docs: refresh upstream API baseline references

.gitattributes

@@ -1 +0,0 @@
-*.sh text eol=lf

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,90 +0,0 @@
-name: Bug report
-description: Report a reproducible problem in Hermes-Relay.
-title: "[Bug]: "
-labels: ["bug"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Before submitting, remove secrets, access tokens, real hostnames/IPs, private deployment names, and personal names. Public example IPs such as `192.168.1.100` are fine.
-
-  - type: dropdown
-    id: area
-    attributes:
-      label: Affected area
-      description: Pick the closest surface.
-      options:
-        - Android app
-        - Standard Hermes chat or voice
-        - Relay plugin or server
-        - Desktop CLI or tray
-        - Dashboard plugin
-        - Docs or installer
-        - CI, release, or packaging
-        - Unsure
-    validations:
-      required: true
-
-  - type: textarea
-    id: summary
-    attributes:
-      label: What happened?
-      description: State the behavior you saw and what you expected instead.
-      placeholder: |
-        Observed:
-
-        Expected:
-    validations:
-      required: true
-
-  - type: textarea
-    id: steps
-    attributes:
-      label: Reproduction steps
-      description: Include the smallest sequence that reproduces the issue.
-      placeholder: |
-        1. Pair or configure...
-        2. Open...
-        3. Tap or run...
-        4. See...
-    validations:
-      required: true
-
-  - type: textarea
-    id: environment
-    attributes:
-      label: Environment
-      description: Include only the fields that apply.
-      value: |
-        - Hermes-Relay version/tag:
-        - Install surface: Google Play / sideload APK / local build / plugin / desktop CLI
-        - Android device and OS:
-        - hermes-agent version or commit:
-        - Connection mode: LAN / Tailscale / public TLS / other
-    validations:
-      required: true
-
-  - type: textarea
-    id: logs
-    attributes:
-      label: Sanitized logs, screenshots, or traces
-      description: Paste the smallest useful log excerpt. Remove tokens, private URLs, hostnames, IPs, and user-identifying data.
-      render: shell
-
-  - type: textarea
-    id: upstream
-    attributes:
-      label: Upstream or standard-path notes
-      description: If relevant, note whether this reproduces against unmodified upstream hermes-agent or only with the relay plugin enabled.
-
-  - type: checkboxes
-    id: checklist
-    attributes:
-      label: Checklist
-      options:
-        - label: I searched existing issues first.
-          required: true
-        - label: I removed secrets, tokens, private infrastructure, and personal names.
-          required: true
-        - label: I included the affected version or install surface where known.
-          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -1,11 +0,0 @@
-blank_issues_enabled: true
-contact_links:
-  - name: Report a security vulnerability (private)
-    url: https://github.com/Codename-11/hermes-relay/security/advisories/new
-    about: Report privately via GitHub Security Advisories — do not open a public issue. See SECURITY.md for the full policy.
-  - name: User documentation
-    url: https://hermes-relay.dev/docs/
-    about: Read setup, pairing, remote access, and troubleshooting docs.
-  - name: Contributing guide
-    url: https://github.com/Codename-11/hermes-relay/blob/main/CONTRIBUTING.md
-    about: Review local setup, branch, commit, changelog, and test conventions.

.github/ISSUE_TEMPLATE/docs.yml

@@ -1,64 +0,0 @@
-name: Documentation or setup issue
-description: Report unclear, stale, or missing docs and setup guidance.
-title: "[Docs]: "
-labels: ["documentation"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Use this for docs, installer, setup, release-note, or contribution-guide problems. Remove private hostnames/IPs, tokens, and personal names before posting.
-
-  - type: dropdown
-    id: area
-    attributes:
-      label: Documentation area
-      options:
-        - README
-        - User docs site
-        - Android setup
-        - Relay plugin setup
-        - Desktop CLI or tray setup
-        - Release notes or changelog
-        - Contributor docs
-        - Other
-    validations:
-      required: true
-
-  - type: input
-    id: location
-    attributes:
-      label: Page, file, or section
-      description: Link the page or name the file and heading.
-      placeholder: user-docs/guide/getting-started.md, README install section, etc.
-    validations:
-      required: true
-
-  - type: textarea
-    id: issue
-    attributes:
-      label: What is wrong or missing?
-      description: Explain what was unclear, outdated, misleading, or absent.
-    validations:
-      required: true
-
-  - type: textarea
-    id: expected
-    attributes:
-      label: Suggested correction
-      description: Optional. Include the wording, command, screenshot need, or structure that would help.
-
-  - type: textarea
-    id: context
-    attributes:
-      label: Context
-      description: Optional. Include the version, install path, device, or command you were following.
-
-  - type: checkboxes
-    id: checklist
-    attributes:
-      label: Checklist
-      options:
-        - label: I checked that this is not already covered in current docs.
-          required: true
-        - label: I removed secrets, private hostnames/IPs, internal deployment names, and personal names.
-          required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,78 +0,0 @@
-name: Feature request
-description: Propose a product, workflow, or platform improvement.
-title: "[Feature]: "
-labels: ["enhancement"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Keep requests focused on user-visible outcomes. Do not include private infrastructure, secrets, personal names, or branch/workspace plumbing.
-
-  - type: dropdown
-    id: area
-    attributes:
-      label: Affected area
-      options:
-        - Android app
-        - Standard Hermes chat or voice
-        - Relay plugin or server
-        - Desktop CLI or tray
-        - Dashboard plugin
-        - Docs or installer
-        - CI, release, or packaging
-        - Unsure
-    validations:
-      required: true
-
-  - type: textarea
-    id: problem
-    attributes:
-      label: Problem or workflow
-      description: What is hard, missing, slow, confusing, or unsafe today?
-      placeholder: Describe the concrete user workflow this would improve.
-    validations:
-      required: true
-
-  - type: textarea
-    id: proposal
-    attributes:
-      label: Proposed behavior
-      description: Describe the outcome, not just an implementation detail.
-      placeholder: After this change, a user should be able to...
-    validations:
-      required: true
-
-  - type: textarea
-    id: standard_path
-    attributes:
-      label: Standard upstream compatibility
-      description: If this touches chat, voice, dashboard, API routes, or server behavior, note whether it can work against unmodified upstream hermes-agent.
-      placeholder: This should work on vanilla upstream because... / This requires the relay plugin because...
-
-  - type: textarea
-    id: alternatives
-    attributes:
-      label: Alternatives considered
-      description: Optional. Mention current workarounds or related approaches.
-
-  - type: textarea
-    id: acceptance
-    attributes:
-      label: Acceptance criteria
-      description: What would make the request complete?
-      placeholder: |
-        - Users can...
-        - The app/server handles...
-        - Documentation covers...
-
-  - type: checkboxes
-    id: checklist
-    attributes:
-      label: Checklist
-      options:
-        - label: I searched existing issues first.
-          required: true
-        - label: I described the user outcome and affected surface.
-          required: true
-        - label: I removed private infrastructure details and personal names.
-          required: true

.github/ISSUE_TEMPLATE/translation.yml

@@ -1,53 +0,0 @@
-name: Translation correction
-description: Report or propose a clearer translation for one locale.
-title: "[Translation]: "
-labels: ["translation"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        English defines the product meaning. Translation corrections are applied to the canonical locale catalog and credited through Git history.
-  - type: input
-    id: locale
-    attributes:
-      label: Language and locale
-      placeholder: Spanish (es), Simplified Chinese (zh-Hans), etc.
-    validations:
-      required: true
-  - type: input
-    id: location
-    attributes:
-      label: Screen and current text
-      description: Name the screen, resource key if known, and current translated wording.
-    validations:
-      required: true
-  - type: textarea
-    id: correction
-    attributes:
-      label: Suggested correction
-      description: Include the corrected text and what the English source means in this context.
-    validations:
-      required: true
-  - type: dropdown
-    id: proficiency
-    attributes:
-      label: Language familiarity
-      options:
-        - Native speaker
-        - Fluent speaker
-        - Professional translator
-        - Learner or machine-assisted report
-        - Prefer not to say
-    validations:
-      required: true
-  - type: checkboxes
-    id: sensitive
-    attributes:
-      label: Sensitive meaning
-      options:
-        - label: This affects permissions, privacy, security, destructive actions, payments, or recovery instructions.
-  - type: textarea
-    id: context
-    attributes:
-      label: Additional context
-      description: Optional screenshot, regional preference, or explanation of why the existing wording is misleading.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+## Summary
+
+<!-- Brief description of what this PR does -->
+
+## Changes
+
+-
+
+## Checklist
+
+- [ ] `./gradlew assembleDebug` succeeds
+- [ ] `./gradlew test` passes
+- [ ] Tested on emulator or device (if UI change)
+- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] CHANGELOG.md updated (if user-facing)
+- [ ] No credentials or secrets in committed files

.github/copilot-instructions.md

@@ -1,23 +0,0 @@
-# GitHub Copilot instructions — Hermes-Relay
-
-This file exists so GitHub Copilot (which reads `.github/copilot-instructions.md`,
-not `AGENTS.md`) picks up the project's agent guidance.
-
-**Read [AGENTS.md](../AGENTS.md) first — it is the single source of truth**
-for agent guidance: the entry point, the non-negotiables, and the public-repo
-writing hygiene. `CLAUDE.md` imports that same canonical file. Follow
-`AGENTS.md` and its linked project records; don't restate them here.
-
-Quick non-negotiables (the full list and rationale are in `AGENTS.md`):
-
-- **Standard path = vanilla upstream only.** The default no-plugin connection
-  must work against unmodified upstream hermes-agent; server-side needs go
-  through upstream PRs or the optional relay plugin, never fork patches.
-- **Conventional Commits**, `main`/`dev` branching — feature branches off
-  `dev`, `--no-ff` merges, tags cut from `main`.
-- **Android:** Jetpack Compose (no XML), kotlinx.serialization (no Gson),
-  OkHttp (no Ktor), `wss://` only. Narrow local checks use the Android lane;
-  pushed exact SHAs prefer `Android On-Demand` for heavy verification; full
-  local pre-push remains an explicit fallback.
-- **Public repo:** no personal names, no private infrastructure, no
-  AI/assistant self-narration in committed prose.

.github/dependabot.yml

@@ -3,7 +3,6 @@ updates:
   # Gradle dependencies
   - package-ecosystem: "gradle"
     directory: "/"
-    target-branch: "dev"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -25,12 +24,10 @@ updates:
         patterns:
           - "junit*"
           - "androidx.compose.ui:ui-test*"
-          - "io.github.takahirom.roborazzi*"
 
   # GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
-    target-branch: "dev"
     schedule:
       interval: "weekly"
     labels:

.github/pull_request_template.md

@@ -1,47 +0,0 @@
-## Summary
-
-<!-- Describe the user/developer outcome and why this change is needed. Link related issues, e.g. Closes #123. -->
-
-## Changes
-
-<!-- List the focused implementation changes. Avoid repeating the commit log. -->
-
--
-
-## Verification
-
-<!-- List exact commands and results. Say explicitly when a check was not run or when device/UI proof remains outstanding. -->
-
--
-
-## Screenshots
-
-<!-- UI change: include screenshots/video plus device, viewport, or emulator details. Otherwise write: No visual change. -->
-
-## Compatibility / risk
-
-<!-- Note Standard Hermes/upstream compatibility, migrations/state changes, security/privacy impact, rollout/rollback, or write N/A. -->
-
-## Lineage / contributor credit
-
-<!-- Preserve prior contributor work when replacing, salvaging, or rebuilding another PR. -->
-
-- Source PR(s): N/A
-- Attribution preserved by: N/A
-
-## Checklist
-
-<!-- Check an item when satisfied or when its N/A rationale is stated above. -->
-
-- [ ] Target branch is `dev`, unless this is a `dev` → `main` release PR or a focused production-tag hotfix PR to `main`
-- [ ] Scope is focused and related issues/PRs are linked
-- [ ] Android changes: lint and focused tests ran, or rationale is listed above
-- [ ] Translation changes: locale validation/review ran, or N/A is listed above
-- [ ] Server/plugin changes: focused tests ran, or N/A/rationale is listed above
-- [ ] Desktop changes: build/tests ran, or N/A/rationale is listed above
-- [ ] Docs/site changes: build or link/route checks ran, or N/A/rationale is listed above
-- [ ] UI changes were tested on a relevant device/emulator/desktop surface, or the missing proof is stated above
-- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
-- [ ] `CHANGELOG.md` is updated for user-visible changes, or N/A is listed above
-- [ ] Public writing hygiene checked: no secrets, private infrastructure, personal names, or AI/process narration
-- [ ] Salvaged/replacement work links source PRs and preserves contributor authorship, or N/A is listed above

.github/scripts/classify-ci-paths.cjs

@@ -1,59 +0,0 @@
-'use strict';
-
-function classifyCiPaths(paths) {
-  const forceAll = paths.some((path) => [
-    '.github/workflows/ci-required.yml',
-    '.github/workflows/release-backmerge.yml',
-    '.github/workflows/approve-release-train.yml',
-    '.github/scripts/classify-ci-paths.cjs',
-    '.github/scripts/classify-ci-paths.test.cjs',
-    'scripts/plan_release_backmerge.py',
-    'scripts/tests/plan_release_backmerge_test.py',
-  ].includes(path));
-  const exact = (values) => paths.some((path) => values.includes(path));
-  const under = (prefixes) => paths.some((path) => prefixes.some((prefix) => path.startsWith(prefix)));
-
-  return {
-    android: forceAll || under(['app/', 'gradle/']) || exact([
-      'build.gradle.kts', 'settings.gradle.kts', 'gradle.properties', 'gradlew', 'gradlew.bat',
-      'scripts/check-android-locales.py', 'scripts/android-locale-harness.py',
-      'scripts/check-android-collection-apis.py', 'scripts/check-android-native-compat.py',
-      'scripts/check-android-release-notes.py',
-      'scripts/android_release_artifacts.py',
-      'scripts/android-lane.ps1', 'scripts/android-prepush.py', 'scripts/dev.bat', 'scripts/dev.sh',
-      'scripts/tests/android_prepush_test.py',
-      'scripts/tests/check_android_native_compat_test.py',
-      'scripts/tests/check_android_release_notes_test.py',
-      'scripts/tests/android_release_artifacts_test.py',
-      '.github/workflows/android-on-demand.yml', '.github/workflows/ci-android.yml',
-      '.github/workflows/play-preflight-android.yml',
-      '.github/workflows/approve-release-android.yml',
-      '.github/workflows/release-android.yml',
-    ]),
-    desktop: forceAll || under(['desktop/']) || exact([
-      '.github/workflows/ci-desktop.yml',
-      '.github/workflows/approve-release-extensions.yml',
-      '.github/workflows/release-cli.yml',
-    ]),
-    plugin: forceAll || paths.some((path) => /^plugin\/[^/]+\.py$/.test(path)) ||
-      under(['plugin/relay/', 'plugin/tools/', 'plugin/tests/', 'relay_server/', 'hermes_relay_bootstrap/']) || exact([
-        'plugin/plugin.yaml', 'pyproject.toml', 'scripts/check-plugin-version-sync.py',
-        'scripts/check-server-version-sync.py', 'scripts/bump-plugin-version.sh',
-        'scripts/bump-server-version.sh', '.github/workflows/ci-plugin.yml',
-        '.github/workflows/approve-release-extensions.yml',
-        '.github/workflows/release-plugin.yml',
-      ]),
-    dashboard: forceAll || under(['plugin/dashboard/']) || exact([
-      '.github/workflows/ci-dashboard.yml',
-    ]),
-    contract: forceAll ||
-      under(['app/src/main/kotlin/com/hermesandroid/relay/network/upstream/']) || exact([
-        'scripts/check-upstream-route-contract.py', '.github/workflows/ci-contract.yml',
-      ]),
-    docs: forceAll || under(['user-docs/']) || exact([
-      '.github/workflows/docs.yml',
-    ]),
-  };
-}
-
-module.exports = { classifyCiPaths };

.github/scripts/classify-ci-paths.test.cjs

@@ -1,130 +0,0 @@
-'use strict';
-
-const assert = require('node:assert/strict');
-const { readFileSync } = require('node:fs');
-const { join } = require('node:path');
-const { classifyCiPaths } = require('./classify-ci-paths.cjs');
-
-const none = {
-  android: false,
-  desktop: false,
-  plugin: false,
-  dashboard: false,
-  contract: false,
-  docs: false,
-};
-
-assert.deepEqual(classifyCiPaths(['README.md']), none);
-assert.deepEqual(classifyCiPaths(['desktop/src/cli.ts']), { ...none, desktop: true });
-assert.deepEqual(classifyCiPaths(['experiments/quest/src/main/kotlin/Quest.kt']), none);
-assert.deepEqual(classifyCiPaths(['scripts/check-android-release-notes.py']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['scripts/check-android-native-compat.py']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['scripts/android_release_artifacts.py']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['scripts/tests/android_release_artifacts_test.py']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['scripts/tests/check_android_native_compat_test.py']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['scripts/android-lane.ps1']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['scripts/android-prepush.py']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['scripts/dev.bat']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['scripts/dev.sh']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['scripts/tests/android_prepush_test.py']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['.github/workflows/android-on-demand.yml']), { ...none, android: true });
-assert.deepEqual(classifyCiPaths(['.github/workflows/approve-release-extensions.yml']), {
-  ...none,
-  desktop: true,
-  plugin: true,
-});
-assert.deepEqual(classifyCiPaths(['.github/workflows/release-cli.yml']), { ...none, desktop: true });
-assert.deepEqual(classifyCiPaths(['.github/workflows/release-plugin.yml']), { ...none, plugin: true });
-assert.deepEqual(classifyCiPaths(['plugin/relay/server.py']), { ...none, plugin: true });
-assert.deepEqual(classifyCiPaths(['plugin/dashboard/src/App.tsx']), { ...none, dashboard: true });
-assert.deepEqual(classifyCiPaths(['user-docs/index.md']), { ...none, docs: true });
-assert.deepEqual(
-  classifyCiPaths(['app/src/main/kotlin/com/hermesandroid/relay/network/upstream/DashboardApiClient.kt']),
-  { ...none, android: true, contract: true },
-);
-assert.deepEqual(classifyCiPaths(['.github/workflows/ci-required.yml']), {
-  android: true,
-  desktop: true,
-  plugin: true,
-  dashboard: true,
-  contract: true,
-  docs: true,
-});
-assert.deepEqual(classifyCiPaths(['.github/workflows/release-backmerge.yml']), {
-  android: true,
-  desktop: true,
-  plugin: true,
-  dashboard: true,
-  contract: true,
-  docs: true,
-});
-assert.deepEqual(classifyCiPaths(['.github/workflows/approve-release-train.yml']), {
-  android: true,
-  desktop: true,
-  plugin: true,
-  dashboard: true,
-  contract: true,
-  docs: true,
-});
-
-const repoRoot = join(__dirname, '..', '..');
-const approvalWorkflow = readFileSync(
-  join(repoRoot, '.github', 'workflows', 'approve-release-extensions.yml'),
-  'utf8',
-);
-const cliReleaseWorkflow = readFileSync(
-  join(repoRoot, '.github', 'workflows', 'release-cli.yml'),
-  'utf8',
-);
-const pluginReleaseWorkflow = readFileSync(
-  join(repoRoot, '.github', 'workflows', 'release-plugin.yml'),
-  'utf8',
-);
-const desktopCiWorkflow = readFileSync(
-  join(repoRoot, '.github', 'workflows', 'ci-desktop.yml'),
-  'utf8',
-);
-const androidPreflightWorkflow = readFileSync(
-  join(repoRoot, '.github', 'workflows', 'play-preflight-android.yml'),
-  'utf8',
-);
-const androidApprovalWorkflow = readFileSync(
-  join(repoRoot, '.github', 'workflows', 'approve-release-android.yml'),
-  'utf8',
-);
-const androidReleaseWorkflow = readFileSync(
-  join(repoRoot, '.github', 'workflows', 'release-android.yml'),
-  'utf8',
-);
-const requiredChecksWorkflow = readFileSync(
-  join(repoRoot, '.github', 'workflows', 'ci-required.yml'),
-  'utf8',
-);
-const releaseTrainWorkflow = readFileSync(
-  join(repoRoot, '.github', 'workflows', 'approve-release-train.yml'),
-  'utf8',
-);
-
-assert.match(approvalWorkflow, /permissions:\r?\n  contents: read/);
-assert.match(
-  approvalWorkflow,
-  /approve:[\s\S]*?permissions:\r?\n      actions: write\r?\n      contents: write/,
-);
-assert.match(
-  approvalWorkflow,
-  /ref: \$\{\{ contains\(inputs\.version, '-'\) && 'dev' \|\| 'main' \}\}/,
-);
-assert.match(cliReleaseWorkflow, /workflow_dispatch:[\s\S]*?Approved CLI\+UI version/);
-assert.match(cliReleaseWorkflow, /name: Restore exact-source tray build cache[\s\S]*?actions\/cache@v6/);
-assert.match(desktopCiWorkflow, /name: Restore exact-source tray build cache[\s\S]*?actions\/cache@v6/);
-assert.match(pluginReleaseWorkflow, /workflow_dispatch:[\s\S]*?Approved Plugin version/);
-assert.match(androidPreflightWorkflow, /Package immutable preflight artifacts/);
-assert.match(androidApprovalWorkflow, /Android public approval accepts stable SemVer only/);
-assert.match(androidReleaseWorkflow, /Download exact stable preflight artifacts/);
-assert.match(androidReleaseWorkflow, /artifact-ids: \$\{\{ needs\.validate\.outputs\.preflight_artifact_id \}\}/);
-assert.match(requiredChecksWorkflow, /name: Reuse exact-tree required checks/);
-assert.match(requiredChecksWorkflow, /name: required-checks-\$\{\{ needs\.changes\.outputs\.tree \}\}/);
-assert.match(releaseTrainWorkflow, /name: Hermes-Relay Coordinated Release Approval/);
-assert.match(releaseTrainWorkflow, /Coordinated Android approval is stable-only/);
-
-console.log('CI path classification tests passed.');

.github/scripts/review-bundle-report.cjs

@@ -1,173 +0,0 @@
-'use strict';
-
-const COMMENT_MARKER = '<!-- hermes-relay-review-candidate -->';
-const ARTIFACT_NAME_RE = /^hermes-relay-review-pr-(\d+)-([0-9a-f]{12})$/;
-
-function formatExpiry(value) {
-  if (!value) return 'the artifact retention window';
-  return new Intl.DateTimeFormat('en-US', {
-    month: 'long',
-    day: 'numeric',
-    year: 'numeric',
-    timeZone: 'UTC',
-  }).format(new Date(value));
-}
-
-function buildReviewComment({ conclusion, prNumber, headSha, runUrl, artifact }) {
-  const shortSha = headSha.slice(0, 12);
-
-  if (conclusion === 'success' && artifact) {
-    const artifactUrl = `${runUrl}/artifacts/${artifact.id}`;
-    return `${COMMENT_MARKER}
-## Review candidate ready
-
-Built from PR #${prNumber} head \`${shortSha}\`.
-
-[Download \`${artifact.name}\`](${artifactUrl}) — expires **${formatExpiry(artifact.expires_at)}**.
-
-1. Unzip the bundle and verify its files against \`SHA256SUMS.txt\`.
-2. Install the APK under \`android/\`. It appears as **HR Candidate**, leaves stable installs untouched, and must be paired separately.
-3. Test the Relay package only in a disposable/staging Hermes instance or with an explicit snapshot and rollback plan. Confirm the source SHA in \`REVIEW_MANIFEST.json\`.
-
-[View workflow run](${runUrl})`;
-  }
-
-  if (conclusion === 'action_required') {
-    return `${COMMENT_MARKER}
-## Review candidate awaiting approval
-
-GitHub held the build for PR #${prNumber} head \`${shortSha}\` at the first-time fork approval gate. A maintainer must approve the run before any candidate can be published.
-
-[Review and approve the workflow run](${runUrl})`;
-  }
-
-  const result = conclusion || 'unknown';
-  return `${COMMENT_MARKER}
-## Review candidate unavailable
-
-The build for PR #${prNumber} head \`${shortSha}\` completed with **${result}** and did not publish a candidate bundle.
-
-[View workflow run](${runUrl})`;
-}
-
-function artifactPrNumber(artifacts, headSha) {
-  const shortSha = headSha.slice(0, 12);
-  for (const artifact of artifacts) {
-    const match = ARTIFACT_NAME_RE.exec(artifact.name);
-    if (match && match[2] === shortSha) return Number(match[1]);
-  }
-  return null;
-}
-
-async function resolvePrNumber({ github, owner, repo, run, artifacts }) {
-  const payloadPr = run.pull_requests?.[0]?.number;
-  if (payloadPr) return payloadPr;
-
-  const artifactPr = artifactPrNumber(artifacts, run.head_sha);
-  if (artifactPr) return artifactPr;
-
-  const headOwner = run.head_repository?.owner?.login;
-  if (!headOwner || !run.head_branch) return null;
-
-  const { data: pulls } = await github.rest.pulls.list({
-    owner,
-    repo,
-    head: `${headOwner}:${run.head_branch}`,
-    state: 'all',
-    per_page: 100,
-  });
-  const exact = pulls.find((pull) =>
-    pull.head.sha === run.head_sha && pull.base.ref === 'dev'
-  );
-  return exact?.number ?? null;
-}
-
-async function resolveWorkflowRun({ github, context, core }) {
-  const completedRun = context.payload.workflow_run;
-  if (completedRun) return completedRun;
-
-  const requested = context.payload.inputs?.run_id;
-  const runId = Number(requested);
-  if (!Number.isSafeInteger(runId) || runId <= 0) {
-    core.setFailed(`Invalid Build Review Bundle run ID: ${requested ?? ''}`);
-    return null;
-  }
-  const { owner, repo } = context.repo;
-  const { data: run } = await github.rest.actions.getWorkflowRun({
-    owner,
-    repo,
-    run_id: runId,
-  });
-  return run;
-}
-
-async function reportReviewBundle({ github, context, core }) {
-  const run = await resolveWorkflowRun({ github, context, core });
-  const { owner, repo } = context.repo;
-  if (!run) return;
-  if (run.name !== 'Build Review Bundle' || run.event !== 'pull_request') {
-    core.info('Ignoring a review-bundle run that was not triggered by a pull request.');
-    return;
-  }
-  if (run.conclusion === 'skipped') {
-    core.info(`Ignoring skipped review-bundle run ${run.id}.`);
-    return;
-  }
-
-  const artifacts = await github.paginate(
-    github.rest.actions.listWorkflowRunArtifacts,
-    { owner, repo, run_id: run.id, per_page: 100 },
-  );
-  const prNumber = await resolvePrNumber({ github, owner, repo, run, artifacts });
-  if (!prNumber) {
-    core.warning(`Could not resolve a pull request for review-bundle run ${run.id}.`);
-    return;
-  }
-
-  const expectedName = `hermes-relay-review-pr-${prNumber}-${run.head_sha.slice(0, 12)}`;
-  const artifact = artifacts.find((item) => item.name === expectedName && !item.expired);
-  const body = buildReviewComment({
-    conclusion: run.conclusion,
-    prNumber,
-    headSha: run.head_sha,
-    runUrl: run.html_url,
-    artifact,
-  });
-
-  const comments = await github.paginate(
-    github.rest.issues.listComments,
-    { owner, repo, issue_number: prNumber, per_page: 100 },
-  );
-  const existing = comments.find((comment) =>
-    comment.user?.login === 'github-actions[bot]' &&
-    comment.body?.includes(COMMENT_MARKER)
-  );
-
-  if (existing) {
-    await github.rest.issues.updateComment({
-      owner,
-      repo,
-      comment_id: existing.id,
-      body,
-    });
-    core.info(`Updated review-candidate comment on PR #${prNumber}.`);
-  } else {
-    await github.rest.issues.createComment({
-      owner,
-      repo,
-      issue_number: prNumber,
-      body,
-    });
-    core.info(`Created review-candidate comment on PR #${prNumber}.`);
-  }
-}
-
-module.exports = {
-  ARTIFACT_NAME_RE,
-  COMMENT_MARKER,
-  artifactPrNumber,
-  buildReviewComment,
-  reportReviewBundle,
-  resolvePrNumber,
-  resolveWorkflowRun,
-};

.github/scripts/review-bundle-report.test.cjs

@@ -1,184 +0,0 @@
-'use strict';
-
-const assert = require('node:assert/strict');
-const {
-  artifactPrNumber,
-  buildReviewComment,
-  reportReviewBundle,
-} = require('./review-bundle-report.cjs');
-
-const run = {
-  id: 32729383426,
-  name: 'Build Review Bundle',
-  event: 'pull_request',
-  conclusion: 'success',
-  head_sha: '90ab705a883ca963035f4f8ccda815619dbd4f3b',
-  head_branch: 'fix/gateway-history-attachments',
-  head_repository: { owner: { login: 'JackHunzicker' } },
-  html_url: 'https://github.com/Codename-11/hermes-relay/actions/runs/32729383426',
-  pull_requests: [],
-};
-const artifact = {
-  id: 9521126010,
-  name: 'hermes-relay-review-pr-398-90ab705a883c',
-  expired: false,
-  expires_at: '2026-08-31T12:52:24Z',
-};
-
-assert.equal(artifactPrNumber([artifact], run.head_sha), 398);
-
-const successBody = buildReviewComment({
-  conclusion: 'success',
-  prNumber: 398,
-  headSha: run.head_sha,
-  runUrl: run.html_url,
-  artifact,
-});
-assert.match(successBody, /## Review candidate ready/);
-assert.match(successBody, /hermes-relay-review-pr-398-90ab705a883c/);
-assert.match(successBody, /expires \*\*August 31, 2026\*\*/);
-assert.match(successBody, /HR Candidate/);
-assert.ok(!successBody.includes(['Hermes', 'Candidate'].join(' ')));
-assert.match(successBody, /REVIEW_MANIFEST\.json/);
-
-const blockedBody = buildReviewComment({
-  conclusion: 'action_required',
-  prNumber: 398,
-  headSha: run.head_sha,
-  runUrl: run.html_url,
-});
-assert.match(blockedBody, /## Review candidate awaiting approval/);
-assert.doesNotMatch(blockedBody, /Download/);
-
-async function testExistingCommentIsUpdated() {
-  const calls = { create: [], update: [] };
-  const github = {
-    rest: {
-      actions: { listWorkflowRunArtifacts() {} },
-      issues: {
-        listComments() {},
-        createComment: async (args) => calls.create.push(args),
-        updateComment: async (args) => calls.update.push(args),
-      },
-      pulls: { list: async () => ({ data: [] }) },
-    },
-    paginate: async (method) => {
-      if (method === github.rest.actions.listWorkflowRunArtifacts) return [artifact];
-      if (method === github.rest.issues.listComments) {
-        return [{
-          id: 77,
-          user: { login: 'github-actions[bot]' },
-          body: '<!-- hermes-relay-review-candidate -->\nold',
-        }];
-      }
-      throw new Error('Unexpected pagination method');
-    },
-  };
-  const messages = [];
-  await reportReviewBundle({
-    github,
-    context: {
-      repo: { owner: 'Codename-11', repo: 'hermes-relay' },
-      payload: { workflow_run: run },
-    },
-    core: {
-      info: (message) => messages.push(message),
-      warning: (message) => messages.push(message),
-    },
-  });
-  assert.equal(calls.create.length, 0);
-  assert.equal(calls.update.length, 1);
-  assert.equal(calls.update[0].comment_id, 77);
-  assert.match(calls.update[0].body, /## Review candidate ready/);
-  assert.deepEqual(messages, ['Updated review-candidate comment on PR #398.']);
-}
-
-async function testManualRunSelectionCreatesComment() {
-  const calls = { create: [], update: [] };
-  const github = {
-    rest: {
-      actions: {
-        getWorkflowRun: async ({ run_id: runId }) => {
-          assert.equal(runId, run.id);
-          return { data: run };
-        },
-        listWorkflowRunArtifacts() {},
-      },
-      issues: {
-        listComments() {},
-        createComment: async (args) => calls.create.push(args),
-        updateComment: async (args) => calls.update.push(args),
-      },
-      pulls: { list: async () => ({ data: [] }) },
-    },
-    paginate: async (method) => {
-      if (method === github.rest.actions.listWorkflowRunArtifacts) return [artifact];
-      if (method === github.rest.issues.listComments) return [];
-      throw new Error('Unexpected pagination method');
-    },
-  };
-  await reportReviewBundle({
-    github,
-    context: {
-      repo: { owner: 'Codename-11', repo: 'hermes-relay' },
-      payload: { inputs: { run_id: String(run.id) } },
-    },
-    core: {
-      info() {},
-      warning() {},
-      setFailed: (message) => assert.fail(message),
-    },
-  });
-  assert.equal(calls.update.length, 0);
-  assert.equal(calls.create.length, 1);
-  assert.equal(calls.create[0].issue_number, 398);
-  assert.match(calls.create[0].body, /## Review candidate ready/);
-}
-
-async function testSkippedRunIsIgnored() {
-  let apiCalled = false;
-  const messages = [];
-  const github = {
-    rest: {
-      actions: {
-        listWorkflowRunArtifacts() {},
-      },
-    },
-    paginate: async () => {
-      apiCalled = true;
-      return [];
-    },
-  };
-  await reportReviewBundle({
-    github,
-    context: {
-      repo: { owner: 'Codename-11', repo: 'hermes-relay' },
-      payload: {
-        workflow_run: {
-          ...run,
-          id: 32736508535,
-          conclusion: 'skipped',
-          head_sha: 'a38849ff1680a1993230773a5d602b781367c789',
-        },
-      },
-    },
-    core: {
-      info: (message) => messages.push(message),
-      warning: (message) => messages.push(message),
-      setFailed: (message) => assert.fail(message),
-    },
-  });
-  assert.equal(apiCalled, false);
-  assert.deepEqual(messages, ['Ignoring skipped review-bundle run 32736508535.']);
-}
-
-Promise.all([
-  testExistingCommentIsUpdated(),
-  testManualRunSelectionCreatesComment(),
-  testSkippedRunIsIgnored(),
-])
-  .then(() => console.log('Review-bundle report tests passed.'))
-  .catch((error) => {
-    console.error(error);
-    process.exitCode = 1;
-  });

