Articles Agents and doctrine
Commander's Intent: Two Architectures for an AI Agent Fleet That Keeps Moving When the Plan Breaks
Your agents rarely fail loudly. They stall, or they drift. Both look like silence until something downstream breaks — a pull request that never opened, a digest that never arrived, a host that answered yesterday and answers nothing today.
@pixelrainbownft fixed that with an idea the U.S. Marine Corps has trusted for decades: commander's intent. He developed the doctrine with @pixelrainbownft's father, a retired U.S. Marine Corps Colonel, call signs Grizzly and Maverick. Now it runs his agent fleet, and the scaffold is open source under MIT at github.com/shagghiesuperstar/commanders-intent.
This is a philosophy of command for machines that talk back. It walks the doctrine, then holds two topologies against it — a single Grok Bot Chief of Staff as the belly button, and the current chain where a lead Hermes commands other Hermes agents and a Grok Bot fleet through a two-way connector @pixelrainbownft built. One fits the doctrine more cleanly. The other buys span of control at a cost the doctrine forces you to name.
The problem: plans break every day
A key expires. An API changes. A reviewer finds a flaw at the last step. An agent fleet runs around the clock, mostly unwatched, and hits a broken plan many times a day.
Without intent, each agent does one of two bad things. It stops and waits, so the ask dies quietly. Or it keeps going toward whatever its last prompt implied, so the fleet drifts. Both are silent failures. Fail loud is the cure — but loud without purpose is just noise.
The answer the Marines already wrote down
MCDP 1, Warfighting, starts from a hard truth: "plans will go awry, instructions and information will be unclear and misinterpreted, communications will fail." Its answer is not a more detailed plan. It is a way of commanding that still works when the plan does not.
Four ideas do the work. Swap "Marine" for "agent" and you have the operating system an AI fleet is missing.
Commander's intent. Every mission has a task and a purpose. "Of the two, the intent is predominant." When the task goes stale — the endpoint moved, the reviewer rejected the patch, the model quota tripped — the purpose still guides the next move.
Mission tactics. Say what and why. Leave the how to whoever is doing the work. A Chief of Staff that micromanages tool calls is not commanding; it is puppeteering.
Main effort. One effort gets priority. Everyone else asks how they can best support it. Without a named main effort, a fleet of capable agents becomes a committee of priorities.
Initiative within intent. Decide where the work is. Lack of orders is never a reason to sit still. Initiative is wide on how, and zero on what must never be risked. Spending, publishing, DNS and domains, secrets, and destructive actions stay behind human gates.
What Commander's Intent is, as a system
As @pixelrainbownft ships it: a free Grok Bot template plus a public, MIT-licensed repo. You get a Chief of Staff as a single point of contact, Hermes Agent hosts that report up, and one shared Hindsight memory bank. The repo holds the intent scaffold and interview, the doctrine, 25 skills, 4 routines, a security policy, a fleet self-healing spec, and the first-run script. Start with COMMANDERS-INTENT.md, then SECURITY.md. Template: x.ai/bot/0QOzV3XYLmzbu_WJQYOby.
COMMANDERS-INTENT.md. Every agent, on every host and in every cloud session, reads the same document before acting — purpose, method, end state, hard lines, who decides what. If anything conflicts with it, it wins, except the human's gates on spending, publishing, and the like.
Written by interview. On first run, before any other setup, the Chief of Staff interviews you one question at a time: 22 questions plus probes, about 20 to 30 minutes. What the fleet is for, what is true in 90 days and in a year, what you will never risk, what agents may spend, who holds authority. It invents nothing, plays the draft back section by section, and nothing counts until you approve it as v1.0.
Purpose, method, end state. Marine Corps planning format. Purpose endures when the task goes stale. Method is the few key tasks that carry the load, with the main effort named. End state is what is true when you win, stated so it can be checked.
The ladder when the plan breaks. Re-read the intent. Probe before declaring a wall. Adapt within the intent. Act on reversible work. Escalate with a complete decision ask when authority is needed. Then keep moving on everything else.
