Architecture-quality audit notes from hermescheck

[huangrichao2020]

Hi maintainers — this is not a security report, just a friendly architecture-quality audit note from hermescheck, a repo scanner for AI agent/runtime systems.

I ran a narrow runtime-oriented pass against get-convex/agent and three implementation-level themes looked worth sharing:

1. Timeout cleanup appears incomplete around cached agent/session state, which may let a timed-out run leave behind stale control-plane objects before the next turn.
2. Context memory growth looks easier to accumulate than to page or prune, so long-running threads may benefit from a clearer paging / retention contract.
3. Tool/retrieval execution paths would be easier to reason about in production if capability boundaries and retrieval governance were documented and enforced more explicitly.

This may be noisy or already planned, so please feel free to close if it is not useful. If helpful, I can rerun with an even tighter runtime-only scope and share a cleaner evidence slice.

[ianmacartney]

Thanks for the suggestions. I don't think these themes are very high signal - the isolation of each mutation/query/action seems to mitigate (1), there are already functions to manage how much context to include and configuration for (2), and (3) seems like pointing towards making tool calls into convex function calls - "retrieval" via convex queries is already a strong isolation boundary with snapshot consistency, etc. Maybe I'm misunderstanding something though- feel free to make specific recommendations

…

On Wed, May 6, 2026 at 2:51 AM Huang richao ***@***.***> wrote: *huangrichao2020* created an issue (get-convex/agent#258) <#258> Hi maintainers — this is not a security report, just a friendly architecture-quality audit note from hermescheck <https://github.com/huangrichao2020/hermescheck>, a repo scanner for AI agent/runtime systems. I ran a narrow runtime-oriented pass against get-convex/agent and three implementation-level themes looked worth sharing: 1. Timeout cleanup appears incomplete around cached agent/session state, which may let a timed-out run leave behind stale control-plane objects before the next turn. 2. Context memory growth looks easier to accumulate than to page or prune, so long-running threads may benefit from a clearer paging / retention contract. 3. Tool/retrieval execution paths would be easier to reason about in production if capability boundaries and retrieval governance were documented and enforced more explicitly. This may be noisy or already planned, so please feel free to close if it is not useful. If helpful, I can rerun with an even tighter runtime-only scope and share a cleaner evidence slice. — Reply to this email directly, view it on GitHub <#258>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACZQW22GZTWZ4BWKGYECJ34ZMDLTAVCNFSM6AAAAACYS2TI4GVHI2DSMVQWIX3LMV43ASLTON2WKOZUGM4TAMZYGM2TIMY> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>