Hermes Agent
8.1 KiB
Hermes Mobile Blockers
R1 — Emulator/device accessibility matrix
R1 cannot be marked complete from the current sandbox. On 2026-07-24, the required recovery preflight passed immediately before this run, but a direct writable-cache Gradle retry was blocked before project execution because the sandbox prohibits Gradle's TCP control socket (java.net.SocketException: Operation not permitted). ADB 37.0.0 is installed at /opt/android-sdk/platform-tools/adb, but its daemon cannot create the local smart-socket listener or netlink socket (Operation not permitted). No emulator executable, AVD, /dev/kvm, USB device bus, or running target is available. No successful attached-target query, physical-device walkthrough, emulator walkthrough, or device evidence was possible.
Required unblock evidence: run the required preflight and focused Android tests in an environment that permits them, then record the small-phone, normal-phone, and tablet checks in docs/ROADMAP.md across portrait/landscape, font scaling, TalkBack, light/dark contrast, touch targets, reduced motion, and IME behavior. Source review, git diff --check, and direct execution of cached test classes are supporting evidence only and do not complete R1.
R2 — Clean beta build/install verification
The v0.1.0-beta.1 Android package metadata and direct-gateway build/install guide are present in source. On 2026-07-24, Task 5 source-current re-verification passed the external recovery preflight and documented offline Gradle :app:testDebugUnitTest :app:assembleDebug command (43 tasks, 1 executed); the generated Gradle XML report records 106 tests with 0 failures/errors, including 29 SetupWizardReducerTest cases. A localhost gateway health probe returned HTTP 200, establishing reachability only. The debug APK reports package cloud.molberg.hermesmobile, version 0.1.0-beta.1 (10001), and SHA-256 45e4ab4783a74eb766070b0f670a2631a9ebdc044468bbe03087788f8106f150. No ADB device/emulator or /dev/kvm was available, so installation verification cannot be completed in the current sandbox.
A later Task 5 rerun on 2026-07-24 was blocked before project execution: the guide's exact Gradle command could not determine a usable wildcard IP, and the offline/no-daemon variant could not open Gradle's daemon TCP socket (java.net.SocketException: Operation not permitted). Both attempts left the existing ignored APK unchanged. The source-current generated XML reports still record 106 tests with 0 failures/errors, including 29 SetupWizardReducerTest cases, while fresh aapt and SHA-256 inspection reconfirmed the package/version/hash above. ADB 37.0.0 was present at /opt/android-sdk/platform-tools/adb but could not create its smart-socket/netlink sockets; /dev/kvm and /dev/bus/usb were absent. This rerun provides no fresh Gradle test/assembly, device, authentication, release, or end-to-end evidence.
A follow-up P0 audit identified that a failed/offline first-run Bearer profile could be mistaken for a historical current-key profile and bypass setup after restart. On 2026-07-25, the gate was corrected to require recorded legacy provenance for migration and a focused Bearer restart regression was added. The offline focused SetupWizardReducerTest and :app:assembleDebug command then passed (43 tasks, 9 executed). This is source-level verification only; no fresh clean-install, device, authentication, release, or end-to-end evidence is claimed.
Task 5 delivery verification on 2026-07-25 passed /root/.openclaw/workspace/scripts/hermes-mobile-preflight.sh; from apps/mobile/android, GRADLE_USER_HOME=/root/hermes-mobile/.gradle-user ./gradlew --offline --no-daemon -Dorg.gradle.jvmargs= -Dorg.gradle.daemon=false -Pkotlin.compiler.execution.strategy=in-process :app:testDebugUnitTest :app:assembleDebug passed (43 tasks, 1 executed); git diff --check passed. Current Gradle XML reports record 107 tests with 0 failures/errors/skips. The ignored debug APK was inspected without using the untracked releases/ artifact and reports package cloud.molberg.hermesmobile, version 0.1.0-beta.1 (10001), size 17,710,960 bytes, and SHA-256 714e8e9cdd3f2eed93b285f233b1f4573d5d13fc2078bb717631f9b38f8428d4. ADB reports no attached devices; no emulator/AVD or /dev/kvm is available. No device installation, release, or gateway end-to-end verification was performed.
The first-run Setup Wizard is also source-complete and unit/build verified, including None/Bearer/password choices and direct password-session cookie handling. No real None/Bearer/password credential flow has been exercised against a live gateway, so R2 must include the chosen authentication mode and observed connection result without recording credentials.
ADB is installed, but it sees no devices; no emulator/AVD or /dev/kvm is available. Package metadata and the SHA-256 of the source-current ignored APK were inspected after the passing test/assembly command, but no clean uninstall/install, launch, or direct-gateway device connection was verified here. No APK was published or uploaded, and no final release criterion is claimed.
Required unblock evidence: in a permitted environment, run the preflight and Android checks from docs/ANDROID_BETA_BUILD.md, record aapt package/version output and the APK SHA-256, clean-install on one named real device or emulator, launch the app, configure the upstream Hermes gateway directly, and record the connection result in docs/ROADMAP.md.
Stable gateway identity binding
The documented direct gateway routes currently available to Hermes Mobile (GET /health and authenticated GET /v1/models) do not expose a verified stable gateway instance identifier.
B2 therefore protects local-first routing by requiring explicit HTTPS URLs, disabling redirects and cleartext traffic, probing /health without credentials, and sending a bearer token only for the documented /v1/models compatibility check. This confirms TLS reachability and authenticated API compatibility, but it cannot cryptographically prove that separately configured Local and Remote URLs terminate at the same Hermes gateway identity.
Upstream compatibility needed for stronger binding: a documented stable gateway instance ID signed or authenticated consistently across both routes, or an upstream-supported certificate/public-key pin that the Android client can bind to the single logical profile. Until then, Local and Remote pairing remains an explicit user trust decision and diagnostics identify only the active route, not internal URLs.
Direct gateway session search contract
The official Hermes Agent API server documentation checked on 2026-07-24 documents authenticated GET /v1/capabilities and session endpoint capability entries for list, create, get, update, delete, messages, fork, chat, and chat streaming. It does not document a session-search endpoint, query parameter/body schema, response envelope, or a session_search capability entry.
B3 therefore keeps searchSessions in the Android repository contract and verifies it with the fake repository, but deliberately provides no direct-gateway HTTP mapping for search. Current official upstream API-server behavior represents capability endpoints as structured {method, path} objects; the earlier Android B3 string-only endpoint parser has not been exercised against a live gateway and is not treated as verified compatibility.
A localhost Hermes gateway health probe returned HTTP 200 on 2026-07-24. This establishes only that the health endpoint was reachable; no authenticated session operation, session-search contract, or end-to-end gateway flow was exercised, so no live session compatibility verification is claimed.
Upstream evidence needed to unblock B3: official documentation for session search including capability key, HTTP method, path, query/body schema, response envelope, and empty/error semantics, followed by a live compatibility exercise against an upstream Hermes gateway.
Sources checked on 2026-07-24: https://hermes-agent.nousresearch.com/docs/user-guide/features/api-server/; installed official upstream checkout NousResearch/hermes-agent at commit 36f2a966c, including gateway/platforms/api_server.py capability and session-stream behavior.