.github/workflows/android-on-demand.yml

@@ -1,226 +0,0 @@
-name: Android On-Demand
-
-run-name: Android ${{ inputs.preset }} · ${{ inputs.head_sha }}
-
-on:
-  workflow_call:
-    inputs:
-      head_sha:
-        required: true
-        type: string
-      preset:
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: android-on-demand-${{ inputs.head_sha }}-${{ inputs.preset }}
-  cancel-in-progress: false
-
-jobs:
-  validate:
-    name: Validate exact SHA
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Validate input shape
-        shell: bash
-        env:
-          REQUESTED_SHA: ${{ inputs.head_sha }}
-          REQUESTED_PRESET: ${{ inputs.preset }}
-        run: |
-          if [[ ! "$REQUESTED_SHA" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "head_sha must be a full lowercase 40-character commit SHA" >&2
-            exit 2
-          fi
-          case "$REQUESTED_PRESET" in
-            focused|lint|assemble-debug|release-smoke|all-final) ;;
-            *)
-              echo "unsupported Android preset: $REQUESTED_PRESET" >&2
-              exit 2
-              ;;
-          esac
-
-      - name: Checkout exact commit
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ inputs.head_sha }}
-          fetch-depth: 1
-
-      - name: Confirm checkout identity
-        shell: bash
-        env:
-          REQUESTED_SHA: ${{ inputs.head_sha }}
-        run: test "$(git rev-parse HEAD)" = "$REQUESTED_SHA"
-
-  focused:
-    name: Focused Android checks
-    needs: validate
-    if: ${{ inputs.preset == 'focused' || inputs.preset == 'all-final' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ inputs.head_sha }}
-
-      - uses: actions/setup-java@v6
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: true
-
-      - name: Run repository checks and focused sideload tests
-        run: python3 scripts/android-prepush.py --skip-lint
-
-      - name: Run the same focused tests for Google Play
-        shell: bash
-        run: |
-          mapfile -t focused_tests < <(python3 -c \
-            "import runpy; print(*runpy.run_path('scripts/android-prepush.py')['FOCUSED_TESTS'], sep='\n')")
-          test_args=()
-          for test_name in "${focused_tests[@]}"; do
-            test_args+=(--tests "$test_name")
-          done
-          ./gradlew :app:testGooglePlayDebugUnitTest "${test_args[@]}" --console=plain
-
-      - name: Upload failed test reports
-        uses: actions/upload-artifact@v7
-        if: failure()
-        with:
-          name: focused-test-reports-${{ inputs.head_sha }}
-          path: app/build/reports/tests/
-          if-no-files-found: ignore
-          retention-days: 7
-
-  lint:
-    name: Android lint
-    needs: validate
-    if: ${{ inputs.preset == 'lint' || inputs.preset == 'all-final' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ inputs.head_sha }}
-
-      - uses: actions/setup-java@v6
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: true
-
-      - name: Validate Android repository inputs
-        run: |
-          python3 scripts/check-android-locales.py
-          python3 scripts/check-user-docs-locales.py
-          python3 scripts/check-android-collection-apis.py
-          python3 scripts/check-android-release-notes.py
-          python3 scripts/check-version-tracks.py
-          if [[ -f scripts/tests/android_prepush_test.py ]]; then
-            python3 -m unittest scripts.tests.android_prepush_test
-          fi
-          python3 -m unittest scripts.tests.check_android_release_notes_test
-          python3 -m unittest scripts.tests.check_android_native_compat_test
-
-      - name: Run Android lint
-        run: ./gradlew lint --console=plain
-
-      - name: Upload lint reports
-        uses: actions/upload-artifact@v7
-        if: always()
-        with:
-          name: lint-reports-${{ inputs.head_sha }}
-          path: app/build/reports/lint-results*
-          if-no-files-found: ignore
-          retention-days: 7
-
-  assemble-debug:
-    name: Assemble both debug flavors
-    needs: validate
-    if: ${{ inputs.preset == 'assemble-debug' || inputs.preset == 'all-final' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ inputs.head_sha }}
-
-      - uses: actions/setup-java@v6
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: true
-
-      - name: Build debug APKs
-        run: ./gradlew assembleDebug --console=plain
-
-      - name: Verify packaged native compatibility
-        run: |
-          python3 scripts/check-android-native-compat.py \
-            app/build/outputs/apk/googlePlay/debug/*.apk \
-            app/build/outputs/apk/sideload/debug/*.apk
-
-      - name: Upload debug APKs
-        uses: actions/upload-artifact@v7
-        with:
-          name: debug-apks-${{ inputs.head_sha }}
-          path: app/build/outputs/apk/*/debug/*.apk
-          if-no-files-found: error
-          retention-days: 7
-
-  release-smoke:
-    name: Release build smoke
-    needs: validate
-    if: ${{ inputs.preset == 'release-smoke' || inputs.preset == 'all-final' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ inputs.head_sha }}
-
-      - uses: actions/setup-java@v6
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: true
-
-      - name: Build release bundles and APKs
-        run: ./gradlew bundleRelease assembleRelease --console=plain
-
-      - name: Scan release DEX for unsupported collection APIs
-        run: |
-          python3 scripts/check-android-collection-apis.py \
-            --apk app/build/outputs/apk/googlePlay/release/*.apk \
-            --apk app/build/outputs/apk/sideload/release/*.apk
-
-      - name: Verify packaged native compatibility
-        run: |
-          python3 scripts/check-android-native-compat.py \
-            app/build/outputs/apk/googlePlay/release/*.apk \
-            app/build/outputs/apk/sideload/release/*.apk
-
-      - name: Upload release smoke artifacts
-        uses: actions/upload-artifact@v7
-        with:
-          name: release-smoke-${{ inputs.head_sha }}
-          path: |
-            app/build/outputs/apk/*/release/*.apk
-            app/build/outputs/bundle/**/*.aab
-          if-no-files-found: error
-          retention-days: 7

.github/workflows/approve-release-android.yml

@@ -1,112 +0,0 @@
-# Hermes-Relay Android — explicit public release approval
-#
-# Run from main only after the automated Play preflight passes and the release
-# PR has merged. Starting this workflow is the release approval. Creating the
-# stable tag triggers Play submission first, then GitHub publication.
-
-name: Hermes-Relay Android Release Approval
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Approved Android version (for example 1.4.3)"
-        required: true
-        type: string
-
-permissions:
-  contents: write
-  actions: write
-
-concurrency:
-  group: approve-android-release
-  cancel-in-progress: false
-
-jobs:
-  approve:
-    name: Verify preflight and create release tag
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Validate approval request
-        id: metadata
-        env:
-          REQUESTED_VERSION: ${{ inputs.version }}
-        run: |
-          if [ "$GITHUB_REF" != "refs/heads/main" ]; then
-            echo "::error::Hermes-Relay Android Release Approval must run from main, not $GITHUB_REF"
-            exit 1
-          fi
-          if [[ ! "$REQUESTED_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Android public approval accepts stable SemVer only: $REQUESTED_VERSION"
-            exit 1
-          fi
-          TOML_VERSION=$(grep -oP 'appVersionName\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
-          if [ "$REQUESTED_VERSION" != "$TOML_VERSION" ]; then
-            echo "::error::Requested version $REQUESTED_VERSION does not match appVersionName $TOML_VERSION"
-            exit 1
-          fi
-
-          echo "version=$TOML_VERSION" >> "$GITHUB_OUTPUT"
-          echo "tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
-
-      - name: Verify this exact release tree passed Play preflight
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ steps.metadata.outputs.version }}
-          RELEASE_TREE: ${{ steps.metadata.outputs.tree }}
-        run: |
-          ARTIFACT_NAME="play-preflight-${VERSION}-${RELEASE_TREE}"
-          ARTIFACT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
-            --jq '[.artifacts[] | select(.expired == false)] | sort_by(.created_at) | last')
-          RUN_ID=$(jq -r '.workflow_run.id // empty' <<<"$ARTIFACT")
-          if [ -z "$RUN_ID" ]; then
-            echo "::error::No successful Play preflight found for version $VERSION with tree $RELEASE_TREE"
-            exit 1
-          fi
-          RUN=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}")
-          CONCLUSION=$(jq -r '.conclusion' <<<"$RUN")
-          WORKFLOW_PATH=$(jq -r '.path' <<<"$RUN")
-          if [ "$WORKFLOW_PATH" != ".github/workflows/play-preflight-android.yml" ] || [ "$CONCLUSION" != "success" ]; then
-            echo "::error::Preflight artifact came from ${WORKFLOW_PATH} with conclusion ${CONCLUSION}"
-            exit 1
-          fi
-          echo "Verified immutable Play preflight artifacts: $ARTIFACT_NAME (run $RUN_ID)"
-
-      - name: Ensure release tag does not already exist
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ steps.metadata.outputs.version }}
-        run: |
-          if gh api "/repos/${GITHUB_REPOSITORY}/git/ref/tags/android-v${VERSION}" >/dev/null 2>&1; then
-            echo "::error::Tag android-v${VERSION} already exists"
-            exit 1
-          fi
-
-      - name: Create approved Android release tag
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ steps.metadata.outputs.version }}
-        run: |
-          gh api --method POST "/repos/${GITHUB_REPOSITORY}/git/refs" \
-            -f ref="refs/tags/android-v${VERSION}" \
-            -f sha="$GITHUB_SHA"
-
-      - name: Start the tag release workflow
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ steps.metadata.outputs.version }}
-        run: |
-          gh workflow run release-android.yml \
-            --ref=main \
-            -f version="$VERSION"
-
-      - name: Approval summary
-        run: |
-          echo "## Android release approved" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Created \`android-v${{ steps.metadata.outputs.version }}\` from main at \`$GITHUB_SHA\`." >> "$GITHUB_STEP_SUMMARY"
-          echo "The current release workflow was dispatched from main and will check out that immutable tag. It will submit the preflighted Play draft before creating the public GitHub Release." >> "$GITHUB_STEP_SUMMARY"

.github/workflows/approve-release-extensions.yml

@@ -1,158 +0,0 @@
-name: Hermes-Relay Plugin and CLI+UI Release Approval
-
-on:
-  workflow_dispatch:
-    inputs:
-      surface:
-        description: "Release surface"
-        required: true
-        type: choice
-        options:
-          - plugin
-          - desktop
-      version:
-        description: "Approved version (for example 1.11.2 or 0.4.0-beta.7)"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: approve-${{ inputs.surface }}-release
-  cancel-in-progress: false
-
-jobs:
-  validate:
-    name: Validate release source and metadata
-    runs-on: ubuntu-latest
-    outputs:
-      source_branch: ${{ steps.metadata.outputs.source_branch }}
-      source_sha: ${{ steps.metadata.outputs.source_sha }}
-      tag: ${{ steps.metadata.outputs.tag }}
-      workflow: ${{ steps.metadata.outputs.workflow }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          ref: ${{ contains(inputs.version, '-') && 'dev' || 'main' }}
-
-      - name: Validate approval request
-        id: metadata
-        env:
-          REQUESTED_SURFACE: ${{ inputs.surface }}
-          REQUESTED_VERSION: ${{ inputs.version }}
-        run: |
-          set -euo pipefail
-          if [[ ! "$REQUESTED_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
-            echo "::error::Version must be SemVer with an optional prerelease suffix: $REQUESTED_VERSION"
-            exit 1
-          fi
-
-          if [[ "$REQUESTED_VERSION" == *-* ]]; then
-            source_branch="dev"
-          else
-            source_branch="main"
-          fi
-          if [ "$GITHUB_REF" != "refs/heads/main" ]; then
-            echo "::error::Release approval must run from the trusted main workflow definition, not $GITHUB_REF"
-            exit 1
-          fi
-          git fetch origin "$source_branch" --no-tags
-          source_sha="$(git rev-parse HEAD)"
-          expected_sha="$(git rev-parse FETCH_HEAD)"
-          if [ "$source_sha" != "$expected_sha" ]; then
-            echo "::error::Checked out $source_sha, but origin/$source_branch is $expected_sha"
-            exit 1
-          fi
-
-          case "$REQUESTED_SURFACE" in
-            plugin)
-              tag="server-v${REQUESTED_VERSION}"
-              workflow="release-plugin.yml"
-              python3 scripts/check-plugin-version-sync.py --expect "$REQUESTED_VERSION"
-              if ! grep -Eq "^## \[Plugin ${REQUESTED_VERSION}\]" CHANGELOG.md; then
-                echo "::error::CHANGELOG.md has no Plugin release heading for $REQUESTED_VERSION"
-                exit 1
-              fi
-              ;;
-            desktop)
-              tag="desktop-v${REQUESTED_VERSION}"
-              workflow="release-cli.yml"
-              node desktop/scripts/cli-version-sync.mjs --expect "$REQUESTED_VERSION"
-              if ! grep -Fq "## [$REQUESTED_VERSION]" CHANGELOG.md; then
-                echo "::error::CHANGELOG.md has no CLI+UI release heading for $REQUESTED_VERSION"
-                exit 1
-              fi
-              ;;
-            *)
-              echo "::error::Unsupported release surface: $REQUESTED_SURFACE"
-              exit 1
-              ;;
-          esac
-
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "workflow=$workflow" >> "$GITHUB_OUTPUT"
-          echo "source_branch=$source_branch" >> "$GITHUB_OUTPUT"
-          echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
-
-  approve:
-    name: Create release tag and start publication
-    needs: validate
-    permissions:
-      actions: write
-      contents: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Verify release source has not moved
-        env:
-          GH_TOKEN: ${{ github.token }}
-          SOURCE_BRANCH: ${{ needs.validate.outputs.source_branch }}
-          SOURCE_SHA: ${{ needs.validate.outputs.source_sha }}
-        run: |
-          current_sha=$(gh api "/repos/${GITHUB_REPOSITORY}/git/ref/heads/${SOURCE_BRANCH}" --jq .object.sha)
-          if [ "$current_sha" != "$SOURCE_SHA" ]; then
-            echo "::error::$SOURCE_BRANCH moved from $SOURCE_SHA to $current_sha; run approval again"
-            exit 1
-          fi
-
-      - name: Ensure release tag does not already exist
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ needs.validate.outputs.tag }}
-        run: |
-          if gh api "/repos/${GITHUB_REPOSITORY}/git/ref/tags/${RELEASE_TAG}" >/dev/null 2>&1; then
-            echo "::error::Tag $RELEASE_TAG already exists"
-            exit 1
-          fi
-
-      - name: Create approved release tag
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ needs.validate.outputs.tag }}
-          RELEASE_SHA: ${{ needs.validate.outputs.source_sha }}
-        run: |
-          gh api --method POST "/repos/${GITHUB_REPOSITORY}/git/refs" \
-            -f ref="refs/tags/${RELEASE_TAG}" \
-            -f sha="$RELEASE_SHA"
-
-      - name: Start the immutable tag release workflow
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_WORKFLOW: ${{ needs.validate.outputs.workflow }}
-          RELEASE_VERSION: ${{ inputs.version }}
-        run: |
-          # A tag created by GITHUB_TOKEN does not recursively start workflows.
-          # Dispatch the trusted definition from main; release jobs check out
-          # and validate the immutable tag created above.
-          gh workflow run "$RELEASE_WORKFLOW" \
-            --repo "$GITHUB_REPOSITORY" \
-            --ref main \
-            -f version="$RELEASE_VERSION"
-
-      - name: Approval summary
-        run: |
-          echo "## Release approved" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Created \`${{ needs.validate.outputs.tag }}\` from \`${{ needs.validate.outputs.source_branch }}\` at \`${{ needs.validate.outputs.source_sha }}\`." >> "$GITHUB_STEP_SUMMARY"
-          echo "Dispatched \`${{ needs.validate.outputs.workflow }}\` to validate and publish that immutable tag." >> "$GITHUB_STEP_SUMMARY"

.github/workflows/approve-release-train.yml

@@ -1,120 +0,0 @@
-name: Hermes-Relay Coordinated Release Approval
-
-on:
-  workflow_dispatch:
-    inputs:
-      android:
-        description: "Approve Hermes-Relay Android"
-        required: true
-        default: false
-        type: boolean
-      android_version:
-        description: "Android version when selected"
-        required: false
-        type: string
-      plugin:
-        description: "Approve Hermes-Relay Plugin"
-        required: true
-        default: false
-        type: boolean
-      plugin_version:
-        description: "Plugin version when selected"
-        required: false
-        type: string
-      desktop:
-        description: "Approve Hermes-Relay CLI+UI"
-        required: true
-        default: false
-        type: boolean
-      desktop_version:
-        description: "CLI+UI version when selected"
-        required: false
-        type: string
-
-permissions:
-  actions: write
-  contents: read
-
-concurrency:
-  group: approve-coordinated-release
-  cancel-in-progress: false
-
-jobs:
-  validate:
-    name: Validate selected release surfaces
-    runs-on: ubuntu-latest
-    steps:
-      - name: Require versions for every selected surface
-        env:
-          ANDROID: ${{ inputs.android }}
-          ANDROID_VERSION: ${{ inputs.android_version }}
-          PLUGIN: ${{ inputs.plugin }}
-          PLUGIN_VERSION: ${{ inputs.plugin_version }}
-          DESKTOP: ${{ inputs.desktop }}
-          DESKTOP_VERSION: ${{ inputs.desktop_version }}
-        run: |
-          set -euo pipefail
-          if [ "$ANDROID" != "true" ] && [ "$PLUGIN" != "true" ] && [ "$DESKTOP" != "true" ]; then
-            echo "::error::Select at least one release surface"
-            exit 1
-          fi
-          for pair in \
-            "$ANDROID:$ANDROID_VERSION:Android" \
-            "$PLUGIN:$PLUGIN_VERSION:Plugin" \
-            "$DESKTOP:$DESKTOP_VERSION:CLI+UI"; do
-            IFS=: read -r selected version label <<<"$pair"
-            if [ "$selected" = "true" ] && [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
-              echo "::error::$label requires a valid SemVer version"
-              exit 1
-            fi
-          done
-          if [ "$ANDROID" = "true" ] && [[ "$ANDROID_VERSION" == *-* ]]; then
-            echo "::error::Coordinated Android approval is stable-only; use a dev candidate tag for prereleases"
-            exit 1
-          fi
-
-  android:
-    name: Approve Hermes-Relay Android
-    needs: validate
-    if: inputs.android
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dispatch Android approval
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ inputs.android_version }}
-        run: gh workflow run approve-release-android.yml --repo "$GITHUB_REPOSITORY" --ref main -f version="$VERSION"
-
-  plugin:
-    name: Approve Hermes-Relay Plugin
-    needs: validate
-    if: inputs.plugin
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dispatch Plugin approval
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ inputs.plugin_version }}
-        run: |
-          gh workflow run approve-release-extensions.yml \
-            --repo "$GITHUB_REPOSITORY" \
-            --ref main \
-            -f surface=plugin \
-            -f version="$VERSION"
-
-  desktop:
-    name: Approve Hermes-Relay CLI+UI
-    needs: validate
-    if: inputs.desktop
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dispatch CLI+UI approval
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ inputs.desktop_version }}
-        run: |
-          gh workflow run approve-release-extensions.yml \
-            --repo "$GITHUB_REPOSITORY" \
-            --ref main \
-            -f surface=desktop \
-            -f version="$VERSION"

.github/workflows/ci-android.yml

@@ -1,21 +1,13 @@
 # Hermes-Relay — Android CI Pipeline
 #
-# Runs directly on Android-affecting pushes to main/dev and is called by the
-# path-aware required-check workflow for relevant pull requests.
+# Runs on pushes to main/dev and on PRs targeting main/dev, scoped to
+# Android-affecting paths so Python-only changes don't spin up the JVM.
 #
-# Pipeline: lint, build, and focused tests run concurrently. PRs build debug
-# APKs before merge; dev pushes keep lint/tests only to avoid duplicate
-# post-merge packaging. Main pushes keep APK artifacts.
-#
-# A release-build smoke (bundleRelease assembleRelease) runs on dev/main pushes
-# and on the dev→main release PR so release-only breakage (R8/minify rules,
-# resource shrinking, bundletool OOM) is caught BEFORE the android-v* tag,
-# instead of mid-release. It is debug-signed, so it needs no signing secrets.
+# Pipeline: lint -> build + test (parallel) -> upload artifacts
 
 name: CI — Android
 
 on:
-  workflow_call:
   push:
     branches: [main, dev]
     paths:
@@ -26,106 +18,80 @@ on:
       - "gradle.properties"
       - "gradlew"
       - "gradlew.bat"
-      - "scripts/android-lane.ps1"
-      - "scripts/android-prepush.py"
-      - "scripts/dev.bat"
-      - "scripts/dev.sh"
-      - "scripts/tests/android_prepush_test.py"
-      - "scripts/check-android-locales.py"
-      - "scripts/android-locale-harness.py"
-      - "scripts/check-android-collection-apis.py"
-      - "scripts/check-android-native-compat.py"
-      - "scripts/check-android-release-notes.py"
-      - "scripts/tests/check_android_native_compat_test.py"
-      - "scripts/tests/check_android_release_notes_test.py"
       - ".github/workflows/ci-android.yml"
-      - ".github/workflows/android-on-demand.yml"
-      - ".github/workflows/play-preflight-android.yml"
-      - ".github/workflows/approve-release-android.yml"
-      - ".github/workflows/release-android.yml"
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - "app/**"
+      - "gradle/**"
+      - "build.gradle.kts"
+      - "settings.gradle.kts"
+      - "gradle.properties"
+      - "gradlew"
+      - "gradlew.bat"
+      - ".github/workflows/ci-android.yml"
 
-# Cancel superseded PR and dev runs. Never cancel main: every release-branch
-# commit must finish its independent validation.
+# Cancel in-progress runs for the same branch/PR, but let main and dev finish
 concurrency:
   group: ci-android-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
 
 jobs:
   # ──────────────────────────────────────────────
-  # Android Lint
+  # Android Lint — gate for build and test jobs
   # ──────────────────────────────────────────────
   lint:
     name: Lint (Android)
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v6
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+        uses: gradle/actions/setup-gradle@v6
 
-      - name: Validate translation catalogs
-        run: python3 scripts/check-android-locales.py
-
-      - name: Reject unsafe Android collection APIs
-        run: python3 scripts/check-android-collection-apis.py
-
-      - name: Validate Android release notes
+      # Prefer ktlintCheck if configured; fall back to Android lint
+      - name: Run lint checks
         run: |
-          python3 scripts/check-android-release-notes.py
-          python3 -m unittest scripts.tests.android_prepush_test
-          python3 -m unittest scripts.tests.check_android_release_notes_test
-
-      - name: Test Android native compatibility checker
-        run: python3 -m unittest scripts.tests.check_android_native_compat_test
-
-      - name: Run Android lint
-        run: ./gradlew lint --console=plain
+          if ./gradlew tasks --all 2>/dev/null | grep -q "ktlintCheck"; then
+            echo "Running ktlintCheck..."
+            ./gradlew ktlintCheck
+          else
+            echo "ktlintCheck not found, falling back to Android lint..."
+            ./gradlew lint
+          fi
 
   # ──────────────────────────────────────────────
-  # Android Build — assembleDebug for PRs and main pushes
+  # Android Build — assembleDebug + upload APK
   # ──────────────────────────────────────────────
   build:
     name: Build (Android)
-    if: ${{ github.event_name == 'pull_request' || github.ref == 'refs/heads/main' }}
+    needs: lint
     runs-on: ubuntu-latest
-    timeout-minutes: 25
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v6
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Build debug APK
-        run: ./gradlew assembleDebug --console=plain
-
-      - name: Verify packaged ONNX Runtime compatibility
-        run: |
-          python3 scripts/check-android-native-compat.py \
-            app/build/outputs/apk/googlePlay/debug/*.apk \
-            app/build/outputs/apk/sideload/debug/*.apk
+        run: ./gradlew assembleDebug
 
       - name: Upload debug APK
         uses: actions/upload-artifact@v7
-        if: ${{ github.ref == 'refs/heads/main' }}
         with:
           name: debug-apk
           # Product flavors (googlePlay, sideload) nest APKs under
@@ -143,6 +109,7 @@ jobs:
   # ──────────────────────────────────────────────
   test:
     name: Test (Android)
+    needs: lint
     runs-on: ubuntu-latest
     timeout-minutes: 20
     # Advisory on dev, strict on main. Evaluates to false (= strict) for
@@ -151,97 +118,33 @@ jobs:
     continue-on-error: ${{ github.ref != 'refs/heads/main' && github.base_ref != 'main' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v6
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+        uses: gradle/actions/setup-gradle@v6
 
       # The broad Gradle `test` aggregate currently hangs in deferred JVM test
       # suites tracked by issue #32. Keep CI release-relevant until that suite is
-      # split: run the stable connection slice plus focused Chat/Voice state,
-      # parser, layout, and accessibility regressions for the active release.
+      # split: pairing URL derivation plus connection switching are the stable
+      # Android regression slice for the active release work.
       - name: Run focused Android unit tests
         run: |
           ./gradlew :app:testSideloadDebugUnitTest \
-            --tests com.hermesandroid.relay.network.ArchitectureBoundaryTest \
-            --tests com.hermesandroid.relay.network.relay.RelayUrlDeriverTest \
+            --tests com.hermesandroid.relay.network.RelayUrlDeriverTest \
             --tests com.hermesandroid.relay.viewmodel.ConnectionSwitchTest \
-            --tests com.hermesandroid.relay.util.ServerAddressTest \
-            --tests com.hermesandroid.relay.util.IssueReportAndDiagnosticsTest \
-            --tests com.hermesandroid.relay.data.AppLanguageTest \
-            --tests com.hermesandroid.relay.viewmodel.ChatStreamRecoveryTest \
-            --tests com.hermesandroid.relay.viewmodel.ChatViewModelRealtimeTurnTest \
-            --tests com.hermesandroid.relay.network.relay.RealtimeVoiceEventParsingTest \
-            --tests com.hermesandroid.relay.voice.VoiceCommandInterpreterTest \
-            --tests com.hermesandroid.relay.data.VoiceModePresetTest \
-            --tests com.hermesandroid.relay.ui.components.BackgroundTaskCardTest \
-            --tests com.hermesandroid.relay.ui.components.DotMatrixIndicatorTest \
-            --tests com.hermesandroid.relay.ui.components.AttachmentGalleryLayoutTest \
-            --tests com.hermesandroid.relay.ui.components.MarkdownStreamingParserTest \
-            --tests com.hermesandroid.relay.ui.screens.ChatUnreadStateTest \
             --console=plain
 
-      # Upload reports only for failures. Successful PR report uploads add
-      # noticeable latency and are rarely inspected.
+      # Upload test reports even if tests fail, for debugging
       - name: Upload test reports
         uses: actions/upload-artifact@v7
-        if: failure()
+        if: always()
         with:
           name: test-reports
           path: app/build/reports/tests/
           retention-days: 7
-
-  # ──────────────────────────────────────────────
-  # Release build smoke — exercises the release variant the android-v* tag
-  # build runs (./gradlew bundleRelease assembleRelease, both flavors), so
-  # release-only breakage (R8/minify, resource shrinking, bundletool OOM) is
-  # caught BEFORE the tag instead of mid-release. Debug-signed — no secrets,
-  # so it also runs on fork PRs. Runs on dev/main pushes (early signal after
-  # each merge) and on the dev→main release PR (hard pre-tag gate); skipped on
-  # dev-targeted feature PRs to avoid re-running a ~12-min build per iteration.
-  # ──────────────────────────────────────────────
-  release-smoke:
-    name: Release build smoke (Android)
-    if: ${{ github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.base_ref == 'main') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v6
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
-
-      # Mirrors release-android.yml's build step. No keystore is provided here,
-      # so app/build.gradle.kts falls back to debug signing — fine for a build
-      # smoke; the goal is to exercise the build, not to produce a shippable AAB.
-      - name: Build release bundles + APKs (both flavors, debug-signed)
-        run: ./gradlew bundleRelease assembleRelease --console=plain
-
-      - name: Scan release DEX for unsupported collection APIs
-        run: |
-          python3 scripts/check-android-collection-apis.py \
-            --apk app/build/outputs/apk/googlePlay/release/*.apk \
-            --apk app/build/outputs/apk/sideload/release/*.apk
-
-      - name: Verify packaged ONNX Runtime compatibility
-        run: |
-          python3 scripts/check-android-native-compat.py \
-            app/build/outputs/apk/googlePlay/release/*.apk \
-            app/build/outputs/apk/sideload/release/*.apk

.github/workflows/ci-contract.yml

@@ -1,106 +0,0 @@
-# Hermes-Relay — Vanilla-Upstream Route Contract (ADR 34)
-#
-# Proves the Android *standard path* (no-plugin) route surface exists on
-# UNMODIFIED NousResearch/hermes-agent — the invariant CLAUDE.md asserts but
-# that was never tested. Source-parses upstream's declared routes (no server
-# boot, no pip install, no model keys); see scripts/check-upstream-route-contract.py
-# for the design + tradeoff (catches renamed/removed routes; not runtime auth).
-#
-# Required-PR and direct push runs check a pinned ref (non-flaky); the weekly
-# schedule tracks upstream `main` as a drift siren.
-
-name: CI — Upstream Contract
-
-permissions:
-  contents: read
-
-on:
-  workflow_call:
-  push:
-    branches: [main, dev]
-    paths:
-      - "scripts/check-upstream-route-contract.py"
-      - ".github/workflows/ci-contract.yml"
-      - "app/src/main/kotlin/com/hermesandroid/relay/network/upstream/**"
-  schedule:
-    - cron: "0 6 * * 1" # Mondays 06:00 UTC — upstream-drift siren (tracks main)
-  workflow_dispatch:
-    inputs:
-      upstream_ref:
-        description: "NousResearch/hermes-agent ref to check (branch, tag, or SHA)"
-        required: false
-        default: ""
-
-concurrency:
-  group: ci-contract-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
-
-jobs:
-  route-contract:
-    name: Vanilla-upstream route contract
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout hermes-relay
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - name: Resolve upstream ref
-        id: ref
-        env:
-          REQUESTED_REF: ${{ github.event.inputs.upstream_ref }}
-        run: |
-          set -euo pipefail
-          # PR/push runs use a known-good NousResearch/hermes-agent commit so
-          # normal CI is stable. The weekly schedule below intentionally tracks
-          # main as the upstream-drift siren.
-          DEFAULT_REF="ef4b897a1843cd32c4f141f55db60f0f0602cc98"
-          if [ "${{ github.event_name }}" = "schedule" ]; then
-            REF="main"                                   # weekly drift siren
-          elif [ -n "$REQUESTED_REF" ]; then
-            REF="$REQUESTED_REF"                          # manual override
-          else
-            REF="$DEFAULT_REF"
-          fi
-
-          # The ref is passed to git below, so reject option-like or malformed
-          # values before it reaches that boundary. Full commit IDs and normal
-          # branch/tag names remain supported for manual contract checks.
-          if [[ "$REF" == -* ]] ||
-             ! git check-ref-format --allow-onelevel "$REF" >/dev/null; then
-            echo "FAIL: invalid upstream branch or tag name." >&2
-            exit 1
-          fi
-
-          echo "ref=$REF" >> "$GITHUB_OUTPUT"
-          echo "Checking standard-path route contract against upstream ref: $REF"
-
-      - name: Extract trusted upstream contract sources
-        env:
-          UPSTREAM_REF: ${{ steps.ref.outputs.ref }}
-        run: |
-          set -euo pipefail
-          UPSTREAM_GIT="$RUNNER_TEMP/hermes-agent-contract.git"
-          git init --bare "$UPSTREAM_GIT"
-          git -C "$UPSTREAM_GIT" remote add origin \
-            "https://github.com/NousResearch/hermes-agent.git"
-          git -C "$UPSTREAM_GIT" fetch --no-tags --depth=1 origin -- "$UPSTREAM_REF"
-          UPSTREAM_COMMIT="$(git -C "$UPSTREAM_GIT" rev-parse 'FETCH_HEAD^{commit}')"
-
-          mkdir -p _upstream/gateway/platforms _upstream/hermes_cli
-          git -C "$UPSTREAM_GIT" show \
-            "$UPSTREAM_COMMIT:gateway/platforms/api_server.py" \
-            > _upstream/gateway/platforms/api_server.py
-          git -C "$UPSTREAM_GIT" show \
-            "$UPSTREAM_COMMIT:hermes_cli/web_server.py" \
-            > _upstream/hermes_cli/web_server.py
-          echo "Extracted contract sources from upstream commit: $UPSTREAM_COMMIT"
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v7
-        with:
-          python-version: "3.11"
-
-      - name: Run route-surface contract
-        run: python scripts/check-upstream-route-contract.py "_upstream"

.github/workflows/ci-dashboard.yml

@@ -1,11 +1,17 @@
 name: CI dashboard plugin
 
 on:
-  workflow_call:
   push:
     branches: [main, dev]
     paths:
       - "plugin/dashboard/**"
+      - "scripts/check-server-version-sync.py"
+      - ".github/workflows/ci-dashboard.yml"
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - "plugin/dashboard/**"
+      - "scripts/check-server-version-sync.py"
       - ".github/workflows/ci-dashboard.yml"
 
 permissions:
@@ -21,10 +27,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: npm
@@ -38,31 +44,19 @@ jobs:
         working-directory: plugin/dashboard
         run: npm run build
 
-      - name: Test dashboard source
-        working-directory: plugin/dashboard
-        run: npm test
-
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 
-      - name: Verify plugin-owned version metadata
-        run: python scripts/check-plugin-version-sync.py
+      - name: Verify server-owned version metadata
+        run: python scripts/check-server-version-sync.py
 
       - name: Install dashboard API test deps
-        # The suite imports the `plugin` package transitively: __init__ loads
-        # android_tool/desktop_tool (`import requests`), and one test imports
-        # `plugin.relay`, whose server.py needs `aiohttp` (+ pyyaml) from
-        # relay_server/requirements.txt. fastapi+httpx cover plugin_api itself.
-        run: pip install -r relay_server/requirements.txt fastapi httpx requests
+        run: pip install -r relay_server/requirements.txt fastapi httpx pytest requests
 
       - name: Run dashboard API tests
-        run: >-
-          python -m unittest
-          plugin.dashboard.test_plugin_api
-          plugin.dashboard.test_git_api
-          plugin.dashboard.test_mobile_plugin_api
+        run: python -m unittest plugin.dashboard.test_plugin_api
 
       - name: Verify dashboard bundle outputs
         run: |

.github/workflows/ci-desktop-upstream-baseline.yml

@@ -1,79 +0,0 @@
-# Hermes-Relay - Desktop Vanilla-Upstream Baseline
-#
-# Manual/scheduled confidence gate for HRUI-055. This keeps the first CI shape
-# intentionally small: check out a clean upstream hermes-agent beside Relay and
-# run the desktop typed-stream/renderer tests that protect the gateway event
-# contract. A later expansion can boot the upstream gateway with a mock provider
-# once that harness is stable enough for CI.
-
-name: CI - Desktop Upstream Baseline
-
-on:
-  workflow_dispatch:
-    inputs:
-      upstream_ref:
-        description: "NousResearch/hermes-agent ref to check"
-        required: false
-        default: "main"
-  schedule:
-    - cron: "30 6 * * 1"
-
-concurrency:
-  group: ci-desktop-upstream-baseline-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  desktop-baseline:
-    name: Desktop typed gateway baseline
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Checkout hermes-relay
-        uses: actions/checkout@v7
-
-      - name: Resolve upstream ref
-        id: ref
-        run: |
-          if [ -n "${{ github.event.inputs.upstream_ref }}" ]; then
-            REF="${{ github.event.inputs.upstream_ref }}"
-          else
-            REF="main"
-          fi
-          echo "ref=$REF" >> "$GITHUB_OUTPUT"
-
-      - name: Checkout vanilla upstream
-        uses: actions/checkout@v7
-        with:
-          repository: NousResearch/hermes-agent
-          ref: ${{ steps.ref.outputs.ref }}
-          path: _upstream
-          fetch-depth: 1
-
-      - name: Assert upstream checkout is vanilla
-        run: |
-          if [ -e "_upstream/hermes_relay_bootstrap" ] || \
-             [ -e "_upstream/plugin/hermes_relay_bootstrap" ] || \
-             find _upstream -name "hermes_relay_bootstrap.pth" 2>/dev/null | grep -q .; then
-            echo "FAIL: upstream checkout contains a relay bootstrap."; exit 1
-          fi
-          git -C _upstream status --short --untracked-files=no
-
-      - name: Run desktop gateway baseline contract
-        run: python scripts/check-desktop-upstream-baseline.py "_upstream"
-
-      - name: Set up Node
-        uses: actions/setup-node@v7
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: desktop/package-lock.json
-
-      - name: Install desktop dependencies
-        working-directory: desktop
-        run: npm ci
-
-      - name: Run desktop gateway baseline tests
-        working-directory: desktop
-        env:
-          HERMES_UPSTREAM_BASELINE: ${{ github.workspace }}/_upstream
-        run: npx tsx --test tests/gatewayTypes.test.ts tests/renderer.test.ts tests/typedStreamRenderer.test.ts

.github/workflows/ci-desktop.yml

@@ -1,20 +1,19 @@
 name: CI desktop
 
 on:
-  workflow_call:
   push:
     branches: [main, dev]
     paths:
       - 'desktop/**'
       - '.github/workflows/ci-desktop.yml'
+  pull_request:
+    paths:
+      - 'desktop/**'
+      - '.github/workflows/ci-desktop.yml'
 
 permissions:
   contents: read
 
-concurrency:
-  group: ci-desktop-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
-
 jobs:
   typecheck-and-build:
     name: Type-check + build
@@ -23,10 +22,10 @@ jobs:
       run:
         working-directory: desktop
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
         with:
           node-version: '22'
           cache: npm
@@ -35,15 +34,9 @@ jobs:
       - name: Install deps
         run: npm ci
 
-      - name: Verify CLI and tray versions are synchronized
-        run: npm run check:version-sync
-
       - name: Type-check
         run: npm run type-check
 
-      - name: Test typed stream rendering
-        run: npm test
-
       - name: Build (tsc → dist/)
         run: npm run build
 
@@ -54,8 +47,16 @@ jobs:
         # prebuilt dist/ that references a source file that moved.
         run: node bin/hermes-relay.js --version
 
