Hermes Agent v0.22.1 (rc.5-v0.22.1)

Release Date: October 14, 2026

This is a patch release, with a handful of fixes for the Windows Store, plugin updates, and more.

✨ Features

• Agent): add nemotron super 3.5 default parameters (c59d2994) — @elisam0
• Cli): add curated model list at the top in the model picker list (e6835fd3) — @elisam0
• Plugin-catalog): add hermes-lang-ko — Korean Desktop language pack (e5f49b6a) — @dandacompany
• Plugin-catalog: add hermes-lang-pt-br (Brazilian Portuguese language pack) (0169e80c) — @StudioCodeAI
• Plugin-catalog: add teamorouter (TeamoRouter model providers) (ef223406) — @2867297362mjb-sketch
• Plugin-catalog): add author-feed (5f6d6836) — @TakeshiTGAL
• Plugin-catalog): bump aux-ledger to 1.4.0 (6048066e) — @olric3015
• Plugin-catalog): add the wait-ledger catalog card (77cb58e5) — @olric3015
• Plugin-catalog): add wait-ledger (97e65322) — @olric3015
• Community plugin: lightningai + lightningai-rate-limit (07515466) — @dinosauria123
• Catalog: add Hermes AAC 0.1.0 at reviewed exact source pin (7c9adda8) — @TREE-Ind
• Plugin-catalog): add openinvest (b6e86101) — @longsizhuo
• Catalog: add hermes-agent-mixer (v0.2.0 @ 04c4e13) (2e7e3859) — @Sahil-SS9
• Plugins): move Kumiho Memory to memory catalog shelf (46f95e08) — @kaveone
• Add canonical group attachment controls (4673f17c)
• Consume event-bound hosted files through canonical admissions (e87bd098)
• Connect Desktop groups to canonical driver controls (3c2c9d47)
• Transport hosted producers through authenticated owner sockets (51189b05)
• Retain hosted room work evidence across authority changes (0af2c714)
• Route hosted room workers through session authority (bd22e0f9)
• Wire canonical hosted group controls (fa2179bb)
• Gateway): resolve --resume <title> and -c <title> [--create-if-missing] in the authority (11a83ad4)
• Retain terminal identity tombstones during history retirement (ba435291)
• Route native CLI and ACP actions through prepared controls (27b0f7f2)
• Publish real prepared compression in the mutation receipt transaction (b6540276)
• Prepare and atomically publish local model changes (7e7fa7c6)
• Commit independent local branch policy and route atomically (f98eaec1)
• Project managed tool progress without private arguments or results (61ccd894)
• Bridge managed worker approvals clarification and stop (a0b5118f)
• Launch admission-owned tool workers from the ordinary daemon (510e32be)
• Enforce safe defaults at bare agent construction (1eeac867)
• Suppress rules skills and memory readers in private safe workers (25cda66a)
• Bypass plugin providers and hook execution in safe workers (33921e6f)
• Bind immutable private worker config before runtime imports (4cc3f420)
• Expose verified canonical ACP editor MCP attachment (1bda56a1)
• Rebind exact editor MCP credentials on canonical ACP resume (5bfa2f2c)
• Borrow editor MCP configurations with frozen session manifests (394f00f6)
• Isolate execution-owned MCP registry overlays (96e4d296)
• Commit local reset targets with runtime mutation receipts (821137c3)
• Expose profile-scoped Bot relay mailbox RPCs on the authority (792aa35a)
• Migrate queued Bot mailbox identities without replaying claims (af49e2fc)
• Send local Bot DMs to the discovered canonical authority (47ba694e)
• Admit identified Bot Chat relay deliveries through session authority (998df8cc)
• Reserve exact owner-started admission worker claims (fbdfd46d)
• Expose authenticated owner mutation snapshots (d6331c48)
• Freeze ACP tool policy and bind execution-owned edit consent (e2f5cfc6)
• Reserve hosted API identities through the authority (6b278ca4)
• Admit API runs before acknowledging execution (f2d9cea3)
• Run bound API turns on the shared cached agent (dea4f0c5)
• Restore server-bound API session identities (76532ae1)
• Retain claim-fenced structured admission results (262e0ebf)
• Compose worker compression lifecycle and delegation persistence (6c57ad37)
• Publish committed worker completions through authenticated owner bridge (d94ccc2d)
• Fence delegation receipts with shared worker sequence and epoch (be85ca24)
• Route registered worker delegation writes through durable outbox (1ee6545f)
• Add execution-bound delegation ledger operations (8128e88f)
• Persist worker titles activity and route sidecars with receipts (235e4f12)
• Add assignment-fenced worker constructor and finalization handlers (b7de5a8e)
• Atomically compact and advance worker transcript assignments (c2e77eba)
• Preserve worker history and cache lineage identities (e63e1101)
• Add receipted worker compression guards and leases (d51afe4c)
• Route REST imports and deletion through mutation receipts (2cdd103d)
• Route REST sidebar edits through the shared authority (eb329d21)
• Coordinate shared mutations and publish committed revisions (eb42a002)
• Reuse transactional rewind with generation and receipt fences (6777ffa4)
• Import session histories atomically with retry receipts (b9194595)
• Fence destructive deletion without erasing runtime obligations (e5249c9a)
• Commit sidebar edits with canonical mutation receipts (0b1b8e0f)
• Project execution-owned approvals to ACP viewers (97a24c10)
• Attach ACP transport to canonical session execution (8dd92a30)
• Persist assigned worker prompt context and usage anchors (c6540cb9)
• Admit local automation through owner durable FIFO (1642b339)
• Queue due gateway heartbeat ticks through canonical admission (ab44af2c)
• Admit trusted gateway completions to the durable session FIFO (7cd1b000)
• Fence worker terminal receipt after sequenced durable writes (21a48aea)
• Authenticate live worker persistence and explicit restart adoption (9d7d7e2a)
• Receipt worker main and auxiliary usage in canonical transactions (9d896c49)
• Atomically receipt structured worker transcripts and turn leases (2abe47de)
• Dispatch bound local slash commands through gateway handlers (b0377e92)
• Share authenticated canonical slash discovery with legacy catalogs (fcf50e03)
• Authenticate native HTTP through private daemon grants (75764b2a)
• Commit local creation policy and restore cold authority routes (aa2624ba)
• Attach Desktop local launches to canonical gateway (9c40ddcf)
• Bind Ink sessions and controls to canonical authority envelopes (a2d9e258)
• Attach Ink local transport through canonical gateway bootstrap (08f628f9)
• Route normal classic and one-shot launch through the gateway (35510459)
• Add transport-only classic gateway client and option validation (6ed03be9)
• Apply local launch policy through real gateway turns (080c5da6)
• Define frozen local session launch policy (81ed9712)
• Route revision-checked session metadata through gateway (17ddbe44)
• Expose scoped local session metadata and document compatibility (52c354ff)
• Create gateway-owned local sessions through authenticated controls (42967cdd)
• Recheck native Discord membership before durable admission and claim (cc0cd5c9)
• Boot authenticated session authority in ordinary gateway (c3bf62eb)
• Share live clarification controls across attached viewers (9c474378)
• Stream canonical gateway execution events to shared observers (40d9b4c7)
• Reauthorize multiplex native connector provenance (244bff73)
• Share generation-fenced approvals across gateway viewers (5e2afdae)
• Retain native media and context before durable admission (ef447482)
• Replay authority events from atomic subscription watermarks (d24dc3fa)
• Recover committed native text without replaying unknown turns (78646003)
• Execute attached websocket turns on the messaging live agent (47fbfd4c)
• Add revision-fenced runtime rename and archive receipts (5878e565)
• Fence typed worker persistence with atomic replay receipts (7cc69d29)
• Import drained legacy admissions atomically with unknown recovery (124dfa7c)
• Centralize durable session admissions in canonical storage (0695b12b)
• Keep declined gateway wizard starts unmanaged (7500930d)
• Require explicit consent for gateway service setup (16d6b7da)
• Restrict runtime bootstrap peers and bound native pipe I/O (d3ccac14)
• Compose the existing API into the gateway event loop (bac47874)
• Distinguish unavailable gateway owners from absent runtimes (e903841c)

