OnlyTerp · OnlyTerp · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,34 @@
 
 Dated list of meaningful guide updates. Roughly [Keep a Changelog](https://keepachangelog.com) flavored.
 
+## 2026-07-17 — The Power Secrets modernization (v0.18.2 era)
+
+### Added
+- **Part 28 — The Recipe Book**: twelve end-to-end community builds mapped onto real primitives — the morning finance loop (read-only), staged Gmail (drafts-only scopes), the SMB approval office, the overnight Kanban shift, the GPU FIFO board, the content swarm, the carousel factory, the job-hunt pipeline, the accountability coach, the health correlator (local backend), the Blender room, and the secretary office — each with its primitives, its approval posture, and the trap that bit its builders first.
+- **New house-style SVG artwork**: Part 27 hero, the one-page cheat-sheet poster, the seven-layer security stack (Part 19), the seven-rung agent ladder (Part 8), the gateway token tax (Part 20), and the Recipe Book map (Part 28); release timeline refreshed to v0.18.2.
+- Part 3: "Scaling LightRAG: the July 2026 playbook" — role-specific LLMs, structural chunking, multimodal ingestion, production stores (OpenSearch), RAGAS-style evals via Langfuse, multi-agent retrieval.
+- Part 5: ≤60-char skill-description hygiene, built-ins-before-skills, and `/skills` + `/memory` approval gating.
+- **Part 27 — Power Secrets**: a new field manual distilling the official Wingtips series (#1–#22) and the highest-signal July community research into 25 verified non-obvious mechanics — memory/USER snapshot semantics, compression internals (`protect_last_n`, cheap auxiliary compression, compaction's structured brief), the messaging-gateway token tax, credential pools vs fallbacks and their cache-miss cost, model-switch cache resets, profiles-as-rooms (and the filesystem-isolation caveat), Kanban's `toolsets` and workspace traps, `state.db`/disk hygiene, session export with `--redact`, `/steer`//`/queue`//`/busy` timing semantics, supervised self-improvement gates, and a printable one-page cheat sheet.
+- Part 17: **MCP Security — July 2026 state of play**: CVE table (LiteLLM CVE-2026-30623, Windsurf CVE-2026-30615, Cursor MCPoison CVE-2025-54136, MCP Inspector CVE-2025-49596, LibreChat CVE-2026-22252), npm-impersonator warning, and a 7-point hardening checklist.
+- Part 19: the **seven-layer security mental model** mapped onto real Hermes primitives, the **action-ontology** containment pattern (host = brain, credential-less container = hands, typed action API), and **external spend kernels** for money-touching agents (Custodian / `CommercePolicy` / Latch / payguard patterns).
+- Part 20: **the gateway token tax** (CLI ~6–8k vs messaging ~15–20k tokens/turn), **benchmark-the-stack-not-the-model** (WolfBench Codex-vs-Hermes data, Terra-vs-Sol economics, busywork anti-pattern, free-tier warning), and a **Langfuse v4 / OTEL Collector** section (local model pricing, double-counted spans, root-observation default change).
+- Part 8: the **seven-rung agent ladder** (basic tools → MCP → pipelines → parallel → routed specialists → human-in-the-loop → dynamic spawning) and a one-agent-vs-profiles decision guide.
+- Part 9: **mid-July model landscape** (Kimi K3 day-one support incl. the Kimi-Direct update requirement, GPT Sol/Terra/Luna routing posture, Anthropic-subscription limitation, local reference points) and **credential pools**.
+- Part 14: `/steer` / `/queue` / `/busy` timing semantics and the **segmented tool batch dispatch** (safe-tool parallelism) behavior.
+- Part 24: **Hermes Cloud** third connection mode (labelled preview) and the remote-backend "code runs on the server" gotcha.
+- Part 25: background **computer use** on macOS (`hermes computer-use install`), current local model reference points, and a local KV-cache note.
+- Parts 6/7: compression levers and compaction internals; the memory **snapshot rule**, `/memory` + `/skills` approval gates, and a memory-stack comparison table (native vs LightRAG vs Mem0 vs skills).
+- Part 21: 10-second sandbox decision guide (Daytona / Modal / E2B / Vercel / OpenShell).
+- ECOSYSTEM: "Community projects on the radar" (Scarf, zhc-fabric, Sibyl, Latch, payguard, hermes-sonus, OpenKnowledge, HOODRADAR, Hermes Pong, Camofox + its context-tax warning).
+
+### Changed
+- Version currency: badges, intro, and "What's New" now target **v0.18.2 (v2026.7.7.2)** with the v0.18.1 patch-rollup note, the WhatsApp/Baileys fix (Part 15 Docker-tag guidance), and an explicit "main → v0.19.0, untagged = experimental" framing.
+- Part 18 agent-lane updates: Claude Code 2.1.20x, Codex 0.144.x stable pin (avoid 0.145 alpha unattended), OpenCode MCP resources + provider change, the Hermes Pong subscription workaround, and Teknium's "keep Hermes in the loop" guidance.
+- Parts 11/16/23 operational updates: `loginctl enable-linger` for headless gateways, real disk-growth hot spots (`state-snapshots/`, cron output, piped stdout), `hermes sessions prune`/`export --redact`, Kanban toolset opt-in + absolute `dir:` workspaces, and overnight/GPU-FIFO board shapes.
+- README: 29-part navigation, new "power secrets" and "recipe book" reading paths, mid-July status section.
+- Community claims are labelled as such throughout; all new config snippets stay within the real v0.18 schema (no invented keys).
+- Note: `README-zh.md` / `README-ja.md` remain synced to the 2026-07-03 state; a translation sync is queued.
+
 ## 2026-07-03 — Accuracy & consistency maintenance pass
 