+      - name: Upload dist/
+        uses: actions/upload-artifact@v4
+        with:
+          name: desktop-dist
+          path: desktop/dist
+          retention-days: 7
+
   smoke-help:
     name: Smoke — --help + --version work on every target OS
+    needs: typecheck-and-build
     strategy:
       fail-fast: false
       matrix:
@@ -65,10 +66,10 @@ jobs:
       run:
         working-directory: desktop
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
         with:
           node-version: '22'
           cache: npm
@@ -93,40 +94,20 @@ jobs:
       run:
         working-directory: desktop
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
         with:
           node-version: '22'
           cache: npm
-          cache-dependency-path: |
-            desktop/package-lock.json
-            desktop/tray/package-lock.json
+          cache-dependency-path: desktop/package-lock.json
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Restore exact-source tray build cache
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry/index
-            ~/.cargo/registry/cache
-            ~/.cargo/git/db
-            desktop/tray/target
-          key: ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-${{ hashFiles('desktop/tray/Cargo.toml', 'desktop/tray/build.rs', 'desktop/tray/src/**/*.rs') }}
-          restore-keys: |
-            ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-
-
       - name: Install deps
-        run: npm ci && npm --prefix tray ci
-
-      - name: Check tray formatting
-        run: npm run tray:fmt
-
-      - name: Lint tray shell
-        run: npm run tray:lint
+        run: npm ci
 
       - name: Cargo check tray shell
         run: npm run tray:check

.github/workflows/ci-required.yml

@@ -1,331 +1,49 @@
-# Path-aware required CI for pull requests targeting main or dev.
+# Required-checks sentinel — always runs on every PR + push to main/dev so
+# branch protection on `main` has a check name it can rely on, regardless
+# of which paths the PR touches.
 #
-# The change detector selects the existing surface workflows, which are exposed
-# through workflow_call. The final job keeps one stable branch-protection check
-# while ensuring that every relevant build or test actually completed.
+# Why this exists. The other CI workflows (`ci-android.yml`, `ci-server.yml`,
+# `ci-desktop.yml`) are scoped via `paths:` filters so a docs-only or
+# desktop-only PR doesn't spin up the Android toolchain. Branch protection's
+# "required status checks" treat a check that doesn't run as failing — so
+# any PR that didn't touch the protected paths was blocked from merging,
+# even with all the relevant gates green. We were admin-overriding every
+# desktop-only PR. Same for relay-touching PRs (the protection rule named
+# `Relay Check (Python)` didn't even match any actual job — broken since
+# day one).
+#
+# This sentinel + claude-review become the only required checks. The
+# path-filtered workflows still run when relevant and surface their
+# results on the PR — visible, clickable, but advisory rather than
+# blocking. Reviewers (human + claude-review) eyeball them. This is the
+# standard pattern for monorepos with path-filtered CI.
+#
+# Trade-off acknowledged: a broken Android build on an Android-touching
+# PR could merge if the reviewer ignores the failing CI badge. Mitigation:
+# claude-review reads CI conclusions in its review prompt + the project's
+# release-merge cadence catches issues before they reach a tag. If a
+# stricter gate is later wanted, fold it into this workflow as a job that
+# fans out to the path-filtered work — but the simplest version (just an
+# `echo`) is what's needed to make branch protection useful again today.
 
 name: Required checks
 
 on:
+  push:
+    branches: [main, dev]
   pull_request:
     branches: [main, dev]
-    types: [opened, synchronize, reopened, ready_for_review]
-  workflow_dispatch:
-    inputs:
-      base_sha:
-        description: "Exact base commit for a trusted release-backmerge candidate"
-        required: true
-        type: string
-      head_sha:
-        description: "Exact candidate commit to check"
-        required: true
-        type: string
-      android_preset:
-        description: "Optional Android-only compute lane"
-        required: false
-        default: auto
-        type: choice
-        options:
-          - auto
-          - focused
-          - lint
-          - assemble-debug
-          - release-smoke
-          - all-final
-
-permissions:
-  actions: read
-  contents: read
-  pull-requests: read
 
+# Cancel in-progress runs for the same branch/PR. Doesn't matter much for
+# a 5-second job, but matches every other workflow's concurrency shape.
 concurrency:
-  group: ci-required-${{ github.event_name == 'workflow_dispatch' && format('{0}-{1}', inputs.head_sha, inputs.android_preset) || github.ref }}
-  cancel-in-progress: true
+  group: ci-required-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
 
 jobs:
-  changes:
-    name: Detect affected surfaces
-    runs-on: ubuntu-latest
-    outputs:
-      android: ${{ steps.filter.outputs.android }}
-      desktop: ${{ steps.filter.outputs.desktop }}
-      plugin: ${{ steps.filter.outputs.plugin }}
-      dashboard: ${{ steps.filter.outputs.dashboard }}
-      contract: ${{ steps.filter.outputs.contract }}
-      docs: ${{ steps.filter.outputs.docs }}
-      release_pr: ${{ steps.release.outputs.release_pr }}
-      tree: ${{ steps.tree.outputs.tree }}
-    steps:
-      - name: Checkout pull request merge
-        if: github.event_name == 'pull_request'
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 2
-
-      - name: Checkout exact dispatched candidate
-        if: github.event_name == 'workflow_dispatch'
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          ref: ${{ inputs.head_sha }}
-
-      - name: Test path classifier
-        run: node .github/scripts/classify-ci-paths.test.cjs
-
-      - name: Record checked tree
-        id: tree
-        run: echo "tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
-
-      - name: Detect canonical release promotion
-        id: release
-        env:
-          BASE_REF: ${{ github.base_ref }}
-          HEAD_REF: ${{ github.head_ref }}
-          HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
-        run: |
-          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && \
-             [ "$BASE_REF" = "main" ] && \
-             [ "$HEAD_REF" = "dev" ] && \
-             [ "$HEAD_REPOSITORY" = "$GITHUB_REPOSITORY" ]; then
-            echo "release_pr=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "release_pr=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Classify changed files
-        id: filter
-        uses: actions/github-script@v8
-        env:
-          DISPATCH_BASE_SHA: ${{ inputs.base_sha }}
-          DISPATCH_HEAD_SHA: ${{ inputs.head_sha }}
-        with:
-          script: |
-            let diffArgs;
-            if (context.eventName === 'workflow_dispatch') {
-              const base = process.env.DISPATCH_BASE_SHA || '';
-              const head = process.env.DISPATCH_HEAD_SHA || '';
-              const shaPattern = /^[0-9a-f]{40}$/;
-              if (!shaPattern.test(base) || !shaPattern.test(head)) {
-                core.setFailed('Exact-tree dispatch requires full 40-character base/head SHAs.');
-                return;
-              }
-              const { stdout: checkedOut } = await exec.getExecOutput(
-                'git',
-                ['rev-parse', 'HEAD'],
-              );
-              if (checkedOut.trim() !== head) {
-                core.setFailed(`Checked out ${checkedOut.trim()}, expected ${head}.`);
-                return;
-              }
-              const ancestry = await exec.exec(
-                'git',
-                ['merge-base', '--is-ancestor', base, head],
-                { ignoreReturnCode: true },
-              );
-              if (ancestry !== 0) {
-                core.setFailed(`Candidate ${head} does not descend from base ${base}.`);
-                return;
-              }
-              diffArgs = ['diff', '--name-only', base, head];
-            } else {
-              diffArgs = ['diff', '--name-only', 'HEAD^1', 'HEAD^2'];
-            }
-            const { stdout } = await exec.getExecOutput(
-              'git',
-              diffArgs,
-            );
-            const paths = stdout.split(/\r?\n/).filter(Boolean);
-            const { classifyCiPaths } = require(
-              `${process.env.GITHUB_WORKSPACE}/.github/scripts/classify-ci-paths.cjs`,
-            );
-            const outputs = classifyCiPaths(paths);
-
-            for (const [surface, affected] of Object.entries(outputs)) {
-              core.setOutput(surface, affected ? 'true' : 'false');
-            }
-            core.notice(`Changed paths: ${paths.join(', ')}`);
-            core.notice(`Selected checks: ${Object.entries(outputs).filter(([, value]) => value).map(([key]) => key).join(', ') || 'none'}`);
-
-  release-proof:
-    name: Reuse exact-tree required checks
-    needs: changes
-    if: needs.changes.outputs.release_pr == 'true'
-    runs-on: ubuntu-latest
-    outputs:
-      reuse: ${{ steps.proof.outputs.reuse }}
-      artifact_id: ${{ steps.proof.outputs.artifact_id }}
-      run_id: ${{ steps.proof.outputs.run_id }}
-      tree: ${{ steps.proof.outputs.tree }}
-    steps:
-      - name: Checkout simulated release merge
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Locate exact-tree proof
-        id: proof
-        env:
-          GH_TOKEN: ${{ github.token }}
-          DEV_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -euo pipefail
-          merge_tree=$(git rev-parse 'HEAD^{tree}')
-          dev_tree=$(git rev-parse "${DEV_SHA}^{tree}")
-          echo "reuse=false" >> "$GITHUB_OUTPUT"
-          echo "tree=$dev_tree" >> "$GITHUB_OUTPUT"
-          if [ "$merge_tree" != "$dev_tree" ]; then
-            echo "Release merge changes the dev tree ($dev_tree -> $merge_tree); running full CI."
-            exit 0
-          fi
-
-          artifact_name="required-checks-${dev_tree}"
-          artifact=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${artifact_name}" \
-            --jq '[.artifacts[] | select(.expired == false)] | sort_by(.created_at) | last')
-          artifact_id=$(jq -r '.id // empty' <<<"$artifact")
-          run_id=$(jq -r '.workflow_run.id // empty' <<<"$artifact")
-          if [ -z "$artifact_id" ] || [ -z "$run_id" ]; then
-            echo "No reusable proof exists for tree $dev_tree; running full CI."
-            exit 0
-          fi
-
-          run=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/runs/${run_id}")
-          conclusion=$(jq -r '.conclusion' <<<"$run")
-          workflow_path=$(jq -r '.path' <<<"$run")
-          if [ "$workflow_path" != ".github/workflows/ci-required.yml" ] || [ "$conclusion" != "success" ]; then
-            echo "::error::Required-check proof came from ${workflow_path} with conclusion ${conclusion}"
-            exit 1
-          fi
-          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
-          echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
-          echo "reuse=true" >> "$GITHUB_OUTPUT"
-
-      - name: Download exact-tree proof
-        if: steps.proof.outputs.reuse == 'true'
-        uses: actions/download-artifact@v8
-        with:
-          artifact-ids: ${{ steps.proof.outputs.artifact_id }}
-          github-token: ${{ github.token }}
-          repository: ${{ github.repository }}
-          run-id: ${{ steps.proof.outputs.run_id }}
-          path: required-check-proof
-
-      - name: Verify exact-tree proof
-        if: steps.proof.outputs.reuse == 'true'
-        env:
-          EXPECTED_TREE: ${{ steps.proof.outputs.tree }}
-        run: |
-          jq -e \
-            --arg repository "$GITHUB_REPOSITORY" \
-            --arg tree "$EXPECTED_TREE" \
-            '.schemaVersion == 1 and .repository == $repository and .tree == $tree' \
-            required-check-proof/required-checks.json
-
-  android:
-    needs: [changes, release-proof]
-    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.android == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
-    uses: ./.github/workflows/ci-android.yml
-
-  android_on_demand:
-    needs: [changes, release-proof]
-    if: ${{ always() && needs.changes.result == 'success' && needs.release-proof.outputs.reuse != 'true' && github.event_name == 'workflow_dispatch' && inputs.android_preset != 'auto' }}
-    uses: ./.github/workflows/android-on-demand.yml
-    with:
-      head_sha: ${{ inputs.head_sha }}
-      preset: ${{ inputs.android_preset }}
-
-  desktop:
-    needs: [changes, release-proof]
-    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.desktop == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
-    uses: ./.github/workflows/ci-desktop.yml
-
-  plugin:
-    needs: [changes, release-proof]
-    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.plugin == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
-    uses: ./.github/workflows/ci-plugin.yml
-
-  dashboard:
-    needs: [changes, release-proof]
-    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.dashboard == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
-    uses: ./.github/workflows/ci-dashboard.yml
-
-  contract:
-    needs: [changes, release-proof]
-    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.contract == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
-    uses: ./.github/workflows/ci-contract.yml
-
-  docs:
-    name: Build public docs
-    needs: [changes, release-proof]
-    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.docs == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: user-docs
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: npm
-          cache-dependency-path: user-docs/package-lock.json
-
-      - run: npm ci
-      - run: npm run build
-
   guard:
     name: Required checks
-    if: always()
-    needs: [changes, release-proof, android, android_on_demand, desktop, plugin, dashboard, contract, docs]
     runs-on: ubuntu-latest
-    env:
-      CHANGES_RESULT: ${{ needs.changes.result }}
-      RELEASE_PROOF_RESULT: ${{ needs.release-proof.result }}
-      REUSED_REQUIRED_CHECKS: ${{ needs.release-proof.outputs.reuse }}
-      ANDROID_RESULT: ${{ needs.android.result }}
-      ANDROID_ON_DEMAND_RESULT: ${{ needs.android_on_demand.result }}
-      DESKTOP_RESULT: ${{ needs.desktop.result }}
-      PLUGIN_RESULT: ${{ needs.plugin.result }}
-      DASHBOARD_RESULT: ${{ needs.dashboard.result }}
-      CONTRACT_RESULT: ${{ needs.contract.result }}
-      DOCS_RESULT: ${{ needs.docs.result }}
     steps:
-      - name: Require every selected check to pass
-        shell: bash
-        run: |
-          failed=0
-          for check in CHANGES RELEASE_PROOF ANDROID ANDROID_ON_DEMAND DESKTOP PLUGIN DASHBOARD CONTRACT DOCS; do
-            result_var="${check}_RESULT"
-            result="${!result_var}"
-            echo "$check: $result"
-            case "$result" in
-              success|skipped) ;;
-              *) failed=1 ;;
-            esac
-          done
-          exit "$failed"
-
-      - name: Write exact-tree proof
-        if: ${{ needs.release-proof.outputs.reuse != 'true' }}
-        env:
-          CHECKED_TREE: ${{ needs.changes.outputs.tree }}
-        run: |
-          mkdir -p required-check-proof
-          jq -n \
-            --arg repository "$GITHUB_REPOSITORY" \
-            --arg tree "$CHECKED_TREE" \
-            --arg commit "$GITHUB_SHA" \
-            --arg run_id "$GITHUB_RUN_ID" \
-            '{schemaVersion: 1, repository: $repository, tree: $tree, commit: $commit, runId: $run_id}' \
-            > required-check-proof/required-checks.json
-
-      - name: Upload exact-tree proof
-        if: ${{ needs.release-proof.outputs.reuse != 'true' }}
-        uses: actions/upload-artifact@v7
-        with:
-          name: required-checks-${{ needs.changes.outputs.tree }}
-          path: required-check-proof/required-checks.json
-          if-no-files-found: error
-          retention-days: 30
+      - name: OK
+        run: echo "Required-checks sentinel — see ci-required.yml header for context."

.github/workflows/ci-server.yml

@@ -1,39 +1,63 @@
-# Hermes-Relay — Plugin CI Pipeline
+# Hermes-Relay — Python Server CI Pipeline
 #
-# Runs directly on plugin-affecting pushes to main/dev and is called by the
-# path-aware required-check workflow for relevant pull requests.
+# Runs on pushes to main/dev and on PRs targeting main/dev, scoped to
+# server-affecting paths so Android-only changes don't spin up the
+# Python toolchain.
 #
-# Pipeline: syntax-check and focused plugin tests run concurrently.
+# Pipeline: syntax-check -> focused server tests
 
-name: CI — Plugin
+name: CI — Server
 
 on:
-  workflow_call:
   push:
     branches: [main, dev]
     paths:
-      - "plugin/*.py"
+      - "plugin/__init__.py"
+      - "plugin/android_tool.py"
+      - "plugin/cli.py"
+      - "plugin/pair.py"
       - "plugin/plugin.yaml"
+      - "plugin/dashboard/manifest.json"
+      - "plugin/dashboard/package.json"
+      - "plugin/dashboard/package-lock.json"
       - "plugin/relay/**"
       - "plugin/tools/**"
       - "plugin/tests/**"
       - "relay_server/**"
       - "hermes_relay_bootstrap/**"
       - "pyproject.toml"
-      - "scripts/check-plugin-version-sync.py"
       - "scripts/check-server-version-sync.py"
-      - "scripts/bump-plugin-version.sh"
       - "scripts/bump-server-version.sh"
-      - ".github/workflows/ci-plugin.yml"
+      - ".github/workflows/ci-server.yml"
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - "plugin/__init__.py"
+      - "plugin/android_tool.py"
+      - "plugin/cli.py"
+      - "plugin/pair.py"
+      - "plugin/plugin.yaml"
+      - "plugin/dashboard/manifest.json"
+      - "plugin/dashboard/package.json"
+      - "plugin/dashboard/package-lock.json"
+      - "plugin/relay/**"
+      - "plugin/tools/**"
+      - "plugin/tests/**"
+      - "relay_server/**"
+      - "hermes_relay_bootstrap/**"
+      - "pyproject.toml"
+      - "scripts/check-server-version-sync.py"
+      - "scripts/bump-server-version.sh"
+      - ".github/workflows/ci-server.yml"
 
 # Cancel in-progress runs for the same branch/PR, but let main and dev finish
 concurrency:
-  group: ci-plugin-${{ github.ref }}
+  group: ci-server-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
 
 jobs:
   # ──────────────────────────────────────────────
-  # Python Plugin — py_compile syntax sanity
+  # Python Server — py_compile syntax sanity
   # ──────────────────────────────────────────────
   syntax-check:
     name: Syntax check (Python)
@@ -41,16 +65,18 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Set up Python 3.11
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 
-      - name: Syntax check (plugin relay — canonical location)
+      - name: Install dependencies
+        run: pip install -r relay_server/requirements.txt
+
+      - name: Syntax check (server/plugin.relay — canonical location)
         run: |
-          python -m py_compile plugin/relay/config.py
           python -m py_compile plugin/relay/server.py
           python -m py_compile plugin/relay/channels/terminal.py
           python -m py_compile plugin/relay/channels/chat.py
@@ -61,18 +87,19 @@ jobs:
       - name: Syntax check (relay_server shim)
         run: python -m py_compile relay_server/__init__.py relay_server/__main__.py
 
-      - name: Validate Plugin version metadata
-        run: python scripts/check-plugin-version-sync.py
+      - name: Validate Server version metadata
+        run: python scripts/check-server-version-sync.py
 
   # ──────────────────────────────────────────────
-  # Python Plugin — focused route/auth/session tests
+  # Python Server — focused route/auth/session tests
   #
   # Tests are ADVISORY on dev (push or PR) so WIP commits don't block the
   # merge queue. Strict on main — the dev → main release-merge PR surfaces
   # any real failures before release.
   # ──────────────────────────────────────────────
   unit-tests:
-    name: Focused Plugin tests (Python)
+    name: Focused Server tests (Python)
+    needs: syntax-check
     runs-on: ubuntu-latest
     timeout-minutes: 10
     # Advisory on dev, strict on main. Evaluates to false (= strict) for
@@ -81,38 +108,21 @@ jobs:
     continue-on-error: ${{ github.ref != 'refs/heads/main' && github.base_ref != 'main' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Set up Python 3.11
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 
       - name: Install dependencies
         run: |
-          # Editable install pulls the full runtime dependency set from
-          # pyproject.toml (requests, aiohttp, segno, httpx, websocket-client,
-          # pyyaml). test_native_layout_imports imports the whole relay module
-          # chain in a clean subprocess, so the minimal relay_server/requirements
-          # set is not enough on its own.
-          pip install -e .
+          pip install -r relay_server/requirements.txt
           pip install pytest responses
 
-      - name: Run focused Plugin tests
+      - name: Run focused Server tests
         run: |
           python -m pytest \
-            plugin/tests/test_manifest_compatibility.py \
             plugin/tests/test_relay_security.py \
             plugin/tests/test_voice_routes.py \
-            plugin/tests/test_session_grants.py \
-            plugin/tests/test_native_layout_imports.py \
-            plugin/tests/test_profile_discovery.py \
-            plugin/tests/test_profiles_updated_broadcast.py \
-            plugin/tests/test_git_state.py \
-            plugin/tests/test_git_state_write.py \
-            plugin/tests/test_git_state_extras.py \
-            plugin/tests/test_mobile_plugin_store.py \
-            plugin/tests/test_android_tool.py \
-            plugin/tests/test_android_navigate.py \
-            plugin/tests/test_phone_platform.py \
-            plugin/tests/test_desktop_tool_availability.py
+            plugin/tests/test_session_grants.py

.github/workflows/ci-website.yml

@@ -1,39 +0,0 @@
-name: Website CI
-
-on:
-  pull_request:
-    paths:
-      - "website/**"
-      - "assets/screenshots/02_chat.png"
-      - "assets/screenshots/03_voice.png"
-      - "assets/screenshots/06_manage.png"
-      - "docs/media/screenshots.json"
-      - ".github/workflows/ci-website.yml"
-  push:
-    branches: [main, dev]
-    paths:
-      - "website/**"
-      - "assets/screenshots/02_chat.png"
-      - "assets/screenshots/03_voice.png"
-      - "assets/screenshots/06_manage.png"
-      - "docs/media/screenshots.json"
-      - ".github/workflows/ci-website.yml"
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: website
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: website/package-lock.json
-      - run: npm ci
-      - run: npm run build

.github/workflows/claude-code-review.yml

@@ -0,0 +1,55 @@
+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes
+    # paths:
+    #   - "src/**/*.ts"
+    #   - "src/**/*.tsx"
+    #   - "src/**/*.js"
+    #   - "src/**/*.jsx"
+
+jobs:
+  claude-review:
+    # Optional: Filter by PR author
+    # if: |
+    #   github.event.pull_request.user.login == 'external-contributor' ||
+    #   github.event.pull_request.user.login == 'new-developer' ||
+    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+    env:
+      IS_RELEASE_PR: ${{ github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.ref == 'dev' && startsWith(github.event.pull_request.title, 'release:') }}
+
+    steps:
+      - name: Skip aggregate release PR review
+        if: env.IS_RELEASE_PR == 'true'
+        run: |
+          echo "Skipping Claude Code Review for aggregate dev -> main release PR."
+          echo "Feature work is reviewed before it lands on dev; release PRs are gated by CI and release metadata checks."
+
+      - name: Checkout repository
+        if: env.IS_RELEASE_PR != 'true'
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code Review
+        if: env.IS_RELEASE_PR != 'true'
+        timeout-minutes: 15
+        id: claude-review
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'
+          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+

.github/workflows/claude.yml

@@ -0,0 +1,50 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+          # This is an optional setting that allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read
+
+          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
+          # prompt: 'Update the pull request description to include a summary of changes.'
+
+          # Optional: Add claude_args to customize behavior and configuration
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+          # claude_args: '--allowed-tools Bash(gh pr *)'
+

.github/workflows/dependabot-auto-merge.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v3
+        uses: dependabot/fetch-metadata@v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/docs.yml

@@ -0,0 +1,71 @@
+# Hermes-Relay — Docs Deployment
+#
+# Builds VitePress docs and deploys to GitHub Pages.
+# Triggers on pushes to main that change user-docs/ content,
+# or manually via workflow_dispatch.
+
+name: Deploy Docs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'user-docs/**'
+      - '.github/workflows/docs.yml'
+  workflow_dispatch:
+
+# Allow only one concurrent deployment
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+# Sets permissions for GITHUB_TOKEN to enable Pages deployment
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+jobs:
+  build:
+    name: Build Docs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0  # Full history for lastUpdated timestamps
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: user-docs/package-lock.json
+
+      - name: Install dependencies
+        run: npm install
+        working-directory: user-docs
+
+      - name: Build VitePress site
+        run: npm run build
+        working-directory: user-docs
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v5
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: user-docs/.vitepress/dist
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/legacy-docs-redirect.yml

@@ -1,89 +0,0 @@
-name: Deploy legacy docs redirects
-
-on:
-  pull_request:
-    paths:
-      - "legacy-pages-redirect/**"
-      - "website/public/privacy.html"
-      - ".github/workflows/legacy-docs-redirect.yml"
-  push:
-    branches: [main]
-    paths:
-      - "legacy-pages-redirect/**"
-      - "website/public/privacy.html"
-      - ".github/workflows/legacy-docs-redirect.yml"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: legacy-docs-pages
-  cancel-in-progress: true
-
-jobs:
-  build:
-    name: Build redirect artifact
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v6
-
-      - name: Build redirect-only site
-        shell: bash
-        run: |
-          set -euo pipefail
-          source_file="legacy-pages-redirect/redirect.html"
-          privacy_file="website/public/privacy.html"
-          output_dir="legacy-pages-redirect/_site"
-          rm -rf "$output_dir"
-          mkdir -p \
-            "$output_dir/guide/getting-started" \
-            "$output_dir/privacy" \
-            "$output_dir/reference/relay-server" \
-            "$output_dir/architecture"
-          for target in \
-            index.html \
-            404.html \
-            guide/getting-started.html \
-            guide/getting-started/index.html \
-            reference/relay-server.html \
-            reference/relay-server/index.html \
-            architecture/connection-security.html; do
-            cp "$source_file" "$output_dir/$target"
-          done
-          cp "$privacy_file" "$output_dir/privacy.html"
-          cp "$privacy_file" "$output_dir/privacy/index.html"
-          touch "$output_dir/.nojekyll"
-          test "$(find "$output_dir" -type f | wc -l)" -eq 10
-          grep -Fq '<h1>Privacy Policy</h1>' "$output_dir/privacy.html"
-          grep -Fq 'https://hermes-relay.dev/privacy.html' "$output_dir/privacy.html"
-          if grep -R -E '<title>VitePress|<div id="app">' "$output_dir"; then
-            echo "Full documentation content must not be deployed by this workflow." >&2
-            exit 1
-          fi
-
-      - name: Configure Pages
-        if: github.event_name != 'pull_request'
-        uses: actions/configure-pages@v6
-
-      - name: Upload redirect artifact
-        if: github.event_name != 'pull_request'
-        uses: actions/upload-pages-artifact@v5
-        with:
-          path: legacy-pages-redirect/_site
-
-  deploy:
-    name: Deploy redirect shim
-    if: github.event_name != 'pull_request'
-    needs: build
-    runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v5

.github/workflows/play-listing.yml

@@ -1,104 +0,0 @@
-name: Play Store Listing
-
-on:
-  pull_request:
-    paths:
-      - "assets/screenshots/**"
-      - "assets/play-store-icon-512.png"
-      - "assets/play-store-feature-1024x500.png"
-      - "docs/media/screenshots.json"
-      - "app/src/googlePlay/play/*.txt"
-      - "app/src/googlePlay/play/listings/**"
-      - "scripts/screenshots.py"
-      - ".github/workflows/play-listing.yml"
-  push:
-    branches:
-      - main
-      - dev
-    paths:
-      - "assets/screenshots/**"
-      - "assets/play-store-icon-512.png"
-      - "assets/play-store-feature-1024x500.png"
-      - "docs/media/screenshots.json"
-      - "app/src/googlePlay/play/*.txt"
-      - "app/src/googlePlay/play/listings/**"
-      - "scripts/screenshots.py"
-      - ".github/workflows/play-listing.yml"
-  workflow_dispatch:
-    inputs:
-      publish_listing:
-        description: "Publish Play Store listing metadata after validation"
-        required: true
-        default: false
-        type: boolean
-
-permissions:
-  contents: read
-
-jobs:
-  validate:
-    name: Validate Listing Assets
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up Python
-        uses: actions/setup-python@v7
-        with:
-          python-version: "3.12"
-
-      - name: Install image tooling
-        run: python -m pip install --upgrade rich Pillow
-
-      - name: Validate screenshots and listing metadata
-        run: python scripts/screenshots.py validate
-
-  publish-listing:
-    name: Publish Listing Metadata
-    needs: validate
-    # Auto-publish the listing when its assets change on `main` (the release
-    # branch; the path filters above already scope this to screenshot/graphic/
-    # text changes). `dev` pushes and PRs validate only. A manual dispatch with
-    # `publish_listing` still works as an on-demand republish.
-    if: >-
-      ${{ (github.event_name == 'workflow_dispatch' && inputs.publish_listing)
-          || (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v6
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: false
-
-      - name: Write Play service account
-        id: sa
-        env:
-          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-        run: |
-          if [ -z "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
-            # Skip gracefully (no red CI) when the secret isn't configured — e.g.
-            # an auto-publish push to main before the service account is set up.
-            echo "::notice::PLAY_SERVICE_ACCOUNT_JSON not configured — skipping listing publish."
-            echo "configured=false" >> "$GITHUB_OUTPUT"
-          else
-            printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > play-service-account.json
-            echo "configured=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Publish Play Store listing
-        if: ${{ steps.sa.outputs.configured == 'true' }}
-        run: ./gradlew publishGooglePlayReleaseListing
-
-      - name: Remove Play service account
-        if: always()
-        run: rm -f play-service-account.json

.github/workflows/play-preflight-android.yml

@@ -1,167 +0,0 @@
-# Hermes-Relay Android — private Google Play preflight
-#
-# Run manually from the final dev or untagged main tree before creating
-# android-v*. The job
-# builds the signed release artifacts once, scans the final packages, and uploads
-# the Google Play bundle as a production DRAFT. The exact signed APK/AAB,
-# mappings, manifest, and checksums remain private Actions artifacts until
-# approval publishes those same bytes. Console-only pre-review and pre-launch
-# reports are informational and do not block release.
-
-name: Hermes-Relay Android Play Preflight
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Android version to preflight (for example 1.4.3)"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: play-preflight-android
-  cancel-in-progress: false
-
-jobs:
-  preflight:
-    name: Build and upload private Play draft
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Require final release branch and matching version
-        id: metadata
-        env:
-          REQUESTED_VERSION: ${{ inputs.version }}
-        run: |
-          if [ "$GITHUB_REF" != "refs/heads/dev" ] && [ "$GITHUB_REF" != "refs/heads/main" ]; then
-            echo "::error::Run Play preflight from dev or untagged main, not $GITHUB_REF"
-            exit 1
-          fi
-
-          TOML_VERSION=$(grep -oP 'appVersionName\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
-          VERSION_CODE=$(grep -oP 'appVersionCode\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
-          if [ "$REQUESTED_VERSION" != "$TOML_VERSION" ]; then
-            echo "::error::Requested version $REQUESTED_VERSION does not match appVersionName $TOML_VERSION"
-            exit 1
-          fi
-
-          echo "version=$TOML_VERSION" >> "$GITHUB_OUTPUT"
-          echo "version_code=$VERSION_CODE" >> "$GITHUB_OUTPUT"
-          echo "tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
-
-      - name: Require Play and release-signing secrets
-        env:
-          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-          HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
-        run: |
-          if [ -z "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
-            echo "::error::PLAY_SERVICE_ACCOUNT_JSON is required for Play preflight"
-            exit 1
-          fi
-          if [ -z "$HERMES_KEYSTORE_BASE64" ]; then
-            echo "::error::HERMES_KEYSTORE_BASE64 is required for Play preflight"
-            exit 1
-          fi
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v6
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: false
-
-      - name: Validate release metadata and source compatibility
-        run: |
-          python3 scripts/check-version-tracks.py
-          python3 scripts/check-android-release-notes.py
-          python3 scripts/check-privacy-policy.py --live
-          python3 scripts/check-android-locales.py
-          python3 scripts/check-android-collection-apis.py
-
-      - name: Decode release keystore
-        env:
-          HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
-        run: |
-          echo "$HERMES_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
-          echo "HERMES_KEYSTORE_PATH=$RUNNER_TEMP/release.keystore" >> "$GITHUB_ENV"
-
-      - name: Build final release artifacts
-        env:
-          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
-          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
-          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
-        run: |
-          ./gradlew \
-            :app:bundleGooglePlayRelease \
-            :app:assembleGooglePlayRelease \
-            :app:assembleSideloadRelease \
-            --console=plain
-
-      - name: Scan final release DEX
-        run: |
-          python3 scripts/check-android-collection-apis.py \
-            --apk app/build/outputs/apk/googlePlay/release/*.apk \
-            --apk app/build/outputs/apk/sideload/release/*.apk
-
-      - name: Verify packaged native compatibility
-        run: |
-          python3 scripts/check-android-native-compat.py \
-            app/build/outputs/apk/googlePlay/release/*.apk \
-            app/build/outputs/apk/sideload/release/*.apk
-
-      - name: Upload private production draft to Play
-        env:
-          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
-          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
-          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
-        run: |
-          trap 'rm -f play-service-account.json' EXIT
-          printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > play-service-account.json
-          ./gradlew publishGooglePlayReleaseBundle \
-            --track=production \
-            --release-status=draft \
-            --resolution-strategy=ignore \
-            --release-name="Hermes-Relay Android v${{ steps.metadata.outputs.version }}"
-
-      - name: Package immutable preflight artifacts
-        run: |
-          python3 scripts/android_release_artifacts.py package \
-            --version "${{ steps.metadata.outputs.version }}" \
-            --version-code "${{ steps.metadata.outputs.version_code }}" \
-            --commit "$GITHUB_SHA" \
-            --tree "${{ steps.metadata.outputs.tree }}" \
-            --sideload-apk app/build/outputs/apk/sideload/release/*.apk \
-            --google-play-aab app/build/outputs/bundle/googlePlayRelease/*.aab \
-            --sideload-mapping app/build/outputs/mapping/sideloadRelease/mapping.txt \
-            --google-play-mapping app/build/outputs/mapping/googlePlayRelease/mapping.txt \
-            --output app/build/preflight-artifacts
-
-      - name: Upload immutable preflight artifacts
-        uses: actions/upload-artifact@v7
-        with:
-          name: play-preflight-${{ steps.metadata.outputs.version }}-${{ steps.metadata.outputs.tree }}
-          path: app/build/preflight-artifacts/*
-          if-no-files-found: error
-          retention-days: 30
-          compression-level: 0
-
-      - name: Preflight summary
-        run: |
-          echo "## Play preflight ready" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Version: **${{ steps.metadata.outputs.version }}** (code ${{ steps.metadata.outputs.version_code }})" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Commit: \`$GITHUB_SHA\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Release tree: \`${{ steps.metadata.outputs.tree }}\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Play track/status: **Production draft**" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "The signed build, package scans, and Play draft upload passed. Approval will publish these exact private artifacts if the unchanged tree reaches main. Console-only reports are informational and non-blocking." >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-android.yml

@@ -1,31 +1,19 @@
-# Hermes-Relay Android — Release Pipeline
+# Hermes-Relay-Android — Release Pipeline
 #
 # Triggered when an Android release tag (android-v*) is pushed.
 # Validates the tag matches the app version in libs.versions.toml,
 # runs focused Android checks, builds release APK/AAB artifacts, and creates a
-# GitHub Release. Plugin/Python package releases use server-v* tags.
+# GitHub Release. Server/Python package releases use server-v* tags.
 
