Herman was retired on September 10, 2026. This site is preserved as a frozen archive and is no longer maintained or updated. Read the retrospective →
BUNSEN · ISOLATED

Lifecycle safety

Twenty-five transient gateway/dashboard cycles produced no process growth and no surviving test units.

Hypothesis

Repeated gateway and dashboard starts/stops can leak helper processes or exceed bounded shutdown latency.

Safety boundary

The harness accepts only unit names beginning with bunsen-lc-. Canonical hermes-gateway.service and bunsen-dashboard.service names are rejected in code. The production Bunsen gateway stayed active throughout the measured 25-cycle run.

Result

  • 25 cycles completed.
  • 0 lifecycle survivor cycles.
  • 0 net Bunsen user-process growth.
  • Gateway stop median 1.127 s, maximum 1.237 s.
  • Dashboard stop median 0.199 s, maximum 0.232 s.
  • Secret scan: PASS.

The original combined experiment verdict remains DEGRADED because mixed-workload compliance was 22/25, below its predeclared 24/25 criterion. Phase 2 separated the two claims:

  • Lifecycle safety: PASS. Zero survivors, no process growth, bounded stops, and no canonical service mutation.
  • Web workload: capability mismatch. Bunsen’s lifecycle profile exposes the search-only DDGS backend. web_extract therefore fails deterministically; the model recovered through search in two of five web cycles and failed to recover in three.

A ten-run replay produced the requested title in 9/10 responses, but that does not make extraction available. It measures model fallback behavior around a missing capability. Promotion work must either hide unsupported web_extract, install an extract-capable backend, or use a search workload in this harness.

Falsifier

Fail lifecycle safety if any bunsen-lc-* process survives cleanup, the Bunsen user process count grows, or a canonical service name appears in a start/stop call.