🔧 Improvements

• Profiles): build the seed routing view once; expand enabled too (311155fa) — @kshitijk4poor
• Update nemotron super 3.5 name (3224993a) — @elisam0
• Hermes_cli): update nemotron 3.5 name (108ae4e7) — @elisam0
• Catalog: re-pin showly to the build without the upstream self-update check (6462f64a) — @slchris
• Catalog: update Model Router to v0.4.3 native preferences (6a097ee9) — @metamindedu
• Keep native MCP revision scoped to frozen tool settings (53d17f1c)
• Cron bot-chat delivery has no local CLI fallback lane (5d87060e)
• Retire bot execution discovery from viewer notification pollers (c8ae25cd)
• Make default ACP construction authority-only (c423a431)
• Remove obsolete updater sidecar deletion path (58895653)
• Remove retired local serve launch imports (5702f9df)
• Extract ordinary gateway bootstrap lifecycle (3c0f1e01)
• Freeze shared session authority interface contract (1af74c27)
• Extract TUI session registry and agent factory seams (a38ca908)
• Separate gateway agent acquisition from native progress (0f3a4fb2)
• Extract gateway turn preparation and persistence phases (6e8de80a)
• Move gateway service wizard into setup sibling (f0b35a98)
• Extract gateway setup service orchestration (02d0307c)
• Remove extracted runner initialization bodies (4b1379fb)
• Extract gateway bootstrap and writable initialization phases (0c287340)
• Extract standalone web application lifespan (f38f2444)