 ### Fixed

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -36,7 +36,7 @@ The [README Repo Map](./README.md#repo-map) is the canonical, row-by-row descrip
 ├── README.md (+ README-zh.md, README-ja.md)
 ├── CHANGELOG.md · ROADMAP.md · ECOSYSTEM.md · CODE_OF_CONDUCT.md · LICENSE
 ├── CONTRIBUTING.md                  ← you are here
-├── part1-setup.md … part26-moa-verification.md   # the 27-part guide (README + 26 part files)
+├── part1-setup.md … part28-recipe-book.md        # the 29-part guide (README + 28 part files)
 ├── skills/                          # 13 installable SKILL.md files under dev/, ops/, security/
 ├── templates/
 │   ├── config/{minimum,telegram-bot,production,cost-optimized,security-hardened}.yaml

diff --git a/ECOSYSTEM.md b/ECOSYSTEM.md
@@ -46,6 +46,23 @@ See [Part 22](./part22-latest-power-moves.md#4-use-plugins-for-integrations-not-
 
 ---
 
+## Community projects on the radar (July 2026)
+
+*Community-maintained; audit before installing — anything that reads sessions or executes code deserves a code review first ([Part 19](./part19-security-playbook.md)).*
+
+- **Scarf** — swarm orchestration for Hermes agents (topologies, consensus, shared state, cost tracking; MIT)
+- **zhc-fabric** — distributed multi-node control plane: mesh networking + mTLS + hardware-attested identity for Hermes fleets
+- **Sibyl Memory (Hermes Atlas)** — alternative memory plugin advertising strong LongMemEval numbers; verify vendor benchmarks on your own workload
+- **Latch** — payments/spend-control layer for agents (see the spend-kernel pattern in [Part 19](./part19-security-playbook.md#external-spend-kernels-when-the-agent-touches-money))
+- **payguard** — self-hostable payment approval firewall: agent requests, human approves
+- **hermes-sonus** — voice for Hermes on Windows/macOS (hotkey push-to-talk, TTS replies)
+- **OpenKnowledge** — Wikipedia-style knowledge dumps distilled for agent consumption
+- **HOODRADAR** — example of a Hermes-built production app (real-time crime mapping); useful as an architecture reference
+- **Hermes Pong** — orchestrate a Claude Code terminal from Hermes (the Anthropic-subscription workaround; see [Part 18](./part18-coding-agents.md))
+- **Camofox** — anti-detect browsing for agents. **Warning:** its `AGENTS.md` injects ~22k chars into every prompt if it's in your cwd ([Part 6](./part6-context-compression.md#the-context-you-didnt-order-third-party-rule-files))
+
+---
+
 ## Coding-agent integrations
 
