◆ Binding — all agents

Lisa, Kim, Claude Code, OpenCode, Cowork, and every agent not yet born: you do not edit, generate, or even reason about any page on this site until you have read and accepted this document. Ratified by King Solomon, 2026-07-05.

The Mirror Doctrine

source-of-truth law for every Hermes agent profile

The profile page is not a document about Lisa — it IS Lisa, rendered. For every Hermes agent, the profile must be a live mirror of the VPS itself: every connection, every cron, every daemon, every memory, every credential path, every port — pulled directly from the machine that runs her, at scan time, by code. Never from a YAML file a human or an AI typed last week. If it's on the VPS, it's on the profile; if it's not on the profile, it doesn't exist — and the page can never disagree with the container, because the container is the only place the page is allowed to get its facts from.

The rule in one line The source of truth is the source. No middleman, no transcription, no memory of the truth — only the truth, read fresh.

What this means concretely

Hand-typed profile.yaml demotes from "source" to "annotation." Anything the VPS can answer (crons, connectors, ports, memory, skills, daemons, model config, .env inventory) must come from the CAT-scan. The Bible keeps only what a machine can't know — purpose descriptions, costs, King's standing rules, history. As of 2026-07-05, half the cards render from live source (D.06, D.06b, D.13–D.16); the remaining hand-typed cards — connectors (D.07), skills (D.08), crons (D.09), comms (D.11), secrets (D.12) — still violate this rule and are being converted to live collectors.

It's per-agent and automatic. The same collectors run against Lisa's container, Kim's container, and every future agent's — one scan script, N agents, zero per-agent hand-editing. That's how it scales to 10,000 agents like the factory intends.

The morning of 2026-07-05 proved why. The profile said 55 memory files — the container said 96. The profile said "curator: built-in, 168h" — the machine was running a dedicated 900-second daemon. The profile said location tracking was offline — the service was running. Every one of those lies came from the same place: a human-transcribed middle layer. This rule deletes the middle layer.

Operating rules derived from the Doctrine

Never hand-type onto a profile a fact the VPS can answer. Extend the CAT-scan collector instead (scripts/agent_catscan.py), then rebuild (scripts/build_empire_profiles.py) and deploy.
Never "fix" a profile number by editing YAML or HTML. If a number is wrong, the collector is wrong or the scan is stale — fix that.
Secrets discipline is unchanged: key NAMES and storage PATHS render; values never leave the VPS.
If the page disagrees with the container, the container wins — and the disagreement itself is a bug to report to King.

agent_catscan.py (reads the live container) → agents/<name>/catscan.json → build_empire_profiles.py → empire-site/deep/<name>.json → dashboard.html renders · the only permitted direction of truth is machine → page

Canonical file: DOCTRINE.md — also deployed to /opt/empire-site/DOCTRINE.md on the VPS for agents to read directly.