🐛 Bug Fixes

• Compression): fallback summaries, multiline setup notes and parallel loads keep skill markers right (297552a9)
• Compression): a slash-skill body's example paths stay out of the anchor index (d6020828)
• Compression): small and slash-invoked skills keep their reload marker across compaction (71e815de)
• Desktop): update notes keep full text, re-read merged PRs per check, respect custom branches (f2a93db9)
• Mcp): preserve server deadlines through outer tool execution (f30020ed)
• Plugins): honor portable per-server call deadlines (fcc170b7)
• Agent): rewrite split tool ids before Mistral sees them (b33ed359) — @xxxigm
• Profiles): align model seed with provider resolution (5fee8d77) — @helix4u
• Profiles): inherit canonical and legacy custom endpoints (2d3e75aa) — @helix4u
• Drop the VPN/proxy advice from the CDN-block message (300228d2)
• Catalog): re-pin Agent Mixer after maintainer review (4297a692) — @Sahil-SS9
• Pin Activity v0.2.1 public credential routes (3dac1f07) — @hassan-kamel
• Plugin-catalog): update switchbot-control to d0e6f77 (c4bf61b1) — @TakeshiTGAL
• Doctor): clarify Docker npm audit remediation (e21caa27) — @KoNit-K
• Deps): bump the WhatsApp bridge lock past its npm-audit findings (231cb757) — @ethernet8023
• Tui): retain native legacy history in canonical session picker (2171365a) — @unsupportedpastels
• Tui): the banner shows main's 8-character session label for a canonical id (2c979900)
• Gateway): a local process completion persists as a process_complete card (ff770cb7)
• Runtime): persist diagnostic automation category through replay (bdac7911) — David Dudok de Wit
• Gateway): retire bot receipt tasks with authority (d50b2eda) — @Lokee86
• Gateway): persist operator provenance for native recovery (c51049aa) — @Lokee86
• Cli): preserve blocking controls in finite output (954638ed) — @Lokee86
• Gateway): isolate malformed bot receipt schemas (4be62f9c) — @Lokee86
• Acp): clean up deferred cancellation lifetime (89dac620) — @Lokee86
• Gateway): close remaining unified-runtime review gaps (83cdc63a) — @Lokee86
• Gateway): isolate bot receipts and keep headless cron no-spawn (cdf36315) — @Lokee86
• Gateway): recover mixed local queues and retire failed hot serves (f4fd982b) — @Lokee86
• Gateway): terminate replay gaps and retain ACP cancels (37662b16) — @Lokee86
• Gateway): route local ticket bootstrap through control owner (996d9beb) — @Lokee86
• Desktop): a transcript reconcile skips a runtime mid-switch to another session (09aafcea)
• Gateway/stream): a failed overflow head send no longer spins the event loop (f0d9bd2f)
• Gateway): profile on our own home is stripped only for the closed session verbs (2c5b0af5)
• Gateway): gateway ensure starts on a systemd host whose user bus is unreachable (82db702f)
• Desktop): a session routed onto a new socket re-attaches before it submits (307dac20)
• Desktop): a registry-connection hover prewarms that connection's gateway (main #89756 port) (#89756)
• Bot-relay): a relayed dm targets only live profiles (#99392 on the authority door) (#99392)
• Gateway_chat): one-shot refuses an unknown-blocked session; stream-json always closes with a result (08b6ebd0)
• Tui_gateway): projects RPCs answer from the scan cache when a profile's state.db was never initialized (372ec7fc)
• Cron): Bot Chat delivery creates the missing Bot Chat instead of failing the run (364a0e22)
• Seed-copy compensation discards the row without the retirement fence (44212c5a)
• Gateway): exact mutation retries repair the runtime projection (X11, reported by @Xipong) (c1ee9286)
• Desktop): preserve accepted input and clarify persistent-work Quit (f8e234ed) — @dokterdok
• Desktop): drop pool-limit notification wiring main added after the pool subsystem was removed (c3632fcc)
• Runtime): owner scope is multiplex-only; foreign LOCAL sources fail closed; primary = launch home (a37550b9)
• Type session creation identity with merged onboarding options (0948ffc9)
• Preserve main lifecycle and discovery behavior after extraction (b186879a)
• Preserve webhook delivery profile and snapshot scoped home (8fe3d198)
• Retain per-admission bot and API authors (61f75a77)
• Recover mixed-clock sessions and compose runtime test listeners (9e747d7f)
• Preserve hosted image admission and execution across owners (2672b820)
• Gateway): restore hosted image attachments natively (bdfe8a50)
• Desktop): preserve profile target during reconnect (ddf8bec7)
• Restore durable hosted group sends before enabling input (d3162155)
• Translate canonical hosted group controls in all desktop locales (29e27af5)
• Desktop): journal canonical group sends before admission (3d1cb4e0)
• Integrate hosted attachment admission hooks (c094d91e)
• Transfer hosted input bytes through task-scoped owner attestation (519e1101)
• Bind hosted owner transport to exact destination home (9035ef9a)
• Minimize retained webhook destinations and preserve legacy receipts (c6456808)
• Capture peer ACK evidence and trim unused file catalog helpers (c86dd71b)
• Publish hosted file shares with cursor-fenced retries (49e27d8b)
• Run hosted rooms through independently owned profile daemons (53a260ac)
• Fence hosted discard and prevent unknown retry generations (3cde0092)
• Explicitly discard exact hosted unknown executions (864c34f3)
• Preserve hosted room ownership during service shutdown (bfa8022d)
• Durably recover webhook destinations (d207fd64)
• Recover native admissions after ordinary adapter startup (70659676)
• Carry finite execution policy through canonical admission (9edd28e6)
• Join finite gateway chat delegations in the admitted turn (5977ef75)
• Resolve managed Node in native ticket probes (ee9030bd)
• Preserve manual compression settings and session identity (9fa0b6aa)
• Prevent duplicate cron alerts after durable delivery handoff (47e3bb25)
• Preserve cron delivery silence and incident acknowledgements (0c7f676e)
• Bound canonical cron owner store acquisition (61759b57)
• Restore canonical desktop image thumbnails safely (4d5db820)
• Restore prepared desktop image drafts after restart (5034ee3a)
• Route lost prompt discard to its session owner (566872a8)
• Preserve newer replies across delayed redirect receipts (ac30b57a)
• Retry transient desktop busy policy reads (82098e63)
• Keep desktop streams intact when corrections are refused (3c886973)
• Connect recovery and owner projection routes (cfa5c152)
• Discover private gateway sockets across native temp roots (de66df14)
• Expose owner-scoped ancillary session reads (61ace21a)
• Stage canonical remote images in the authorized owner cache (baaa4464)
• Project native config and model inventory from canonical owner (1064971e)
• Preserve Kanban board discovery and unknown owner attempts (90e2b2eb)
• Reconcile canonical cron receipts into durable delivery (c1172b1a)
• Preserve admitted images and async usage in managed workers (4abbb3f9)
• Share static-token session ownership across HTTP and WebSocket (56e344e5)
• Connect canonical cutover repairs across owner and clients (c8f8d9ae)
• Restore scoped canonical busy and correction controls (daa01697)
• Isolate authenticated gateway owners by provider and issuer (6b8a6d4c)
• Bootstrap Windows desktop tickets through validated Python pipes (f8ba25a9)
• Submit Desktop images through canonical admissions (c93382c0)
• Preserve desktop busy correction intent on rejection (b3cca0f3)
• Keep canonical RPC refusals out of Desktop resume recovery (9ba2582b)
• Keep unbound Ink drafts instead of claiming memory-only admission (07588b5e)
• Honor non-idempotent canonical busy control acknowledgements (01e4829c)
• Stage clipboard images on the Ink client host (179a8473)
