Runtime Products: Hermes And OpenClaw

KsADK supports two image-based runtime products in addition to code-framework agents:

Hermes: a hosted coding-agent runtime with dashboard, API proxy, terminal WebSocket, and workspace files.
OpenClaw: a hosted OpenClaw gateway runtime where KsADK adds deployment, workspace files, memory backend wiring, and CLI lifecycle management.

These are runtime products, not ordinary local framework projects. A LangGraph or ADK project packages user code. Hermes and OpenClaw deploy a maintained runtime image plus public configuration.

Runtime products: Hermes and OpenClaw

When To Use Which Runtime

Need	Recommended path
Python agent code with LangGraph, ADK, LangChain, or DeepAgents	normal code framework project
Hosted coding assistant with terminal and workspace	Hermes
OpenClaw gateway, channels, or OpenClaw-native UI	OpenClaw
Public quickstart that must run without cloud credentials	normal local framework project

Do not present Hermes or OpenClaw as just another StateGraph or Agent wrapper. They have separate lifecycle commands and deployment contracts.

Lifecycle Comparison

Typical flow and command shape for each runtime. Same concept, two runtimes — use the tabs below:

Typical flow:

Configure model placeholders in local .env or shell.
Review the dry run where supported.
Deploy the Hermes runtime.
Open the dashboard or connect the terminal.
Use workspace files for generated artifacts.

Public examples should use placeholder model values:

OPENAI_BASE_URL=https://api.example.com/v1
OPENAI_MODEL_NAME=my-model

Hermes terminal access uses a WebSocket subprotocol:

Sec-WebSocket-Protocol

Sec-WebSocket-Protocol: ks-terminal.v1

The CLI handles the subprotocol for normal users. API clients should treat it as part of the remote runtime contract.

Typical flow:

Create or enter an OpenClaw project.
Configure model placeholders and optional runtime policy.
Deploy through agentengine openclaw deploy.
Use status, tui, gateway open, or channel commands for operations.
Keep workspace artifacts inside the runtime workspace.

For public examples, document policy knobs without internal values:

agentengine openclaw deploy \
  --model-base-url https://api.example.com/v1 \
  --model-api-key sk-test \
  --default-model my-model

Hermes and OpenClaw both expose KsADK workspace files through the /_ksadk/workspace/v1/* family. Generated files should stay inside the runtime workspace so the hosted UI and CLI file commands see the same artifacts.

Do not document arbitrary host-path access in public docs.

The public model is:

list workspace files.
read or download a workspace file.
add or update a workspace file.
delete a workspace file when permitted.
export a workspace archive when the hosted surface supports it.

Model Configuration Boundary

New in 0.6.7

Hermes and OpenClaw deploy inject a unified model policy env that the runtime uses to pick primary, multimodal, and fallback models.

The unified policy is carried by AGENTENGINE_MODEL_POLICY_JSON, while each runtime also exposes its own DEFAULT/FALLBACK/IMAGE/CATALOG variables for fine-grained override:

Variable	Description
`AGENTENGINE_MODEL_POLICY_JSON`	unified model policy: primary/multimodal/fallback and optional catalog
`HERMES_DEFAULT_MODEL`	Hermes default (primary) model override
`HERMES_FALLBACK_MODEL`	Hermes fallback model override
`HERMES_MODEL_CATALOG_JSON`	Hermes optional model catalog override
`OPENCLAW_DEFAULT_MODEL`	OpenClaw default (primary) model override
`OPENCLAW_FALLBACK_MODEL`	OpenClaw fallback model override
`OPENCLAW_IMAGE_MODEL`	OpenClaw image-scenario model override
`OPENCLAW_MODEL_CATALOG_JSON`	OpenClaw optional model catalog override

The default policy is:

primary = glm-5.2
multimodal = kimi-k2.7-code
fallback = deepseek-v4-pro

Unified policy example (placeholder values)

AGENTENGINE_MODEL_POLICY_JSON='{"primary":"glm-5.2","multimodal":"kimi-k2.7-code","fallback":"deepseek-v4-pro"}'

Override precedence

Explicit env wins. Setting HERMES_DEFAULT_MODEL / OPENCLAW_DEFAULT_MODEL and friends overrides the matching field of the unified policy for that runtime; when unset, the runtime falls back to the default value in AGENTENGINE_MODEL_POLICY_JSON.

OpenClaw image scenario default

The OpenClaw image scenario defaults to kimi-k2.7-code (the multimodal field of the unified policy). To pin a different model, set OPENCLAW_IMAGE_MODEL to override.

Public examples show only the placeholder shape, never real endpoints or tokens.

OPENAI_BASE_URL=https://api.example.com/v1

Memory And Tooling Boundaries

Hermes and OpenClaw may read model, memory, channel, or tool configuration from environment variables. Public docs should keep these variables as names and placeholders, not real values.

Category	Public-safe examples
model	`OPENAI_API_KEY`, `OPENAI_BASE_URL`, `OPENAI_MODEL_NAME`
memory	`KSADK_LTM_BACKEND`, `KSADK_LTM_NAMESPACE`, `KSADK_LTM_SCENE_ID`
workspace	`KSADK_WORKSPACE_FILES_ENABLED`, runtime workspace path labels
OpenClaw policy	strict mode, workspace-only filesystem policy, approval mode
secrets	variable names only; never commit literal tokens

Memory backend wiring

New in 0.6.7

KSADK_LTM_BACKEND selects the memory backend. The three options differ in storage and retrieval capabilities.

backend_type	Description
`openclaw_default`	OpenClaw default memory backend, integrated into the OpenClaw gateway lifecycle
`mem0`	Mem0 memory backend; requires additional `KSADK_LTM_NAMESPACE` and scene config
`lancedb`	Local LanceDB memory backend, suited to fast validation without external dependencies

Placeholder example: pick a backend and set namespace / scene

KSADK_LTM_BACKEND=openclaw_default
KSADK_LTM_NAMESPACE=my-agent
KSADK_LTM_SCENE_ID=default

Backend switching

Different backends have different persistence and retrieval semantics. After switching KSADK_LTM_BACKEND, existing memories are not migrated automatically; to preserve history, export from the old backend first and import into the new one.

What Stays Internal

Do not publish:

private runtime image names or registries.
private-environment endpoints.
kubeconfig files or cluster names.
real channel tokens, model keys, or kdocs tokens.
customer workspace paths or object storage buckets.
incident runbooks tied to internal platforms.

The public docs should explain the contract and lifecycle. Operational details for a specific private environment belong in internal documentation.