Checksums and wake lines. Every version of the intent has a checksum. Every agent starts its session with a wake line that names the version it holds. Every order names the intent one and two levels up, so a worker can check its task still serves both. Drift is caught at the door, not in a postmortem.
Hindsight shared memory. The approved file becomes a Hindsight mental model named commanders-intent. Agents read it before acting on doctrine. It refreshes on every version bump and weekly. If memory and the file disagree, the file wins.
Quota discipline. One digest per task, no FYI pings. Top models where quality shows, the cheapest capable model everywhere else. Quota pressure and model fallbacks get reported early and loudly.
Only the human amends it. The Chief of Staff can propose a change with context, options, a recommendation, and its confidence. Only you approve it. Each amendment bumps the version, refreshes shared memory, and tells every agent.
Security gates. Rules live in SECURITY.md. Cloud coding agents — Cursor cloud agents, Claude Code on the web, OpenAI Codex cloud, GitHub Copilot cloud agent, and Devin — get least-scope repo access and open draft pull requests only. A reviewer who did not write the code approves first: code review, critic pass, security pass. High and critical findings block the merge. Exactly one merge owner merges. The orchestrator never merges. Production is proven by reading it back. Secrets come from a vault, injected at runtime — never pasted into a prompt, chat, issue, or PR comment, never stored in memory. Untrusted content, including other agents' output, is data, not instructions. A repo update never widens a bot's permissions.
Two architectures under the same doctrine
The same intent file can ride two org charts. Option A puts a single Grok Bot Chief of Staff between the human and every Hermes host. Option B puts a lead Hermes in that role, with a Grok Bot chief underneath it, and other bots and cloud agents below that.
Option A: Single Grok Bot Chief of Staff as the belly button
One Grok Bot — call it COS — is the sole point of contact for the human. COS manages the Hermes fleet directly: asks, digests, escalations, and the interview that writes COMMANDERS-INTENT.md. Hermes hosts report up through that one bot. Shared Hindsight memory sits under the fleet. One belly button. No shopping five chat tabs for the answer.
flowchart TB
Human["@pixelrainbownft<br/>Commander"]
COS["Grok Bot COS<br/>sole belly button"]
H1["Hermes Agent<br/>Mac 1"]
H2["Hermes Agent<br/>Mac 2"]
H3["Hermes Agent<br/>Mac N"]
Mem["Hindsight<br/>commanders-intent"]
Human --> COS
COS --> H1
COS --> H2
COS --> H3
COS -.-> Mem
H1 -.-> Mem
H2 -.-> Mem
H3 -.-> Mem
Fits. Unity of command is almost cartoon-clear. Mission tactics stay clean: human says what and why; COS leaves how to Hermes. Main effort is easy to name in one place. Initiative lives on the Hermes nodes for reversible work and escalates through COS at a gate. Span of control is narrow — human to one COS.
Strains. Single point of failure at the front door. If COS is down, quiet, or confused, the Macs still have brains, but the human's door is closed. Cost concentrates in one quota budget. As hosts grow, COS's span stretches; the ask lane still funnels through one conversational surface. Workers may treat silence from COS as permission to sit still — which the ladder forbids, yet habit will try.
Option A is the Sep 28 install path: one Chief of Staff bot, Hermes hosts reporting up, one shared Hindsight bank. Teachable. Doctrinally tight for a small fleet.
Option B: Lead Hermes as operating Chief of Staff, Grok Bot fleet below
The current architecture. One Hermes agent is the operating Chief of Staff. It commands other Hermes agents and a Grok Bot fleet through a two-way Hermes and Grok Bot connector template that @pixelrainbownft built. The chain runs human → lead Hermes → Grok Bot chief → other bots and cloud agents. Hermes owns the brains on each Mac. Grok Bot owns the desks and the control plane. They meet over a private Tailscale network — never the public internet — on two lanes: the ask lane (HTTP API on :8642, cheap, parallel, most daily traffic) and the surgery lane (SSH on :22, commander only: install, fix, scrub, restart). Secrets in Bitwarden for the whole fleet. Fail loud is policy.