• Scope Ink config hydration and prompt model mutations (798c3926)
• Retain disconnected Ink input and canonical control receipts (1a5bae9b)
• Stage and retain canonical Ink image submissions (33622c04)
• Route Ink session controls through canonical authority (bf0b25a9)
• Preserve Kanban execution PID and durable worker outcomes (d4fd07d2)
• Route claimed Kanban tasks through trusted owner admission (5aeba055)
• Admit agent cron runs through the canonical owner (cdbe8c35)
• Forward A2A profile tasks through session authority (4e3a6bdb)
• Project ACP cancellation and failed admissions accurately (03c0efc8)
• Preserve API content identity history and terminal outcomes (f48d0956)
• Fence legacy history claims and follow Bot reset targets (f88f8615)
• Adopt legacy local history through trusted session owner (cb748e7a)
• Record physical admission assignment before later compression (7b9dc454)
• Classify managed worker errors and verify compression restart (4bbbb90f)
• Preserve worker compression admission identity (588c609c)
• Refresh worker row identities after compression (e19f05ff)
• Preserve managed transcript lineage and settle after worker finish (ec0ebf80)
• Cli): keep Termux startup hints out of gateway policy (31dc5078)
• Service suffix follows main profile-root rule; drop in-process cli.main tests (0ea5a879)
• Canonical delivery feeds attachment results to record_delivery; log failed turns (19ca1e85)
• Managed worker outbox directory is a portable spelling of the execution id (4a08032d)
• Owner verifies managed worker identity through interpreter trampolines (e8fbefb2)
• Refuse /v1/runs on a natively owned session with a bounded 409 (809fec15)
• Commit execution results with terminal settlement (43348a03)
• Replay canonical relay envelopes until terminal reply acknowledgement (8dfd7add)
• Keep bot relay discovery and outbox in sender profile (437e3d85)
• Isolate desktop bot relay sender and target profile routes (4f75b6aa)
• Recover bot mailbox receipts and migrate queued inputs at owner startup (76a60441)
• Recover bot replies from exact committed admission results (a5ea5b21)
• Retain identified desktop bot deliveries until settlement (e1734e7d)
• Pause managed admission followers when the owned worker is lost (e6077ecc)
• Prevent scoped secret rehydration in bypass workers (1ff3d877)
• Preserve hosted API source during peer persistence (06a9516c)
• Return explicit unknown execution on API crash retries (f26c5c43)
• Recover committed API queue when its adapter reconnects (8ef9fbe8)
• Resolve API prompts through canonical pending controls (f35358a6)
• Preserve pre-editor credential identity and native control coverage (8e3b3a0c)
• Defer editor MCP schema changes until a new session (be748101)
• Bind imported history control in its receipt transaction (f40dc17b)
• Prevent import from reusing retired runtime identities (0a55e373)
• Retire local physical lineage and cache affinity on deletion (a1d47945)
• Authorize cold history mutations without execution rebinding (529fb127)
• Retire native session routes with deletion receipts (10b155bf)
• Retire the legacy Bot mailbox producer and inference drain (ee09dad4)
• Retain immutable Bot relay reply receipts on exact retry (391517b7)
• Refuse Bot delivery instead of starting a competing runtime (03f5d843)
• Migrate worker rotation automation inside owner publication (6fce9f77)
• Bind registered worker ledger before agent discovery (56586998)
• Release original worker turn lease after rotation (ce8b1171)
• Preserve REST mutation success response shape (c1882a69)
• Require exclusive maintenance for legacy bulk session writes (7323773c)
• Fence persisted bot visibility without activating profiles (7fab399a)
• Retain dashboard mutation identity across uncertain replies (20dd6813)
• Prepare desktop session edits from owner snapshots (c01a625c)
• Preserve import validation with real authority fixtures (83b87b01)
• Reject coerced session mutation counters and flags (927ca964)
• Anchor V4A editor approval paths to session cwd (490453f7)
• List canonical ACP sessions under their frozen workspace (3c79ac4e)
• Resolve ACP edit previews against execution cwd (85ce5418)
• Project canonical editor diffs and frozen cwd to ACP (45aee742)
• Release ACP transport without client MCP discovery (92d97ba8)
• Steer API runs through the current authority claim (a69efa90)
• Fence API run cancellation to its durable admission (f67f19fb)
• Replay durable API results across HTTP delivery modes (cbcad6fb)
• Retain recoverable worker title conflicts as durable outcomes (b7d14c75)
• Preserve worker compression pre-publication flush annotations (dbe08962)
• Retain worker compression cleanup authority after rotation (36d5b639)
• Accept real worker compression handoff markers (e98a036a)
• Preserve live delegate tasks during parent deletion (b0f792ac)
• Fence ACP controls and expose the read-only catalog (d304b025)
• Keep ACP session catalog read-only (b117521c)
• Bind API storage to its selected runtime authority (c812ec71)
• Preserve webhook duplicate responses with real route admission fixtures (253f9b5e)
• Fence webhook finalization by admitted session and generation (ca2211f0)
• Durably admit authenticated Graph notifications before acknowledgement (e8e17493)
• Retain relay deliveries until canonical admission commits (e75bc52f)
• Acknowledge webhooks only after durable native admission (9d9e4789)
• Restore worker compressor guards before agent construction (84ccae21)
• Refuse unregistered child and cron persistence in compute workers (2ee0725c)
• Keep registered compute imports out of owner delegation recovery (7eecdcf2)
• Retain distinct repeated watch notices in local consumers (0c42619c)
• Refund legacy notification claims refused by admission (d5b332ed)
• Give watch events stable owner-bound automation identities (135730d1)
• Validate gateway launch options before first-run config checks (bec94623)
• Restore first-run guidance before gateway admission (351b8eb4)
• Retain partial-update diagnostics at canonical CLI launch (a6376f0e)
• Preserve runtime authority across updater snapshot restores (8a8a1372)
• Refuse unowned automation without spending sibling retry budgets (d6635ffe)
• Retain completion batch siblings across durable handoff retries (0307a33f)
• Keep named launch keys and endpoints separate from profile defaults (219ed58f)
• Redact and recover credential-bearing terminal projections (478d9b73)
• Resolve configured local routes from frozen provider policy (e02cc03a)
• Retain startup consent on top-level one-shot launches (ecb0afa6)
• Enforce startup cost and data consent before gateway admission (4dcf234d)
• Retry local creation without binding replacement credentials (12899b65)
• Recover frozen local config credentials from their profile source (f1da7833)
• Keep configured credentials out of frozen policy receipts (2f6fb46b)
• Keep explicit local launch keys in authority memory only (32d512fb)
• Freeze local CLI reasoning and execution launch options (d0954a9e)
• Preflight canonical epoch before restoring profile snapshot files (610a97ea)
• Retain explicit verified deletion after read-only export migration (23456236)
• Recover fresh and historical session row layouts by identity (9c681b2d)
• Explain safe transcript salvage when canonical restore is refused (c559236f)
• Preserve structured Unicode through worker payload and receipt encoding (f56e660e)
• Pause workers on outbox I/O failure and preserve local lease waits (23b54921)
• Freeze retry journals and retain exclusive worker outbox ownership (a8c163af)
• Attenuate worker reconnect tickets to execution operations (e7cd5f93)
• Install relay trust only after provenance verification (90f107f2)