 - [Claude Code](https://docs.claude.com/en/docs/claude-code) — `claude -p` + ACP; best unattended PR lane with Sonnet 5 / Opus 4.7

diff --git a/README.md b/README.md
@@ -5,15 +5,15 @@
 </p>
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE)
-[![Hermes](https://img.shields.io/badge/Hermes-v0.18.0%20%282026.7.1%29-9146FF)](https://github.com/NousResearch/hermes-agent/releases/tag/v2026.7.1)
-[![Last updated](https://img.shields.io/badge/Last%20updated-2026--07--01-brightgreen)](./CHANGELOG.md)
-[![Parts](https://img.shields.io/badge/parts-27-blue)](#table-of-contents)
+[![Hermes](https://img.shields.io/badge/Hermes-v0.18.2%20%282026.7.7.2%29-9146FF)](https://github.com/NousResearch/hermes-agent/releases/tag/v2026.7.7.2)
+[![Last updated](https://img.shields.io/badge/Last%20updated-2026--07--17-brightgreen)](./CHANGELOG.md)
+[![Parts](https://img.shields.io/badge/parts-29-blue)](#table-of-contents)
 [![Skills](https://img.shields.io/badge/installable%20skills-13-blue)](./skills/)
 [![Configs](https://img.shields.io/badge/config%20templates-5-blue)](./templates/config/)
 [![CI](https://github.com/OnlyTerp/hermes-optimization-guide/actions/workflows/ci.yml/badge.svg)](./.github/workflows/ci.yml)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](./CONTRIBUTING.md)
 
-> **Current through Hermes Agent v0.18.0 (v2026.7.1) — "The Judgment Release"** · **27 parts, 13 installable guide skills, 5 opinionated configs, 4 reference architectures, one-command VPS bootstrap** · Now covering **Mixture-of-Agents as a first-class model**, evidence-based **verification** + `/goal` completion contracts, **`/learn` + `/journey`** self-improvement, **background subagent fan-out**, the maturing **Desktop app** (Projects, memory graph, multi-terminal), **iMessage via Photon** (no Mac needed), the NVIDIA RTX / DGX Spark local-hardware story, and gateway **scale-to-zero** for teams. **Bring any model** — this guide is about the *harness*, not the weights.
+> **Current through Hermes Agent v0.18.2 (v2026.7.7.2) — the "Judgment" line** · **29 parts, 13 installable guide skills, 5 opinionated configs, 4 reference architectures, one-command VPS bootstrap** · Now covering **Mixture-of-Agents as a first-class model**, evidence-based **verification** + `/goal` completion contracts, **`/learn` + `/journey`** self-improvement, **background subagent fan-out**, the maturing **Desktop app** (Projects, memory graph, multi-terminal), **iMessage via Photon** (no Mac needed), the NVIDIA RTX / DGX Spark local-hardware story, gateway **scale-to-zero** for teams — and now a full **[Power Secrets field manual](./part27-power-secrets.md)** and a twelve-build **[Recipe Book](./part28-recipe-book.md)** distilled from the official Wingtips series and July's best community research. **Bring any model** — this guide is about the *harness*, not the weights.
 >
 > Other languages: [中文](./README-zh.md) · [日本語](./README-ja.md)
 
@@ -23,10 +23,10 @@ Every part you need to go from fresh install to a production Hermes deployment
 Unlike most guides, the prescriptions come with **working files**: [`skills/`](./skills) you can `ln -s` into `~/.hermes/skills/`, [`templates/config/`](./templates/config) you `cp` to `~/.hermes/config.yaml`, [`scripts/vps-bootstrap.sh`](./scripts/vps-bootstrap.sh) that takes a fresh VPS to production in one command.
 
 <p align="center">
-  <img src="./assets/runnable-artifacts.svg" alt="Docs plus runnable artifacts — 27 guide parts, 13 installable skills, 5 config templates, 4 reference architectures, one-command VPS bootstrap, 8-question config wizard" width="920">
+  <img src="./assets/runnable-artifacts.svg" alt="Docs plus runnable artifacts — 29 guide parts, 13 installable skills, 5 config templates, 4 reference architectures, one-command VPS bootstrap, 8-question config wizard" width="920">
 </p>
 
-*By Terp — [Terp AI Labs](https://x.com/OnlyTerp)* · Last updated **July 1, 2026** · [CHANGELOG](./CHANGELOG.md) · [ROADMAP](./ROADMAP.md) · [ECOSYSTEM](./ECOSYSTEM.md)
+*By Terp — [Terp AI Labs](https://x.com/OnlyTerp)* · Last updated **July 17, 2026** · [CHANGELOG](./CHANGELOG.md) · [ROADMAP](./ROADMAP.md) · [ECOSYSTEM](./ECOSYSTEM.md)
 
