419 files / 0 mismatch, installer exit 0 with doctor PASS reporting the Lean budget.

Full detail: docs/history/V8.2.0-CHANGELOG.md

v8.1.0 — One click installs what you have

A plain double-click now configures the AI tools you actually have, instead of assuming five providers and downloading the rest.

One-click means one click

• Providers are auto-detected. Through v8.0.4, -Providers defaulted to all five and the bootstrap then fetched the missing ones — a machine with only Claude Code finished the install carrying Codex, Grok, Kimi and Hermes. Detection is executable presence, so uninstalling a provider actually removes it from future runs; a leftover ~/.kimi-code no longer counts as an install. An empty machine still falls back to all five. -AllProviders forces the old behavior.
• -Providers Grok,Claude works from START-HERE.bat now. powershell -File collapses it into one string, which ValidateSet rejected — so the documented syntax never worked from the launcher people actually use.
• claude-mem is opt-in (-WithClaudeMem). It is the only component that is not unattended: Bun runtime, background worker daemon, and a Claude Code restart before its tools appear.
• One launcher. INSTALL-V8-AIO.bat called START-HERE.bat and nothing else, and cost a hand-maintained version string every release. Deleted. START-HERE.bat installs from this folder; INSTALL-REMOTE.bat downloads the release first.

Hermes native profiles

TOOLS\Migrate-HermesProfiles.ps1 owns default (context7/GitHub/Headroom), roblox (+ the official Studio MCP) and skyrim (+ houseCARL). Forge MCPs are not members of any of them — Skyrim Forge and Spooky stay reachable through their skills and CLIs, with -WithForgeCompatibility as the explicit opt-in.

Backup-first with hash-verified rollback, preserves unknown user MCP entries, creates a game profile only when its capability is installed, and reports no-op on the second run.

Measured: tool count is the wrong unit

houseCARL 1.9.0      45 tools  167,118 bytes  ~41,780 tokens/turn
skyrim-forge 6.0.0   52 tools   17,488 bytes   ~4,372 tokens/turn

Skyrim Forge has seven more tools and costs a tenth of the context. Ranking by tool count puts Forge first in line to be cut — backwards by an order of magnitude. Recorded in BUNDLED-TOOLS/capability-records/game-mcp-schema-cost.json.

Fixed

Two release contracts were defined but missing from the list CI iterates — including the one guarding the Hermes profile migration. Both registered, and a falsifiable guard now compares the module namespace against the list.

---

Verified on 5f0050b: 18/18 checks green, 68/68 release contracts, pack gate PASS, hermes bootstrap 5/5, MANIFEST 4418 files / 0 mismatch, installer exit 0 with doctor PASS.

Full detail: docs/history/V8.1.0-CHANGELOG.md

v8.0.4 — Hermes install-time MCP preservation

v8.0.4 — Hermes install-time MCP preservation (2026-08-24)

What changed

Fix: installing with the Hermes desktop app open no longer wipes the MCP board.

The installer stopped the Hermes gateway service (hermes gateway stop) but never
touched the Hermes desktop app (Hermes.exe). When the app was open during an install,
it held a stale in-memory copy of config.yaml from before the install and, on its
next save, rewrote mcp_servers: {} over the freshly written entries — silently
removing context7, github, and headroom.

The fix

INSTALL-AIO.ps1 now:

1. Closes the desktop app before install work begins — captures the Hermes.exe
   path, then Stop-Process -Force on every instance, so the app cannot reload
   mid-install against a half-written config.
2. Relaunches the app only after config.yaml is final — the relaunch sits after
   the install-state write, so the app comes back against the completed configuration
   (and only when the install succeeded).

Verified: PowerShell parse OK (0 errors) and 9/9 behavioral checks — kill block
ordering before the plugin scanner, relaunch ordering after the state write, and the
real-path/bogus-path relaunch branches.

Scope

• Skill/MCP surface unchanged: 146 canonical skills per AI across the five provider trees.
• Hermes only. Claude Code, Codex, Grok, Kimi and Claude Desktop were not affected
  (no long-lived GUI holding an in-memory config over their MCP files).
• For an already-affected machine: re-add the three always-on servers, or re-run the
  installer with the app closed, then restart the app.

v8.0.3 — Hermes fixes + portable starter config refresh

Hermes fixes + starter config refresh.

• Portable starter config refreshed from the maintainer's current live tuning, in portable form: no MCP servers, paths, or hooks; contract pins kept (max_turns null, reasoning max, DeepSeek compression aux).
• Contract suite now tolerates Core zips that ship without BUNDLED-TOOLS/offline - a fresh Core extract previously failed its own tests.
• Carries the V8.0.x Hermes fixes the v8.0.2 assets predate.

Verify: sha256sum -c Ultimate-AI-Starter-Bundle-v8.0.3-Core.zip.sha256

Ultimate AI Starter Bundle v8.0.2

Ultimate AI Starter Bundle V8.0.2

V8.0.2 restores normal Codex marketplace upgrades and cleans up the legacy Hermes OpenRouter workaround.

• Online Codex installs prefer an independently updatable CLI and migrate bundle-owned Superpowers and Ponytail marketplaces to their upstream Git sources.
• Bundled local marketplace sources remain available as the offline fallback.
• Existing Hermes configs remove only the legacy bundle-created openrouter-extra entry from providers or custom_providers.
• Hermes migration is backup-first, atomic, and preserves unrelated settings and YAML comments while leaving native OpenRouter model discovery enabled.
• 146 canonical skills ship across the supported provider trees.

Ultimate AI Starter Bundle v8.0.1

Ultimate AI Starter Bundle V8.0.1

V8.0.1 refines the canonical full, compact, and web AIO sources and Hermes starter defaults.

• 146 canonical skills ship across the supported provider trees.
• INSTALL-AIO.ps1 continues to read the canonical full AIO source and stamp it into every selected provider preamble.
• Existing user configuration remains preserved; only bundle-owned instructions and missing starter defaults are updated.