• Keep relay reader live during canonical busy delivery (4485fb73)
• Admit relay inputs with verified connector provenance (8fe258cc)
• Keep retained process lineage lookup read-only (bf9cf5c2)
• Retain corruption restore for non-runtime SQLite stores (ad354c28)
• Preflight all restore destinations and preserve import warning parity (f1b4f6e3)
• Preserve runtime epoch floors across older backup restores (7fd8082e)
• Fence canonical recovery output and report excluded runtime state (43f62e7a)
• Exclude restore and import with canonical runtime ownership (4dce8f7e)
• Keep dashboard session browsing read-only (af4599c1)
• Preserve loop liveness witnesses for long gateway homes (ae92d198)
• Retain newer composer scope across delayed queue acknowledgements (4b39a5fd)
• Keep native steer fallback on canonical queue admission (35255f5c)
• Admit native busy slash kickoffs through canonical submit (6bef46ea)
• Reconcile queue input IDs with canonical admission identities (a877aa6e)
• Preserve active turn ownership during canonical queue admission (a131bf4a)
• Route native composer Queue through existing admission submit (4ce95d5f)
• Authenticate native desktop file downloads per attempt (28741ef8)
• Scope stable execution identity to canonical local sources (c3aa2e5c)
• Reject foreign local receipts inside lineage publication (1ffba2ac)
• Retain local admission ownership across transcript rotation (42ee0d34)
• Publish shared queue changes to attached viewers (fb02973f)
• Retain public queued input identity in shared snapshots (37332c17)
• Expose profile-bound setup readiness on canonical sessions (971c3c95)
• Normalize canonical prompts before named desktop listeners (9a2a30a6)
• Fence canonical desktop RPC metadata edits with revision receipts (ce3037dc)
• Bind desktop create retries to the explicit draft intent (c69bb4db)
• Retain desktop update and profile gates before canonical ensure (a7821f63)
• Adapt desktop native sessions to canonical identities and controls (d1546a54)
• Authenticate native desktop HTTP with fresh private tickets (dd8b9f38)
• Preserve native HTTP profile selectors across JSON contracts (eaad737e)
• Retain source-free authority control projections (3546eb41)
• Preflight durable local policy before claiming queued work (d98dd743)
• Publish canonical Ink readiness only after discovery (653889ef)
• Hydrate canonical Ink history independently of live events (971ff7f3)
• Carry native ticket through WebSocket subprotocol negotiation (7fe8c72c)
• Correlate canonical Ink receipts with prepared input identities (3dfb7d50)
• Scope one-shot output to its admitted turn and retain direct query aliases (17155e73)
• Preserve gateway toolset policy and reject resume source overrides (6feaafcc)
• Reject fresh session registration while gateway drains (a67637cc)
• Separate clarification permission from execution control (66bc2861)
• Stamp authenticated legacy clients before shared session admission (4be08ae5)
• Preserve scoped bootstrap grants in shared session connections (b699e0e9)
• Keep forged local profiles out of messaging authorization fallback (d379d6cc)
• Retain queued inputs when shutdown crosses authorization awaits (733dde1c)
• Reload transport role policy after Discord membership awaits (43ae9e9a)
• Retain native trust fields for validation when freezing ingress (53aadf44)
• Fence native authorization yields against identity and FIFO changes (6ef8b38d)
• Report malformed installed plists without leaking parser failures (1b55d964)
• Resolve installed names from the requested profile root (258049b3)
• Reject unbound launch wrappers and nonregular service definitions (1dd6268b)
• Preserve task XML encoding and document service binding refusals (7b904f95)
• Bind loaded launchd jobs and scheduled task XML before start (1ce0d11e)
• Verify effective systemd profile and account before ensure starts (efadac8d)
• Stop bootstrap background workers after listener failure (6716636f)
• Withdraw gateway readiness when the session listener exits (57ec2718)
• Keep readiness and cleanup fenced across runtime shutdown (82ff0592)
• Retain browser authentication and withdraw native ingress on drain (5da456be)
• Export sessions without mutating canonical storage (ae82c1a2)
• Keep native segment sentinels out of canonical text deltas (caae4af5)
• Keep launcher YOLO out of shared gateway policy (628d702c)
• Align profile reservations with bootstrap permissions (87ba34fd)
• Reject FIFO gateway metadata without blocking discovery (5b0f0276)
• Bind fresh ordinary admissions while preserving exact legacy retries (e5f39ada)
• Preserve ordinary native retry fingerprints through callback migration (6083e9ed)
• Refuse unrouted profile claims in native callback snapshots (99c923bc)
• Preserve authority ownership through scoped adapter callbacks (42ce26af)
• Retain trusted ordinary native callback provenance (1d4dab77)
• Omit retired approvals from gateway attach snapshots (e7ee1d67)
• Deny controls after gateway execution settlement (a064afdd)
• Reject approval publication from retired gateway workers (295bc0f5)
• Retain legacy session writers during reader migration (82dfb85d)
• Keep session lists and statistics read-only (1a1ad945)
• Resolve terminal breadcrumbs without opening a session writer (73238088)
• Share read-only insights reporting with interactive CLI (9cd5d6dd)
• Generate CLI insights without initializing session storage (680937a6)
• Keep resume lookup and TUI exit metadata read-only (617be2da)
• Keep status session inspection read-only (ca77b197)
• Bind shared authority when starting gateway API (11958d46)
• Refuse redirected native media publication (e924cf98)
• Preserve legacy native text admission retries (ca226b68)
• Rotate authority replay epoch on concurrent eviction (a9de35d2)
• Isolate authority execution from slow observers (aab36dc6)
• Keep authority subscriptions stable across repeated resume (8c889765)
• Admit busy messaging text into the canonical durable FIFO (eae6194b)
• Preserve surrogate request identity while sanitizing worker text (bb90f4b8)
• Replay committed worker receipts after terminal settlement (203b3f4f)
• Retain transcript closure guard for worker appends (71f835b6)
• Revoke workers when resolving unknown admissions (d7089f75)
• Align runtime mutation receipts with canonical wire contract (e6b1dc06)
• Fence ancestor revisions when runtime titles transfer (62aef795)
• Fence worker persistence when its admission settles (e3bfe640)
• Transfer admitted claims atomically during worker adoption (341aed41)
• Preserve legacy execution generations through admission import (c45d2e5c)
• Restore Ink pending inputs after cold durable resume (34fb13a1)
• Preserve Ink slash attachments and reconcile stale images (dbc7ffa8)
• Reconcile Ink replay receipts with current execution (8a589010)
• Settle desktop receipts on recovered runtime and tidy composed probes (1ad31afa)
• Retire desktop Stop for newer owner executions and fence old output (926d097d)
• Settle terminal desktop admission receipts without stopping live turns (d89a90e1)
• Fence same-call desktop legacy admission retries (41b017f1)
• Never resend ambiguous Ink legacy admissions (5681c7d4)
• Emit structured CLI parse failures only once (1d4d2b2d)
• Bound gateway probes and structure ensure parser errors (ad1099d6)
• Discover the gateway private fallback socket directory (c804d40b)
• Retain runtime locks while scheduler threads survive cleanup (954d5e99)
• Retain gateway ownership through exit-state persistence (d465ad0d)
• Reserve all gateway profiles before writable initialization (c941b0e6)
• Keep standalone session search read-only (0e7c0588)