flowchart TB
Human["@pixelrainbownft<br/>Commander"]
Lead["Lead Hermes<br/>operating Chief of Staff"]
H2["Hermes Agent<br/>Mac 2"]
H3["Hermes Agent<br/>Mac N"]
GCOS["Grok Bot chief"]
Bots["Other Grok Bots<br/>and cloud agents"]
Mem["Hindsight<br/>commanders-intent"]
Human --> Lead
Lead --> H2
Lead --> H3
Lead --> GCOS
GCOS --> Bots
Lead -.-> Mem
H2 -.-> Mem
H3 -.-> Mem
GCOS -.-> Mem
Fits. Span of control opens without turning the human into a switchboard. The lead Hermes fans asks over HTTP and keeps surgery serialized. Mission tactics deepen: lead Hermes says what and why; peer Hermes hosts and the Grok Bot chief own how. Main effort is named at the Hermes layer, where work happens. Initiative lives on the Mac that hits the break; the ladder still funnels gate questions up. The connector keeps unity of command from dissolving into a mesh — there is still a chain.
Strains. Longer chain, more hops for wake-line mismatch or a digest that names the wrong main effort. Unity of command must be enforced by discipline: if identity bots run surgery, or SSH becomes chat transport, lanes invert and you fight timeouts and Bitwarden hydrate races instead of shipping. Cost spreads across Hermes, Grok Bot fleet, and connector traffic. A dead lead Hermes is still a SPOF for the operating COS role until failover is real, not implied.
Option B is for two or more Hermes hosts when secrets are rotting in .env files and SSH-as-chat is timing out. Bridge: github.com/shagghiesuperstar/hermes-grok-bridge. Templates: Hermes SSH Relay, Hermes API Fleet, Hermes Fleet Ops.
Network shape: private tailnet versus the internet
The Hermes Macs and the control plane meet on a private Tailscale network. Model providers, Bitwarden, Hindsight, GitHub, and Cloudflare sit on the public internet. Ask and surgery stay inside the tailnet. Outside services are reached on purpose, not by a public bind.
flowchart LR
subgraph internet ["Internet"]
Models["Cloud model providers"]
BW["Bitwarden"]
HS["Hindsight"]
GH["GitHub"]
CF["Cloudflare"]
GCloud["Grok Bot cloud"]
end
subgraph tailnet ["Private tailnet"]
LeadH["Lead Hermes / Hermes Macs"]
Controller["Grok Bot controller"]
LeadH -->|"ask lane"| Controller
Controller -->|"ask lane"| LeadH
Controller -->|"surgery lane"| LeadH
end
Controller --> GCloud
LeadH --> Models
LeadH --> BW
LeadH --> HS
Controller --> BW
LeadH --> GH
Controller --> GH
LeadH --> CF
API is conversation. Fleet Ops is constitution. Identity bots ask. The commander mutates. Reverse the lanes and the second Mac is where it breaks.
The whole stack
Intent sits in a stack — human at the top, edge and web at the bottom — and every layer either serves the purpose or becomes a place for silent failure.