-name: Hermes-Relay Android Release
+name: Release Android
 
 on:
   push:
     tags:
       - "android-v*"
-  # Hermes-Relay Android Release Approval creates its tag with GITHUB_TOKEN,
-  # whose tag event
-  # does not recursively start workflows. It dispatches the current workflow
-  # definition from main, while every job checks out the immutable tag. Manual
-  # tag pushes continue to use the push trigger.
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Approved Android version"
-        required: true
-        type: string
 
 permissions:
   contents: write
-  actions: read
   id-token: write
 
 jobs:
@@ -34,42 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
-      version_code: ${{ steps.version.outputs.version_code }}
-      prerelease: ${{ steps.version.outputs.prerelease }}
-      release_tree: ${{ steps.version.outputs.release_tree }}
-      preflight_artifact_id: ${{ steps.preflight.outputs.artifact_id }}
-      preflight_run_id: ${{ steps.preflight.outputs.run_id }}
     steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('android-v{0}', inputs.version) || github.ref }}
+      - uses: actions/checkout@v6
 
       - name: Extract version from tag
         id: version
-        env:
-          DISPATCHED_VERSION: ${{ inputs.version }}
-        run: |
-          if [ -n "$DISPATCHED_VERSION" ]; then
-            REF_VERSION="$DISPATCHED_VERSION"
-            TAG_COMMIT=$(git rev-list -n 1 "android-v${REF_VERSION}")
-            if [ -z "$TAG_COMMIT" ] || [ "$TAG_COMMIT" != "$(git rev-parse HEAD)" ]; then
-              echo "::error::Checked-out commit does not match immutable tag android-v${REF_VERSION}"
-              exit 1
-            fi
-          else
-            REF_VERSION="${GITHUB_REF#refs/tags/android-v}"
-          fi
-          VERSION_CODE=$(grep -oP 'appVersionCode\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
-          if [[ "$REF_VERSION" == *-* ]]; then
-            PRERELEASE=true
-          else
-            PRERELEASE=false
-          fi
-          echo "version=$REF_VERSION" >> "$GITHUB_OUTPUT"
-          echo "version_code=$VERSION_CODE" >> "$GITHUB_OUTPUT"
-          echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
-          echo "release_tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
+        run: echo "version=${GITHUB_REF#refs/tags/android-v}" >> $GITHUB_OUTPUT
 
       - name: Verify version sync
         run: |
@@ -83,94 +41,28 @@ jobs:
             echo "::error::Tag version ($TAG_VERSION) does not match appVersionName ($TOML_VERSION) in gradle/libs.versions.toml"
             exit 1
           fi
-          if ! grep -Eq "^## \\[(Android )?${TAG_VERSION}\\]" CHANGELOG.md; then
-            echo "::error::CHANGELOG.md has no Android release heading for $TAG_VERSION"
-            exit 1
-          fi
 
           echo "Version validated: $TAG_VERSION"
 
-      - name: Verify public privacy policy URLs
-        run: python3 scripts/check-privacy-policy.py --live
-
-      - name: Verify tag belongs to the correct integration branch
-        env:
-          PRERELEASE: ${{ steps.version.outputs.prerelease }}
-        run: |
-          set -euo pipefail
-          tag_commit="$(git rev-parse HEAD)"
-          if [ "$PRERELEASE" = "true" ]; then
-            git fetch origin dev --no-tags
-            if ! git merge-base --is-ancestor "$tag_commit" origin/dev; then
-              echo "Android prereleases must be tagged from dev; $tag_commit is not in origin/dev" >&2
-              exit 1
-            fi
-          else
-            git fetch origin main --no-tags
-            if ! git merge-base --is-ancestor "$tag_commit" origin/main; then
-              echo "Stable Android releases must be tagged from main; $tag_commit is not in origin/main" >&2
-              exit 1
-            fi
-          fi
-
-      - name: Require successful Play preflight for this exact release tree
-        id: preflight
-        if: ${{ !contains(steps.version.outputs.version, '-') }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          RELEASE_TREE="${{ steps.version.outputs.release_tree }}"
-          ARTIFACT_NAME="play-preflight-${VERSION}-${RELEASE_TREE}"
-          ARTIFACT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
-            --jq '[.artifacts[] | select(.expired == false)] | sort_by(.created_at) | last')
-          ARTIFACT_ID=$(jq -r '.id // empty' <<<"$ARTIFACT")
-          RUN_ID=$(jq -r '.workflow_run.id // empty' <<<"$ARTIFACT")
-          if [ -z "$ARTIFACT_ID" ] || [ -z "$RUN_ID" ]; then
-            echo "::error::No successful Play preflight found for version $VERSION with tree $RELEASE_TREE"
-            echo "Run Hermes-Relay Android Play Preflight from the final dev tree, merge that unchanged tree to main, then approve the release."
-            exit 1
-          fi
-          RUN=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}")
-          CONCLUSION=$(jq -r '.conclusion' <<<"$RUN")
-          WORKFLOW_PATH=$(jq -r '.path' <<<"$RUN")
-          if [ "$WORKFLOW_PATH" != ".github/workflows/play-preflight-android.yml" ] || [ "$CONCLUSION" != "success" ]; then
-            echo "::error::Preflight artifact came from ${WORKFLOW_PATH} with conclusion ${CONCLUSION}"
-            exit 1
-          fi
-          echo "artifact_id=$ARTIFACT_ID" >> "$GITHUB_OUTPUT"
-          echo "run_id=$RUN_ID" >> "$GITHUB_OUTPUT"
-          echo "Play preflight artifacts verified: $ARTIFACT_NAME (run $RUN_ID, artifact $ARTIFACT_ID)"
-
   ci:
-    name: CI Checks (prerelease only)
+    name: CI Checks
     needs: validate
-    if: ${{ needs.validate.outputs.prerelease == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('android-v{0}', inputs.version) || github.ref }}
+      - uses: actions/checkout@v6
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v6
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: false
+        uses: gradle/actions/setup-gradle@v6
 
-      - name: Validate release metadata and Android API compatibility
-        run: |
-          python3 scripts/check-version-tracks.py
-          python3 scripts/check-android-release-notes.py
-          python3 scripts/check-privacy-policy.py
-          python3 scripts/check-android-locales.py
-          python3 scripts/check-android-collection-apis.py
+      - name: Build debug APK
+        run: ./gradlew assembleDebug
 
       # Keep the tag release gate aligned with CI — Android's broad Gradle
       # `test` aggregate currently hangs in deferred JVM suites tracked by
@@ -185,220 +77,94 @@ jobs:
   release:
     name: Build & Publish Release
     needs: [validate, ci]
-    if: ${{ always() && needs.validate.result == 'success' && (needs.ci.result == 'success' || needs.ci.result == 'skipped') }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('android-v{0}', inputs.version) || github.ref }}
+      - uses: actions/checkout@v6
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v6
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: false
+        uses: gradle/actions/setup-gradle@v6
 
-      - name: Download exact stable preflight artifacts
-        if: ${{ needs.validate.outputs.prerelease != 'true' }}
-        uses: actions/download-artifact@v8
-        with:
-          artifact-ids: ${{ needs.validate.outputs.preflight_artifact_id }}
-          github-token: ${{ github.token }}
-          repository: ${{ github.repository }}
-          run-id: ${{ needs.validate.outputs.preflight_run_id }}
-          path: app/build/preflight-artifacts
-
-      - name: Verify exact stable preflight artifacts
-        if: ${{ needs.validate.outputs.prerelease != 'true' }}
-        run: |
-          python3 scripts/android_release_artifacts.py verify \
-            --version "${{ needs.validate.outputs.version }}" \
-            --version-code "${{ needs.validate.outputs.version_code }}" \
-            --tree "${{ needs.validate.outputs.release_tree }}" \
-            --directory app/build/preflight-artifacts
-
-      - name: Decode release keystore for candidate build
+      - name: Decode release keystore
         env:
           HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
-        if: ${{ needs.validate.outputs.prerelease == 'true' && env.HERMES_KEYSTORE_BASE64 != '' }}
+        if: env.HERMES_KEYSTORE_BASE64 != ''
         run: |
           echo "$HERMES_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
           echo "HERMES_KEYSTORE_PATH=$RUNNER_TEMP/release.keystore" >> "$GITHUB_ENV"
 
-      - name: Build side-by-side release candidate APK
-        if: ${{ needs.validate.outputs.prerelease == 'true' }}
+      - name: Build release artifacts (APK + AAB)
         env:
           HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
           HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
           HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
-          VERSION: ${{ needs.validate.outputs.version }}
-        run: |
-          SOURCE_SHA="$(git rev-parse HEAD)"
-          ./gradlew :app:assembleSideloadCandidate \
-            -Pcandidate.kind=rc \
-            -Pcandidate.label="Hermes-Relay Android v${VERSION}" \
-            -Pcandidate.sourceRef="android-v${VERSION}" \
-            -Pcandidate.sourceSha="$SOURCE_SHA" \
-            --console=plain
-
-      # The Play AAB carries its mapping for Play Console deobfuscation, but
-      # sideload issue reports need the exact mapping from this immutable build.
-      # Keep both variants as a workflow artifact (not a public release asset).
-      - name: Retain R8 mappings for retrace
-        if: ${{ needs.validate.outputs.prerelease != 'true' }}
-        uses: actions/upload-artifact@v7
-        with:
-          name: android-r8-mappings-${{ needs.validate.outputs.version }}-${{ needs.validate.outputs.release_tree }}
-          path: |
-            app/build/preflight-artifacts/mapping-googlePlayRelease.txt
-            app/build/preflight-artifacts/mapping-sideloadRelease.txt
-          if-no-files-found: error
-          retention-days: 90
-
-      - name: Retain candidate R8 mapping for retrace
-        if: ${{ needs.validate.outputs.prerelease == 'true' }}
-        uses: actions/upload-artifact@v7
-        with:
-          name: android-rc-r8-mapping-${{ needs.validate.outputs.version }}-${{ github.sha }}
-          path: app/build/outputs/mapping/sideloadCandidate/mapping.txt
-          if-no-files-found: error
-          retention-days: 90
-
-      - name: Scan stable release DEX for unsupported collection APIs
-        if: ${{ needs.validate.outputs.prerelease != 'true' }}
-        run: |
-          python3 scripts/check-android-collection-apis.py \
-            --apk app/build/preflight-artifacts/*-sideload-release.apk
-
-      - name: Scan candidate DEX for unsupported collection APIs
-        if: ${{ needs.validate.outputs.prerelease == 'true' }}
-        run: |
-          python3 scripts/check-android-collection-apis.py \
-            --apk app/build/outputs/apk/sideload/candidate/*.apk
-
-      - name: Verify stable packaged ONNX Runtime compatibility
-        if: ${{ needs.validate.outputs.prerelease != 'true' }}
-        run: |
-          python3 scripts/check-android-native-compat.py \
-            app/build/preflight-artifacts/*-sideload-release.apk
-
-      - name: Verify candidate packaged ONNX Runtime compatibility
-        if: ${{ needs.validate.outputs.prerelease == 'true' }}
-        run: |
-          python3 scripts/check-android-native-compat.py \
-            app/build/outputs/apk/sideload/candidate/*.apk
+        # `assembleRelease` and `bundleRelease` are flavor-wide task aliases
+        # (added by `flavorDimensions += "track"` in app/build.gradle.kts), so
+        # this one line builds ALL four artifacts at once. Filenames come from
+        # `archivesName` (set in app/build.gradle.kts) which injects the app
+        # version, so `<version>` below is `libs.versions.appVersionName`:
+        #   app/build/outputs/apk/googlePlay/release/hermes-relay-<version>-googlePlay-release.apk
+        #   app/build/outputs/apk/sideload/release/hermes-relay-<version>-sideload-release.apk
+        #   app/build/outputs/bundle/googlePlayRelease/hermes-relay-<version>-googlePlay-release.aab
+        #   app/build/outputs/bundle/sideloadRelease/hermes-relay-<version>-sideload-release.aab
+        run: ./gradlew bundleRelease assembleRelease
 
       - name: List produced artifacts (debug aid)
         run: |
-          echo "=== Reused stable artifacts ==="
-          find app/build/preflight-artifacts -maxdepth 1 -type f -print 2>/dev/null || true
-          echo "=== Candidate APK outputs ==="
+          echo "=== APK outputs ==="
           find app/build/outputs/apk -name '*.apk' -print 2>/dev/null || true
+          echo "=== AAB outputs ==="
+          find app/build/outputs/bundle -name '*.aab' -print 2>/dev/null || true
 
-      - name: Generate candidate checksums
-        if: ${{ needs.validate.outputs.prerelease == 'true' }}
+      - name: Generate checksums
+        # Flavor dimension adds an extra path segment to the AGP output layout.
+        # APKs live under `apk/<flavor>/release/`, AABs under `bundle/<flavor>Release/`
+        # (note the concatenated camelCase — AGP path quirk, documented but
+        # different between APK and AAB). The globs below match both flavors.
         run: |
           cd app/build/outputs
-          sha256sum apk/sideload/candidate/*.apk > SHA256SUMS.txt
+          sha256sum apk/*/release/*.apk bundle/*Release/*.aab > SHA256SUMS.txt
           cat SHA256SUMS.txt
 
-      - name: Require Play credentials for stable release
-        env:
-          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-        if: ${{ !contains(needs.validate.outputs.version, '-') }}
-        run: |
-          if [ -z "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
-            echo "::error::PLAY_SERVICE_ACCOUNT_JSON is required for stable Android releases"
-            exit 1
-          fi
-
-      - name: Submit preflighted Play draft to production review
-        env:
-          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-        if: ${{ !contains(needs.validate.outputs.version, '-') }}
-        run: |
-          trap 'rm -f play-service-account.json' EXIT
-          printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > play-service-account.json
-          ./gradlew promoteGooglePlayReleaseArtifact \
-            --update=production \
-            --version-code=${{ needs.validate.outputs.version_code }} \
-            --release-status=completed \
-            --release-name="Hermes-Relay Android v${{ needs.validate.outputs.version }}"
-
-      # Public distribution happens only after Play accepts the production
-      # submission above. This keeps a Play-detected release blocker from
-      # appearing after the sideload APK is already public.
-      - name: Create stable GitHub Release
-        if: ${{ needs.validate.outputs.prerelease != 'true' }}
+      - name: Create GitHub Release
         uses: softprops/action-gh-release@v3
         with:
-          name: Hermes-Relay Android v${{ needs.validate.outputs.version }}
+          name: Hermes-Relay-Android v${{ needs.validate.outputs.version }}
           tag_name: android-v${{ needs.validate.outputs.version }}
           body_path: RELEASE_NOTES.md
-          prerelease: false
-          # Deliberate 2-asset policy (#144): attach ONLY the installable
-          # sideload APK and Play AAB, plus checksums covering those files.
+          prerelease: ${{ contains(needs.validate.outputs.version, '-') }}
+          # Attach all four flavored artifacts — users sideload the
+          # `hermes-relay-<version>-sideload-release.apk` for the full
+          # Phase 3 / Tier 3/4/6 feature set; the
+          # `hermes-relay-<version>-googlePlay-release.aab` is what gets
+          # uploaded to Play Console. APK twin of the googlePlay flavor
+          # and AAB twin of the sideload flavor are included for parity
+          # (useful for diff tooling, not primary downloads).
           files: |
-            app/build/preflight-artifacts/*-sideload-release.apk
-            app/build/preflight-artifacts/*-googlePlay-release.aab
-            app/build/preflight-artifacts/SHA256SUMS.txt
-
-      - name: Create candidate GitHub prerelease
-        if: ${{ needs.validate.outputs.prerelease == 'true' }}
-        uses: softprops/action-gh-release@v3
-        with:
-          name: Hermes-Relay Android v${{ needs.validate.outputs.version }}
-          tag_name: android-v${{ needs.validate.outputs.version }}
-          body_path: RELEASE_NOTES.md
-          prerelease: true
-          fail_on_unmatched_files: true
-          files: |
-            app/build/outputs/apk/sideload/candidate/*.apk
+            app/build/outputs/apk/*/release/*.apk
+            app/build/outputs/bundle/*Release/*.aab
             app/build/outputs/SHA256SUMS.txt
 
       - name: Release summary
         env:
           HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
-          PRERELEASE: ${{ needs.validate.outputs.prerelease }}
         run: |
-          echo "## Hermes-Relay Android v${{ needs.validate.outputs.version }}" >> "$GITHUB_STEP_SUMMARY"
+          echo "## Hermes-Relay-Android v${{ needs.validate.outputs.version }}" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
-          if [ "$PRERELEASE" != "true" ]; then
-            echo "✅ **Published the exact signed Play-preflight artifacts**" >> "$GITHUB_STEP_SUMMARY"
-          elif [ -n "$HERMES_KEYSTORE_BASE64" ]; then
-            echo "✅ **Release-signed HR Candidate app** — separate package ID; never uploaded to Play" >> "$GITHUB_STEP_SUMMARY"
+          if [ -n "$HERMES_KEYSTORE_BASE64" ]; then
+            echo "✅ **Signed with release keystore** — suitable for Play Store upload" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "⚠️ **Debug-signed HR Candidate app** — separate package ID; never uploaded to Play" >> "$GITHUB_STEP_SUMMARY"
+            echo "⚠️ **Debug-signed** (no \`HERMES_KEYSTORE_BASE64\` secret) — NOT suitable for Play Store. Add the secret in repo settings to enable release signing." >> "$GITHUB_STEP_SUMMARY"
           fi
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo "### Artifacts" >> "$GITHUB_STEP_SUMMARY"
           echo '```' >> "$GITHUB_STEP_SUMMARY"
-          find app/build/preflight-artifacts -maxdepth 1 -type f -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
           find app/build/outputs/apk -name '*.apk' -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
           find app/build/outputs/bundle -name '*.aab' -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
           echo '```' >> "$GITHUB_STEP_SUMMARY"
-
-  request-backmerge:
-    name: Request stable release backmerge
-    needs: [validate, release]
-    if: needs.validate.outputs.prerelease != 'true'
-    permissions:
-      actions: write
-      contents: read
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dispatch fail-closed release reconciliation
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: android-v${{ needs.validate.outputs.version }}
-        run: |
-          gh workflow run release-backmerge.yml \
-            --repo "$GITHUB_REPOSITORY" \
-            --ref main \
-            -f release_tag="$RELEASE_TAG"

.github/workflows/release-backmerge.yml

@@ -1,267 +0,0 @@
-# Reconcile a completed stable hotfix into dev without adding a ceremonial PR
-# merge commit. Normal dev -> main releases are detected and intentionally no-op.
-# A conflicted merge, failed exact-tree CI, stale dev ref, or denied branch update
-# stops without mutating dev and falls back to the normal reconciliation PR path.
-
-name: Release Backmerge
-
-on:
-  workflow_dispatch:
-    inputs:
-      release_tag:
-        description: "Published stable tag to reconcile (android-v*, server-v*, or desktop-v*)"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: release-backmerge-dev
-  cancel-in-progress: false
-
-jobs:
-  prepare:
-    name: Prepare exact backmerge candidate
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    outputs:
-      outcome: ${{ steps.prepare.outputs.outcome }}
-      base_dev_sha: ${{ steps.prepare.outputs.base_dev_sha }}
-      candidate_branch: ${{ steps.prepare.outputs.candidate_branch }}
-      candidate_sha: ${{ steps.prepare.outputs.candidate_sha }}
-      release_commit: ${{ steps.prepare.outputs.release_commit }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          ref: main
-
-      - name: Validate release and prepare merge commit
-        id: prepare
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ inputs.release_tag }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if [[ ! "$RELEASE_TAG" =~ ^(android|server|desktop)-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Release Backmerge accepts stable SemVer production tags only; got $RELEASE_TAG"
-            exit 1
-          fi
-
-          git fetch origin \
-            "+refs/heads/main:refs/remotes/origin/main" \
-            "+refs/heads/dev:refs/remotes/origin/dev" \
-            "+refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"
-          release_commit="$(git rev-parse "${RELEASE_TAG}^{commit}")"
-          base_dev_sha="$(git rev-parse origin/dev)"
-          echo "release_commit=$release_commit" >> "$GITHUB_OUTPUT"
-          echo "base_dev_sha=$base_dev_sha" >> "$GITHUB_OUTPUT"
-
-          if ! git merge-base --is-ancestor "$release_commit" origin/main; then
-            echo "::error::$RELEASE_TAG ($release_commit) is not contained in origin/main"
-            exit 1
-          fi
-
-          read -r is_draft is_prerelease < <(
-            gh release view "$RELEASE_TAG" --json isDraft,isPrerelease \
-              --jq '[.isDraft, .isPrerelease] | @tsv'
-          )
-          if [ "$is_draft" != "false" ] || [ "$is_prerelease" != "false" ]; then
-            echo "::error::$RELEASE_TAG is not a published stable GitHub release"
-            exit 1
-          fi
-
-          plan="$(
-            python3 scripts/plan_release_backmerge.py \
-              --release-commit "$release_commit" \
-              --dev-commit "$base_dev_sha"
-          )"
-          case "$plan" in
-            already-contained)
-              echo "outcome=noop" >> "$GITHUB_OUTPUT"
-              echo "## Release backmerge not needed" >> "$GITHUB_STEP_SUMMARY"
-              echo "\`$RELEASE_TAG\` is already contained in \`dev\`." >> "$GITHUB_STEP_SUMMARY"
-              exit 0
-              ;;
-            normal-release)
-              echo "outcome=noop" >> "$GITHUB_OUTPUT"
-              echo "## Normal release: no backmerge" >> "$GITHUB_STEP_SUMMARY"
-              echo "The released merge's integration parent is already contained in \`dev\`." >> "$GITHUB_STEP_SUMMARY"
-              exit 0
-              ;;
-            hotfix) ;;
-            *)
-              echo "::error::Unknown release-backmerge plan: $plan"
-              exit 1
-              ;;
-          esac
-
-          candidate_branch="chore/release-backmerge/${RELEASE_TAG}-${GITHUB_RUN_ID}"
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git switch --detach "$base_dev_sha"
-
-          set +e
-          git merge --no-ff -m "chore: back-merge ${RELEASE_TAG}" "$release_commit"
-          merge_status=$?
-          set -e
-          if [ "$merge_status" -ne 0 ]; then
-            conflicts="$(git diff --name-only --diff-filter=U | paste -sd ', ' -)"
-            echo "outcome=conflict" >> "$GITHUB_OUTPUT"
-            echo "::error::Automatic backmerge conflicts: ${conflicts:-unknown}. Open a reconciliation PR."
-            echo "## Manual reconciliation PR required" >> "$GITHUB_STEP_SUMMARY"
-            echo "\`$RELEASE_TAG\` conflicts with current \`dev\`: ${conflicts:-unknown}." >> "$GITHUB_STEP_SUMMARY"
-            git merge --abort || true
-            exit 1
-          fi
-
-          candidate_sha="$(git rev-parse HEAD)"
-          first_parent="$(git rev-parse HEAD^1)"
-          second_parent="$(git rev-parse HEAD^2)"
-          if [ "$first_parent" != "$base_dev_sha" ] || [ "$second_parent" != "$release_commit" ]; then
-            echo "::error::Candidate parents do not match dev + release commit"
-            exit 1
-          fi
-
-          git push origin "$candidate_sha:refs/heads/$candidate_branch"
-          echo "outcome=candidate" >> "$GITHUB_OUTPUT"
-          echo "candidate_branch=$candidate_branch" >> "$GITHUB_OUTPUT"
-          echo "candidate_sha=$candidate_sha" >> "$GITHUB_OUTPUT"
-
-          echo "## Backmerge candidate prepared" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Release: \`$RELEASE_TAG\` (\`$release_commit\`)" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Dev base: \`$base_dev_sha\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Candidate: \`$candidate_sha\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Temporary ref: \`$candidate_branch\`" >> "$GITHUB_STEP_SUMMARY"
-
-  gate:
-    name: Run exact-tree required checks
-    needs: prepare
-    if: needs.prepare.outputs.outcome == 'candidate'
-    permissions:
-      actions: write
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    outputs:
-      check_run_id: ${{ steps.gate.outputs.check_run_id }}
-    steps:
-      - name: Dispatch and await Required checks
-        id: gate
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BASE_DEV_SHA: ${{ needs.prepare.outputs.base_dev_sha }}
-          CANDIDATE_BRANCH: ${{ needs.prepare.outputs.candidate_branch }}
-          CANDIDATE_SHA: ${{ needs.prepare.outputs.candidate_sha }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          gh workflow run ci-required.yml \
-            --repo "$GITHUB_REPOSITORY" \
-            --ref "$CANDIDATE_BRANCH" \
-            -f base_sha="$BASE_DEV_SHA" \
-            -f head_sha="$CANDIDATE_SHA"
-
-          check_run_id=""
-          for _ in {1..20}; do
-            check_run_id="$(
-              gh run list \
-                --repo "$GITHUB_REPOSITORY" \
-                --workflow ci-required.yml \
-                --branch "$CANDIDATE_BRANCH" \
-                --event workflow_dispatch \
-                --limit 20 \
-                --json databaseId,headSha \
-                --jq ".[] | select(.headSha == \"$CANDIDATE_SHA\") | .databaseId" \
-                | head -n 1
-            )"
-            if [ -n "$check_run_id" ]; then
-              break
-            fi
-            sleep 3
-          done
-          if [ -z "$check_run_id" ]; then
-            echo "::error::Required checks dispatch was not observed for $CANDIDATE_SHA"
-            exit 1
-          fi
-
-          echo "check_run_id=$check_run_id" >> "$GITHUB_OUTPUT"
-          gh run watch "$check_run_id" --repo "$GITHUB_REPOSITORY" --exit-status
-
-  promote:
-    name: Compare-and-swap dev
-    needs: [prepare, gate]
-    if: needs.prepare.outputs.outcome == 'candidate' && needs.gate.result == 'success'
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          ref: main
-
-      - name: Fast-forward dev to the tested candidate
-        env:
-          BASE_DEV_SHA: ${{ needs.prepare.outputs.base_dev_sha }}
-          CANDIDATE_BRANCH: ${{ needs.prepare.outputs.candidate_branch }}
-          CANDIDATE_SHA: ${{ needs.prepare.outputs.candidate_sha }}
-          RELEASE_COMMIT: ${{ needs.prepare.outputs.release_commit }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          git fetch origin --no-tags \
-            "+refs/heads/dev:refs/remotes/origin/dev" \
-            "+refs/heads/$CANDIDATE_BRANCH:refs/remotes/origin/$CANDIDATE_BRANCH"
-          current_dev="$(git rev-parse origin/dev)"
-          remote_candidate="$(git rev-parse "origin/$CANDIDATE_BRANCH")"
-
-          if [ "$current_dev" != "$BASE_DEV_SHA" ]; then
-            echo "::error::dev moved from $BASE_DEV_SHA to $current_dev; rerun or open a reconciliation PR"
-            exit 1
-          fi
-          if [ "$remote_candidate" != "$CANDIDATE_SHA" ]; then
-            echo "::error::Candidate ref moved from $CANDIDATE_SHA to $remote_candidate"
-            exit 1
-          fi
-          if [ "$(git rev-parse "$CANDIDATE_SHA^1")" != "$BASE_DEV_SHA" ] || \
-             [ "$(git rev-parse "$CANDIDATE_SHA^2")" != "$RELEASE_COMMIT" ]; then
-            echo "::error::Candidate ancestry changed after verification"
-            exit 1
-          fi
-
-          # The explicit lease is the atomic stale-base guard. The update is a
-          # fast-forward from BASE_DEV_SHA; no unrelated history can be replaced.
-          git push \
-            --force-with-lease="refs/heads/dev:$BASE_DEV_SHA" \
-            origin "$CANDIDATE_SHA:refs/heads/dev"
-
-          git push origin --delete "$CANDIDATE_BRANCH" || \
-            echo "::warning::Could not remove temporary branch $CANDIDATE_BRANCH"
-
-          echo "## Release backmerge complete" >> "$GITHUB_STEP_SUMMARY"
-          echo "Fast-forwarded \`dev\` from \`$BASE_DEV_SHA\` to tested merge \`$CANDIDATE_SHA\`." >> "$GITHUB_STEP_SUMMARY"
-
-  fallback:
-    name: Report PR fallback
-    needs: [prepare, gate, promote]
-    if: always() && needs.prepare.outputs.outcome == 'candidate' && needs.promote.result != 'success'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Preserve safe fallback instructions
-        env:
-          CANDIDATE_BRANCH: ${{ needs.prepare.outputs.candidate_branch }}
-          CANDIDATE_SHA: ${{ needs.prepare.outputs.candidate_sha }}
-          CHECK_RUN_ID: ${{ needs.gate.outputs.check_run_id }}
-        run: |
-          echo "## Automatic backmerge stopped" >> "$GITHUB_STEP_SUMMARY"
-          echo "\`dev\` was not updated. Open or refresh a reconciliation PR after addressing the failed/stale gate." >> "$GITHUB_STEP_SUMMARY"
-          echo "- Candidate ref: \`${CANDIDATE_BRANCH:-not-created}\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Candidate SHA: \`${CANDIDATE_SHA:-n/a}\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Required-check run: \`${CHECK_RUN_ID:-n/a}\`" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cli.yml

