feat(plugin-catalog): add compartment (encrypted offline memory provider) - #114494

What does this PR do?

Adds plugin-catalog/compartment.yaml, a community entry in the memory category for Compartment's native Hermes memory provider. Compartment is an encrypted, fully offline memory vault I build and maintain (Apache-2.0, on PyPI as compartment): AEAD-encrypted at rest including the embedding vectors, the embedding model bundled in the wheel, exact hybrid vector and keyword search, per-record crypto-shred on forget, a hash-chained audit log, no API key, no account, no network at runtime. One vault per machine, shared by every agent on it, so what Hermes stores is recallable from Claude, Cursor or the CLI and the other way round. As a Hermes provider it recalls before each turn, persists each turn encrypted, and exposes compartment_search, compartment_store and compartment_forget.

The entry points at the provider directory (subdir: integrations/hermes/compartment) of the Compartment repository, pinned to b144fc34723911eace9f240ac1044b9280b74bf2: the commit on main directly after the v4.10.0 release. That commit adds the register(ctx) entry point the admission probe requires (the provider used to be found by subclass scan alone) and declares the engine in pip_dependencies, so hermes plugins install compartment also installs it into the Hermes environment. The plugin manifest at that commit reports 4.10.0, which is the version label on the card.

The dependency floor is compartment>=4.9.3 rather than >=4.10.0 on purpose. Plugin dependencies resolve behind the installer's two-week package age filter, and 4.10.0 was published on 2026-09-16. 4.9.3 is the oldest release that shipped this exact provider module unchanged (byte-identical from 4.9.3 through 4.10.0), so the resolver takes the newest seasoned release today (4.9.5) and moves up by itself as releases age past the filter. I ran the gate's own dry-run resolution (plugin_python_deps.check_candidate) on this entry against upstream main: it resolves.

The capabilities lists are all empty, which is what the probe records for a memory provider: it registers through register_memory_provider, no tools, hooks or middleware, no environment variables. Same shape as the existing memory entries (lancedb, mnemosyne, intelligent_memory). requires_hermes: ">=0.20.1" is the first release whose PluginContext has register_memory_provider (v2026.8.13). platforms is empty because the engine's dependencies are wheels-only on macOS, Linux and Windows. The image is the repository's 1280x640 social preview pinned to the same commit.

Submitted by the repository owner (admission rule 5). This is the plugin-catalog counterpart of #95708, the MCP catalog entry for running Compartment as an MCP server: the two coexist, share the same vault, and neither depends on the other.

Related Issue

None. A self-contained catalog entry; I searched open PRs for compartment and there is no other submission.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• plugin-catalog/compartment.yaml (new file, the entire diff)

How to Test

1. python3 scripts/validate_plugin_catalog.py plugin-catalog/ prints OK: 107 file(s) valid.
2. git clone https://github.com/MaxFreedomPollard/Compartment && git -C Compartment checkout --detach b144fc34723911eace9f240ac1044b9280b74bf2, then hermes plugins validate Compartment/integrations/hermes/compartment: all 13 checks pass, security scan safe, Validation passed.
3. In a scratch HERMES_HOME, hermes plugins install "https://github.com/MaxFreedomPollard/Compartment#integrations/hermes/compartment" --ref b144fc34723911eace9f240ac1044b9280b74bf2 --no-deps (the identifier the catalog builds for this entry): it lands in plugins/compartment, hermes plugins show compartment prints compartment v4.10.0, and plugins.memory.discover_memory_providers() lists compartment, loaded through register(ctx).
4. Once merged, the user path is hermes plugins install compartment, compartment init, hermes memory setup (select compartment); hermes memory status then reports Provider: compartment.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• pytest tests/ -q: not applicable to a catalog YAML; the gates that apply are the two Plugin Catalog CI jobs, and both were replayed locally (steps 1 and 2 above).
• Tests: covered by the plugin-catalog CI (structural check plus pinned-source validate), which validates every entry at PR time by design.
• I've tested on my platform: macOS 26.2, Python 3.11, upstream main at 77fb7f0.

Documentation & Housekeeping

• Relevant documentation: N/A here; the catalog UIs render from the manifest, and the plugin's own README at the pinned commit documents the catalog route.
• cli-config.yaml.example: N/A
• CONTRIBUTING.md / AGENTS.md: N/A
• Cross-platform impact per the compatibility guide: the plugin is two files of pure Python and the engine's dependencies are wheels-only on all three OSes; platforms is left empty.
• Tool descriptions/schemas: N/A

Screenshots / Logs

✓ manifest - plugin.yaml parses
✓ manifest fields - name, version, description present
✓ requires_hermes - not declared
✓ config schema - not declared
✓ requires_env - all entries UPPER_SNAKE
✓ loadable - entry: __init__.py
✓ python dependencies - 1 installable from manifest
✓ capability probe - register() ran in isolation
✓ declared tools - matches registrations
✓ declared hooks - matches registrations
✓ declared middleware - matches registrations
✓ built-in tool collisions - no tools to check
✓ security scan - safe

Validation passed.

$ hermes plugins install "https://github.com/MaxFreedomPollard/Compartment#integrations/hermes/compartment" --ref b144fc34723911eace9f240ac1044b9280b74bf2 --no-deps --no-enable
Cloning https://github.com/MaxFreedomPollard/Compartment (subdir: integrations/hermes/compartment)...
✓ Installed
Plugin installed: https://github.com/MaxFreedomPollard/Compartment#integrations/hermes/compartment
Location: $HERMES_HOME/plugins/compartment

$ hermes plugins show compartment
compartment v4.10.0
Compartment - high-security, fully offline, encrypted vector memory.
AEAD-encrypted vault, locked-by-default after restart, native Hermes provider, no API key.
Status: not enabled
Source: user
Key: compartment

$ python -c "from plugins.memory import discover_memory_providers; ..."
discovered: compartment | available: False   (this machine's vault is locked; the provider reports lock state instead of failing)

$HERMES_HOME/plugins/compartment: __init__.py  plugin.yaml