This is a working specification for how Hermes Agent's plugin ecosystem handles discovery, installation, and trust. The core claim: a human-reviewed catalog of pinned plugin commits lives in git; the desktop app and CLI both reference a CDN snapshot of that catalog (rebuilt on each PR merge); users install by name (`hermes plugins install <name>`), which always checks out the exact reviewed SHA, not a branch tip. The system separates concerns cleanly — catalog entry = point-in-time human review of *that commit*, not a security audit of the repo overall. Updates require new PRs; removed plugins land on a blocklist. Capability declarations are shown before install. Installation doesn't auto-enable plugins. Custom git URLs still work but skip review and show a warning. The spec includes the submission bar (owner-submitted, public repo, released, passes validation, no self-updating) and notes that the catalog name can differ from the plugin's manifest name. The page reads as genuine internal documentation, not marketing — it's specific about SHA pins, the removed list, the six-hour cache refresh, and what review actually covers (and doesn't). One sharp tension: how is the "reviewed by a maintainer" gate enforced in practice, and which maintainers have merge rights?