@@ -1,594 +0,0 @@
-name: Hermes-Relay CLI+UI Release
-
-on:
-  push:
-    tags: ['desktop-v*']
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Approved CLI+UI version"
-        required: true
-        type: string
-
-permissions:
-  contents: write
-
-jobs:
-  validate-release:
-    name: Validate tag, branch, and version metadata
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: desktop
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('desktop-v{0}', inputs.version) || github.ref }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: '22'
-          cache: npm
-          cache-dependency-path: desktop/package-lock.json
-
-      - name: Install deps
-        run: npm ci
-
-      - name: Extract and validate tag version
-        id: version
-        shell: bash
-        env:
-          DISPATCHED_VERSION: ${{ inputs.version }}
-        run: |
-          set -euo pipefail
-          if [ -n "$DISPATCHED_VERSION" ]; then
-            version="$DISPATCHED_VERSION"
-          else
-            version="${GITHUB_REF_NAME#desktop-v}"
-          fi
-          if [ -z "$version" ] || { [ -z "$DISPATCHED_VERSION" ] && [ "$version" = "$GITHUB_REF_NAME" ]; }; then
-            echo "Expected a desktop-v* tag, got $GITHUB_REF_NAME" >&2
-            exit 1
-          fi
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          npm run check:version-sync -- --expect "$version"
-          if ! grep -Fq "## [$version]" ../CHANGELOG.md; then
-            echo "CHANGELOG.md has no release heading for $version" >&2
-            exit 1
-          fi
-
-      - name: Verify tag belongs to the correct integration branch
-        shell: bash
-        working-directory: .
-        env:
-          TAG_VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          set -euo pipefail
-          tag_commit="$(git rev-parse HEAD)"
-          if [[ "$TAG_VERSION" == *-* ]]; then
-            git fetch origin dev --no-tags
-            if ! git merge-base --is-ancestor "$tag_commit" origin/dev; then
-              echo "CLI+UI prereleases must be tagged from dev; $tag_commit is not in origin/dev" >&2
-              exit 1
-            fi
-          else
-            git fetch origin main --no-tags
-            if ! git merge-base --is-ancestor "$tag_commit" origin/main; then
-              echo "Stable CLI+UI releases must be tagged from main; $tag_commit is not in origin/main" >&2
-              exit 1
-            fi
-          fi
-
-  build-cli-binaries:
-    name: Build cross-platform CLI binaries via Bun compile
-    runs-on: ubuntu-latest
-    needs: validate-release
-    defaults:
-      run:
-        working-directory: desktop
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('desktop-v{0}', inputs.version) || github.ref }}
-
-      - name: Setup Node.js (for npm ci + tsc)
-        uses: actions/setup-node@v7
-        with:
-          node-version: '22'
-          cache: npm
-          cache-dependency-path: desktop/package-lock.json
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version-file: 'desktop/.bun-version'
-
-      - name: Install deps
-        run: npm ci
-
-      - name: Type-check
-        run: npm run type-check
-
-      - name: Test CLI
-        run: npm test
-
-      - name: Build dist/ (tsc)
-        run: npm run build
-
-      - name: Print Bun version (diagnostics)
-        run: bun --version
-
-      - name: Prepare binary output dir
-        run: mkdir -p dist/bin
-
-      # Keep the package.json scripts as the single source of truth for Bun
-      # compile flags so release and local smoke builds cannot diverge.
-      - name: Build Windows x64
-        run: npm run build:bin:win
-
-      - name: Build Linux x64
-        run: npm run build:bin:linux
-
-      - name: Build Linux arm64
-        run: npm run build:bin:linux-arm
-
-      - name: Build macOS x64
-        run: npm run build:bin:mac-x64
-
-      - name: Build macOS arm64
-        run: npm run build:bin:mac-arm
-
-      - name: Size guard (<150 MB each)
-        run: |
-          set -e
-          for f in dist/bin/hermes-relay-*; do
-            sz=$(stat -c%s "$f")
-            mb=$(( sz / 1024 / 1024 ))
-            echo "  $f - ${mb} MB"
-            if [ "$sz" -gt 157286400 ]; then
-              echo "FAIL: $f exceeds 150 MB - Bun likely shipped a debug build or we added a large dep."
-              exit 1
-            fi
-          done
-
-      - name: Smoke-test Linux binary
-        run: |
-          set -euo pipefail
-          chmod +x dist/bin/hermes-relay-linux-x64
-          for cmd in --version --help doctor; do
-            set +e
-            out=$(./dist/bin/hermes-relay-linux-x64 "$cmd" 2>&1)
-            exit_code=$?
-            set -e
-            if [ "$exit_code" -ne 0 ] || [ -z "$out" ] || [ ${#out} -lt 10 ]; then
-              echo "SMOKE FAIL: './hermes-relay-linux-x64 $cmd' failed or produced no output (exit=$exit_code)"
-              echo "Raw output was: [$out]"
-              exit 1
-            fi
-            echo "  smoke OK: $cmd -> $(echo "$out" | head -1)"
-          done
-
-      - name: Verify Linux arm64 artifact architecture
-        run: |
-          set -euo pipefail
-          file dist/bin/hermes-relay-linux-arm64 | tee /tmp/hermes-relay-linux-arm64.file
-          grep -Eq 'ELF 64-bit.*(ARM aarch64|ARM64)' /tmp/hermes-relay-linux-arm64.file
-
-      - name: Upload CLI release assets
-        uses: actions/upload-artifact@v4
-        with:
-          name: cli-binaries
-          path: |
-            desktop/dist/bin/hermes-relay-win-x64.exe
-            desktop/dist/bin/hermes-relay-linux-x64
-            desktop/dist/bin/hermes-relay-linux-arm64
-            desktop/dist/bin/hermes-relay-darwin-x64
-            desktop/dist/bin/hermes-relay-darwin-arm64
-          retention-days: 7
-
-  smoke-windows-cli-release-asset:
-    name: Smoke exact Windows CLI release asset
-    runs-on: windows-latest
-    needs:
-      - validate-release
-      - build-cli-binaries
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          name: cli-binaries
-          path: release-assets
-
-      - name: Repeated launch and process cleanup gate
-        shell: pwsh
-        env:
-          EXPECTED_DESKTOP_VERSION: ${{ needs.validate-release.outputs.version }}
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $exe = (Resolve-Path 'release-assets/hermes-relay-win-x64.exe').Path
-          1..20 | ForEach-Object {
-            $output = & $exe --version
-            if ($LASTEXITCODE -ne 0) { throw "Windows CLI smoke failed with exit $LASTEXITCODE" }
-            if ($output -ne "hermes-relay $env:EXPECTED_DESKTOP_VERSION") {
-              throw "Unexpected Windows CLI version output: $output"
-            }
-          }
-          Start-Sleep -Milliseconds 500
-          $leftovers = Get-CimInstance Win32_Process | Where-Object {
-            $_.ExecutablePath -eq $exe
-          }
-          if ($leftovers) {
-            throw "Windows CLI smoke left $(@($leftovers).Count) process(es) behind"
-          }
-
-  smoke-macos-cli-release-asset:
-    name: Smoke exact macOS CLI release asset
-    runs-on: macos-latest
-    needs:
-      - validate-release
-      - build-cli-binaries
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          name: cli-binaries
-          path: release-assets
-
-      - name: Launch native release asset and inspect both architectures
-        env:
-          EXPECTED_DESKTOP_VERSION: ${{ needs.validate-release.outputs.version }}
-        run: |
-          set -euo pipefail
-          case "$(uname -m)" in
-            x86_64) native_asset=hermes-relay-darwin-x64 ;;
-            arm64) native_asset=hermes-relay-darwin-arm64 ;;
-            *) echo "Unsupported macOS runner architecture: $(uname -m)" >&2; exit 1 ;;
-          esac
-          chmod +x "release-assets/$native_asset"
-          version_output=$("release-assets/$native_asset" --version)
-          test "$version_output" = "hermes-relay $EXPECTED_DESKTOP_VERSION"
-          "release-assets/$native_asset" --help | grep -Fq 'Usage:'
-          file release-assets/hermes-relay-darwin-x64 | grep -Fq 'x86_64'
-          file release-assets/hermes-relay-darwin-arm64 | grep -Eq '(arm64|arm64e)'
-
-  smoke-linux-arm64-cli-release-asset:
-    name: Smoke exact Linux arm64 CLI release asset
-    runs-on: ubuntu-24.04-arm
-    needs:
-      - validate-release
-      - build-cli-binaries
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          name: cli-binaries
-          path: release-assets
-
-      - name: Launch native arm64 release asset
-        env:
-          EXPECTED_DESKTOP_VERSION: ${{ needs.validate-release.outputs.version }}
-        run: |
-          set -euo pipefail
-          asset=release-assets/hermes-relay-linux-arm64
-          test "$(uname -m)" = "aarch64"
-          chmod +x "$asset"
-          version_output=$("$asset" --version)
-          test "$version_output" = "hermes-relay $EXPECTED_DESKTOP_VERSION"
-          "$asset" --help | grep -Fq 'Usage:'
-          file "$asset" | grep -Eq 'ELF 64-bit.*(ARM aarch64|ARM64)'
-
-  build-windows-tray-installer:
-    name: Build Windows tray installer
-    runs-on: windows-latest
-    needs: validate-release
-    defaults:
-      run:
-        working-directory: desktop
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('desktop-v{0}', inputs.version) || github.ref }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: '22'
-          cache: npm
-          cache-dependency-path: |
-            desktop/package-lock.json
-            desktop/tray/package-lock.json
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version-file: 'desktop/.bun-version'
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Restore exact-source tray build cache
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry/index
-            ~/.cargo/registry/cache
-            ~/.cargo/git/db
-            desktop/tray/target
-          key: ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-${{ hashFiles('desktop/tray/Cargo.toml', 'desktop/tray/build.rs', 'desktop/tray/src/**/*.rs') }}
-          restore-keys: |
-            ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-
-
-      - name: Install deps
-        run: npm ci && npm --prefix tray ci
-
-      - name: Type-check
-        run: npm run type-check
-
-      - name: Build dist/ (tsc)
-        run: npm run build
-
-      - name: Check and lint tray shell
-        run: npm run tray:fmt && npm run tray:lint
-
-      - name: Test tray shell
-        run: npm run tray:test
-
-      - name: Install NSIS
-        run: choco install nsis --yes --no-progress
-
-      - name: Build tray installer
-        run: npm run tray:build
-
-      - name: Smoke-test tray exe launch
-        shell: pwsh
-        run: |
-          # $HOME is a read-only automatic variable in PowerShell (names are
-          # case-insensitive), so use a distinct scratch name; only the
-          # $env:HOME / $env:USERPROFILE environment vars are writable.
-          $smokeHome = Join-Path $env:RUNNER_TEMP 'hermes-tray-smoke-home'
-          New-Item -ItemType Directory -Force -Path $smokeHome | Out-Null
-          $env:USERPROFILE = $smokeHome
-          $env:HOME = $smokeHome
-          $env:HERMES_RELAY_CLI_PATH = (Resolve-Path dist/bin/hermes-relay-win-x64.exe).Path
-          $proc = Start-Process -FilePath tray/target/release/hermes-relay-tray.exe -WindowStyle Hidden -PassThru
-          Start-Sleep -Seconds 5
-          if ($proc.HasExited) { throw "tray app exited early with code $($proc.ExitCode)" }
-          $traySize = (Get-Item tray/target/release/hermes-relay-tray.exe).Length
-          if ($traySize -le 0) { throw 'tray executable is empty' }
-          Stop-Process -Id $proc.Id -Force
-          Write-Host "management tray launch smoke OK pid=$($proc.Id) bytes=$traySize"
-
-      - name: Smoke-test packaged installer lifecycle
-        shell: pwsh
-        env:
-          EXPECTED_DESKTOP_VERSION: ${{ needs.validate-release.outputs.version }}
-        run: |
-          $ErrorActionPreference = 'Stop'
-
-          function Normalize-UserPath([string]$Value) {
-            return (@($Value -split ';' | Where-Object { $_ }) -join ';')
-          }
-
-          function Get-RawUserPath {
-            $environmentKey = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Environment')
-            if ($null -eq $environmentKey) { return '' }
-            try {
-              return [string]$environmentKey.GetValue(
-                'Path',
-                '',
-                [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames
-              )
-            } finally {
-              $environmentKey.Dispose()
-            }
-          }
-
-          $setup = (Resolve-Path 'dist/tray/hermes-relay-windows-x64-setup.exe').Path
-          $smokeRoot = Join-Path $env:RUNNER_TEMP 'hermes-installer-lifecycle-smoke'
-          $smokeProfile = Join-Path $smokeRoot 'profile'
-          $installDir = Join-Path $smokeRoot 'installed files'
-          $sessionDir = Join-Path $smokeProfile '.hermes'
-          $sessionSentinel = Join-Path $sessionDir 'remote-sessions.json'
-          $uninstaller = Join-Path $installDir 'uninstall-hermes-relay.exe'
-          $uninstallKey = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\HermesRelay'
-          $productKey = 'HKCU:\Software\HermesRelay'
-          $startupKey = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'
-          $startMenuDir = Join-Path $env:APPDATA 'Microsoft\Windows\Start Menu\Programs\Hermes-Relay CLI'
-          $oldUserProfile = $env:USERPROFILE
-          $oldHomeEnv = $env:HOME
-          $environmentKey = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Environment', $true)
-          $hadUserPath = $environmentKey.GetValueNames() -contains 'Path'
-          $originalUserPath = Get-RawUserPath
-          $originalUserPathKind = if ($hadUserPath) { $environmentKey.GetValueKind('Path') } else { $null }
-          $userPathBefore = 'C:\Windows\System32'
-          $environmentKey.Dispose()
-          $startupBefore = (Get-ItemProperty -Path $startupKey -Name HermesRelayTray -ErrorAction SilentlyContinue).HermesRelayTray
-
-          if (Test-Path $uninstallKey) { throw 'installer smoke requires a clean HermesRelay uninstall registry key' }
-          if (Test-Path $productKey) { throw 'installer smoke requires a clean HermesRelay product registry key' }
-          if (Test-Path $smokeRoot) { Remove-Item -LiteralPath $smokeRoot -Recurse -Force }
-          New-Item -ItemType Directory -Force -Path $sessionDir | Out-Null
-          Set-Content -LiteralPath $sessionSentinel -Value '{"sentinel":"preserve-me"}' -Encoding UTF8
-
-          $env:USERPROFILE = $smokeProfile
-          $env:HOME = $smokeProfile
-          try {
-            $environmentKey = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Environment', $true)
-            $environmentKey.SetValue('Path', $userPathBefore, [Microsoft.Win32.RegistryValueKind]::String)
-            $environmentKey.Dispose()
-
-            $installProcess = Start-Process -FilePath $setup -ArgumentList @('/S', "/D=$installDir") -Wait -PassThru
-            if ($installProcess.ExitCode -ne 0) { throw "installer exited with code $($installProcess.ExitCode)" }
-
-            $expectedFiles = @(
-              'hermes-relay.exe',
-              'hermes-relay-tray.exe',
-              'hermes-relay-ui.cmd',
-              'hermes-relay-path.ps1',
-              'uninstall-hermes-relay.exe'
-            )
-            foreach ($name in $expectedFiles) {
-              $path = Join-Path $installDir $name
-              if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
-                throw "packaged installer did not create $path"
-              }
-            }
-
-            $cli = Join-Path $installDir 'hermes-relay.exe'
-            $versionOutput = (& $cli --version | Out-String).Trim()
-            if ($LASTEXITCODE -ne 0) { throw "installed CLI --version exited with code $LASTEXITCODE" }
-            if ($versionOutput -ne "hermes-relay $env:EXPECTED_DESKTOP_VERSION") {
-              throw "installed CLI version mismatch: expected $env:EXPECTED_DESKTOP_VERSION, got '$versionOutput'"
-            }
-            $tray = Join-Path $installDir 'hermes-relay-tray.exe'
-            $trayVersion = (Get-Item -LiteralPath $tray).VersionInfo.ProductVersion
-            if ($trayVersion -ne $env:EXPECTED_DESKTOP_VERSION) {
-              throw "installed UI version mismatch: expected $env:EXPECTED_DESKTOP_VERSION, got '$trayVersion'"
-            }
-            $helpOutput = (& $cli --help | Out-String)
-            if ($LASTEXITCODE -ne 0 -or $helpOutput -notmatch 'Usage:') {
-              throw 'installed CLI --help smoke failed'
-            }
-            if (-not (Test-Path -LiteralPath $sessionSentinel -PathType Leaf)) {
-              throw 'installer removed profile session data'
-            }
-
-            $uninstallProcess = Start-Process -FilePath $uninstaller -ArgumentList '/S' -Wait -PassThru
-            if ($uninstallProcess.ExitCode -ne 0) { throw "uninstaller exited with code $($uninstallProcess.ExitCode)" }
-
-            $deadline = [DateTime]::UtcNow.AddSeconds(20)
-            while ((Test-Path -LiteralPath $uninstaller) -and [DateTime]::UtcNow -lt $deadline) {
-              Start-Sleep -Milliseconds 250
-            }
-            foreach ($name in $expectedFiles) {
-              $path = Join-Path $installDir $name
-              if (Test-Path -LiteralPath $path) { throw "uninstaller left owned artifact $path" }
-            }
-            if (Test-Path $uninstallKey) { throw 'uninstaller left the Installed Apps registry key' }
-            if (Test-Path $productKey) { throw 'uninstaller left the HermesRelay product registry key' }
-            if (Test-Path -LiteralPath $startMenuDir) { throw "uninstaller left Start-menu artifacts at $startMenuDir" }
-            if (-not (Test-Path -LiteralPath $sessionSentinel -PathType Leaf)) {
-              throw 'uninstaller removed preserved profile session data'
-            }
-            if ((Get-Content -LiteralPath $sessionSentinel -Raw) -notmatch 'preserve-me') {
-              throw 'installer lifecycle modified preserved profile session data'
-            }
-
-            # Compare the raw registry value so expandable entries such as
-            # %USERPROFILE% are not resolved against the isolated smoke profile.
-            $userPathAfter = Normalize-UserPath (Get-RawUserPath)
-            if ($userPathAfter -ne $userPathBefore) {
-              throw "uninstaller did not restore user PATH (before='$userPathBefore', after='$userPathAfter')"
-            }
-            $startupAfter = (Get-ItemProperty -Path $startupKey -Name HermesRelayTray -ErrorAction SilentlyContinue).HermesRelayTray
-            if ($startupAfter -ne $startupBefore) {
-              throw "installer lifecycle changed the pre-existing tray startup preference"
-            }
-
-            Write-Host "packaged installer lifecycle smoke OK cli=$versionOutput ui=$trayVersion install=$installDir"
-          } finally {
-            Get-Process -Name 'hermes-relay-tray' -ErrorAction SilentlyContinue |
-              Stop-Process -Force -ErrorAction SilentlyContinue
-            if (Test-Path -LiteralPath $uninstaller) {
-              Start-Process -FilePath $uninstaller -ArgumentList '/S' -Wait | Out-Null
-            }
-            $env:USERPROFILE = $oldUserProfile
-            $env:HOME = $oldHomeEnv
-            $environmentKey = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Environment', $true)
-            if ($hadUserPath) {
-              $environmentKey.SetValue('Path', $originalUserPath, $originalUserPathKind)
-            } else {
-              $environmentKey.DeleteValue('Path', $false)
-            }
-            $environmentKey.Dispose()
-            if (Test-Path -LiteralPath $smokeRoot) {
-              Remove-Item -LiteralPath $smokeRoot -Recurse -Force -ErrorAction SilentlyContinue
-            }
-          }
-
-      - name: Upload Windows tray release asset
-        uses: actions/upload-artifact@v4
-        with:
-          name: cli-windows-installer
-          path: desktop/dist/tray/hermes-relay-windows-x64-setup.exe
-          retention-days: 7
-
-  publish-release:
-    name: Publish GitHub Release
-    runs-on: ubuntu-latest
-    needs:
-      - validate-release
-      - build-cli-binaries
-      - smoke-windows-cli-release-asset
-      - smoke-macos-cli-release-asset
-      - smoke-linux-arm64-cli-release-asset
-      - build-windows-tray-installer
-    steps:
-      # Needed so CLI_RELEASE_NOTES.md is available to render into the release body
-      # (the other publish-release steps only consume downloaded build artifacts).
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('desktop-v{0}', inputs.version) || github.ref }}
-
-      - uses: actions/download-artifact@v8
-        with:
-          path: release-assets
-
-      - name: Generate SHA256SUMS
-        run: |
-          set -e
-          find release-assets -type f ! -name SHA256SUMS.txt -print0 \
-            | sort -z \
-            | xargs -0 sha256sum \
-            | sed -E 's#release-assets/[^/]+/##' > release-assets/SHA256SUMS.txt
-          cat release-assets/SHA256SUMS.txt
-
-      # Render CLI_RELEASE_NOTES.md (hand-written per release) into the GitHub
-      # Release body. __VERSION__ = bare version (0.3.0), __TAG__ = full tag
-      # (desktop-v0.3.0) so install/pin commands stay accurate without manual edits.
-      - name: Render release notes
-        env:
-          VERSION: ${{ needs.validate-release.outputs.version }}
-          TAG: desktop-v${{ needs.validate-release.outputs.version }}
-        run: |
-          sed -e "s/__VERSION__/${VERSION}/g" -e "s/__TAG__/${TAG}/g" \
-            CLI_RELEASE_NOTES.md > cli_release_notes_rendered.md
-          echo "=== rendered release body ===" && cat cli_release_notes_rendered.md
-
-      - name: Publish GitHub Release
-        uses: softprops/action-gh-release@v3
-        with:
-          name: Hermes-Relay CLI+UI v${{ needs.validate-release.outputs.version }}
-          tag_name: desktop-v${{ needs.validate-release.outputs.version }}
-          draft: false
-          prerelease: ${{ contains(needs.validate-release.outputs.version, '-') }}
-          fail_on_unmatched_files: true
-          body_path: cli_release_notes_rendered.md
-          files: |
-            release-assets/cli-binaries/hermes-relay-win-x64.exe
-            release-assets/cli-binaries/hermes-relay-linux-x64
-            release-assets/cli-binaries/hermes-relay-linux-arm64
-            release-assets/cli-binaries/hermes-relay-darwin-x64
-            release-assets/cli-binaries/hermes-relay-darwin-arm64
-            release-assets/cli-windows-installer/hermes-relay-windows-x64-setup.exe
-            release-assets/SHA256SUMS.txt
-
-  request-backmerge:
-    name: Request stable release backmerge
-    needs: [validate-release, publish-release]
-    if: ${{ !contains(needs.validate-release.outputs.version, '-') }}
-    permissions:
-      actions: write
-      contents: read
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dispatch fail-closed release reconciliation
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: desktop-v${{ needs.validate-release.outputs.version }}
-        run: |
-          gh workflow run release-backmerge.yml \
-            --repo "$GITHUB_REPOSITORY" \
-            --ref main \
-            -f release_tag="$RELEASE_TAG"

.github/workflows/release-desktop.yml

@@ -0,0 +1,241 @@
+name: Release Desktop
+
+on:
+  push:
+    tags: ['desktop-v*']
+
+permissions:
+  contents: write
+
+jobs:
+  build-cli-binaries:
+    name: Build cross-platform CLI binaries via Bun compile
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js (for npm ci + tsc)
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: desktop/package-lock.json
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.3.x'
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Type-check
+        run: npm run type-check
+
+      - name: Build dist/ (tsc)
+        run: npm run build
+
+      - name: Print Bun version (diagnostics)
+        run: bun --version
+
+      - name: Prepare binary output dir
+        run: mkdir -p dist/bin
+
+      # Keep the package.json scripts as the single source of truth for Bun
+      # compile flags so release and local smoke builds cannot diverge.
+      - name: Build Windows x64
+        run: npm run build:bin:win
+
+      - name: Build Linux x64
+        run: npm run build:bin:linux
+
+      - name: Build macOS x64
+        run: npm run build:bin:mac-x64
+
+      - name: Build macOS arm64
+        run: npm run build:bin:mac-arm
+
+      - name: Size guard (<150 MB each)
+        run: |
+          set -e
+          for f in dist/bin/hermes-relay-*; do
+            sz=$(stat -c%s "$f")
+            mb=$(( sz / 1024 / 1024 ))
+            echo "  $f - ${mb} MB"
+            if [ "$sz" -gt 157286400 ]; then
+              echo "FAIL: $f exceeds 150 MB - Bun likely shipped a debug build or we added a large dep."
+              exit 1
+            fi
+          done
+
+      - name: Smoke-test Linux binary
+        run: |
+          set -e
+          chmod +x dist/bin/hermes-relay-linux-x64
+          for cmd in --version --help doctor; do
+            out=$(./dist/bin/hermes-relay-linux-x64 "$cmd" 2>&1 || true)
+            exit_code=$?
+            if [ -z "$out" ] || [ ${#out} -lt 10 ]; then
+              echo "SMOKE FAIL: './hermes-relay-linux-x64 $cmd' produced no output (exit=$exit_code)"
+              echo "Raw output was: [$out]"
+              exit 1
+            fi
+            echo "  smoke OK: $cmd -> $(echo "$out" | head -1)"
+          done
+
+      - name: Upload CLI release assets
+        uses: actions/upload-artifact@v4
+        with:
+          name: desktop-cli-release
+          path: |
+            desktop/dist/bin/hermes-relay-win-x64.exe
+            desktop/dist/bin/hermes-relay-linux-x64
+            desktop/dist/bin/hermes-relay-darwin-x64
+            desktop/dist/bin/hermes-relay-darwin-arm64
+          retention-days: 7
+
+  build-windows-tray-installer:
+    name: Build Windows tray installer
+    runs-on: windows-latest
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: desktop/package-lock.json
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.3.x'
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Type-check
+        run: npm run type-check
+
+      - name: Build dist/ (tsc)
+        run: npm run build
+
+      - name: Test tray shell
+        run: npm run tray:test
+
+      - name: Build tray installer
+        run: npm run tray:build
+
+      - name: Normalize installer asset name
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path dist/tray | Out-Null
+          $installer = Get-ChildItem -Path tray/src-tauri/target/release/bundle/nsis -Filter '*_x64-setup.exe' | Select-Object -First 1
+          if (-not $installer) { throw 'NSIS installer was not produced' }
+          Copy-Item -Force $installer.FullName dist/tray/hermes-relay-desktop-windows-x64-setup.exe
+
+      - name: Smoke-test tray exe launch
+        shell: pwsh
+        run: |
+          $home = Join-Path $env:RUNNER_TEMP 'hermes-tray-smoke-home'
+          New-Item -ItemType Directory -Force -Path $home | Out-Null
+          $env:USERPROFILE = $home
+          $env:HOME = $home
+          $proc = Start-Process -FilePath tray/src-tauri/target/release/hermes-relay-desktop.exe -WindowStyle Hidden -PassThru
+          Start-Sleep -Seconds 5
+          if ($proc.HasExited) { throw "tray app exited early with code $($proc.ExitCode)" }
+          Stop-Process -Id $proc.Id -Force
+          Write-Host "tray launch smoke OK pid=$($proc.Id)"
+
+      - name: Upload Windows tray release asset
+        uses: actions/upload-artifact@v4
+        with:
+          name: desktop-windows-tray-release
+          path: desktop/dist/tray/hermes-relay-desktop-windows-x64-setup.exe
+          retention-days: 7
+
+  publish-release:
+    name: Publish GitHub Release
+    runs-on: ubuntu-latest
+    needs:
+      - build-cli-binaries
+      - build-windows-tray-installer
+    steps:
+      - name: Extract desktop version
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#desktop-v}" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: release-assets
+
+      - name: Generate SHA256SUMS
+        run: |
+          set -e
+          find release-assets -type f ! -name SHA256SUMS.txt -print0 \
+            | sort -z \
+            | xargs -0 sha256sum \
+            | sed -E 's#release-assets/[^/]+/##' > release-assets/SHA256SUMS.txt
+          cat release-assets/SHA256SUMS.txt
+
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          name: Hermes-Relay-Desktop v${{ steps.version.outputs.version }}
+          tag_name: ${{ github.ref_name }}
+          draft: false
+          prerelease: ${{ contains(steps.version.outputs.version, 'alpha') || contains(steps.version.outputs.version, 'beta') || contains(steps.version.outputs.version, 'rc') }}
+          fail_on_unmatched_files: true
+          body: |
+            # Hermes-Relay-Desktop v${{ steps.version.outputs.version }}
+
+            **Experimental phase.** Assets are unsigned - Windows SmartScreen and macOS Gatekeeper will warn on first launch. Windows now ships a tray installer as the primary desktop surface; CLI binaries remain available for terminal/headless use and for macOS/Linux.
+
+            ## Install
+
+            **Windows tray app (PowerShell):**
+            ```powershell
+            irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
+            ```
+
+            **Windows CLI only:**
+            ```powershell
+            $env:HERMES_RELAY_INSTALL_SURFACE='cli'; irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
+            ```
+
+            **macOS / Linux CLI:**
+            ```bash
+            curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.sh | sh
+            ```
+
+            Pin this specific release with `HERMES_RELAY_VERSION=${{ github.ref_name }}`.
+
+            ## Verify
+
+            ```text
+            hermes-relay --version
+            hermes-relay pair --remote ws://<host>:8767
+            hermes-relay shell
+            ```
+
+            Open **Hermes Relay Desktop** from the Windows Start menu for tray pairing, devices, task log, settings, pause, and emergency stop.
+
+            See [Desktop docs](https://codename-11.github.io/hermes-relay/desktop/) for full usage.
+
+          files: |
+            release-assets/desktop-cli-release/hermes-relay-win-x64.exe
+            release-assets/desktop-cli-release/hermes-relay-linux-x64
+            release-assets/desktop-cli-release/hermes-relay-darwin-x64
+            release-assets/desktop-cli-release/hermes-relay-darwin-arm64
+            release-assets/desktop-windows-tray-release/hermes-relay-desktop-windows-x64-setup.exe
+            release-assets/SHA256SUMS.txt

.github/workflows/release-plugin.yml

@@ -1,183 +0,0 @@
-name: Hermes-Relay Plugin Release
-
-on:
-  push:
-    tags:
-      - "server-v*"
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Approved Plugin version"
-        required: true
-        type: string
-
-permissions:
-  contents: write
-
-jobs:
-  validate:
-    name: Validate Plugin release
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('server-v{0}', inputs.version) || github.ref }}
-
-      - name: Extract version from tag
-        id: version
-        env:
-          DISPATCHED_VERSION: ${{ inputs.version }}
-        run: |
-          if [ -n "$DISPATCHED_VERSION" ]; then
-            version="$DISPATCHED_VERSION"
-          else
-            version="${GITHUB_REF#refs/tags/server-v}"
-          fi
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Verify Plugin version sync and changelog
-        run: |
-          python scripts/check-plugin-version-sync.py --expect "$TAG_VERSION"
-          if ! grep -Eq "^## \[Plugin ${TAG_VERSION}\]" CHANGELOG.md; then
-            echo "::error::CHANGELOG.md has no Plugin release heading for $TAG_VERSION"
-            exit 1
-          fi
-        env:
-          TAG_VERSION: ${{ steps.version.outputs.version }}
-
-      - name: Verify tag belongs to the correct integration branch
-        env:
-          TAG_VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          set -euo pipefail
-          tag_commit="$(git rev-parse HEAD)"
-          if [[ "$TAG_VERSION" == *-* ]]; then
-            git fetch origin dev --no-tags
-            if ! git merge-base --is-ancestor "$tag_commit" origin/dev; then
-              echo "Plugin prereleases must be tagged from dev; $tag_commit is not in origin/dev" >&2
-              exit 1
-            fi
-          else
-            git fetch origin main --no-tags
-            if ! git merge-base --is-ancestor "$tag_commit" origin/main; then
-              echo "Stable Plugin releases must be tagged from main; $tag_commit is not in origin/main" >&2
-              exit 1
-            fi
-          fi
-
-  test:
-    name: Test Plugin package
-    needs: validate
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('server-v{0}', inputs.version) || github.ref }}
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v7
-        with:
-          python-version: "3.11"
-
-      - name: Install test dependencies
-        run: |
-          pip install -r relay_server/requirements.txt
-          pip install pytest responses
-
-      - name: Syntax check
-        run: |
-          python -m py_compile plugin/relay/server.py
-          python -m py_compile plugin/relay/voice.py
-          python -m py_compile plugin/relay/upstream_voice.py
-          python -m py_compile plugin/relay/voice_auth.py
-          python -m py_compile plugin/tools/android_tool.py
-          python -m py_compile plugin/tools/desktop_tool.py
-          python -m py_compile relay_server/__init__.py relay_server/__main__.py
-
-      - name: Run focused Plugin tests
-        run: |
-          python -m pytest \
-            plugin/tests/test_manifest_compatibility.py \
-            plugin/tests/test_relay_security.py \
-            plugin/tests/test_voice_routes.py \
-            plugin/tests/test_session_grants.py \
-            plugin/tests/test_proactive_channel.py \
-            plugin/tests/test_android_phone_status.py \
-            plugin/tests/test_android_tool.py \
-            plugin/tests/test_android_navigate.py \
-            plugin/tests/test_phone_platform.py \
-            plugin/tests/test_desktop_tool_availability.py
-
-  package:
-    name: Build and publish Plugin package
-    needs: [validate, test]
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('server-v{0}', inputs.version) || github.ref }}
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v7
-        with:
-          python-version: "3.11"
-
-      - name: Build wheel and sdist
-        run: |
-          pip install build
-          python -m build
-
-      - name: Generate checksums
-        run: |
-          cd dist
-          sha256sum * > SHA256SUMS.txt
-          cat SHA256SUMS.txt
-
-      # Render PLUGIN_RELEASE_NOTES.md (hand-written per release) into the GitHub
-      # Release body, substituting the version token so the Install command stays
-      # accurate without a manual edit. The file is the single source of the notes;
-      # see RELEASE.md "Plugin / Python package release".
-      - name: Render release notes
-        env:
-          VERSION: ${{ needs.validate.outputs.version }}
-        run: |
-          sed "s/__VERSION__/${VERSION}/g" PLUGIN_RELEASE_NOTES.md > release_notes_rendered.md
-          echo "=== rendered release body ===" && cat release_notes_rendered.md
-
-      - name: Publish GitHub Release
-        uses: softprops/action-gh-release@v3
-        with:
-          name: Hermes-Relay Plugin v${{ needs.validate.outputs.version }}
-          tag_name: server-v${{ needs.validate.outputs.version }}
-          prerelease: ${{ contains(needs.validate.outputs.version, '-') }}
-          fail_on_unmatched_files: true
-          body_path: release_notes_rendered.md
-          files: |
-            dist/*.whl
-            dist/*.tar.gz
-            dist/SHA256SUMS.txt
-
-  request-backmerge:
-    name: Request stable release backmerge
-    needs: [validate, package]
-    if: ${{ !contains(needs.validate.outputs.version, '-') }}
-    permissions:
-      actions: write
-      contents: read
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dispatch fail-closed release reconciliation
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: server-v${{ needs.validate.outputs.version }}
-        run: |
-          gh workflow run release-backmerge.yml \
-            --repo "$GITHUB_REPOSITORY" \
-            --ref main \
-            -f release_tag="$RELEASE_TAG"

.github/workflows/release-server.yml

@@ -0,0 +1,118 @@
+name: Release Server
+
+on:
+  push:
+    tags:
+      - "server-v*"
+
+permissions:
+  contents: write
+
+jobs:
+  validate:
+    name: Validate Server release
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF#refs/tags/server-v}" >> "$GITHUB_OUTPUT"
+
+      - name: Verify Server version sync
+        run: python scripts/check-server-version-sync.py --expect "$TAG_VERSION"
+        env:
+          TAG_VERSION: ${{ steps.version.outputs.version }}
+
+  test:
+    name: Test Server package
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install test dependencies
+        run: |
+          pip install -r relay_server/requirements.txt
+          pip install pytest responses
+
+      - name: Syntax check
+        run: |
+          python -m py_compile plugin/relay/server.py
+          python -m py_compile plugin/relay/voice.py
+          python -m py_compile plugin/relay/upstream_voice.py
+          python -m py_compile plugin/relay/voice_auth.py
+          python -m py_compile plugin/tools/android_tool.py
+          python -m py_compile plugin/tools/desktop_tool.py
+          python -m py_compile relay_server/__init__.py relay_server/__main__.py
+
+      - name: Run focused Server tests
+        run: |
+          python -m pytest \
+            plugin/tests/test_relay_security.py \
+            plugin/tests/test_voice_routes.py \
+            plugin/tests/test_session_grants.py
+
+  package:
+    name: Build and publish Server package
+    needs: [validate, test]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Build wheel and sdist
+        run: |
+          pip install build
+          python -m build
+
+      - name: Generate checksums
+        run: |
+          cd dist
+          sha256sum * > SHA256SUMS.txt
+          cat SHA256SUMS.txt
+
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          name: Hermes-Relay-Server v${{ needs.validate.outputs.version }}
+          tag_name: server-v${{ needs.validate.outputs.version }}
+          prerelease: ${{ contains(needs.validate.outputs.version, '-') }}
+          fail_on_unmatched_files: true
+          body: |
+            # Hermes-Relay-Server v${{ needs.validate.outputs.version }}
+
+            This release contains the server/Python plugin package.
+            Android releases use `android-v*` tags. Desktop releases use
+            `desktop-v*` tags. Historical server releases before this lane
+            rename used `relay-v*` tags.
+
+            ## Install
+
+            ```bash
+            pip install hermes-relay==${{ needs.validate.outputs.version }}
+            ```
+
+            ## Verify
+
+            ```bash
+            python -m relay_server --help
+            ```
+          files: |
+            dist/*.whl
+            dist/*.tar.gz
+            dist/SHA256SUMS.txt

.github/workflows/review-bundle-report.yml

@@ -1,55 +0,0 @@
-name: Report Review Bundle
-
-on:
-  workflow_dispatch:
-    inputs:
-      run_id:
-        description: Completed Build Review Bundle run ID to report
-        required: true
-        type: string
-  workflow_run:
-    workflows:
-      - Build Review Bundle
-    types:
-      - completed
-
-permissions:
-  actions: read
-  contents: read
-  issues: write
-  pull-requests: write
-
-concurrency:
-  group: review-bundle-report-${{ github.event.workflow_run.id || inputs.run_id }}
-  cancel-in-progress: false
-
-jobs:
-  report:
-    if: >-
-      ${{
-        github.event_name == 'workflow_dispatch' ||
-        github.event.workflow_run.event == 'pull_request'
-      }}
-    name: Update pull request comment
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      # Check out only the trusted default branch. Never check out the PR head or
-      # execute/download its candidate artifact in this write-capable workflow.
-      - name: Checkout trusted reporter
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event.repository.default_branch }}
-          persist-credentials: false
-
-      - name: Test trusted reporter
-        run: node .github/scripts/review-bundle-report.test.cjs
-
-      - name: Report candidate status
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const reporter = require(
-              `${process.env.GITHUB_WORKSPACE}/.github/scripts/review-bundle-report.cjs`
-            );
-            await reporter.reportReviewBundle({ github, context, core });

.github/workflows/review-bundle.yml

@@ -1,198 +0,0 @@
-name: Build Review Bundle
-
-on:
-  pull_request:
-    branches:
-      - dev
-    types:
-      - labeled
-      - reopened
-      - synchronize
-
-permissions:
-  contents: read
-  pull-requests: read
-
-concurrency:
-  group: review-bundle-pr-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  resolve:
-    if: >-
-      ${{
-        (github.event.action == 'labeled' && github.event.label.name == 'review-candidate') ||
-        (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'review-candidate'))
-      }}
-    name: Resolve exact source
-    runs-on: ubuntu-latest
-    outputs:
-      repository: ${{ steps.source.outputs.repository }}
-      sha: ${{ steps.source.outputs.sha }}
-      short_sha: ${{ steps.source.outputs.short_sha }}
-      label: ${{ steps.source.outputs.label }}
-      artifact_slug: ${{ steps.source.outputs.artifact_slug }}
-      source_kind: ${{ steps.source.outputs.source_kind }}
-      source_value: ${{ steps.source.outputs.source_value }}
-    steps:
-      - name: Resolve exact pull request head
-        id: source
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const kind = "pull_request";
-            const source = process.env.PR_NUMBER;
-            const repository = process.env.PR_HEAD_REPOSITORY;
-            const sha = process.env.PR_HEAD_SHA;
-            if (!repository || !sha) {
-              core.setFailed("the PR head repository is no longer available");
-              return;
-            }
-            const label = `PR #${source}`;
-            const slug = `pr-${source}`;
-
-            core.setOutput("repository", repository);
-            core.setOutput("sha", sha);
-            core.setOutput("short_sha", sha.slice(0, 12));
-            core.setOutput("label", label);
-            core.setOutput("artifact_slug", slug);
-            core.setOutput("source_kind", kind);
-            core.setOutput("source_value", source);
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-
-  build:
-    name: Build matched Android + Relay bundle
-    needs: resolve
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    steps:
-      - name: Checkout exact review source
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ needs.resolve.outputs.repository }}
-          ref: ${{ needs.resolve.outputs.sha }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Verify immutable source
-        env:
-          EXPECTED_SHA: ${{ needs.resolve.outputs.sha }}
-        run: test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v6
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6.3.0
-        with:
-          cache-read-only: true
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v7
-        with:
-          python-version: "3.11"
-
-      - name: Build side-by-side candidate APK
-        env:
-          SOURCE_LABEL: ${{ needs.resolve.outputs.label }}
-          SOURCE_REF: ${{ needs.resolve.outputs.source_kind }}:${{ needs.resolve.outputs.source_value }}
-          SOURCE_SHA: ${{ needs.resolve.outputs.sha }}
-        run: |
-          ./gradlew :app:assembleSideloadCandidate \
-            -Pcandidate.kind=review \
-            -Pcandidate.label="$SOURCE_LABEL" \
-            -Pcandidate.sourceRef="$SOURCE_REF" \
-            -Pcandidate.sourceSha="$SOURCE_SHA" \
-            --console=plain
-
-      - name: Build Relay packages
-        run: |
-          python -m pip install build
-          python -m build
-
-      - name: Verify candidate application identity
-        run: |
-          apk="$(find app/build/outputs/apk/sideload/candidate -name '*.apk' -print -quit)"
-          test -n "$apk"
-          aapt="$(find "$ANDROID_HOME/build-tools" -type f -name aapt -print | sort -V | tail -1)"
-          test -x "$aapt"
-          "$aapt" dump badging "$apk" | grep -F "package: name='com.axiomlabs.hermesrelay.sideload.candidate'"
-          "$aapt" dump badging "$apk" | grep -F "application-label:'HR Candidate'"
-
-      - name: Assemble review bundle
-        env:
-          SOURCE_KIND: ${{ needs.resolve.outputs.source_kind }}
-          SOURCE_VALUE: ${{ needs.resolve.outputs.source_value }}
-          SOURCE_REPOSITORY: ${{ needs.resolve.outputs.repository }}
-          SOURCE_SHA: ${{ needs.resolve.outputs.sha }}
-          SOURCE_LABEL: ${{ needs.resolve.outputs.label }}
-          SHORT_SHA: ${{ needs.resolve.outputs.short_sha }}
-        run: |
-          mkdir -p review-bundle/android review-bundle/relay
-          cp app/build/outputs/apk/sideload/candidate/*.apk review-bundle/android/
-          cp dist/*.whl dist/*.tar.gz review-bundle/relay/
-          git archive \
-            --format=tar.gz \
-            --output="review-bundle/relay/hermes-relay-source-${SHORT_SHA}.tar.gz" \
-            HEAD plugin pyproject.toml relay_server
-          cp docs/review-candidates.md review-bundle/INSTALL.md
-          python - <<'PY'
-          import json
-          import os
-          from datetime import datetime, timezone
-          from pathlib import Path
-
-          manifest = {
-              "schema_version": 1,
-              "kind": "review",
-              "label": os.environ["SOURCE_LABEL"],
-              "source": {
-                  "kind": os.environ["SOURCE_KIND"],
-                  "value": os.environ["SOURCE_VALUE"],
-                  "repository": os.environ["SOURCE_REPOSITORY"],
-                  "sha": os.environ["SOURCE_SHA"],
-              },
-              "android": {
-                  "application_id": "com.axiomlabs.hermesrelay.sideload.candidate",
-                  "stable_install_affected": False,
-              },
-              "relay": {
-                  "side_by_side_in_same_hermes_process": False,
-                  "staging_or_snapshot_rollback_required": True,
-              },
-              "generated_at": datetime.now(timezone.utc).isoformat(),
-          }
-          Path("review-bundle/REVIEW_MANIFEST.json").write_text(
-              json.dumps(manifest, indent=2, sort_keys=True) + "\n",
-              encoding="utf-8",
-          )
-          PY
-          cd review-bundle
-          find android relay -type f -print0 | sort -z | xargs -0 sha256sum > SHA256SUMS.txt
-
-      - name: Upload matched review bundle
-        uses: actions/upload-artifact@v7
-        with:
-          name: hermes-relay-review-${{ needs.resolve.outputs.artifact_slug }}-${{ needs.resolve.outputs.short_sha }}
-          path: review-bundle/
-          if-no-files-found: error
-          retention-days: 14
-
-      - name: Review summary
-        env:
-          SOURCE_LABEL: ${{ needs.resolve.outputs.label }}
-          SOURCE_SHA: ${{ needs.resolve.outputs.sha }}
-        run: |
-          echo "## Hermes-Relay review bundle" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Source: **$SOURCE_LABEL**" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Commit: \`$SOURCE_SHA\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Android package: \`com.axiomlabs.hermesrelay.sideload.candidate\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Stable Android installs are not replaced." >> "$GITHUB_STEP_SUMMARY"
-          echo "- Relay review requires a staging Hermes instance or an explicit snapshot/rollback window." >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -24,14 +24,12 @@ Thumbs.db
 local.properties
 /build/
 /app/build/
-/experiments/quest/**/build/
+/relay-core/build/
+/relay-ui/build/
+/quest/build/
 /app/release/
 *.apk
 *.aab
-
-# Scratch / working directory (local pet packs, generated test assets, etc.)
-/tmp/
-/build-*.log
 *.jks
 *.keystore
 /captures
@@ -74,9 +72,6 @@ hermes-agent-fork/
 .claude/
 .claude-launcher/
 