📚 Documentation

• Agent): use the released model name Nemotron 3.5 Super VL (79651b71) — @j-nolan
• Env): add NVIDIA NIM to .env example (3dd96101) — @elisam0
• Providers): use a non-cloud example key for local NIM (da463310) — @rroverin
• Rollback section the downgrade refusals link to; regenerate the command-parity table (97ec76fa)
• Gateway): describe the messaging pause notice and /reset escape (6cdf7815)
• Explain ambiguous legacy A2A recovery boundary (22a8154f)
• Cli): classic chat resolves --resume <title> and -c <title> --create-if-missing at the gateway; bare -c stays refused (c6c4161c)
• Gateway): document prompt.submit attachments and the ACP media path (e3d60eed)
• Desktop): gateway-owned queue and the Discard control for a turn lost during restart (101be7d7)
• Explicit /model rewrites the system prompt Model line once (single cache-prefix miss) (ef813b35)
• /new rebinds only the invoking view of a shared session (6be1de8d)
• API runs and X-Hermes-Session-Id cannot bind a session owned by another surface (409 permission_denied) (789caca2)
• Dashboard session delete fences, tombstones, and offline-only bulk maintenance (46c50515)
• Explain canonical editor MCP ownership and cold reattachment (fcc978bd)
• Distinguish canonical Bot admission from retired UI ownership (2d22a7cd)
• Record worker lifecycle hooks proofs and remaining integration gates (3dae322e)
• Record isolated worker inference proof and remaining migration gates (b762d80c)
• Distinguish admission recovery from producer replay proof (bc3bcaff)
• Delimit verified worker substrate coverage and rollout blockers (f22754e8)
• Inventory exact worker persistence consumers before substrate (0e30eb6a)
• Define stable local lineage and paused fork recovery (757f19f4)
• Define native HTTP trust and primary-profile scope (a8a6b02c)
• Document local crash recovery contract and replay limits (375fce55)
• Describe settled Ink recovery and native lifecycle probes (2dc2e740)
• Define Desktop gateway ownership and private ticket boundary (f0ff6c57)
• Distinguish native policy proof from remaining classic CLI parity (256cab2b)
• Publish supported local creation policy and recovery boundary (0400a5ef)
• Explain gateway ensure readiness and service consent (a272e8df)

