hermes-mobile/docs/BLOCKERS.md

Hermes Mobile Blockers

Stable gateway identity binding

The documented direct gateway routes currently available to Hermes Mobile (GET /health and authenticated GET /v1/models) do not expose a verified stable gateway instance identifier.

B2 therefore protects local-first routing by requiring explicit HTTPS URLs, disabling redirects and cleartext traffic, probing /health without credentials, and sending a bearer token only for the documented /v1/models compatibility check. This confirms TLS reachability and authenticated API compatibility, but it cannot cryptographically prove that separately configured Local and Remote URLs terminate at the same Hermes gateway identity.

Upstream compatibility needed for stronger binding: a documented stable gateway instance ID signed or authenticated consistently across both routes, or an upstream-supported certificate/public-key pin that the Android client can bind to the single logical profile. Until then, Local and Remote pairing remains an explicit user trust decision and diagnostics identify only the active route, not internal URLs.