-# Per-issue dev-loop brief generated by scripts/start-issue.sh into each worktree
-ISSUE-BRIEF.md
-
 # Kotlin compiler cache
 .kotlin/
 
@@ -88,8 +83,5 @@ keystore.properties
 .smoke-relay.pid
 .smoke-relay.log
 
-# Legacy generated desktop tray assets may remain after upgrading a worktree.
+# Generated tray frontend vendor assets copied from desktop/node_modules
 desktop/tray/ui/vendor/
-# Generated from assets/screenshots/02_chat.png before docs dev/build.
-/user-docs/public/chat-demo.png
-/user-docs/public/product/desktop-ui/

.mcp.json

@@ -1,8 +0,0 @@
-{
-  "mcpServers": {
-    "mobile-mcp": {
-      "command": "npx",
-      "args": ["-y", "@mobilenext/mobile-mcp@latest"]
-    }
-  }
-}

AGENTS.md

@@ -1,168 +0,0 @@
-# AGENTS.md
-
-Universal agent instructions for **Hermes-Relay**. This is the entry point for any
-coding agent (Claude Code, Codex, Cursor, etc.).
-
-## Read this first
-
-This file is the provider-neutral canonical agent context. Read it before
-touching code, then `docs/spec.md` and `docs/decisions.md`. Provider adapters
-such as **[CLAUDE.md](CLAUDE.md)** import this file instead of duplicating
-policy. They do not redefine the branch, release, hotfix, or verification
-contract here and in `RELEASE.md`.
-
-- Release process → **[RELEASE.md](RELEASE.md)**
-- Contributor setup → **[CONTRIBUTING.md](CONTRIBUTING.md)**
-- Gateway/session/reconnect testing → **[docs/gateway-contract-testing.md](docs/gateway-contract-testing.md)**
-- Android local/cloud verification → **[docs/android-build-lane.md](docs/android-build-lane.md)**
-- Android emulator lanes → **[docs/android-emulator-testing.md](docs/android-emulator-testing.md)** — suggest the smallest relevant API 36 lanes; never run the full matrix automatically
-- `android_*` toolset + MCP → **[docs/mcp-tooling.md](docs/mcp-tooling.md)**
-- Follow-ups / deferred work / known gaps → **[docs/project/TODO.md](docs/project/TODO.md)** (the single home for "what's next" — never DEVLOG, never scattered code comments)
-
-## Branch contract
-
-| Contract item | Canonical source or target |
-|---|---|
-| Integration branch | `dev`; normal feature, fix, docs, and chore PRs target `dev` |
-| Integration authority | `origin/dev`; local `dev` is a fast-forward-only mirror, never a private staging queue |
-| Release branch | `main`; release history and hotfix integration only |
-| Production tag source | The new `main` tip after an approved `dev` → `main` release PR, or after an approved hotfix PR to `main` |
-| Candidate tag source | An exact release-prepared and tested `dev` SHA; prerelease suffix required (`-alpha`, `-beta`, or `-rc.N`) |
-| Staging source | An exact tested `dev` SHA or release-candidate tag; staging is an environment, never a branch |
-| Production source | Immutable `android-v*`, `server-v*`, or `desktop-v*` tags, selected by surface |
-| Hotfix base | The immutable production tag for the affected surface |
-| Back-merge target | `dev`; stable hotfixes reconcile automatically when the exact tested merge is conflict-free, otherwise through a PR |
-
-Feature completion means merged and verified on `dev`; it does not mean
-released. A release train is separate work owned by a Forge release
-issue/session: reconcile only the affected surface version and notes on `dev`,
-open the `dev` → `main` release PR, tag the resulting `main` tip, publish the
-surface artifacts, deploy or roll out, and verify the live result. Never create
-a staging branch.
-
-A normal `dev` → `main` release needs no back-merge: the released integration
-parent is already in `dev`. A production-tag hotfix is different. After its
-stable release succeeds, `Release Backmerge` prepares a `dev`-first merge
-commit, runs the same path-aware required checks on that exact SHA, verifies
-that `dev` has not moved, and fast-forwards `dev`. Conflicts, failed checks,
-stale refs, or denied branch updates fail closed and require a reconciliation
-PR; never resolve those cases by choosing a side automatically.
-
-### Local integration discipline
-
-- Fetch `origin/dev` before creating a task branch or worktree; do not base new
-  work on a stale local `dev` ref.
-- Keep the primary local `dev` checkout tracked-clean and update it only with
-  `git merge --ff-only origin/dev`. Feature, fix, docs, release-prep, and
-  integration commits belong on their own branches and reach `dev` through PRs.
-- When several reviewed branches must move together, combine them on a named
-  `integration/<batch>` branch in its own worktree, then open one PR to `dev`.
-  An integration branch is not a second `dev` and must not become a hidden queue.
-- One coordinator owns final base refresh, required checks, and merges while
-  concurrent worktrees continue independently.
-
-## Non-negotiables (the short list)
-
-- **Vanilla Hermes path = upstream-only.** The standard (no-plugin) connection
-  uses the upstream Dashboard/Gateway for chat, authentication, Manage, sessions,
-  and Vanilla Hermes voice. The API server is an explicit API-only/headless
-  compatibility surface; Relay adds optional extensions. A Gateway-owned
-  conversation never changes transport because Gateway auth or reachability
-  changes. This
-  path must work against unmodified upstream hermes-agent. Server-side needs go
-  through upstream PRs or the optional relay plugin, never fork patches.
-- **Verify endpoints against upstream** (`gateway/platforms/api_server.py` /
-  `tui_gateway/server.py` in hermes-agent) before assuming a route exists.
-- **Use the Gateway contract lab when its boundary changes.** Changes to
-  Gateway chat events, session identity/resume/activation, streaming completion,
-  queue ownership, reconnect/lifecycle recovery, or authoritative history must
-  reuse or extend the declarative fixture scenarios, run the relevant Android
-  instrumentation when rendered/lifecycle behavior is affected, and run the
-  scenario manifest through current-upstream conformance. Physical ADB
-  certification is required only when device/runtime behavior is claimed. All
-  of these lanes are on demand; do not add scheduled execution without explicit
-  approval.
-- **Conventional Commits + `main`/`dev` branching.** Normal branches start at
-  current `origin/dev` and PR back to `dev`; merge commits/no-ff are the
-  repository policy.
-  Version bumps happen only on a release-prep branch targeting `dev`, and
-  production tags are cut only from `main`.
-- **Android:** Jetpack Compose only (no XML), kotlinx.serialization (no Gson),
-  OkHttp (no Ktor), `wss://` only. While editing, use only the narrow local
-  compile or focused test needed for feedback, through `scripts/android-lane.ps1`
-  on Windows. Once an exact commit is already pushed, prefer the `Android
-  On-Demand` workflow for lint, the focused shards, both-flavor assemblies, and
-  release smoke; isolated cloud jobs may run concurrently. Do not push solely
-  to obtain cloud compute without push authorization, and do not duplicate a
-  preset already running for the same SHA. Full local verification remains
-  available through `scripts/dev.bat prepush` (or `./scripts/dev.sh prepush`)
-  when explicitly wanted or when cloud execution is unavailable.
-  Physical-device checks and APK installation remain separately owned local
-  evidence.
-- **Plugin (Python 3.11+):** aiohttp + asyncio (no threading), type hints
-  everywhere, structured `logging` (no `print`). **Desktop CLI (Node ≥21):**
-  zero runtime deps, strict TS + ES modules, ship compiled `dist/`. Contributor
-  commands and the development loop live in `CONTRIBUTING.md`.
-
-## Review guidelines
-
-- Report only actionable correctness, security, compatibility, or release-risk
-  findings; avoid stylistic preferences unless they violate a documented rule.
-- Treat the vanilla Hermes upstream boundary as release-critical. Flag any
-  default-path dependency on relay-only or fork-only server behavior.
-- Check that changes preserve public-repo writing hygiene and do not expose
-  secrets, private infrastructure, or personal information.
-- Use the affected surface's CI result as evidence, but do not imply Android UI
-  or device behavior was proven without an explicit on-device verification.
-- Prioritize findings that warrant holding the merge. State the impacted path
-  and the concrete failure mode.
-
-## Automated public issue triage
-
-New public issues may receive one clearly labeled **Hermes-Relay automated
-triage** reply. That first response may classify the report with existing
-type/area labels, point to related issues or current code/docs, ask for safe
-sanitized diagnostics, and flag the thread for maintainer review.
-
-GitHub attributes that reply to the repository-scoped
-`hermes-relay-triage[bot]` App, never to a maintainer's personal account.
-
-The automated lane may assign only the fixed maintainer account `Codename-11`
-as follow-up ownership; that assignment does not imply acceptance, priority,
-implementation, or a release commitment. It never closes, milestones,
-prioritizes, promises a fix/release/timeline, chooses another assignee, or
-continues replying after its first response. A related issue is not
-automatically a duplicate. Human maintainer comments and decisions remain
-authoritative; read the complete live thread before acting on an issue.
-
-## Automated public PR intake
-
-New external-contributor, non-draft pull requests may receive one clearly
-labeled **Hermes-Relay automated PR intake** reply from
-`hermes-relay-triage[bot]`. Owner-authored `Codename-11` PRs and bot PRs are
-dropped before model dispatch. For eligible PRs, the intake compares the live PR
-metadata/body and changed-path list with trusted `origin/dev` policy and
-`.github/pull_request_template.md` without checking out or executing contributor
-code. It may add genuine area labels plus `documentation`, `ci`, or
-`needs-maintainer-review` and point out missing intake evidence.
-
-The automated lane never approves, requests changes, merges, closes, assigns,
-requests reviewers, milestones, prioritizes, pushes commits, edits PR text,
-reruns workflows, applies `review-candidate`, or claims code correctness. Human
-maintainer review and CI remain authoritative.
-
-## Public-repo writing hygiene
-
-Everything committed is public. In CHANGELOG, DEVLOG, README, docs, and release
-notes:
-
-- **No personal names** — attribute impersonally; identity lives in git + the
-  signing cert.
-- **No private infrastructure** — real hostnames/IPs, internal deployment names,
-  `~/SYSTEM.md`. (Generic example IPs in setup docs are fine.)
-- **No AI/assistant process self-narration** ("I should have…", course
-  corrections) — state the technical conclusion only.
-- **No internal jargon or fork/branch plumbing** in user-facing notes.
-- **CHANGELOG** uses Keep-a-Changelog grouping; condense the version block to
-  crisp public bullets at release-prep (see RELEASE.md §2 "Scrub for public
-  distribution"). **DEVLOG** is a depersonalized, factual engineering log.

CLAUDE.md

@@ -1 +1,419 @@
-@AGENTS.md
+# Hermes-Relay — Claude Code Context
+
+> Read this before touching code. Then read docs/spec.md and docs/decisions.md.
+
+## What This Is
+
+A native Android app (Kotlin + Jetpack Compose) paired with a Python relay server (aiohttp) for the Hermes agent platform. Chat connects directly to the Hermes API Server via HTTP/SSE; bridge and terminal use a relay over WSS.
+
+**Current state:** v0.8.0 (release-prep on `dev`) — Phase 0–3 complete. Direct API chat, session management, pairing + security (now multi-endpoint, ADR 24), inbound media, voice mode (stable Hermes Chat + Voice Output plus opt-in provider-native Realtime Agent with reliable low-latency playback and a text/mic Voice Lab), bridge/accessibility control, notification companion, safety rails, multi-Connection, agent profiles + inspector, connection diagnostics, and first-class Tailscale (ADR 25). Two product flavors: `googlePlay` (conservative, Bridge Core without Device Control) and `sideload` (full-capability).
+
+## Architecture
+
+```
+Phone (HTTP/SSE) → Hermes API Server (:8642)   [chat — direct]
+Phone (WSS)      → Relay Server (:8767)          [bridge, terminal]
+```
+
+Chat goes directly to the API server via HTTP/SSE. The API key (Bearer token) is optional — most local setups run without one. Terminal will go through tmux via the relay. Bridge wraps existing relay protocol. See docs/decisions.md for why.
+
+### Upstream Hermes API Reference
+
+**IMPORTANT:** Always verify endpoints against the actual hermes-agent source (`gateway/platforms/api_server.py`). The upstream repo is the source of truth — not our docs, not our memory, not assumptions from other frontends.
+
+**Standard endpoints (confirmed in hermes-agent source):**
+
+| Endpoint | Purpose | Tool Call Format |
+|----------|---------|-----------------|
+| `POST /v1/chat/completions` | OpenAI-compatible chat (stream=true for SSE) | Inline markdown text (`` `💻 terminal` ``) — no separate tool events |
+| `POST /v1/runs` | Start an agent run | Returns `run_id` |
+| `GET /v1/runs/{run_id}/events` | SSE stream of run lifecycle events | **Structured events**: `tool.started`, `tool.completed`, `message.delta`, `reasoning.available`, `run.completed`, `run.failed` |
+| `POST /v1/responses` | OpenAI Responses API format | Structured `function_call` objects (non-streaming only) |
+| `GET /v1/models` | List available models | — |
+| `GET /health` | Health check | — |
+| `GET/POST/PATCH/DELETE /api/jobs/*` | Cron job management (api_server surface) | — |
+
+**Baseline upstream endpoints vs compatibility endpoints:**
+
+Upstream hermes-agent now has a native baseline for API Server session control and skill/toolset discovery:
+
+1. **Native upstream** — commit [`f7527b0`](https://github.com/NousResearch/hermes-agent/commit/f7527b0fdb54f01691547df03fc65a6d367f9fde), merged via PR [#33134](https://github.com/NousResearch/hermes-agent/pull/33134), salvaged the focused session-control work from closed PR [#29302](https://github.com/NousResearch/hermes-agent/pull/29302). It provides `/api/sessions/*`, session chat/stream, fork/messages, plus `/v1/skills` and `/v1/toolsets`.
+2. **Codename-11 `axiom` fork** — still carries compatibility/client-metadata routes that upstream does not provide yet: `/api/sessions/search`, `/api/memory`, `/api/skills` detail routes, `/api/config`, and `/api/available-models`.
+3. **Bootstrap injection** (`hermes_relay_bootstrap/`) — monkey-patches aiohttp on startup via `.pth` file and injects only missing compatibility routes for older or partial upstream builds. It should remain per-route/per-feature, not all-or-nothing.
+
+| Endpoint | Purpose | Provided by |
+|----------|---------|-------------|
+| `GET /api/sessions` (CRUD) | Session list/create/rename/delete/fork | Native upstream OR fork OR bootstrap |
+| `GET /api/sessions/{id}/messages` | Conversation history | Native upstream OR fork OR bootstrap |
+| `GET /api/sessions/search` | Full-text message search | Fork OR bootstrap only |
+| `POST /api/sessions/{id}/chat/stream` | Session-based SSE chat | Native upstream OR fork only (NOT bootstrap) |
+| `GET /v1/skills` | Skill list metadata | Native upstream OR fork |
+| `GET /api/config`, `PATCH /api/config` | Personalities + model config | Fork OR bootstrap only |
+| `GET /api/skills`, `/{name}` | Legacy skill discovery/detail routes | Fork OR bootstrap only; Android prefers `/v1/skills` first |
+| `PUT /api/skills/toggle` | Enable/disable installed skill | `hermes_cli/web_server.py` dashboard surface; mirrored into bootstrap |
+| `GET/POST/PATCH/DELETE /api/memory` | Memory CRUD | Fork OR bootstrap only |
+| `GET /api/available-models` | Provider-aware model list | Fork OR bootstrap only |
+
+The Android client probes per-endpoint capability via `HermesApiClient.probeCapabilities()` (returns `ServerCapabilities`). When `streamingEndpoint = "auto"`, `ConnectionViewModel.resolveStreamingEndpoint()` picks `sessions` or `runs` based on the capability snapshot.
+
+**Dashboard web server (separate surface — loopback-only):**
+
+hermes-agent ships a second web server at `hermes_cli/web_server.py` that hosts the React admin dashboard at `hermes_cli/web_dist/`. It has its **own** `/api/*` routes that **do not live on `api_server.py`** — notably: `GET/PUT /api/config` (full tree), `GET /api/config/schema`, `GET /api/config/defaults`, `GET/PUT /api/config/raw` (YAML text), `GET/PUT/DELETE /api/env` + `POST /api/env/reveal`, `PUT /api/skills/toggle`, `/api/cron/jobs/*` (different shape from `/api/jobs/*`), `/api/providers/oauth/*`, `/api/dashboard/themes`, `/api/dashboard/plugins`, `/api/model/info`, `/api/logs`, `/api/analytics/usage`. Auth is a page-injected `window.__HERMES_SESSION_TOKEN__` — loopback-only, no external issuance. **Do not proxy this surface over the relay.** Phone consumes the narrower, fork/bootstrap `api_server.py` surface or relay-native profile-scoped endpoints.
+
+**Tool call rendering paths:**
+1. **Runs API** — Emits `tool.started`/`tool.completed` as real SSE events → `ToolProgressCard` in real-time.
+2. **Sessions API** — No structured tool events during streaming; reloads message history on stream complete ("session_end reload" pattern).
+3. **Annotation parser** — Fallback for servers emitting inline markdown annotations (`` `💻 terminal` ``).
+
+## Key Instructions
+- **Always verify upstream before assuming an endpoint exists.** Check `gateway/platforms/api_server.py` in hermes-agent. If an endpoint isn't there, document whether bootstrap injects it or it requires the fork.
+- If we use a non-standard endpoint, ensure `probeCapabilities()` covers it and the auto-resolver degrades gracefully.
+- **Bootstrap maintenance:** Do not remove `hermes_relay_bootstrap/` just because upstream has native sessions. It can start shrinking only after each Relay-consuming compatibility route has a native replacement or the Android/Desktop clients have migrated away from it.
+
+## Repository Layout
+
+```
+hermes-android/
+├── app/src/main/kotlin/com/hermesandroid/relay/
+│   ├── ui/                  # Screens, components, theme
+│   ├── network/             # ConnectionManager, ChannelMultiplexer, handlers
+│   ├── auth/                # AuthManager (pairing + tokens)
+│   ├── viewmodel/           # ChatViewModel, ConnectionViewModel
+│   ├── data/                # ChatMessage, ToolCall models, FeatureFlags
+│   ├── audio/               # VoiceRecorder, VoicePlayer, VoiceSfxPlayer
+│   ├── voice/               # VoiceViewModel, VoiceBridgeIntentHandler
+│   ├── accessibility/       # HermesAccessibilityService, ScreenReader, ActionExecutor
+│   ├── bridge/              # BridgeSafetyManager, BridgeForegroundService, BridgeStatusOverlay
+│   └── notifications/       # HermesNotificationCompanion
+├── desktop/                 ← Node thin-client CLI (`@hermes-relay/cli`)
+│   ├── bin/hermes-relay.js  # #!/usr/bin/env node shim → dist/cli.js
+│   ├── src/
+│   │   ├── cli.ts           # argv parser + subcommand dispatcher (bare → shell)
+│   │   ├── commands/        # chat, shell, pair, status, tools, devices
+│   │   ├── banner.ts        # contextual connect line (LAN / Tailscale / Plain / Secure)
+│   │   ├── renderer.ts      # GatewayEvent → plain-line stdout formatter (chat only)
+│   │   ├── endpoint.ts      # ADR 24 EndpointCandidate + role helpers
+│   │   ├── pairingQr.ts     # v3 QR decode + priority-raced reachability probe
+│   │   ├── pairing.ts       # readline 6-char prompt + payload validator
+│   │   ├── credentials.ts   # token → pair-qr → code → stored → prompt precedence
+│   │   ├── certPin.ts       # TOFU SPKI sha256 extract / pinKey / compare
+│   │   ├── tools/           # desktop.command router + fs/terminal/search handlers + consent
+│   │   ├── transport/       # RelayTransport (reconnect state machine + TLS probe TOFU)
+│   │   └── lib/             # gracefulExit, rpc, circularBuffer (vendored)
+│   └── scripts/             # install.sh + install.ps1 curl/iwr one-liners
+├── plugin/                  ← Hermes agent plugin
+│   ├── android_tool.py      # 18 android_* tool handlers
+│   ├── pair.py              # QR pairing implementation
+│   ├── relay/               # Canonical WSS relay (server.py, auth.py, channels/, media.py, voice.py)
+│   ├── tools/               # android_navigate.py, android_notifications.py
+│   └── dashboard/           # hermes-agent dashboard plugin — manifest, React UI, FastAPI proxy
+├── relay_server/            ← Thin compat shim → plugin.relay (legacy entrypoint)
+├── hermes_relay_bootstrap/  ← Runtime patch for vanilla/partial upstream compatibility routes
+├── skills/devops/hermes-relay-pair/  ← /hermes-relay-pair slash command
+├── scripts/                 ← dev.bat, bridge-smoke.sh, bump-version.sh
+└── docs/                    ← spec, decisions, security, relay-server, mcp-tooling
+```
+
+## Project Conventions
+
+### File Structure
+- **Root-level:** README.md, CLAUDE.md, AGENTS.md, DEVLOG.md, .gitignore
+- **docs/** — spec, decisions, security, and any other long-form documentation
+- **DEVLOG.md** — update at end of each work session with what was done, what's next, blockers
+- **CLAUDE.md hygiene:** Key Files entries must stay one line — implementation detail belongs in the file or `docs/`. Run `/revise-claude-md` after feature-heavy sessions to trim drift.
+
+### Code Style — Android (Kotlin)
+- **Jetpack Compose** — no XML layouts. Material 3 / Material You.
+- **kotlinx.serialization** — not Gson. Type-safe, faster.
+- **OkHttp** for WebSocket + SSE — `okhttp` for WSS relay, `okhttp-sse` for API streaming
+- **Single-activity** — Compose Navigation for all routing
+- **Namespace (Kotlin source tree):** `com.hermesandroid.relay` — stable, drives on-disk layout + class FQCNs
+- **applicationId:** `com.axiomlabs.hermesrelay` (googlePlay), `com.axiomlabs.hermesrelay.sideload` (sideload)
+- **Min SDK 26, Target SDK 35, Compile SDK 36** / **Kotlin 2.0+**, JVM toolchain 17
+
+### Code Style — Desktop CLI (Node/TypeScript)
+- **Node ≥21** — uses built-in global `WebSocket` (no `ws`/`undici` dep). Strict TS, ES modules, `NodeNext` resolution.
+- **Zero runtime deps** — `@types/node` + `tsx`/`rimraf`/`typescript` are devDeps only. Ship compiled `dist/`, not tsx.
+- **One binary, subcommands** — idiomatic for Node CLIs (codex, continue, vite pattern). Bare invocation is `chat`.
+- **Vendor-for-now** — transport/gateway/types are copied verbatim from `hermes-agent-tui-smoke/ui-tui/src/` with a header note. Extract to a shared package when the TUI and CLI stabilize.
+- **Dev loop:** `npx tsx src/cli.ts <args>` (no rebuild). `npm run build` + `npm link` before pushing to verify the bin shim. Never ship tsx in the published tarball — pre-build with `tsc` so Windows `npm install -g` can cmd-shim the JS directly.
+
+### Code Style — Server (Python)
+- **aiohttp** — async, matches existing Hermes relay patterns
+- **Type hints everywhere** — Python 3.11+ syntax
+- **asyncio** — no threading; **structured logging** — use `logging`, not print()
+
+### Git
+- **Conventional Commits:** `feat`, `fix`, `docs`, `refactor`, `test`, `chore`
+- **Branching model (as of 2026-04-19):** `main` + `dev`. Feature branches target `dev`, not `main`. `main` receives only release merges (and tags). No straight-to-main exemption — even single-file typos go through `dev`.
+- **Merge style:** `git merge --no-ff` — no squash. Preserves per-commit trail for agent-team branches on every merge in the chain (feature → dev → main).
+- **Merging ≠ releasing.** Feature branches land on `dev` continuously as CI goes green; each PR appends to `[Unreleased]` in `CHANGELOG.md` on `dev`. Releases are a separate act — cut when accumulated state is worth shipping, not per-feature. See `RELEASE.md` "When to cut a release."
+- **Version bumps happen on `dev`, then release-merge to `main`.** Bump only the surface being released: `scripts/bump-android-version.sh` for `android-vX.Y.Z`, `scripts/bump-server-version.sh` for `server-vX.Y.Z`, and `desktop/package.json` for `desktop-vX.Y.Z`. The release commit lives on `dev`, then a release PR merges `dev` → `main` with `--no-ff`, then the surface tag is cut from `main`.
+- **Server tracks `dev` for staging.** The hermes-host deployment pulls `dev` so merged features are exercised before they reach a tag. Released state lives on tags cut from `main`.
+- **Branch protection** on `main` — direct push blocked; only release-merge PRs from `dev` land here. `dev` also requires CI to pass on PRs but accepts feature-branch merges freely.
+
+### Testing
+- **Android:** JUnit + Compose testing for UI, MockK for mocks
+- **Python:** `python -m unittest plugin.tests.test_<name>` — avoid bare `pytest` (conftest imports `responses` which may not be installed in the venv)
+- **CI is split by path:** `.github/workflows/ci-android.yml` runs on app/Gradle changes; `.github/workflows/ci-server.yml` runs on plugin/Python changes. Both trigger on pushes to `main` and `dev` and on PRs targeting either. Build + tests must pass before merge to `dev`; release-merge to `main` requires the same.
+
+## Key Files
+
+| File | Why |
+|------|-----|
+| `docs/spec.md` | Full specification — protocol, UI layouts, phases, dependencies |
+| `docs/decisions.md` | Architecture decisions — framework choice, channel design, auth model |
+| `AGENTS.md` | Tool usage patterns for the `android_*` toolset |
+| `docs/mcp-tooling.md` | MCP server setup — android-tools-mcp + mobile-mcp |
+| **App — Core** | |
+| `ui/RelayApp.kt` | Main scaffold — bottom nav, Compose navigation |
+| `viewmodel/ChatViewModel.kt` | Chat orchestration — send, stream, cancel, slash commands |
+| `viewmodel/ConnectionViewModel.kt` | Dual connection model (API + relay); `resolveStreamingEndpoint()`; derived `relayUiState` flow + `markPaired` hook stamp the active Connection |
+| `viewmodel/RelayUiState.kt` | Shared sealed state for the relay row — 5 cases + `asBadgeState()` / `statusText()` extensions; 5s grace window before Stale |
+| `network/HermesApiClient.kt` | Direct HTTP/SSE — `sendRunStream()`, `sendChatStream()`, `probeCapabilities()` |
+| `network/ConnectionManager.kt` | WSS to relay with auto-reconnect; rebuilds OkHttpClient with fresh CertPinner on connect |
+| `network/ChannelMultiplexer.kt` | Envelope routing by channel; `sendNotification()` for notification outbound |
+| `network/handlers/ChatHandler.kt` | Chat message state, streaming events, tool annotation parser |
+| `network/models/SessionModels.kt` | Session, message, SSE event data models |
+| `data/FeatureFlags.kt` | Feature gating — DEV_MODE + DataStore overrides; `BuildFlavor` (googlePlay/sideload Tier flags) |
+| **App — Auth** | |
+| `auth/AuthManager.kt` | Wires SessionTokenStore + CertPinStore; parses auth.ok; `applyServerIssuedCodeAndReset()` |
+| `auth/SessionTokenStore.kt` | Keystore (StrongBox) + EncryptedSharedPrefs fallback; lossless migration on upgrade |
+| `auth/CertPinStore.kt` | TOFU cert pinning — SHA-256 SPKI per host:port in DataStore |
+| `auth/PairedSession.kt` | PairedSession state + PairedDeviceInfo wire model |
+| `data/Endpoint.kt` | `EndpointCandidate` / `ApiEndpoint` / `RelayEndpoint` — multi-endpoint pairing (ADR 24); `displayLabel()` for LAN/Tailscale/Public/Custom chips |
+| `network/RelayHttpClient.kt` | OkHttp for /media, /sessions (list/revoke/extend), /health |
+| **App — Bridge** | |
+| `network/handlers/BridgeCommandHandler.kt` | Routes `bridge.command` → ActionExecutor; full path inventory + safety-rail integration |
+| `viewmodel/BridgeViewModel.kt` | BridgeScreen VM — masterToggle, bridgeStatus, permissionStatus, activityLog |
+| `bridge/BridgeSafetyManager.kt` | Blocklist + destructive-verb confirmation + auto-disable timer; fails-closed on /call and /send_sms |
+| `data/BridgeSafetyPreferences.kt` | DataStore for blocklist, destructive verbs, auto-disable minutes, confirmation timeout |
+| `ui/screens/BridgeScreen.kt` | Bridge UI — master → permission checklist → [Advanced] → unattended → safety → activity log (v0.4.1 reorder) |
+| `ui/components/UnattendedAccessRow.kt` | Unattended toggle card (sideload); `enabled=masterEnabled`; inline `KeyguardDetectedAlert` |
+| `ui/components/UnattendedGlobalBanner.kt` | 28dp amber strip at scaffold top when master+unattended on (sideload); tap → Bridge tab |
+| `bridge/BridgeStatusOverlay.kt` | WindowManager overlay; `ConfirmationOverlayHost`; requires `SavedStateRegistryOwner` init order (CREATED→restore→RESUMED) |
+| `accessibility/HermesAccessibilityService.kt` | AccessibilityService subclass; `@Volatile instance` singleton for BridgeCommandHandler |
+| `accessibility/ScreenReader.kt` | UI tree → ScreenContent; `findNodeBoundsByText()`, `findFocusedInput()` |
+| `accessibility/ActionExecutor.kt` | Gesture/text dispatch via GestureDescription + ACTION_SET_TEXT; pressKey maps vocab only |
+| **App — Voice** | |
+| `voice/VoiceViewModel.kt` | Voice turn state machine; TTS queue; `ignoreAssistantId`; `errorEvents: SharedFlow` |
+| `audio/VoiceRecorder.kt` | MediaRecorder wrapper; perceptual amplitude curve; `.m4a` at 16kHz/64kbps |
+| `audio/VoicePlayer.kt` | Media3 ExoPlayer (gapless TTS queue) + Visualizer; amplitude StateFlow; `awaitCompletion()` via coroutine; `audioSessionId` is a thread-safe `@Volatile` cache |
+| `network/RelayVoiceClient.kt` | OkHttp for `/voice/transcribe`, `/synthesize`, `/config` |
+| `voice/VoiceBridgeIntentHandler.kt` | Interface routing voice utterances to bridge; impls per flavor via factory |
+| `voice/VoiceIntentClassifier.kt` | Regex phone-control classifier (sideload only); false-negatives preferred over false-positives |
+| `ui/components/VoiceModeOverlay.kt` | Full-screen voice UI — MorphingSphere + VoiceWaveform + mic button |
+| `ui/components/MorphingSphere.kt` | Compose renderer for the agent sphere — delegates math to `MorphingSphereCore` |
+| `ui/components/MorphingSphereCore.kt` | Platform-agnostic sphere algorithm (`kotlin.math` only) — single source of truth; mirrored byte-for-byte in `preview/web/sphere.js` |
+| `preview/web/` | Zero-dep browser harness — live `index.html` preview + `parity-check.mjs`; paired with `MorphingSphereCoreParityTest` (JVM) for struct/full checksum diffing |
+| `user-docs/.vitepress/theme/components/SphereMark.vue` | Docs-site sphere embed — imports `preview/web/sphere.js` directly; autonomous fbm drift + pointer-proximity gaze/state blend; `<ClientOnly>` + `IntersectionObserver` + `prefers-reduced-motion` aware |
+| **App — Media + Notifications** | |
+| `util/MediaCacheWriter.kt` | `cacheDir/hermes-media/` LRU writer; returns FileProvider URIs |
+| `ui/components/InboundAttachmentCard.kt` | Discord-style attachment card for images/video/audio/pdf/text/generic |
+| `data/HermesCard.kt` | `CARD:{json}` envelope (ADR 26) — type/accent/fields/actions; kotlinx.serialization |
+| `ui/components/HermesCardBubble.kt` | Rich-card renderer — accent stripe + FlowRow actions + dispatch stamp collapse |
+| `viewmodel/CardDispatchSyncBuilder.kt` | Twin of VoiceIntentSyncBuilder — synthesizes card dispatches as `hermes_card_action` OpenAI pairs for session memory |
+| `notifications/HermesNotificationCompanion.kt` | NotificationListenerService; cold-start buffer (50); forwards via ChannelMultiplexer |
+| `util/RelayErrorClassifier.kt` | `classifyError(Throwable, context) → HumanError`; used by Voice/Chat/Connection |
+| **Relay — Server** | |
+| `plugin/relay/server.py` | Canonical relay — WSS + HTTP routes; bridge, media, voice, session, pairing handlers. `handle_pairing_mint` mirrors `pair.py:762` — top-level = API server, `relay.{url,code}` nested |
+| `plugin/relay/auth.py` | PairingManager, SessionManager, RateLimiter; `math.inf` for never-expire |
+| `plugin/relay/channels/bridge.py` | Bridge handler — `handle_command()` mints request_id, awaits response, 30s timeout |
+| `plugin/relay/channels/notifications.py` | Bounded deque (100) of notification metadata; in-memory only |
+| `plugin/relay/media.py` | MediaRegistry — LRU token store; `strict_sandbox` off by default for `/media/by-path` |
+| `plugin/relay/voice.py` | Voice endpoints — transcribe, synthesize, voice_config; lazy tool imports |
+| `plugin/relay/qr_sign.py` | HMAC-SHA256 QR signing; secret at `~/.hermes/hermes-relay-qr-secret`; canonical form preserves `endpoints` array order + role strings verbatim (ADR 24) |
+| `plugin/relay/tailscale.py` | First-class Tailscale helper (ADR 25) — `status()` / `enable(port)` / `disable(port)` / `canonical_upstream_present()`; safe-absent via shell-out to `tailscale` CLI |
+| `plugin/relay/_env_bootstrap.py` | Loads `~/.hermes/.env` before relay imports; called from both entry points |
+| **Plugin — Tools + Installer** | |
+| `plugin/tools/android_tool.py` | 18 `android_*` tool handlers (14 baseline + send_sms, call, search_contacts, return_to_hermes); `android_screenshot` first consumer of `register_media()` |
+| `plugin/tools/android_navigate.py` | Vision-driven navigation loop; up to 20 iterations; `llm_gap` error until vision client wired |
+| `plugin/pair.py` | QR payload builder + CLI; `build_payload(sign=True)`; `--register-code` fallback |
+| `install.sh` | Canonical installer — 6 steps; idempotent; drops `hermes-relay-update` shim |
+| `uninstall.sh` | Canonical uninstaller; reverses install.sh; never touches `.env` or `state.db` |
+| `hermes_relay_bootstrap/` | Runtime patch for vanilla/partial upstream compatibility routes; shrink per route group after native parity or client migration |
+| **Plugin — Dashboard** | |
+| `plugin/dashboard/manifest.json` | Declares tab, entry bundle, and FastAPI module for hermes-agent discovery |
+| `plugin/dashboard/plugin_api.py` | FastAPI router proxying 5 routes to relay over loopback; `/pairing` body = API-server overrides (host/port/tls/api_key), relay URL auto-derived |
+| `plugin/dashboard/src/index.jsx` | React root registering `hermes-relay` plugin with 4-tab shell |
+| `plugin/dashboard/dist/index.js` | Committed IIFE bundle loaded verbatim by dashboard |
+| **Desktop CLI** | |
+| `desktop/package.json` | `@hermes-relay/cli` package manifest — Node ≥21, one `hermes-relay` bin, pre-built dist |
+| `desktop/bin/hermes-relay.js` | Tiny shim: `import('../dist/cli.js').then(m => m.main())` + error surfacing |
+| `desktop/src/chatAttach.ts` | captureClipboardImage / captureScreenshot / readImageFile; ships base64 to server via `image.attach.bytes` RPC before next prompt.submit |
+| `desktop/src/cli.ts` | argv parser + subcommand dispatcher — bare → `shell` (PTY), positional-only → `chat` |
+| `desktop/src/commands/chat.ts` | REPL + one-shot + piped-stdin; `runOneTurn` returns `{promise, cancel}` for safe SIGINT; auto-wires `DesktopToolRouter` when consented |
+| `desktop/src/commands/shell.ts` | Pipes the `terminal` relay channel to raw-mode stdin/stdout; post-attach `exec hermes` 350ms after tmux settles; `Ctrl+A .` detach / `Ctrl+A k` kill / `Ctrl+A Ctrl+A` literal |
+| `desktop/src/commands/pair.ts` | Either 6-char code + `--remote`, or full v3 QR via `--pair-qr` — probes + picks endpoint, records role; `--grant-tools` (TTY prompt) / `--auto-grant-tools` (silent) stamp `toolsConsented` so `daemon` works without a `shell` round-trip |
+| `desktop/src/commands/tools.ts` | `tools.list` RPC → enabled/available toolsets; `--verbose` lists individual tools |
+| `desktop/src/commands/status.ts` | Local read of `~/.hermes/remote-sessions.json`; renders `grants:` + `expires:` + `route:`; `--json` redacts tokens, `--reveal-tokens` opts in |
+| `desktop/src/commands/devices.ts` | Server-side session management — `GET/DELETE/PATCH /sessions` via `fetch` over http(s)://host:port; `list` / `revoke <prefix>` / `extend <prefix> --ttl <s>` |
+| `desktop/src/banner.ts` | `buildConnectBanner({url, meta, endpointRole})` → "Connected via LAN (plain) — server 0.6.0"; `humanExpiry()` for TTL formatting |
+| `desktop/src/endpoint.ts` | `EndpointCandidate` / `EndpointRole` types + `displayLabel()` — mirrors Android `data/Endpoint.kt` |
+| `desktop/src/pairingQr.ts` | `decodePairingPayload` (JSON or base64), `payloadToCandidates` (v3 verbatim / v1–v2 synthesized), `probeCandidatesByPriority` (`Promise.any` within tier, `AbortSignal.any`, 4s timeout, 60s cache) |
+| `desktop/src/certPin.ts` | `extractSpkiSha256(der)` via `crypto.X509Certificate` + `publicKey.export({type:'spki'})`; `pinKey(url)`, `comparePins()`, `isSecureUrl()` |
+| `desktop/src/tools/router.ts` | `DesktopToolRouter.attach(relay)` — `onChannel('desktop')` dispatch under 30s `AbortController`; heartbeat enriched with host/platform/version/uptime_ms + sticky `last_error` for `desktop_health` |
+| `desktop/src/tools/handlerSet.ts` | Single source of truth for the desktop tool map — `DESKTOP_HANDLERS` + `DESKTOP_ADVERTISED_TOOLS`; consumed by `chat.ts` / `shell.ts` / `daemon.ts` so adding a tool is a one-file change |
+| `desktop/src/tools/consent.ts` | `ensureToolsConsent(url)` — stored per-URL in `toolsConsented`; TTY prompt; non-TTY fails closed |
+| `desktop/src/tools/handlers/fs.ts` | `readFileHandler` / `writeFileHandler` / `patchHandler` — strict unified-diff applier, no fuzz |
+| `desktop/src/tools/handlers/terminal.ts` | `bash -lc` / `cmd /c`, SIGKILL on timeout or abort, returns `{stdout, stderr, exit_code, duration_ms}` |
+| `desktop/src/tools/handlers/powershell.ts` | Spawns `pwsh`/`powershell` directly with `-Command -`, script piped via stdin — no cmd.exe quote-mangling; auto-picks pwsh > powershell |
+| `desktop/src/tools/handlers/process.ts` | `spawn_detached` (unref'd, returns pid+log_path), `list_processes` (tasklist /FO CSV — no /V to dodge window-title latency), `kill_process`, `find_pid_by_port` (netstat/lsof/ss) |
+| `desktop/src/tools/handlers/jobs.ts` | Job API — `~/.hermes/desktop-jobs/<id>/{stdout.log, stderr.log, meta.json}` is source of truth across daemon restarts; `taskkill /T` on Windows so build trees die fully |
+| `desktop/src/tools/handlers/transfer.ts` | `copy_directory` via `fs.cp`, `zip`/`unzip` via tar > zip > PowerShell probe, `checksum` streamed (sha256/sha1/md5) |
+| `desktop/src/tools/handlers/search.ts` | ripgrep with pure-Node fallback, skips `.git`/`node_modules`/`dist`/`.next`/`.cache` |
+| `desktop/src/renderer.ts` | Streams `message.delta` → stdout, tool events → decorated lines; NO_COLOR / --json / --quiet aware |
+| `desktop/src/pairing.ts` | readline-based 6-char prompt (`A-Z0-9`); headless mirror of TUI's Ink prompt; `validatePairingPayloadString` discriminated-union wrapper |
+| `desktop/src/credentials.ts` | Precedence: `--token` → `--pair-qr` (probe+pair) → `--code` → stored → prompt; returns `Credentials{sessionToken?, pairingCode?, resolvedEndpoint?}` |
+| `desktop/src/transport/RelayTransport.ts` | Fork of ui-tui's transport + reconnect state machine (`idle/connecting/connected/reconnecting`, exp backoff 1→30s, 5min on 429, gate re-check post-sleep) + pre-WS TLS probe for TOFU |
+| `desktop/src/remoteSessions.ts` | Same file path as TUI (`~/.hermes/remote-sessions.json`, 0600); schema widened with `grants`, `ttlExpiresAt`, `endpointRole`, `toolsConsented`; `saveSession` back-compat overload |
+| `desktop/src/commands/daemon.ts` | Headless WSS + tool router for always-on access; JSON-line logs; fails closed on missing consent unless `--allow-tools` with explicit `--token` |
+| `desktop/src/commands/doctor.ts` | Local-only diagnostic report — version / binary path / PATH / sessions / daemon detection; `--json` for support-paste; omits tokens entirely |
+| `desktop/src/relayUrlPrompt.ts` | First-run URL fallback — `resolveFirstRunUrl()` auto-picks single stored session, numbered picker for multiple, welcome banner for zero; throws on non-interactive + ambiguous |
+| `desktop/src/version.ts` | Build-time-generated constant (`npm run gen:version` before every build) — Bun compiled binaries can't read package.json via `__dirname` so version is embedded at build |
+| `desktop/scripts/install.sh` / `install.ps1` | curl/iwr one-liner installers — download prebuilt Bun binary (no Node required), SHA256-verified, API-resolver for `latest` that includes prereleases, version-aware pre/post-install readback |
+| `desktop/scripts/uninstall.sh` / `uninstall.ps1` | 3-tier removal — default (binary + PATH), `--purge` (also wipes `~/.hermes/remote-sessions.json`), `--service` (stub for future service installers); Windows iex-safe env-var fallback |
+| `desktop/README.md` | User-facing install + usage reference |
+| **Desktop CLI — dev iteration** | |
+| `npm run smoke` (in `desktop/`) | Builds Windows binary + runs `--version` / `--help` / `doctor`, fails loud on zero-output. Local pre-flight before cutting any tag. |
+| `npm run gen:version` | Regenerates `src/version.ts` from `package.json`. Runs automatically before every `build` / `build:bin:*`. |
+| `release-desktop.yml → Smoke-test Linux binary` step | CI-side equivalent: runs compiled Linux binary through the same 3-command check before uploading assets. Catches silent-exit-0 + segfault classes. |
+| **Server — Desktop tool routing (Phase B)** | |
+| `plugin/relay/channels/desktop.py` | Mirrors `bridge.py` — `desktop.command`/`desktop.response`/`desktop.status`, UUID-correlated futures, 30s timeout, single-client MVP, per-session advertised-tools set |
+| `plugin/tools/desktop_tool.py` | 24 `desktop_*` tools (fs/shell/powershell/process/jobs/transfer/health) — registers with `tools.registry` under `desktop` toolset; per-tool `check_fn` pings `/desktop/_ping?tool=<name>`; `desktop_health` is `_RELAY_ONLY` and pings `/desktop/health` so it works even when the client is wedged |
+
+## What NOT to Do
+
+- **Don't use XML layouts** — Compose only
+- **Don't use Gson** — kotlinx.serialization
+- **Don't use Ktor for networking** — OkHttp for WebSocket
+- **Don't use plaintext WebSocket** — `wss://` only, even in development
+- **Don't put documentation in root** — long-form docs go in `docs/`
+- **Don't forget DEVLOG.md** — update it
+
+## MCP Tooling
+
+Two MCP servers are configured for AI-assisted development. See `docs/mcp-tooling.md` for full reference.
+
+| Server | Layer | Requires |
+|--------|-------|----------|
+| `android-tools-mcp` | IDE/Build — Compose previews, Gradle, code search, Android docs | Android Studio running with project open |
+| `mobile-mcp` | Device/Runtime — tap, swipe, screenshot, app management | ADB + connected device/emulator |
+
+## Dev Workflow
+
+```bash
+scripts/dev.bat build      # Build debug APK (DEV_MODE=true)
+scripts/dev.bat release    # Build signed release APK (DEV_MODE=false)
+scripts/dev.bat bundle     # Build release AAB for Google Play upload
+scripts/dev.bat run        # Build + install + launch + logcat
+scripts/dev.bat test       # Run unit tests
+scripts/dev.bat version    # Show current version from libs.versions.toml
+scripts/dev.bat relay      # Start relay server (dev mode, no SSL)
+```
+
+### Bridge smoke test (run on hermes-host, not local PC)
+
+```bash
+scripts/bridge-smoke.sh                   # full suite, destructive ON
+scripts/bridge-smoke.sh --no-destructive  # read-only paths only
+scripts/bridge-smoke.sh --filter open_app # re-run a single test
+scripts/bridge-smoke.sh --pair ABCDEF     # register pairing code first
+```
+
+Curls every bridge HTTP route via `localhost:8767`. Catches the silent-drop regression class (Python relay registers a route but Kotlin dispatcher's `when (path)` has no matching branch). Run after every relay restart.
+
+### Typical Dev Loop
+
+1. **Edit locally** — Windows checkout. Both plugin (`plugin/`) and app (`app/`) live here.
+2. **Python syntax check** — `python -m py_compile plugin/<file>.py`. Full tests run on the server.
+3. **Kotlin changes** — do NOT run `gradle build`. Bailey builds via Android Studio's ▶ button. Never `adb install` from Claude.
+4. **Before pushing Kotlin changes** — run `./gradlew lint` locally. It's the exact task CI runs (see `.github/workflows/ci.yml` → `gradlew lint` fallback) and catches errors Android Studio's live inspections miss — e.g. `UnsafeOptInUsageError` with `kotlin.OptIn` vs `androidx.annotation.OptIn`, `FlowOperatorInvokedInComposition` (mapped flows inside Composables), Media3 `@UnstableApi` propagation. Lint is a hard blocker in CI: Build + Test show "skipping" until lint passes, and lint prints only the **first failure** before aborting — so CI iterations reveal errors one at a time while a single local lint run surfaces all of them.
+5. **Commit + push** — feature branch off `dev`, merged back to `dev` via PR. `main` is reserved for release merges.
+6. **Pull + restart on server** — see Server Deployment below.
+7. **Test on phone** — Bailey builds from Studio, installs to Samsung device, pairs via `/hermes-relay-pair`.
+
+### Server Deployment
+
+Server is a Linux box running hermes-agent with hermes-relay editable-installed (`pip install -e`). Sensitive details (IP, user, secrets) in `~/SYSTEM.md` on the server — not in this repo.
+
+| What | Where |
+|---|---|
+| hermes-agent repo | `~/.hermes/hermes-agent/` |
+| hermes-relay clone | `~/.hermes/hermes-relay/` |
+| Plugin symlink | `~/.hermes/plugins/hermes-relay` → `~/.hermes/hermes-relay/plugin` |
+| Config | `~/.hermes/config.yaml` + `~/.hermes/.env` |
+| Relay log | `journalctl --user -u hermes-relay -f` |
+
+**Update:** `hermes-relay-update` (idempotent, re-fetches install.sh). Or manually: `git pull --ff-only && systemctl --user restart hermes-relay`.
+
+**Key conventions:**
+- Phone re-pairs after each relay restart (SessionManager is in-memory; wiped on restart)
+- Use `python -m unittest` not `pytest` — conftest imports `responses` which may not be installed
+- `_env_bootstrap.py` loads `~/.hermes/.env` on every relay start — no stale API keys
+
+### Where Python vs. Kotlin changes land
+
+| Change type | Who restarts? | Command |
+|---|---|---|
+| Plugin tool (`android_tool.py` etc.) | `hermes-gateway.service` | `systemctl --user restart hermes-gateway` |
+| Relay code (`plugin/relay/*.py`) | `hermes-relay.service` | `systemctl --user restart hermes-relay` |
+| Pair CLI / skill files | — | No restart — fresh process / scanned on invocation |
+| Android app | Bailey (Studio) | Studio run button |
+
+### Release Process
+
+See [RELEASE.md](RELEASE.md) for the full recipe.
+
+- **Version source:** `gradle/libs.versions.toml` (`appVersionName`, `appVersionCode`)
+- **Bump atomically:** `bash scripts/bump-version.sh <new-version>` — updates all three sources
+- **`appVersionCode` is monotonic** — always increment across prereleases
+- **Cut a release:** bump → commit → `git tag vMAJOR.MINOR.PATCH` → push tag → CI builds + GitHub Release
+- **Required secrets:** `HERMES_KEYSTORE_BASE64`, `HERMES_KEYSTORE_PASSWORD`, `HERMES_KEY_ALIAS`, `HERMES_KEY_PASSWORD`
+
+## Integration Points
+
+| Surface | Endpoint | Notes |
+|---------|----------|-------|
+| Chat streaming | `POST /v1/runs` → `GET /v1/runs/{id}/events` | Structured tool events; preferred |
+| Chat (sessions) | `POST /api/sessions/{id}/chat/stream` | No live tool events; reloads history on stream complete |
+| Chat (compat) | `POST /v1/chat/completions` (stream=true) | Inline tool annotations only |
+| Session CRUD | `GET/POST/PATCH/DELETE /api/sessions` | Non-standard; bootstrap or fork |
+| Pairing (QR) | `POST /pairing/register` (loopback only) | Via `/hermes-relay-pair` or `hermes-pair` shim; accepts optional `endpoints` for multi-endpoint QRs |
+| Pairing (multi-endpoint) | QR `endpoints` array (ADR 24) | `hermes: 3` schema; ordered `lan`/`tailscale`/`public`/... candidates; phone re-probes on network change |
+| Pairing auth | WSS `auth.ok` payload | Includes `expires_at`, `grants`, `transport_hint` |
+| Tailscale Serve (ADR 25) | `hermes-relay-tailscale enable\|disable\|status` CLI | Fronts loopback `:8767` with `tailscale serve --bg --https=<port>`; auto-retires on upstream PR #9295 |
+| Inbound media (token) | `GET /media/{token}` | Bearer auth; 24h TTL |
+| Inbound media (path) | `GET /media/by-path?path=<abs>` | Permissive by default; `RELAY_MEDIA_STRICT_SANDBOX=1` to restrict |
+| Session management | `GET /sessions`, `DELETE /sessions/{prefix}`, `PATCH /sessions/{prefix}` | List/revoke/extend; RelayHttpClient |
+| Voice transcribe | `POST /voice/transcribe` | multipart/form-data; bearer auth |
+| Voice synthesize | `POST /voice/synthesize` | JSON → audio/mpeg; max 5000 chars |
+| Voice config | `GET /voice/config` | Returns current tts/stt provider info |
+| Notifications | `GET /notifications/recent?limit=N` | Loopback callers skip bearer |
+| Relay health | `GET /health` on `:8767` | Used by `RelayHttpClient.probeHealth()` |
+| Capabilities | `HEAD /api/sessions`, `HEAD /v1/runs`, etc. | HEAD avoids CORS 403 on OPTIONS preflight |
+| Desktop CLI (tui channel) | WSS `tui.attach` / `tui.rpc.request` / `tui.rpc.event` | Same channel + envelopes as the Ink TUI — the CLI just renders events as plain lines. Zero server changes. |
+| Desktop CLI (terminal channel) | WSS `terminal.attach` / `terminal.input` / `terminal.output` / `terminal.resize` / `terminal.detached` | Existing channel (shared with Android). CLI `shell` subcommand attaches, injects `clear; exec hermes\n` 350ms after ack, pipes raw bytes. `Ctrl+A .` detaches (tmux preserved), `Ctrl+A k` kills. |
+| Desktop CLI tool visibility | `tools.list` RPC on the shared tui channel | Returns `{toolsets: [{name, description, tool_count, enabled, tools:[]}]}`; surfaced by `hermes-relay tools` |
+| Desktop CLI devices | HTTP `GET/DELETE/PATCH /sessions` on the relay's same port | Wrapped by `hermes-relay devices list | revoke <prefix> | extend <prefix> --ttl <s>`; bearer token from stored session; token prefix only (never full token) |
+| Desktop tool routing (Phase B) | WSS `desktop.command` (s→c) + `desktop.response` (c→s) + `desktop.status` (c→s heartbeat) | New channel. Hermes calls `desktop_read_file(path)` → Python handler POSTs to `/desktop/desktop_read_file` → relay forwards over `desktop.command` → Node client's `DesktopToolRouter` runs the handler locally → response bubbles back. Mirror of Android's `bridge.command` pattern. |
+| Desktop tool check_fn | HTTP `GET /desktop/_ping?tool=<name>` | Returns 200 if a client is connected AND advertises this tool; 503 otherwise. Hermes uses this to fail the tool quickly when no desktop client is live, instead of waiting 30s for the dispatch timeout. |
+| Desktop health | HTTP `GET /desktop/health` | Returns full status snapshot — connected/host/platform/version/pid/uptime/advertised_tools/last_error/recent_commands. Loopback-only. Backs the `desktop_health` agent tool, which intentionally does NOT round-trip through the client so it remains callable when other tools are wedged. |
+
+## Upstream References
+
+| Topic | Upstream File |
+|-------|--------------|
+| API endpoints | `gateway/platforms/api_server.py` — all registered HTTP routes |
+| Platform adapter interface | `gateway/platforms/base.py` — `BasePlatformAdapter` abstract class |
+| Adding a platform | `gateway/platforms/ADDING_A_PLATFORM.md` — 16-step checklist |
+| Platform registration | `gateway/run.py` → `_create_adapter()`, `gateway/config.py` → `Platform` enum |
+| Channel directory | `gateway/channel_directory.py` — how platforms/channels are enumerated |
+| Send message routing | `tools/send_message_tool.py` → `platform_map` dict |
+| SSE streaming (runs) | `gateway/platforms/api_server.py` → runs endpoint, `_on_tool_progress` |
+
+## Related Projects
+
+- **[hermes-agent](https://github.com/NousResearch/hermes-agent)** — the agent platform (gateway, WebAPI, plugin system)
+- **[android-tools-mcp](https://github.com/Codename-11/android-tools-mcp)** — our fork of Android Studio MCP bridge (Compose previews, Gradle, docs)
+- **[mobile-mcp](https://github.com/mobile-next/mobile-mcp)** — device control MCP server (ADB, tap/swipe, screenshots)