🧪 Tests

• Relay): the OpenAI-stream e2e no longer self-deadlocks when the stream is buffered (6e84ce66)
• Gateway): the authority stream probe waits for the idle session.info (56b9691c)
• Gateway): align SSE prepare cleanup with retained streams (c0230ca5) — @Lokee86
• Desktop-core): capture the Electron PID before quit for the orphan census message (2cf48e0c)
• Gateway): the unserve runner stub carries the reservation our release step shrinks (5fdb477b)
• Cold-profile archive/unarchive through one multiplexing gateway is an acceptance case (dfbb9142)
• Seed-compensation fake uses discard_unadmitted_session; hosted auth probe waits are load-tolerant (cc1eab12)
• Gateway): managed-worker first-inference wait tolerates a saturated 40-worker runner (57c95771)
• Tui): slash-attachment composer assertions wait for the journaled clear (d5950d72)
• Patch origin API probe in banner ancestry fixtures (cdf4eda7)
• Migrate authored bot fixtures to canonical transport (37d7834e)
• Verify webhook receipt observation and composed HTTP startup (a5a0da66)
• Exercise authenticated hosted room Stop and approval (7a6b2961)
• Use system Python for the stdlib-only ticket bridge (3394ef4c)
• Preserve Kanban policy and cron cleanup owner invariants (e1b6f10b)
• Align Kanban scope fixtures with owner worker client (ea2342d4)
• Observe relay completion and cron guard at owner seams (625bb379)
• Drain durable cron failure deliveries before asserting sends (9b753d3b)
• Migrate cron guards and context fixtures through owner execution (7080a488)
• Restore cron owner configuration and session invariants (c08349cf)
• Exercise cron provider and workdir paths through owner (9fde59d3)
• Migrate cron lifecycle invariants to canonical owner execution (e4a2d476)
• Retain queued input identity after session list loading (2671381d)
• Exercise native Electron gateway HTTP and WebSocket tickets (45c6c8de)
• Verify busy acknowledgements and document Ink recovery limits (59a90b4d)
• Cover canonical Ink image composer and startup handoff (65635634)
• Verify native legacy resume and compression cutover (90052b33)
• Prove admission-backed automatic compression retry (3ec0ea59)
• Gate the Discord role probe on the real distribution, not the conftest mock (19feada0)
• Acp): live editor image prompt reaches the loopback model as an image_url part (993a63f0)
• Native suite finds the managed worker by owner ancestry, not bare ppid (venv trampoline) (9e335738)
• Trampoline reap check waits for the owner's bounded close instead of racing the terminal commit (cc2cdbe2)
• Desktop): move the token download-transport invariant beside the extracted function (ff662b6b)
• Exercise safe identity suppression through real prompt assembly (cccb516c)
• Verify reserved admission claims through worker handlers (107af6fc)
• Isolate and reap owned Kanban systemd scopes (3776709d)
• Prove rotated worker survives owner kill and adoption (8459b140)
• Prove fresh ACP handoff and cold canonical restoration (56f62381)
• Verify per-admission API usage on the ordinary daemon (35d9eb2f)
• Prove shared API FIFO on the ordinary daemon (e721121f)
• Prove registered worker terminal execution without canonical SQLite opens (e31b96bc)
• Exercise worker lifecycle and stale callbacks through ordinary owner (5038cf75)
• Verify worker rotation claim and lost-ack replay over daemon (17cf264f)
• Verify native ACP approval and wrong-profile refusal (d157534a)
• Verify local automation stays nonhuman and cache stable (ef071dd3)
• Prove local completion recovery after owner kill (9afff7e9)
• Follow canonical CLI launch in startup guard fixtures (34b9aad1)
• State): keep FTS migration fixtures on historical versions (21baec51)
• Document recovery limits and verify consented gateway launches (ddc1b0a1)
• Refuse unauthenticated credential launch over ordinary daemon websocket (9b0d7861)
• Deny credential-bearing creation to restricted principals (2d2fdff9)
• Verify frozen CLI iteration limits through actual tool rounds (cc37de8b)
• Prove concurrent CLI launch wire and restart credential isolation (84e86a87)
• Own canonical daemon in completed-process CLI integration (6c8f0fd8)
• Keep simulated HEAD updates off the live runtime fleet (7b8fdfa8)
• Seed owner database for dashboard parameter validation (2af3bfd4)
• Initialize owner store for dashboard refresh success (a1811942)
• Isolate service ordering fixture home (3b42e697)
• Seed gateway status through real read-only storage (6af1ac81)
• Exercise CLI exports against real read-only session storage (96782704)
• Prove pending worker usage survives real owner outage and adoption (58bcc3ec)
• Verify live relay replacement and websocket revocation fences (89567476)
• Reject relay trust installation from an invalid seal (80d677d2)
• Reproduce relay busy ingress blocking outbound acknowledgements (73bf2c66)
• Reproduce authenticated relay native admission rejection (0bbe3740)
• Preserve destination lock identity after offline import (ef1fe3de)
• Verify separate-output recovery against active daemon source (cc96119b)
• Expose epoch reuse and service revival after refused import (dbb1e531)
• Reproduce live restore deleting active authority admissions (3a0111ee)
• Align search fixture with owner-initialized session stores (e2a853ba)
• Cover encoded socket limits with direct control paths (34407c9e)
• Reproduce missing loop witnesses in long-home daemons (36649795)
• Configure a restorable model for token session creation (bcf39bfb)
• Verify ordinary daemon replay and release fixture stores (e8f57b7f)
• Supply real session stores to gateway authority fixtures (e3d23087)
• Verify ordinary daemon slash actor isolation and handler scope (3cdf25cb)
• Verify native download boundaries and document transport scope (c8620011)
• Prove local rotation and reset across cold daemon restarts (af3f2dfe)
• Compare discovery on real legacy serve and canonical daemon sockets (5d1d1ee0)
• Reproduce missing canonical command discovery over ordinary daemon WS (659632c3)
• Scope private Unix ticket fixture to supported native hosts (ca3e4b64)
• Keep native protocol fixtures within their runtime type boundary (da98497c)
• Verify canonical receipts retire the native private-file journal (5bd5a8d6)
• Verify native HTTP selectors against real sibling profiles (f6ef1ea4)
• Prove cold local recovery through separate authenticated daemons (041d9ee7)
• Exercise native Stop through the Python Ink launcher (c75e0cdd)
• Verify native Ink Stop acknowledgement and fresh follow-up (d0ad8324)
• Exercise fresh Ink launch through the real Python launcher (8b727f4a)
• Verify actual native clarification answer on model wire (cc4ad0d1)
• Require native Ink reconnect to render settled history (eecaba42)
• Initialize replay fixture with explicit runtime admission state (014b3ea4)
• Retain native reconnect output for intermittent Ink failure (f454485d)
• Verify native CLI cwd execution against the policy-enabled daemon (db2bdf31)
• Prove native gateway approvals survive CLI detach and invalid choice (a0c361ae)
• Prove concurrent local policy isolation on provider wire (15052599)
• Verify metadata retries through ordinary gateway sockets (0d5d548f)
• Execute fresh sessions through ordinary gateway startup (ae19a6e0)
• Prove fresh local clarify survives complete viewer detachment (1044867b)
• Preserve Discord direct pairing and scoped DM grants (144c86c7)
• Retain startup exit contracts with real authority stores (a126b4cc)
• Verify excluded observer prefix against canonical replay (cacd4d22)
• Retain live gateway bootstrap readiness probe (29167522)
• Exercise shared approvals through production API startup (118b34ac)
• Verify native runtime ownership and execution-time secret refresh (234f1278)
• Exercise approval rendering through initialized turn runners (76efc227)
• Verify CLI readers alongside an active SQLite writer (ee23996c)
• Retain real CLI reader A/B harness (bcc03ee8)
• Preserve insights cleanup coverage with absent-store fast path (eae783bc)
• Exercise shared turns through production API startup (0cfe5a2f)
• Retain authority backpressure execution receipt (47ce83d6)
• Retain real-process read-only search A/B probe (551ccfca)
• Require complete shared gateway acceptance receipt coverage (d853d145)
• Retain gateway source invariants across sibling extractions (e1df5d12)
• Follow production methods across gateway turn extraction (04cef1e9)
• Reap truncation fixture worker before restoring bindings (d6d8af93)
• Trace borrowed SQLite readers in search projection invariant (fa572cbe)
• Verify runtime schema upgrades and genuine SQLite full rollback (1769e803)
• Reproduce Ink receipt-only retry busy latch (1c144c98)
• Reproduce desktop receipt stop and legacy timeout races (02e0ab74)
• Verify gateway service consent across import and setup (4ecf5975)
• Make unreserved profile snapshots explicit in multiplex fixtures (a72ed0a5)

