diff --git a/HERMES-OSA-HANDOFF.md b/HERMES-OSA-HANDOFF.md
new file mode 100644
index 0000000..a0c27f3
--- /dev/null
+++ b/HERMES-OSA-HANDOFF.md
@@ -0,0 +1,45 @@
+# HERMES-OSA-HANDOFF
+
+## Task checklist
+
+- [ ] Pull latest `layered-soul` and confirm `docs/HOST-MATRIX.md` is current.
+- [ ] Pull latest `hermes-bsd` from Forgejo.
+- [ ] Wait for or include the `hermes-bsd` PR #3 shebang fix before running setup.
+- [ ] Probe disk before install:
+  ```sh
+  df -h /
+  zfs list
+  python3 /home/clawdie/ai/layered-soul/scripts/verify_facts_probe.py --storage --text
+  ```
+- [ ] Validate Hermes locally only, with Telegram off and no new secrets:
+  ```sh
+  cd /home/clawdie/ai/hermes-bsd
+  HERMES_HOME=/home/clawdie/.hermes ./setup-hermes.sh
+  HERMES_HOME=/home/clawdie/.hermes ./venv/bin/hermes --version
+  HERMES_HOME=/home/clawdie/.hermes ./venv/bin/hermes --help
+  ```
+- [ ] Do not start or enable `hermes_daemon` until local validation is clean.
+- [ ] Do not use `/home/clawdie/clawdie-ai` as Hermes state; preserve/retire that old Clawdie runtime separately.
+- [ ] Do not reuse any existing Telegram bot token for Hermes.
+
+## Current decisions
+
+- `HERMES_HOME=/home/clawdie/.hermes` is the authoritative local validation state home on `osa`.
+- `/var/db/hermes` remains the rc.d service default for a later daemon phase.
+- `AUTOLYCUS_HOME` is not used for hermes-osa.
+- `hermes-bsd` is the intended FreeBSD implementation repo; the older `hermes-freebsd` checkout is not the install target.
+- Deferred upstream items are tracked separately: PR #3 shebang fix, issue #4 Node Dockerfile, issue #7 disk.
+
+## Deletion criteria
+
+Delete this handoff after Codex reports:
+
+- the exact `layered-soul` and `hermes-bsd` commits used,
+- disk probe output before installation,
+- local Hermes command validation output,
+- whether any service/daemon work was intentionally deferred,
+- confirmation that Telegram stayed off and no secrets were printed.
+
+## Results
+
+Pending Codex run on `osa`.