CLI_RELEASE_NOTES.md

@@ -1,46 +0,0 @@
-# Hermes-Relay CLI+UI v__VERSION__
-
-**Release Date:** 2026-09-02
-
-This beta fixes Windows updates so the installed CLI and management UI advance together. Explicit CLI-only installations keep their standalone update path.
-
-**Beta phase.** Assets remain unsigned, so Windows SmartScreen and macOS Gatekeeper may warn on first launch. Standalone CLI binaries ship for Windows x64, Linux x64/arm64, and macOS x64/arm64; the management UI is Windows-only.
-
-## What's changed
-
-### Fixed
-
-- `hermes-relay update` detects an installed management UI beside the CLI and reports both installed versions.
-- Bundle installations use the checksum-verified Windows installer to update and restart the affected CLI and UI together.
-- Explicit CLI-only installations continue to use the standalone binary updater.
-
-## Install
-
-**Windows CLI + management tray (PowerShell):**
-
-```powershell
-irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
-```
-
-**Windows CLI only:**
-
-```powershell
-$env:HERMES_RELAY_INSTALL_SURFACE='cli'; irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
-```
-
-**macOS / Linux CLI:**
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.sh | sh
-```
-
-Pin this release with `HERMES_RELAY_VERSION=__TAG__`.
-
-## Verify
-
-```text
-hermes-relay --version
-hermes-relay hosts list --json
-hermes-relay daemon start
-hermes-relay daemon status --json
-```

CODE_OF_CONDUCT.md

@@ -1,78 +0,0 @@
-# Code of Conduct
-
-Hermes-Relay adopts the [Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct/),
-version 2.1, as its code of conduct. The canonical, full text lives at that
-link; the summary below states what it means for this project.
-
-## Our Pledge
-
-We as members, contributors, and maintainers pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity and
-orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Behavior that helps create a positive environment includes:
-
-- Showing empathy and kindness toward others.
-- Being respectful of differing opinions, viewpoints, and experiences.
-- Giving and gracefully accepting constructive feedback.
-- Taking responsibility, apologizing to those affected by our mistakes, and
-  learning from the experience.
-- Focusing on what is best for the overall community, not just ourselves.
-
-Behavior that is not acceptable includes:
-
-- Harassment, intimidation, or discrimination in any form.
-- Personal or political attacks, insults, or derogatory comments.
-- Unwelcome advances or attention, including of a romantic or sexual nature.
-- Publishing others' private information (such as a physical or email address)
-  without their explicit permission.
-- Other conduct that could reasonably be considered inappropriate in a
-  professional setting.
-
-For the complete, canonical list of standards and examples, see the
-[Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
-
-## Enforcement Responsibilities
-
-Project maintainers are responsible for clarifying and enforcing these standards
-and will take appropriate and fair corrective action in response to any behavior
-they deem inappropriate, threatening, offensive, or harmful.
-
-Maintainers have the right and responsibility to remove, edit, or reject
-comments, commits, code, issues, and other contributions that are not aligned
-with this Code of Conduct, and will communicate reasons for moderation decisions
-when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all project spaces — the repository, issues,
-pull requests, discussions, and the documentation site — and also applies when
-an individual is officially representing the project in public spaces.
-
-## Reporting & Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported privately to the maintainers at **`conduct@codename-11.dev`**. All
-complaints will be reviewed and investigated promptly and fairly. Maintainers
-are obligated to respect the privacy and security of the reporter of any
-incident.
-
-For the **Enforcement Guidelines** (the tiered Correction → Warning →
-Temporary Ban → Permanent Ban ladder maintainers use to determine consequences),
-see the corresponding section of the
-[Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/#enforcement-guidelines).
-
-## Attribution
-
-This Code of Conduct is adapted from the
-[Contributor Covenant](https://www.contributor-covenant.org/), version 2.1.
-Community Impact Guidelines were inspired by
-[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).

CONTRIBUTING.md

@@ -17,80 +17,17 @@ That's it — no extra setup or credentials required for a debug build.
 Helper scripts for common development tasks:
 
 ```bash
-scripts/dev.bat build      # Build the sideload debug APK
-scripts/dev.bat compile    # Compile sideload Kotlin only
-scripts/dev.bat test-one "com.hermesandroid.relay.SomeTest"  # Run one test class
-scripts/dev.bat install-fast  # Build arm64 only + install + launch
+scripts/dev.bat build      # Build debug APK
 scripts/dev.bat release    # Build signed release APK
 scripts/dev.bat bundle     # Build release AAB for Google Play
-scripts/dev.bat run        # Build sideload + install + launch + logcat
-scripts/dev.bat test       # Run sideload debug unit tests
+scripts/dev.bat run        # Build + install + launch + logcat
+scripts/dev.bat test       # Run unit tests
 scripts/dev.bat version    # Show current version
 scripts/dev.bat relay      # Start relay server (dev, no TLS)
 ```
 
-### Review bundles
-
-Maintainers can produce a matched Android + Relay handoff for one pull request
-without cutting a release. Apply the `review-candidate` label to an open PR
-targeting `dev`. The short-lived artifact contains a side-by-side
-**HR Candidate** APK, Relay packages/source from the same exact PR commit,
-provenance, checksums, and install/rollback guidance. While the label remains
-applied, a new PR head commit automatically replaces any in-progress build with
-a bundle for the new head.
-For a first-time fork contributor, GitHub may hold the first run for explicit
-maintainer approval before any untrusted code executes.
-When an opted-in candidate run completes, a separate trusted reporter creates or
-updates one PR comment with the exact source SHA, artifact link, expiry, and
-concise install and rollback guidance. Skipped workflow shells for unlabeled PRs
-do not create comments.
-
-Review bundles never bump versions, create tags, upload to Play, or replace the
-stable Android app. Relay review still requires a staging Hermes instance or an
-explicit immutable snapshot/rollback window because two Relay plugins cannot
-own the same tools and hooks in one Hermes process. See
-[Review builds and release candidates](docs/review-candidates.md).
-
 Linux/macOS equivalent lives at `scripts/dev.sh`.
 
