hermes - 💡(How to fix) Fix Add L safe read-only executors registry [2 comments, 2 participants]

What to build

Add a small registry for L's safe read-only executors so L can automatically execute trusted status checks without requiring Leo to run /lexecute latest. The registry should make each executor's safety boundary explicit, including what it reads, what it never mutates, and what confidence/result shape it returns.

Acceptance criteria

• Gateway, LINE webhook, and Cloudflare status checks are represented as registered safe read-only executors.
• New executor entries declare their source, safety boundary, result shape, and whether approval is ever required.
• Unknown or unregistered executor work remains blocked rather than auto-executed.
• The auto-execute path only runs registered read-only status checks.
• Tests cover registered, unregistered, and approval-required work items.

Blocked by

• https://github.com/NousResearch/hermes-agent/issues/25029