HERMES AGENT HAS 4 MEMORY LAYERS. MOST USERS ONLY KNOW ABOUT 1. THE OTHER 3 ARE WHY SOME AGENTS GET SMARTER EVERY MONTH AND YOURS DOESN'T. LAYER 1: USER.MD (who you are) ~/.hermes/memories/USER.md the agent builds a profile of you over time. your role, your stack, your communication style, your goals. capped at ~1,375 characters. the cap is the point. forces the agent to keep only what matters about you. not a diary. a compressed identity. you don't write this. the agent does. but you SHOULD read it monthly. hermes memory status open the file. delete what's wrong. "user prefers Python" (you mentioned it once). "user works at [old company]" (3 months outdated). one wrong fact = wrong assumptions every session. LAYER 2: MEMORY.MD (what the agent learned) ~/.hermes/memories/MEMORY.md agent-curated notes about your projects, preferences, environment, workflows. capped at ~2,200 characters. the agent decides what goes here based on conversation patterns. not because you said "remember this." because it noticed something worth keeping. entries get timestamped automatically: keep the timestamps. the agent uses them to decide which entries are still relevant. same rule: read monthly. delete outdated facts. the agent doesn't prune on its own. when memory is full, new writes get rejected instead of silently dropping old ones. LAYER 3: SESSION SEARCH (full conversation archive) ~/.hermes/state.db every CLI and messaging session stored in SQLite with FTS5 full-text search. the agent searches its own past: "what did we discuss about the auth migration?" it queries the database. returns actual messages. no LLM summarization. no truncation. real conversations from weeks ago. memory = critical facts always in context. session search = historical lookup when needed. most users don't know this exists. the agent uses it automatically when you reference something from a past conversation. LAYER 4: EXTERNAL MEMORY PROVIDERS (8 options) beyond the built-in files, Hermes ships with 8 external memory provider plugins: Honcho: dialectic reasoning + deep user modeling. derives implicit patterns you don't articulate. Hindsight: shared memory bank across agents. Hermes remembers → Codex knows. and vice versa. Mem0: semantic search + auto-consolidation. OpenViking: graph-based memory with entity linking. Holographic: vector similarity recall. RetainDB: hierarchical knowledge tree. ByteRover: local-first with cloud sync. Supermemory: semantic search + profile recall. one active at a time. built-in memory (USER.md + MEMORY.md) stays alongside it. hermes memory setup (interactive picker + configuration) hermes memory status (check what's active) HOW THEY STACK: layer 1 (USER.md): always in system prompt. who you are. updated by the agent. layer 2 (MEMORY.md): always in system prompt. what the agent learned. updated by the agent. layer 3 (session search): queried on demand. full conversation history in SQLite. layer 4 (external provider): runs in background. prefetches relevant memories before each turn. syncs conversation after each response. layers 1-3 are free and built-in. layer 4 is optional and extends the system. WHAT MOST PEOPLE GET WRONG: MISTAKE 1: never reading memory files. open USER.md and MEMORY.md right now. Desktop app: sidebar → Memory. CLI: cat ~/.hermes/memories/USER.md wrong facts compound. one bad entry = wrong assumptions on every future session. MISTAKE 2: thinking bigger memory = better. bounded memory works better than unlimited. 2,200 characters forces curation. unlimited memory encourages dumping everything and never cleaning up. MISTAKE 3: confusing memory with session search. memory = facts that should ALWAYS be in context. session search = historical lookups when needed. put your API server address in memory. don't put last Tuesday's debugging session. MISTAKE 4: two agents sharing one home directory. memory writes are automatic. two writers sharing ~/.hermes/ compound entries neither of them authored. give each agent its own profile. shared memory = use an external provider (layer 4). SECURITY: every memory entry scanned before acceptance. prompt injection attempts = blocked. credential exfiltration = blocked. SSH backdoors = blocked. invisible Unicode characters = blocked. exact duplicates = rejected automatically. your memory files are injected into the system prompt. that's why security scanning is non-negotiable. 5-MINUTE MONTHLY CLEANUP: 1. hermes memory status (check what's active) 2. open USER.md. delete outdated facts. 1 minute. 3. open MEMORY.md. delete stale entries. 2 minutes. 4. check timestamps. anything older than 60 days with no recent reference = candidate for removal. 5. done. sharper agent for 30 days.