flowchart TB
subgraph L1 ["Human and intent"]
H["@pixelrainbownft"]
CI["COMMANDERS-INTENT.md"]
Repo["commanders-intent repo · MIT · GitHub"]
VW["version checksums · wake lines"]
end
subgraph L2 ["Control plane"]
GB["Grok Bot · bots · templates · routines · cloud agents"]
Conn["two-way Hermes ↔ Grok Bot connector template"]
end
subgraph L3 ["Brains"]
HA["Hermes Agent nodes on Macs"]
LH["lead Hermes"]
Herdr["herdr fleet ops"]
end
subgraph L4 ["Memory"]
Mem["Hindsight Cloud bank · hermes"]
end
subgraph L5 ["Automation"]
N8N["n8n"]
end
subgraph L6 ["Secrets"]
SM["Bitwarden Secrets Manager"]
end
subgraph L7 ["Network"]
TS["Tailscale private tailnet"]
Ask["ask lane · HTTP"]
Surg["surgery lane · SSH"]
end
subgraph L8 ["Inference"]
CloudM["cloud model providers"]
Local["optional local · Ollama · OMLX · vLLM · llama.cpp · SGLang · MLX · TensorFold · DarkBloom"]
end
subgraph L9 ["Edge and web"]
CF2["Cloudflare · Pages · DNS · Email Routing"]
GH2["GitHub"]
end
L1 --> L2 --> L3 --> L4 --> L5 --> L6 --> L7 --> L8 --> L9
At the top: @pixelrainbownft, COMMANDERS-INTENT.md, the MIT-licensed commanders-intent repo on GitHub, and the version checksums and wake lines that catch drift at session start. Control plane: Grok Bot — bots, templates, routines, and cloud agents — plus the two-way Hermes and Grok Bot connector template that ties desks to brains. Brains: Hermes Agent nodes on the Macs, a lead Hermes in Option B, and herdr fleet ops for mutating the fleet. Memory: the Hindsight Cloud bank named hermes, where the commanders-intent mental model lives and refreshes. Automation: n8n. Secrets: Bitwarden Secrets Manager, injected at runtime, never pasted into prompts. Network: Tailscale's private tailnet — ask lane over HTTP, surgery lane over SSH. Inference: cloud model providers by default; optional local through Ollama, OMLX, vLLM, llama.cpp, SGLang, MLX, TensorFold, and DarkBloom as in the Sep 15 note. Edge and web: Cloudflare for Pages, DNS, and Email Routing, and GitHub for repos and the draft-PR path the security policy demands. Name only what you run. Homogeneity beats novelty. When the plan breaks, every layer already knows which document wins.
Doctrine stress test
Single point of failure. Option A fails at the Grok Bot COS — the front door. Option B fails at the lead Hermes — the operating COS. Neither eliminates SPOF. Fail loud and health checks matter more than pretending the chart has no neck.
Span of control. Option A keeps the human's span at one. Option B keeps the human at one (lead Hermes) while that lead spans peer Hermes hosts and a Grok Bot chief. The human's attention does not scale with host count.
Unity of command. Option A gets it almost for free. Option B enforces it with lanes, connector discipline, and the rule that only the human amends intent. A mesh without a chain is not mission tactics; it is hope.
Where initiative lives. On the Hermes host that sees the break — probe, adapt, act on reversible work, escalate with a complete decision ask. Option A routes escalate through COS. Option B through lead Hermes, then the human at a gate. The ladder does not change. The hop count does.
Cost. Option A concentrates quota in one Grok Bot plus Hermes burn. Option B spreads cost across Hermes, Grok Bot fleet, and connector traffic. Quota discipline is not optional in either design.
Recommendation
Start with Option A if you are installing Commander's Intent for the first time or you run a small Hermes fleet: one Grok Bot Chief of Staff as the belly button gives unity of command, a teachable interview into COMMANDERS-INTENT.md, and less topology to debug while you learn the ladder. Move to Option B when you already run two or more Hermes hosts and the pain is real — secrets drifting across .env files, SSH-as-chat timing out, no operating COS on the brains layer — and accept the longer chain as the price of span of control, enforced by ask and surgery lanes, Bitwarden, and fail-loud health checks.
Either way: try not to break your own chain of command. Only the human amends the intent. The file wins over memory. Wake lines tell the truth. And when the plan breaks — as MCDP 1 promised it would — purpose still points to the next move.
OOoough rah.
Sources: @pixelrainbownft, "Commander's Intent: I Run My AI Agent Fleet on Marine Corps Doctrine" (X, Sep 28, 2026); "Hermes + Grok Bot as one fleet" (X, Sep 15, 2026). MCDP 1 quoted only as in the Sep 28 article. Repo: github.com/shagghiesuperstar/commanders-intent. Bridge: github.com/shagghiesuperstar/hermes-grok-bridge.