🏗️ Infrastructure

• Release): admit stable releases from release/* branches, not just main (9686d55c) — @ethernet8023
• Plugins): pin birkin-mnemosyne to core 0.7.1 (e216cd74) — @ashmoonori-afk
• Catalog): review disclosure for huddo (85d27a51)
• Map contributor email for StudioCodeAI (c708b34f)
• Plugin-catalog): update Telegram Client to 1.3.1 (27aaade9) — @guberm
• Plugin-catalog): bump Gmail to v1.0.20 (c6ac0565) — @guberm
• Kiwi): bump pin to kiwi@0.12.5, plugin v1.2.2 (a08f5894) — @harrylabsj
• Lightningai-rate-limit to v1.1.0 (wall-clock aligned window) (e28d64e8) — @dinosauria123
• Map contributor email for TREE-Ind (71f78b3f)
• Catalog): review disclosure for hermes-aac (0567d017)
• Catalog): review disclosure for openinvest (c179b286)
• Map contributor email for Sahil-SS9 (d8b5bd8a)
• Catalog): review disclosure for hermes-agent-mixer (a98cc310)
• Update Activity catalog to v0.2.0 (908c525d) — @hassan-kamel
• Catalog): showly reviewed disclosure + requires_hermes >=0.21.6 (2ee820e7)
• Catalog): review disclosure for nexus (1a5f5c7b)
• Catalog): review disclosure for kumiho-memory (63da5f7b)
• Catalog): review disclosure for model-router (92790c6d)
• Catalog): review disclosures for anatomy-museum, agent-janitor (560b2507)
• Js): lint after the main merges: drop the unused watchdog import, order a test import, stub gw on the steer ctx (1b78a417)
• Retrigger CI (zero-job dispatch failure, auto-heal) (d056a624)
• Give area detection its sparse checkout and retry budget (8824ac96)
• Retrigger CI (zero-job dispatch failure, auto-heal) (2cbeac1f)
• Retrigger after 0-job workflow startup failure (254432b2)
• Retrigger (dispatch window) (1e398140)
• Retrigger (dispatch window) (40b17a25)
• Retrigger (dispatch window) (5e198b8b)
• Retrigger after 0-job workflow startup failure (f6dd9025)
• Retrigger after 0-job workflow startup failure (911b559e)
• Retrigger after 0-job workflow startup failure (4ff21ecd)
• Retrigger after 0-job workflow startup failure (c37453e7)
• Retrigger after 0-job workflow startup failure (cb296788)
• Retrigger after 0-job workflow startup failure (346615f3)
• Retrigger after 0-job workflow startup failure (1e4edefa)
• Retrigger after 0-job workflow startup failure (f3d4105f)
• Retrigger after 0-job workflow startup failure (73d9e413)
• Retrigger after 0-job workflow startup failure (c7fcc65c)
• Retrigger after 0-job workflow startup failure (4892e1d4)
• Retrigger after 0-job workflow startup failure (2cb84f43)
• Retrigger after lost push event (0 runs on 19ca1e8) (c86b415d)
• Trim native HTTP helper imports (25fd73b6)

📦 Other Changes

• Repin hermes-insight to afb08fb (1.0.2) (51e663da) — @BrokeSkill
• Plugin-catalog: bump huddo to 0.9.0 (eeacc00a) — @hellohanchen
• Plugin-catalog: re-pin hermes-lang-pt-br to 7548ff1 (pack verifier + CI) (82fbd41f) — @StudioCodeAI
• Plugin-catalog: re-pin hermes-lang-pt-br to 69efb2f (credits/timeline README) (2c20d9a3) — @StudioCodeAI
• Catalog: bump speechify to 0.1.1 (3a5b9e84) — @Lokeshm24
• Catalog: re-pin qdrant-memory to 0.2.1 (e14adc06) (720552bb) — @cnkang
• Catalog: repin Hermes AAC 0.1.1 SDK-only reduced features (473e2847) — @TREE-Ind
• Plugin-catalog: openinvest re-pin to 106e5ba (bounded backend deps, 0.41.6) (6cc9a434) — @longsizhuo
• Plugin-catalog: openinvest re-pin to 3a0c816 (review fixes, backend 0.41.4) (00c311c8) — @longsizhuo
• Plugin-catalog: openinvest re-pin to 3e1a9d7 (review fixes) (cb223633) — @longsizhuo
• Plugin-catalog: bump plan-mode to 0.4.4 (2a5617f8) — @100yenadmin
• Plugin-catalog: bump plan-mode to 0.4.3 (6fafdd4f) — @100yenadmin
• Catalog: pin the Showly community plugin (5da3156c) — @slchris
• Catalog(nexus): repin the sha to 4392e6d — /embed and /mcp demand a per-installation key (64425a06) — @Neboy72
• Plugin-catalog: bump account-pool to 4.0.2 (e5d2cebe) — @roqianjas
• Plugin-catalog: bump alans-way and alans-way-computer to 0.21.5 (a8d61e30) — @capthvnsen
• Plugin-catalog: nvidia-app + nvidia-broadcast pin -> 729e25c (first-run setup when the app side is not ready) (f18948e4) — @alt-glitch
• Catalog: agent-janitor (from #137875) (#137875) — @ZidoCode
• Catalog: anatomy-museum (from #138166) (#138166) — @danrudy33
• Catalog: secure-env-ingress (from #132272) (#132272) — @web3blind
• Style: align canonical group controls with Desktop lint rules (c8d8900d)
• Style: normalize verified queue admission imports and spacing (d3ad7a90)

👥 Contributors

Thank you to everyone who contributed to this release!

• @Lokee86 (11 commits)
• @dokterdok (6 commits)
• @elisam0 (5 commits)
• @longsizhuo (4 commits)
• @100yenadmin (3 commits)
• @StudioCodeAI (3 commits)
• @olric3015 (3 commits)
• @ethernet8023 (2 commits)
• @helix4u (2 commits)
• @guberm (2 commits)
• @TakeshiTGAL (2 commits)
• @dinosauria123 (2 commits)
• @TREE-Ind (2 commits)
• @Sahil-SS9 (2 commits)
• @hassan-kamel (2 commits)
• @slchris (2 commits)
• David Dudok de Wit (2 commits)
• @xxxigm (1 commit)
• @kshitijk4poor (1 commit)
• @j-nolan (1 commit)
• @rroverin (1 commit)
• @BrokeSkill (1 commit)
• @dandacompany (1 commit)
• @ashmoonori-afk (1 commit)
• @hellohanchen (1 commit)
• @2867297362mjb-sketch (1 commit)
• @Lokeshm24 (1 commit)
• @harrylabsj (1 commit)
• @cnkang (1 commit)
• @Neboy72 (1 commit)
• @kaveone (1 commit)
• @roqianjas (1 commit)
• @capthvnsen (1 commit)
• @alt-glitch (1 commit)
• @metamindedu (1 commit)
• @ZidoCode (1 commit)
• @danrudy33 (1 commit)
• @web3blind (1 commit)
• @KoNit-K (1 commit)
• @unsupportedpastels (1 commit)
• @abundantbeing (1 commit)
• @utkubakir (1 commit)

Full Changelog: v0.22.0...rc.5-v0.22.1