Leases, receipts, and a judge: running unattended agents safely

An agent that runs while nobody watches needs different machinery than an agent you supervise. Hosted Hermes runs tasks in isolated fenced VPS sandboxes, and three mechanisms carry the safety load: leases, receipts, and a judge.

Renewable leases: only one live executor

Every task thread holds a 90-second renewable lease on the fenced VPS runner. A healthy run renews its lease continuously; a crashed, wedged, or superseded run loses it. Only the current unexpired lease-holder can complete the task, which kills the classic unattended-agent failure where a zombie process and its replacement both write results.

Receipts: an audit trail you can replay

Every consequential action produces a receipt. When a run ends — success or not — you can read what the agent actually did rather than what it says it did. Public aggregate numbers from the same pipeline are on our stats endpoint; the private per-task trail stays in your workspace.

The judge: checks before the tool call

Before sensitive tool calls execute, an LLM-as-a-Judge policy layer evaluates them. Destructive commands, secret exfiltration, and spend overruns get blocked or escalated. Money, customer, and production actions always pause for a human decision in the thumbgate.app browser — the agent cannot approve itself.

None of this requires you to run infrastructure. The mechanisms above are what the flat monthly price buys: an agent that keeps working when you leave, inside fences it cannot quietly climb.