 ---
 
@@ -80,7 +80,7 @@ Prefer a 5-minute local-only setup? → **[docs/quickstart.md](./docs/quickstart
 | [`docs/quickstart.md`](./docs/quickstart.md) | 5-minute zero-to-Telegram-bot. |
 | [`ECOSYSTEM.md`](./ECOSYSTEM.md) | Curated directory of MCP servers, coding agents, dashboard plugins. |
 | [`ROADMAP.md`](./ROADMAP.md) · [`CHANGELOG.md`](./CHANGELOG.md) · [`CONTRIBUTING.md`](./CONTRIBUTING.md) | The usual suspects. |
-| README + `part1-*.md` … `part26-*.md` | The 27-part guide itself (now incl. MoA + verification, Desktop App, NVIDIA / local hardware). |
+| README + `part1-*.md` … `part28-*.md` | The 29-part guide itself (now incl. MoA + verification, Desktop App, NVIDIA / local hardware, the Power Secrets field manual, and the Recipe Book). |
 
 ---
 
@@ -117,10 +117,10 @@ Full set of diagrams: [`diagrams/architecture.md`](./diagrams/architecture.md).
 ## Pick Your Path
 
 <p align="center">
-  <img src="./assets/pick-your-path.svg" alt="Pick your path — ten curated reading paths through the guide's 27 parts, from a 10-minute setup to production hardening, local GPU, and MoA verification" width="920">
+  <img src="./assets/pick-your-path.svg" alt="Pick your path — curated reading paths through the guide's 29 parts, from a 10-minute setup to production hardening, local GPU, and MoA verification" width="920">
 </p>
 
-This guide grew to 27 parts because *Hermes grew*. Every part lives in its own file (`part1-setup.md` … `part26-moa-verification.md`); this README keeps a short summary of Parts 1–5 (plus the full SOUL.md personality section) and links out. You don't have to read them all — pick the shortest path to what you need:
+This guide grew to 29 parts because *Hermes grew*. Every part lives in its own file (`part1-setup.md` … `part28-recipe-book.md`); this README keeps a short summary of Parts 1–5 (plus the full SOUL.md personality section) and links out. You don't have to read them all — pick the shortest path to what you need:
 
 ### 🎯 "I just want it working in 10 minutes"
 Skip the terminal: install the [desktop app](./part24-desktop-app.md) and let first-run **Quick Setup via Nous Portal** pick a model for you. Prefer the CLI? [Part 1: Setup](./part1-setup.md) → [Part 12: Web Dashboard](./part12-web-dashboard.md) and point-and-click the rest.
@@ -152,6 +152,12 @@ Skip the terminal: install the [desktop app](./part24-desktop-app.md) and let fi
 ### 🧑‍⚖️ "I want an ensemble of frontier models — and proof the work is done"
 [Part 26: MoA, Verification & Self-Improvement](./part26-moa-verification.md) — pick a Mixture-of-Agents council like a model, judge `/goal` completion against evidence, and steer what the agent learns with `/learn` + `/journey`.
 
+### ⚡ "I've been running Hermes for months — give me the stuff I don't know"
+[Part 27: Power Secrets](./part27-power-secrets.md) — 25 non-obvious mechanics: the memory snapshot rule, the gateway token tax, credential-pool cache misses, the Kanban traps, profiles-as-rooms, and a printable one-page cheat sheet.
+
+### 🍳 "Show me what people actually *build* with this"
+[Part 28: The Recipe Book](./part28-recipe-book.md) — twelve production builds from the wild: the morning finance loop, staged Gmail, the content swarm, the overnight Kanban shift, the GPU FIFO board, the secretary office, and more — each mapped to real primitives with the trap that bit its builders first.
+
 ---
 
 ## What's New (July 2026)
@@ -162,7 +168,17 @@ Skip the terminal: install the [desktop app](./part24-desktop-app.md) and let fi
 
 Two huge releases landed since the Surface refresh — **v0.17.0 "Reach" (v2026.6.19)** and **[v0.18.0 "The Judgment Release" (v2026.7.1)](https://github.com/NousResearch/hermes-agent/releases/tag/v2026.7.1)**. Combined: ~3,200 commits, ~1,800 merged PRs, 1,200+ issues closed, and — as of v0.18 — **every P0 and P1 issue in the entire Hermes repo resolved** (~700 highest-priority items cleared in twelve days, with a standing commitment to keep the count at zero). None of it is model-specific — bring whatever weights you want.
 
-### v0.18.0 — "Judgment" (latest)
+### Mid-July status — v0.18.1 / v0.18.2 and what's coming
+
+- **v0.18.1 (`v2026.7.7`)** is a big *patch rollup* on the Judgment line — fixes and small features, not a curated feature release.
+- **v0.18.2 (`v2026.7.7.2`)** is the current tagged release. Headline fix: the **WhatsApp personal (Web/QR) adapter** broken by an upstream Baileys change ([Part 15](./part15-new-platforms.md)). If you pin Docker tags, move to `v2026.7.7.2` or newer.
+- **`main` is marching toward v0.19.0** — features you see discussed but not tagged (e.g. the **Hermes Cloud** connection mode, background **computer use**) should be treated as **experimental/preview** until they land in a release. Where this guide covers them ([Part 24](./part24-desktop-app.md#7b-hermes-cloud--the-third-connection-mode-preview), [Part 25](./part25-nvidia-local.md#9-background-computer-use-macos)) they're labelled as such.
+- **Model landscape moved too**: day-one **Kimi K3** support, the GPT **Sol / Terra / Luna** family, and a hard fact worth knowing — Anthropic *subscriptions* don't work natively (API keys do). Current routing posture: [Part 9](./part9-custom-models.md#the-mid-july-2026-model-landscape).
+- **New: [Part 27 — Power Secrets](./part27-power-secrets.md)**, the distilled field manual from the official Wingtips series (#1–#22) and July's community research: context/cache mechanics, cost traps, profile architecture, and operational gotchas — each verified against the real schema.
+- **New: [Part 28 — The Recipe Book](./part28-recipe-book.md)**, twelve end-to-end production builds observed in the wild — money & ops, content & career, life & lab — each mapped onto real Hermes primitives with its approval posture and its known trap.
+- **New artwork throughout** — the seven-layer security stack, the agent ladder, the gateway token tax, the Power Secrets cheat-sheet poster, and the Recipe Book map, all in the guide's house style.
+
+### v0.18.0 — "Judgment"
 
 - **Mixture-of-Agents is a first-class model** — every named MoA preset is a selectable virtual model under a `moa` provider in every picker (CLI/TUI/desktop/gateway). Each reference model's reasoning renders as its own labelled block, and the aggregator's answer streams live. `/moa` is now one-shot sugar. See [Part 26](./part26-moa-verification.md).
 - **The agent proves its work** — verification evidence for coding tasks (run the project's checks, don't assert success), **completion contracts** for `/goal`, `/goal wait <pid>`, and a `pre_verify` hook. See [Part 26](./part26-moa-verification.md#2-verification--done-means-proven-not-claimed).
@@ -239,6 +255,8 @@ Hermes is now optimized for always-on **local** use on **NVIDIA RTX PCs, RTX PRO
 25. [Hermes Desktop App](./part24-desktop-app.md) — Native macOS/Windows/Linux GUI, Quick Setup, Cmd+K palette, Projects, multi-terminal, memory graph, remote gateway, multi-profile, voice, self-update
 26. [NVIDIA & Local Hardware](./part25-nvidia-local.md) — Run Hermes on your own GPU: RTX / DGX Spark, OpenShell isolation, NemoClaw, and a model-agnostic local stack
 27. [MoA, Verification & Self-Improvement](./part26-moa-verification.md) — Mixture-of-Agents presets as models, `/moa`, completion contracts for `/goal`, `/learn`, `/journey`, background fan-out, scale-to-zero
+28. [Power Secrets](./part27-power-secrets.md) — 25 verified non-obvious mechanics: memory snapshots, the gateway token tax, cache economics, credential pools, Kanban traps, profiles-as-rooms, and a printable cheat sheet
+29. [The Recipe Book](./part28-recipe-book.md) — twelve production builds: finance loops, staged Gmail, approval offices, overnight Kanban, GPU FIFO, content swarms, job-hunt pipelines, coaches, correlators, Blender rooms, and the secretary office
 
 ---