-### Fast Android iteration
-
-Gradle's daemon, local build cache, configuration cache, and parallel task
-execution are enabled for repeat local builds. Keep the same Gradle JVM
-configuration between invocations and do not add `--no-daemon` to normal dev
-commands; a different heap or Java home starts a separate daemon and discards
-the warm-process benefit.
-
-On Windows, all repository dev helpers serialize Android build and device work
-through one machine-wide lane shared by every Hermes-Relay worktree. Use
-`scripts/android-lane.ps1` for ad hoc Gradle, connected-test, and APK-install
-commands, and keep Android Studio idle while another owner holds the lane. For
-an exact commit that is already pushed, prefer the `Android On-Demand` workflow
-for heavy verification so concurrent worktrees use isolated GitHub-hosted
-runners. See [Android build execution](docs/android-build-lane.md) for cloud
-presets, the optional full local gate, status, and recovery modes.
-
-Use the narrowest command that proves the change:
-
-1. `scripts/dev.bat compile` for a Kotlin compile check.
-2. `scripts/dev.bat test-one "<fully-qualified-class-or-pattern>"` for a focused regression.
-3. `scripts/dev.bat install-fast` when the result must run on the connected
-   arm64 phone. This passes `-Phermes.devAbi=arm64-v8a`, avoiding the x86,
-   x86_64, and armeabi-v7a native libraries in the local APK.
-4. `Android On-Demand` after an exact commit is pushed for lint, broad checks,
-   assemblies, or release smoke.
-5. `scripts/dev.bat prepush` only when full local verification is explicitly
-   wanted or cloud execution is unavailable.
-
-Android release preparation uses `python scripts/android-prepush.py
---release-prep` while version notes are changing. It keeps local feedback to
-metadata and release-presentation tests; the exact pushed commit still goes
-through required CI and Play preflight before publication.
-
-`install-fast` is intentionally phone-specific. Use `install` for a universal
-sideload debug APK or when the target ABI is not arm64. Release builds remain
-universal and are unaffected unless `-Phermes.devAbi` is explicitly supplied.
-
 ## Repository Structure
 
 ```
@@ -114,30 +51,12 @@ The legacy `relay_server/` directory is a thin compatibility shim around `plugin
 
 | Component | Stack |
 |-----------|-------|
-| **Android App** | Kotlin 2.4, Jetpack Compose, Material 3, OkHttp |
+| **Android App** | Kotlin 2.0, Jetpack Compose, Material 3, OkHttp |
 | **Relay Server** | Python 3.11+, aiohttp |
 | **Serialization** | kotlinx.serialization |
-| **Build** | AGP 9.3.1, Gradle 9.6.1, JVM toolchain 17 |
+| **Build** | AGP 9, Gradle 8.13, JVM toolchain 17 |
 | **CI/CD** | GitHub Actions (lint, build, test, signed APK artifacts) |
-| **Min SDK** | 26 (Android 8.0) / Target SDK 36 |
-
-## Issues and automated triage
-
-New issues may receive one first response headed **Hermes-Relay automated
-triage**. It reads the live report against current code, documentation, related
-issues, and public release state; it may add existing type/area labels and ask
-for a focused, safe diagnostic such as the app version, interaction mode, or a
-sanitized log excerpt.
-
-GitHub displays the response as authored by `hermes-relay-triage[bot]`, a
-repository-scoped App rather than a maintainer's personal account.
-
-That reply is an acknowledgement and initial analysis, not a maintainer
-decision. The automated path may assign `Codename-11` as the fixed owner for
-follow-up, but assignment does not mean acceptance, priority, implementation,
-or a release commitment. It does not close issues, choose another assignee, set
-milestones or priority, promise a fix or release, or continue the conversation.
-A maintainer will follow up on the thread.
+| **Min SDK** | 26 (Android 8.0) / Target SDK 35 |
 
 ## Running the Relay Locally
 
@@ -173,137 +92,18 @@ After the plugin is in place, restart hermes and verify pairing with `hermes-pai
 
 We follow [Conventional Commits](https://www.conventionalcommits.org/): `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`.
 
-**Branching model: `main` + `dev`.** Feature branches — `feature/<name>`,
-`fix/<name>`, `docs/<name>`, `chore/<name>` — branch from current `origin/dev`
-and merge back into `dev` via merge-commit/no-ff PRs. This includes small
-documentation fixes.
-`main` is release history, not the normal contribution target; it receives
-approved release PRs from `dev` and focused hotfix PRs based on production tags.
+**Branching model (as of 2026-04-19): `main` + `dev`.** Feature branches — `feature/<name>`, `fix/<name>`, `docs/<name>`, `chore/<name>` — branch off `dev` and merge back into `dev` via `--no-ff` PRs. `main` is released state only; it receives release merges from `dev` and nothing else. There is no straight-to-main exemption — even single-file typos go through `dev`.
 
-Pull requests use [the repository template](.github/pull_request_template.md).
-Keep the body grounded: describe the outcome and focused changes, list exact
-verification, include visual evidence when applicable, state compatibility or
-risk, and preserve contributor lineage when replacing or salvaging prior work.
-Check an item when it is satisfied or when its N/A rationale is written in the
-body; do not use checked boxes as a substitute for evidence.
-
-New external-contributor, non-draft pull requests may receive one
-**Hermes-Relay automated PR intake** reply from `hermes-relay-triage[bot]`.
-Owner-authored `Codename-11` PRs and bot PRs skip this lane. For eligible PRs,
-the bot checks the live body, base branch, changed-path areas, template
-completeness, stated verification, visual proof, and lineage without checking
-out or executing contributor code. It may add bounded area/intake labels and
-identify missing evidence, but it does not review code correctness, approve,
-request changes, merge, close, assign, request reviewers, push commits, edit the
-PR, rerun workflows, or select review bundles.
-
-`origin/dev` is the canonical integration ref. Keep local `dev` as a clean,
-fast-forward-only mirror and create each task in its own branch/worktree from the
-current `origin/dev`. Do not accumulate unpublished commits on local `dev`. If a
-maintainer needs to combine several reviewed branches, use a temporary
-`integration/<batch>` branch and merge that branch through a normal PR to `dev`.
-See [docs/worktree-workflow.md](docs/worktree-workflow.md) for the concurrent
-worktree procedure.
-
-Feature completion means merged and verified on `dev`; it does not mean the
-change has been released. A separate Forge release issue/session owns release
-preparation, the `dev` → `main` release PR, tagging, artifacts, rollout or
-deployment, and live verification. Release-prep commits use a dedicated branch
-and PR into `dev`; tags are cut from the resulting `main` tip as
-`android-vX.Y.Z`, `server-vX.Y.Z`, or `desktop-vX.Y.Z`. See
-[RELEASE.md](RELEASE.md) for the full release and hotfix procedures.
-
-## Stale PR salvage and contributor credit
-
-A valuable pull request can become unsafe to merge when `dev` has materially
-changed around it. Maintainers may create a replacement **salvage PR** from the
-current `dev` instead of resolving a stale branch by choosing whole conflict
-sides.
-
-A salvage PR must:
-
-- Link the original PR and contributor in its title or opening summary.
-- Recover only the intended feature; unrelated fork, release, signing, and
-  generated migration changes stay out.
-- Preserve the original commit author when a substantive commit can be safely
-  cherry-picked.
-- Use a verified `Co-authored-by: Name <email>` trailer when the implementation
-  must be reconstructed or substantially rewritten.
-- Include a `Lineage` section listing source and superseded PRs, plus a concise
-  explanation of integration changes made for current `dev`.
-- Run current verification rather than relying on checks from the stale branch.
-- Leave a comment linking the replacement before the source PR is closed.
-
-The maintainer remains the committer for integration commits. The original
-contributor remains the author or co-author of the recovered work. Do not guess
-an email address: use the source commit's verified address or ask the
-contributor.
-
-## Localization contributions
-
-English resources are canonical and Android locale catalogs must retain exact
-resource and format-argument parity. Read [docs/localization.md](docs/localization.md)
-before changing user-facing strings or adding a language.
-
-Translation PRs should cover one locale or one clear catalog refresh. They must
-not include custom APK publishing, signing configuration, version bumps, or
-fork-specific branding. Run:
-
-```bash
-python scripts/check-android-locales.py
-./gradlew lint
-```
-
-Update `docs/localization-status.json` with the actual review level. AI-assisted
-translations may ship as `ai-translated`; do not claim fluent review unless a
-review reference is recorded. Focused correction PRs from fluent contributors
-are the canonical way to improve wording and can advance a locale to
-`community-reviewed` or `verified` under `docs/translation-playbook.md`.
-Translated README entrypoints live under `docs/readme/` as
-`README.<locale>.md`; root `README.md` remains the canonical project
-description. Keep translated entrypoints concise: summarize onboarding and
-core capabilities, link to localized user docs where available, and link back
-to English for fast-moving architecture, security, and operator detail. User
-docs may be added incrementally under `user-docs/<locale>/`, with links back to
-canonical English reference material.
-
-## Changelog & writing conventions
-
-This is a **public repo** — `CHANGELOG.md`, `docs/project/DEVLOG.md`, the README, and everything under `docs/` ship publicly. Keep them clean:
-
-- **`CHANGELOG.md`** follows [Keep a Changelog](https://keepachangelog.com/) (Added / Changed / Fixed). Append your change to the `## [Unreleased]` block in the PR. Entries can carry detail while they accumulate, but at release-prep the version block is **condensed to crisp public bullets** (1–2 lines each) — the deep "how we debugged it" narrative belongs in commit messages and `docs/project/DEVLOG.md`, not the public changelog.
-- **`docs/project/DEVLOG.md`** is a factual engineering log — what changed, why, and how it was verified. Keep it depersonalized and third-person; it's a record, not a diary.
-- **No non-public wording anywhere committed:** no personal names (attribute impersonally — identity lives in git history), no real server hostnames/IPs or internal deployment names, no AI/assistant process self-narration, no fork/branch plumbing in user-facing notes. Generic example IPs in setup docs are fine.
-
-Release notes (`RELEASE_NOTES.md`, `app/src/main/assets/whats_new.txt`, `docs/play-store-listing.md`) are theme-framed and user-facing; see [RELEASE.md](RELEASE.md) §2 "Scrub for public distribution" for the full checklist.
+Release-prep commits (version bump, changelog promotion) land on `dev` first, then a surface-specific release PR merges `dev` → `main` with `--no-ff`. Tags are cut from `main` after the merge: `android-vX.Y.Z`, `server-vX.Y.Z`, or `desktop-vX.Y.Z`. See [RELEASE.md](RELEASE.md) for the full release process.
 
 ## Testing
 
-- **Android cloud verification (preferred for pushed work):** dispatch the
-  registered `Required checks` workflow with an exact base/head SHA pair and
-  `android_preset` set to `focused`, `lint`, `assemble-debug`, `release-smoke`,
-  or `all-final`. It calls the reusable Android workflow from `dev`. Check for
-  an existing run before dispatching the same SHA/preset again. The four
-  `all-final` compute jobs use isolated runners and may execute concurrently.
-- **Full local Android gate (optional):** `scripts\dev.bat prepush` on Windows
-  or `./scripts/dev.sh prepush` on macOS/Linux. This retains the repository
-  checks, full Android lint, and both focused flavor shards for an explicit local
-  run or cloud outage. On Windows it acquires the machine-wide lane.
-- **Focused Android unit test:** `scripts/dev.bat test-one "<fully-qualified-class-or-pattern>"`
-- **Android unit tests:** `scripts/dev.bat test` (runs the sideload debug JUnit + MockK + Compose suite)
-- **Gateway contract lab:** [`docs/gateway-contract-testing.md`](docs/gateway-contract-testing.md)
-  covers the on-demand vanilla-Gateway fixture, Android instrumentation,
-  upstream conformance, and physical-device ADB certification. No contract or
-  device lane is scheduled automatically.
+- **Android unit tests:** `scripts/dev.bat test` (runs JUnit + MockK + Compose testing)
 - **Python tests:** `python -m unittest plugin.tests.test_<name>` from the repo root with the hermes-agent venv active. `pytest` works too but the pre-existing `conftest.py` imports a module that isn't always installed — `unittest` avoids that entirely.
 
-CI is split into path-filtered workflows: `.github/workflows/ci-android.yml` (lint + build + test on app/Gradle changes), `.github/workflows/ci-server.yml` (syntax check + focused server tests on plugin/Python changes), and `.github/workflows/ci-desktop.yml` (desktop type/build/smoke checks). They run on pushes to `main` and `dev` and on PRs targeting either when their paths are touched. The registered `ci-required.yml` dispatcher calls `android-on-demand.yml` as the trusted manual compute lane for an exact pushed commit; it does not replace required PR checks.
-Superseded Android runs on `dev` and PR refs are canceled automatically; `main`
-runs are never canceled because each release-branch commit must complete its
-independent validation.
+CI is split into path-filtered workflows: `.github/workflows/ci-android.yml` (lint + build + test on app/Gradle changes), `.github/workflows/ci-server.yml` (syntax check + focused server tests on plugin/Python changes), and `.github/workflows/ci-desktop.yml` (desktop type/build/smoke checks). They run on pushes to `main` and `dev` and on PRs targeting either when their paths are touched.
 
 ## Questions?
 
 - **Architecture context?** [docs/spec.md](docs/spec.md) covers protocols, UI layouts, and the channel model. [docs/decisions.md](docs/decisions.md) covers the forks in the road and why we picked what we did.
-- Need help or want to explore an early idea? Start a [GitHub Discussion](https://github.com/Codename-11/hermes-relay/discussions).
-- Found a reproducible bug or have a specific, actionable feature request? [Open an issue](https://github.com/Codename-11/hermes-relay/issues/new).
+- **Something unclear?** [Open an issue](https://github.com/Codename-11/hermes-relay/issues/new) — we read every one, and "this contributing guide is confusing" is a completely fair bug report.

GEMINI.md

@@ -1,13 +0,0 @@
-# GEMINI.md
-
-Agent instructions for **Hermes-Relay**. This file exists so Gemini CLI (which
-does not read `AGENTS.md` natively) picks up the project's guidance.
-
-**Read [AGENTS.md](AGENTS.md) — it is the single source of truth** for every
-coding agent: the entry point, the non-negotiables (standard-path-is-vanilla-
-upstream, verify-endpoints, Conventional Commits + `main`/`dev` branching, the
-per-language stack rules), and the public-repo writing hygiene. It links on to
-`CLAUDE.md` for the deep reference (architecture, upstream Hermes API, repo
-layout, code style, the dev loop, and the Key Files map).
-
-Do not restate rules here — keep them in `AGENTS.md` so they can't drift.

PLUGIN_RELEASE_NOTES.md

@@ -1,33 +0,0 @@
-# Hermes-Relay Plugin v__VERSION__
-
-**Release Date:** August 31, 2026
-
-## Summary
-
-This patch restores native installation compatibility on affected Hermes versions and makes Relay prompt context advertise only capabilities the selected session can actually call. Standard Chat, Manage, standard voice, and ordinary inbound files remain upstream-owned.
-
-## Fixed
-
-- **Native installer compatibility.** The plugin keeps its complete current manifest while avoiding the installer/runtime schema mismatch that caused `manifest_version 2` installs to fail after an apparent Hermes update.
-- **Capability-gated phone context.** Phone-control and cross-platform delivery guidance now follows the selected session/profile tool catalog instead of implying unavailable `android_*` or `send_message` callables.
-
-## Install / update
-
-    # Native upstream plugin path:
-    hermes plugins install Codename-11/hermes-relay/plugin --enable
-
-    # Classic install / update on a systemd host:
-    curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/server-v__VERSION__/install.sh | bash
-    # or, if already installed:
-    hermes-relay-update
-
-Restart or reload the Hermes Dashboard and Relay after updating so the new manifest and prompt context are active.
-
-## Verify
-
-    hermes relay doctor
-    python scripts/check-plugin-version-sync.py --expect __VERSION__
-
----
-
-Tag prefixes: Android releases use android-v*, Plugin releases use server-v*, and CLI+UI releases use desktop-v*.

README.md

@@ -1,285 +1,144 @@
 <p align="center">
-  <img src="assets/readme-hero-v2.jpg" alt="Hermes-Relay — Your Hermes agent. Wherever you are. Android, Voice, Desktop." width="1000">
+  <img src="assets/logo.svg" alt="Hermes-Relay" width="120">
 </p>
 
-<p align="center">
-  <strong>Runs on your machine. Lives on your devices.</strong><br>
-  A native Android companion for your <a href="https://github.com/NousResearch/hermes-agent">Hermes agent</a> — streaming chat, hands-free voice,
-  and full agent management. Plus a single-binary CLI that gives the agent hands on any machine you pair.
-</p>
+<h1 align="center">Hermes-Relay</h1>
 
 <p align="center">
-  <a href="https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay"><img src="https://play.google.com/intl/en_us/badges/static/images/badges/en_badge_web_generic.png" alt="Get it on Google Play" height="56"></a>
+  <strong>One Hermes agent. Two ways to use it.</strong><br>
+  A native Android remote-control app for your phone, plus a desktop CLI that lets you<br>
+  use a server-deployed Hermes from your laptop as if it were running locally.
 </p>
 
 <p align="center">
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="MIT"></a>
-  <a href="https://developer.android.com/about/versions/oreo"><img src="https://img.shields.io/badge/Android-8.0%2B-3DDC84.svg?logo=android&logoColor=white" alt="Android 8.0+"></a>
-  <a href="https://github.com/Codename-11/hermes-relay/actions/workflows/ci-android.yml"><img src="https://github.com/Codename-11/hermes-relay/actions/workflows/ci-android.yml/badge.svg" alt="Android CI"></a>
-  <a href="https://github.com/Codename-11/hermes-relay/releases"><img src="https://img.shields.io/github/v/release/Codename-11/hermes-relay?filter=android-v*&label=release&color=8B5CF6" alt="Latest release"></a>
-  <a href="https://github.com/Codename-11/hermes-relay/tree/main/desktop"><img src="https://img.shields.io/badge/CLI-beta-756cff.svg" alt="CLI (beta)"></a>
+  <a href="https://developer.android.com"><img src="https://img.shields.io/badge/Surface%201-Android-green.svg" alt="Android"></a>
+  <a href="https://github.com/Codename-11/hermes-relay/tree/main/desktop"><img src="https://img.shields.io/badge/Surface%202-Desktop%20CLI-orange.svg" alt="Desktop CLI"></a>
+  <a href="https://github.com/Codename-11/hermes-relay/actions/workflows/ci.yml"><img src="https://github.com/Codename-11/hermes-relay/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <a href="https://developer.android.com/about/versions/oreo"><img src="https://img.shields.io/badge/Min%20SDK-26-brightgreen.svg" alt="Min SDK 26"></a>
 </p>
 
 <p align="center">
-  <strong>English</strong> ·
-  <a href="docs/readme/README.de.md">Deutsch</a> ·
-  <a href="docs/readme/README.es.md">Español</a> ·
-  <a href="docs/readme/README.ja.md">日本語</a> ·
-  <a href="docs/readme/README.pt-BR.md">Português (Brasil)</a> ·
-  <a href="docs/readme/README.ru.md">Русский</a> ·
-  <a href="docs/readme/README.zh-CN.md">简体中文</a><br>
-  <a href="https://hermes-relay.dev/docs/">Documentation</a> ·
+  <a href="https://codename-11.github.io/hermes-relay/">Documentation</a> ·
   <a href="https://github.com/Codename-11/hermes-relay/releases">Releases</a> ·
-  <a href="https://github.com/Codename-11/hermes-relay/discussions">Discussions</a> ·
   <a href="CHANGELOG.md">Changelog</a> ·
   <a href="https://hermes-agent.nousresearch.com">Hermes Agent</a>
 </p>
 
+<p align="center">
+  <video src="https://github.com/Codename-11/hermes-relay/raw/main/assets/chat_demo.mp4" poster="https://github.com/Codename-11/hermes-relay/raw/main/assets/chat_demo_poster.jpg" autoplay loop muted playsinline width="280"></video>
+</p>
+
 ---
 
-## What it is
+## Two surfaces, one pair
 
-Hermes-Relay puts your [Hermes agent](https://github.com/NousResearch/hermes-agent) on the devices you actually carry. The brain stays on your own machine — Hermes-Relay is how you reach it.
+| Surface | What | Status |
+|---------|------|--------|
+| **[Android app](#1a-android-app)** | Native phone control — chat, voice, the agent reads your screen and acts on it (tap, type, swipe), notification companion, multi-Connection. | Available — Google Play (Internal testing) + sideload APK |
+| **[Desktop app + CLI](#1b-desktop-app--cli-experimental)** | Use a server-deployed Hermes from your laptop **like it's local**. Windows gets the native tray app first: pair, start/pause the daemon, view devices, task log, settings, overlay status, and emergency stop. The CLI remains the terminal/headless surface and powers macOS/Linux installs. Experimental computer-use tools are opt-in. | **Experimental** — `desktop-v0.3.0-alpha.18` (Windows tray installer + native CLI binaries, no Node required) |
 
-- **📱 Android app** — streaming chat, hands-free voice, native plugin pages, and the full Hermes dashboard (models, keys, skills, profiles), rebuilt native. Add a floating Petdex companion or optionally make Hermes your Android assistant; sideload builds can also let the agent read and act on your screen.
-- **⌨️ Hermes-Relay CLI** *(beta)* — a single binary that gives the agent **hands on any machine you pair**: files, terminal, search, screenshots — consent-gated.
+Both share `~/.hermes/remote-sessions.json` and the same WSS relay. **Pair once from either, both work.**
 
-A vanilla [hermes-agent](https://github.com/NousResearch/hermes-agent) install is enough for the upstream standard path: chat, management, voice, inbound files, Petdex, and ordinary installed-plugin pages. The Hermes-Relay plugin is optional for that base but encouraged for the complete current experience: Terminal/TUI, notifications, desktop tools, enhanced voice, Relay sessions, page drafts, optional Device Control, and media compatibility or metadata. Hermes-Relay prefers compatible upstream surfaces as they become available instead of keeping duplicate extension paths. **Connect Hermes first, then grant Hermes-Relay separately; the same one-time invite contract pairs Android or the Desktop CLI.**
+---
 
-<p align="center">
-  <img src="assets/readme-connection-map-v2.png" alt="How Hermes-Relay connects — Dashboard and Gateway own the standard Android path for Chat, Manage, Voice, and inbound files; the optional Relay plugin separately adds Android enhancements plus CLI and UI tools; sideload adds Device Control." width="1000">
-</p>
+## Quick Start
 
-## Quick Start (Android)
+Three steps: pick your surface (or install both), then install the relay plugin on your Hermes server.
 
-Install → connect → talk, in about two minutes.
+### 1a. Android app
 
-### 1 · Install the app
+<!-- TODO: Uncomment when Play Store listing is live
+<a href="https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay"><img src="https://play.google.com/intl/en_us/badges/static/images/badges/en_badge_web_generic.png" alt="Get it on Google Play" height="80"></a>
+-->
 
-- **Google Play** *(easiest — auto-updates)* — [**install from Google Play**](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay). Chat, voice, sessions, Manage, and inbound files work with standard Hermes; pairing the Hermes-Relay plugin adds Terminal/TUI, notifications, Relay sessions, and media enhancements.
-- **APK** *(full phone-control feature set)* — download the file ending in **`-sideload-release.apk`** from the newest `android-v*` release on [GitHub Releases](https://github.com/Codename-11/hermes-relay/releases) and open it (allow your browser to install unknown apps the first time). Integrity verification, signing fingerprint, and per-build details are in the [Sideload guide](https://hermes-relay.dev/docs/guide/getting-started.html#sideload-apk).
+- **Google Play** — coming soon (currently on Internal testing)
+- **APK** — download from [GitHub Releases](https://github.com/Codename-11/hermes-relay/releases) and choose the newest Android release (`android-v*`; historical Android releases used bare `v*`)
 
-Sideload builds check GitHub for updates and show a one-tap banner when you're behind; Play builds update through the Store. See [Release tracks](https://hermes-relay.dev/docs/guide/release-tracks) for the capability matrix.
+#### Sideload APK (GitHub Releases)
 
-### 2 · Have the Hermes Dashboard running
+Prefer not to wait for Google Play? Grab the signed APK directly:
 
-The normal Android connection uses the upstream Hermes Dashboard/Gateway for
-chat, sign-in, sessions, Manage, voice, and inbound files. Installing Hermes and choosing a
-provider is vanilla Hermes setup:
+1. Download the file ending in **`-sideload-release.apk`** from the newest Android release (`android-v*`; historical Android releases used bare `v*`) on [GitHub Releases](https://github.com/Codename-11/hermes-relay/releases) — that's the full-featured "Hermes Dev" build. (Skip any `.aab` file — those are the Google Play bundle format and won't install directly.)
+2. On your phone: **Settings → Apps → Special app access → Install unknown apps** and allow your browser (first time only).
+3. Open the APK from your downloads and tap **Install**.
+4. Optionally verify integrity against `SHA256SUMS.txt` from the same release (`sha256sum` on macOS/Linux, `Get-FileHash -Algorithm SHA256` on Windows).
 
-```bash
-hermes setup --portal   # install / log in / pick a provider — skip if already done
-hermes dashboard       # start the standard Dashboard/Gateway surface
-```
+Full walkthrough, including signing-certificate fingerprint: [Sideload guide](https://codename-11.github.io/hermes-relay/guide/getting-started.html#sideload-apk).
 
-Make the dashboard reachable from your phone over a trusted LAN, Tailscale, or
-an HTTPS reverse proxy. The [full walkthrough](https://hermes-relay.dev/docs/guide/getting-started)
-covers Windows, remote access, and dashboard authentication. You do not need to
-enable the separate API server or invent an API key for the standard path.
+**Staying up to date (sideload):** the app checks GitHub for a newer release on cold start (at most once every 6 hours) and shows a dismissable banner when you're behind. Tapping **Update** opens the next APK in your browser so Android's Downloads notification hands it to the system installer — no second app required. You can also trigger a check manually under **Settings → About → Updates**. Google Play installs get auto-updates through the Play Store and don't show this banner.
 
-Start on a trusted LAN. For away-from-home access, Tailscale is the recommended
-path. Secure Link, public TLS, and experimental routing options are covered in
-the [remote-access guide](https://hermes-relay.dev/docs/guide/remote-access/).
+### 1b. Desktop app + CLI (experimental)
 
-### 3 · Connect and talk
+The desktop surface talks to a server-deployed Hermes over WSS. On Windows, the default installer launches the native tray app with pairing, daemon control, devices, task log, settings, overlay status, pause, and emergency stop. The same release still ships the `hermes-relay` CLI for shell/TUI use, scripting, headless daemon mode, and macOS/Linux.
 
-Use **Find Hermes on LAN** or enter the Dashboard address manually
-(conventionally `http://<host>:9119`). Sign in through the
-Dashboard's configured provider when prompted. The app probes the available
-upstream capabilities and finishes with a connection summary.
+The remote agent can also reach back through the relay and run `desktop_read_file`, `desktop_terminal`, `desktop_search_files`, `desktop_screenshot`, `desktop_clipboard_*`, `desktop_open_in_editor`, etc. **on your machine** while its brain stays on the host. One pair, two surfaces (with the Android app), no `ssh`.
 
-If the Relay Dashboard page is already installed, **Connect mobile app** offers
-the same standard connection as a tokenless QR. It contains only the Dashboard
-address and does not install, enable, or pair Relay.
-
-The separate API server can be discovered automatically or added later under
-**Advanced** as a chat fallback or for a headless compatibility setup. Its API
-key is requested only when that optional endpoint is configured. Existing
-API-first setup QRs remain importable.
-
-The wizard probes everything and finishes with a capability card:
-
-| Line | What it means |
-|------|---------------|
-| **Chat** | Dashboard/Gateway ready — you can talk |
-| **Manage** | Models, keys, skills, and profiles are available from the phone |
-| **Voice** | Speech ready via your server (or one Manage sign-in away) |
-| **Direct API** | Optional API-only compatibility route available/unavailable |
-| **Relay** | Recommended extensions paired/unpaired; never blocks the upstream path |
-
-One dashboard sign-in unlocks Chat, Manage, sessions, and standard voice. That's
-the whole Vanilla Hermes setup.
-
-> **Going places?** Add the Dashboard's Tailscale address — for example `http://100.x.y.z:9119` or a separately published `https://host.ts.net` URL — under **Settings → Gateways → Routes**. Android tests it as a Dashboard route; no API server or API key is required. The app uses LAN at home and switches routes automatically when you leave. See [Remote access](https://hermes-relay.dev/docs/guide/remote-access).
-
-### 4 · Recommended: pair Relay for the complete experience
-
-Install Relay for Terminal/TUI, notifications, desktop tools, enhanced voice,
-Relay sessions, approval-gated page drafts, optional Device Control, and media
-compatibility or sensitivity metadata:
-
-```bash
-hermes plugins install Codename-11/hermes-relay/plugin --enable
-hermes relay doctor
-hermes relay start --no-ssl
-```
-
-Use `--no-ssl` only on a trusted LAN or VPN. Use the
-[remote-access guide](https://hermes-relay.dev/docs/guide/remote-access/) before
-exposing any Hermes surface beyond that network.
-
-Refresh or restart the Dashboard/Gateway, open **Relay → Pair new device**, and
-scan the one-time QR from Android **Settings → Gateways → Access → Pair Relay**.
-Leave mode on **Auto** for the recommended route discovery. The same dialog
-shows a copyable invite for Desktop CLI clients:
-
-```bash
-hermes-relay pair --pair-qr "hermes-relay://pair?payload=…" --grant-tools
-```
-
-As alternatives, `hermes pair` renders the same Android QR and pasteable invite
-in a terminal, while URL + six-character code and `--register-code` remain
-manual fallbacks when QR or clipboard transfer is unavailable.
-
-**Next:** [Android + Hermes-Relay Quick Start](https://hermes-relay.dev/docs/guide/quick-start) ·
-[Desktop CLI pairing](https://hermes-relay.dev/docs/desktop/pairing) ·
-[server, TLS, legacy install, and uninstall reference](https://hermes-relay.dev/docs/reference/relay-server)
-
-**Requirements:** Android 8.0+ (SDK 26) · current upstream [hermes-agent](https://github.com/NousResearch/hermes-agent) with the Dashboard/Gateway enabled · Python 3.11+ when installing the Hermes-Relay plugin. Direct API is optional; the Hermes-Relay plugin is encouraged for the complete experience.
-
-## Screenshots
-
-<table>
-  <tr>
-    <td align="center" width="25%"><img src="assets/screenshots/01_voice_conversation.png" alt="Voice controls in chat" width="100%"><br><sub><b>Voice in chat</b></sub></td>
-    <td align="center" width="25%"><img src="assets/screenshots/02_chat.png" alt="Streaming chat" width="100%"><br><sub><b>Streaming chat</b></sub></td>
-    <td align="center" width="25%"><img src="assets/screenshots/03_voice.png" alt="Hands-free voice" width="100%"><br><sub><b>Hands-free voice</b></sub></td>
-    <td align="center" width="25%"><img src="assets/screenshots/04_sessions.png" alt="Session history" width="100%"><br><sub><b>Session history</b></sub></td>
-  </tr>
-  <tr>
-    <td align="center" width="25%"><img src="assets/screenshots/05_themes.png" alt="App themes" width="100%"><br><sub><b>App themes</b></sub></td>
-    <td align="center" width="25%"><img src="assets/screenshots/06_manage.png" alt="Manage your agent" width="100%"><br><sub><b>Manage your agent</b></sub></td>
-    <td align="center" width="25%"><img src="assets/screenshots/07_connections.png" alt="Gateways and routes" width="100%"><br><sub><b>Gateways &amp; routes</b></sub></td>
-    <td align="center" width="25%"><img src="assets/screenshots/08_appearance.png" alt="Agent avatar &amp; skins" width="100%"><br><sub><b>Avatars &amp; skins</b></sub></td>
-  </tr>
-</table>
-
-<p align="center">
-  <img src="assets/screenshots/supplemental/15_git_workspace.png" alt="Native Git workspace showing repository changes, an inline diff, and staging controls" width="260"><br>
-  <sub><b>Native Git workspace</b> — upstream session context with optional Relay discovery and operations</sub>
-</p>
-
-### Simplified Chinese
-
-<table>
-  <tr>
-    <td align="center" width="33%"><img src="assets/screenshots/Zh01.jpg" alt="中文设置界面" width="100%"><br><sub><b>设置 — 全面汉化</b></sub></td>
-    <td align="center" width="33%"><img src="assets/screenshots/Zh02.jpg" alt="中文管理界面" width="100%"><br><sub><b>管理 — 仪表盘汉化</b></sub></td>
-    <td align="center" width="33%"><img src="assets/screenshots/Zh03.jpg" alt="中文导航界面" width="100%"><br><sub><b>导航菜单 — 简体中文</b></sub></td>
-  </tr>
-</table>
-
-The Android app ships complete AI-assisted catalogs for **Deutsch**, **Español**,
-**日本語**, **Português (Brasil)**, **Русский**, and **简体中文**. Choose a language from
-**Settings → Appearance → Language**; translation status and fluent review are
-tracked independently so community corrections remain easy to contribute.
-
-<p align="center"><sub>▶ <a href="https://hermes-relay.dev/docs/guide/getting-started.html#see-it-working">Watch the demo</a> on the docs site</sub></p>
-
-## Features
-
-### Android
-
-- **Streaming chat** — rides vanilla Hermes, preferring the dashboard gateway (`/api/ws`, live thinking) when signed in to Manage and falling back to API-server SSE otherwise, with live markdown, tool-call cards, session history, a searchable command palette, file attachments, quote-in-reply, conversation share, and send-while-streaming queuing.
-- **Manage your agent** — the full Hermes dashboard, native: switch models from your provider catalog, manage keys (write-only, masked, rate-limited reveal), create and edit profiles including `SOUL.md`, and browse/install/update skills. One dashboard sign-in covers it all.
-- **Hands-free voice** — talk on a vanilla install: speech rides your server's configured providers, unlocked by the same Manage sign-in. Relay-paired setups add per-profile voice and an opt-in provider-native Realtime Agent with background task handoff.
-- **Works away from home** — add a Tailscale or public URL and the app roams automatically (LAN at home, fallback elsewhere). An unreachable server gets a diagnosis, not just a red dot.
-- **Multi-Connection + profiles** — pair multiple Hermes servers (home + work, dev + prod) and switch in one tap; overlay a profile's model + `SOUL.md` per chat.
-- **Device Control (Sideload + Hermes-Relay required)** — the agent can read the screen and act: tap, type, swipe, scroll, screenshots, clipboard, media keys, and batched macros. This is not included in the Google Play build. It is guarded by a per-app blocklist (banking/2FA blocked by default), destructive-verb confirmation, idle auto-disable, and a full activity log.
-- **Notification companion** — opt-in access so the agent can triage, summarize, and route incoming notifications.
-- **Security & pairing** — QR pairing, Android Keystore session storage (StrongBox-preferred), TOFU cert pinning, per-channel time-bound grants, user-chosen session TTL.
-- **Stats for Nerds** — local-only analytics: TTFT, token usage, stream health, peak-time charts.
-
-> Sideload builds add direct SMS, contact search, one-tap dialing, and location awareness — handy for fully hands-free intents like *"text Sam I'll be 10 minutes late."* See [Release tracks](https://hermes-relay.dev/docs/guide/release-tracks).
-
-## Hands on any machine — the Hermes-Relay CLI&nbsp;<sub>(beta)</sub>
-
-> **Beta.** Self-contained CLI binaries ship for Windows x64, Linux x64/arm64, and macOS x64/arm64 — no Node required. Windows also has an optional compact management tray. Assets are unsigned during the experimental phase, so SmartScreen / Gatekeeper warnings are expected.
-
-The agent's brain stays on the host; the CLI lets it call tools **on your machine** over the same WSS relay — `read_file`, `write_file`, `terminal`, `search_files`, `screenshot`, `clipboard`, `open_in_editor`, and more — behind a one-time consent gate, interactive diff approval for patches, and a `--no-tools` kill-switch.
+**Install tray app** (Windows PowerShell):
 
 ```powershell
 irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
 ```
 
+**Install CLI only** (Windows PowerShell):
+
+```powershell
+$env:HERMES_RELAY_INSTALL_SURFACE='cli'; irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex
+```
+
+**Install CLI** (macOS / Linux):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.sh | sh
+```
+
 ```bash
 hermes-relay pair --remote ws://<host>:8767   # once
-hermes-relay daemon start                      # background tool router — agent reaches you anytime
+hermes-relay                                   # interactive Hermes TUI in tmux
+hermes-relay "summarize the last commit"       # one-shot
+hermes-relay --json "..." | jq                 # structured events for scripting
+hermes-relay daemon                            # headless tool router (agent reaches you anytime)
 hermes-relay update                            # self-update via GitHub Releases
 ```
 
-It pairs against the **same relay and credential store** as the Android app — pair once from either, both work. Tagged on the `desktop-v*` [release track](https://github.com/Codename-11/hermes-relay/releases?q=desktop), with historical releases still visible under `cli-v*`.
+**Native paste workflow** (the killer demo): inside `hermes-relay shell`, hit `Win+Shift+S` to screenshot, then `Ctrl+A v` — the client reads your clipboard, ships the image to the server's inbox, and types `/paste` into the TUI for you. Identical UX to native local-Hermes paste. The same chord set works on macOS (`Cmd+Shift+4` → `Ctrl+A v`) and Linux (Wayland/X11 detected automatically).
 
-On Windows, the default installer adds the optional compact **Hermes-Relay CLI UI** tray popup for host selection and pairing, connection and daemon state, per-host Ask/Trusted/Full Access, local grant dialogs, authorized-client revocation, activity, settings, and emergency stop. `hermes-relay update` detects this bundle and updates the CLI and UI together; explicit CLI-only installations stay headless and continue using the standalone binary updater. The UI is a management surface only—chat, TUI, plugins, voice, and agent sessions remain CLI/upstream concerns.
+**No Node required** — the Windows tray installer bundles the compiled CLI sidecar; CLI-only installs use Bun-compiled native binaries (~60–110 MB per platform) via curl/irm. Version-aware install (`upgrading X → Y`), collision-safe `hermes` short alias for CLI installs, self-update via `hermes-relay update`. Assets are **unsigned** during the experimental phase — SmartScreen/Gatekeeper warnings are expected. Code signing, multi-client server-side routing, and service installers (sc.exe / systemd / launchd) land with v1.0.
 
-<table>
-  <tr>
-    <td align="center" width="33%"><img src="assets/screenshots/desktop-ui/overview.png" alt="Hermes-Relay CLI UI connected overview" width="100%"><br><sub><b>Connection &amp; activity</b></sub></td>
-    <td align="center" width="33%"><img src="assets/screenshots/desktop-ui/host-access.png" alt="Hermes-Relay CLI UI host access presets" width="100%"><br><sub><b>Per-host access</b></sub></td>
-    <td align="center" width="33%"><img src="assets/screenshots/desktop-ui/settings.png" alt="Hermes-Relay CLI UI computer control and updates" width="100%"><br><sub><b>Control &amp; maintenance</b></sub></td>
-  </tr>
-</table>
+- **Docs**: [Desktop guide](https://codename-11.github.io/hermes-relay/desktop/) · [`desktop/README.md`](desktop/README.md)
+- **Release track**: tagged `desktop-v*`, [separate from Android](https://github.com/Codename-11/hermes-relay/releases?q=desktop)
+- **AI-agent setup recipe**: `/hermes-relay-desktop-setup` (the agent can run `desktop_terminal` on your machine to diagnose install/pair issues live)
 
-Structured Windows computer control prefers a compatible local CUA Driver
-runtime for window-targeted background actions and virtual per-session agent
-cursors. It remains behind Hermes host policy, grants, targeting, audit, and
-emergency stop; Windows input is an explicit compatibility backend. CUA is not
-bundled or updated automatically, but the local CLI/UI can explicitly install,
-check, or update its verified canonical package. It is never exposed as a raw
-remote tool surface. See the [desktop tools guide](https://hermes-relay.dev/docs/desktop/tools.html#computer-use-engines).
+### 2. Install the server plugin (one-liner)
 
-- **Docs:** [CLI guide](https://hermes-relay.dev/docs/desktop/) · [`desktop/README.md`](desktop/README.md)
-- **AI-agent setup recipe:** `/hermes-relay-desktop-setup`
+On the machine running your Hermes agent:
 
-## How It Works
-
-```
-Phone        (HTTP/WSS) --> Hermes Dashboard  (:9119)   [chat gateway, manage, vanilla voice, inbound files]
-Phone        (HTTP/SSE) --> Hermes API Server (:8642)   [Direct API chat, sessions, runs]
-Phone        (WSS/HTTP) --> Relay             (:8767)   [terminal, bridge, media enhancements, relay voice, sessions]
-CLI          (WSS)      --> Relay             (:8767)   [machine tools, tui, terminal]
+```bash
+curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/install.sh | bash
 ```
 
-Standard connections keep Chat on the Hermes Dashboard/Gateway. Explicit API-only
-connections use the upstream Direct API SSE path with an API key. Manage and Vanilla Hermes
-voice ride the Hermes dashboard with its own one-time sign-in, so a vanilla
-install needs no plugin for those surfaces or ordinary inbound files. The optional relay on `:8767` adds
-terminal, bridge phone control, media compatibility/metadata, machine tools, and
-relay-side voice, which is preferred automatically when paired. One QR can
-configure API, dashboard, and relay routes without merging their auth models.
+The installer clones Hermes-Relay to `~/.hermes/hermes-relay/` (override with `$HERMES_RELAY_HOME`), `pip install -e`s the package into the hermes-agent venv, registers the `skills/` directory in your `~/.hermes/config.yaml` under `skills.external_dirs` (so updates flow through `git pull`), symlinks the plugin into `~/.hermes/plugins/hermes-relay`, drops a thin `hermes-pair` shim into `~/.local/bin/`, and (optionally) installs a systemd user service for the WSS relay. After restart, pair your client via either of these equivalent entry points:
 
-## Documentation
+- **From any Hermes chat surface** (CLI, Discord, Telegram, etc.): type `/hermes-relay-pair` and the `hermes-relay-pair` skill renders the QR + 6-char code inline. Shortest path if you're already chatting with the agent.
+- **From a shell**: `hermes-pair` (dashed) — a thin wrapper around `python -m plugin.pair` in the hermes-agent venv. Use this in scripts or when you want the raw output.
+- **No camera?** `hermes-pair --register-code ABCD12` — manual fallback for SSH-only / camera-less setups. For Android: read the 6-char code from the app's **Settings → Connection → Manual pairing code (fallback)** card, pre-register it on the host with this command, then tap **Connect** in the app. For the desktop CLI: just pass it as `hermes-relay pair ABCD12 --remote ws://<host>:8767`. Composes with `--ttl` / `--grants`.
 
-| | |
-|---|---|
-| **[User Guide](https://hermes-relay.dev/docs/)** | **Quick start, features, configuration — start here** |
-| [Android](https://hermes-relay.dev/docs/guide/) | Android install + setup + features |
-| [Hermes-Relay CLI](https://hermes-relay.dev/docs/desktop/) | Pairing, subcommands, local tool routing |
-| [Architecture](https://hermes-relay.dev/docs/architecture/) | How the system works under the hood |
-| [API Reference](https://hermes-relay.dev/docs/reference/api.html) | Hermes API endpoints used by both surfaces |
-| [Specification](docs/spec.md) | Full spec — protocol, UI, phases, dependencies |
-| [Architecture Decisions](docs/decisions.md) | ADRs — framework, channels, auth, terminal |
-| [Changelog](CHANGELOG.md) | Release history (`android-v*`, `server-v*`, `desktop-v*`; historical prefixes remain immutable) |
+Scan the QR from the Android app's onboarding screen, OR paste the 6-char code into `hermes-relay pair --remote ws://<host>:8767` on your laptop, and you're connected. One pair configures **both** the direct-chat API server **and** the relay (WSS for terminal / bridge / TUI / desktop tools, HTTP for voice routes) — if a local relay is running at `localhost:8767`, the pair command pre-registers a fresh 6-char pairing code with it and embeds the relay URL + code in the same QR. If you only want direct chat from the Android app, pass `--no-relay` (or just don't start the relay). Plain-text connection details are always printed alongside the QR so you can copy values by hand if your terminal can't render QR blocks.
 
-<details>
-<summary><b>Install with an AI agent</b> — paste-ready prompt for Claude / GPT</summary>
+**Dashboard plugin.** If your hermes-agent install has the Dashboard Plugin System (upstream `axiom` branch), Hermes-Relay ships a plugin at `plugin/dashboard/` that surfaces paired devices, bridge command activity, and active inbound-media tokens in the gateway's web UI. It auto-registers through the same `~/.hermes/plugins/hermes-relay` symlink created by `install.sh` — restart the gateway and a "Relay" tab appears. See [docs/relay-server.md](docs/relay-server.md) and `user-docs/features/dashboard.md` for details.
 
-<br>
+**Updating:** `hermes-relay-update` (shortest path — installed as part of the one-liner) or re-run the same `curl … | bash` from above. Both are equivalent and fully idempotent: pulls latest main, refreshes the editable install, recreates all three shims, restarts `hermes-relay`, and prompts before restarting `hermes-gateway`. Set `HERMES_RELAY_RESTART_GATEWAY=1` to opt into the gateway restart non-interactively. For routine plugin/skill updates without restarting anything, a plain `cd ~/.hermes/hermes-relay && git pull` is enough — the editable install picks up the new code on next process start.
 
-If an AI assistant manages your server, paste this block into its chat and it will fetch the canonical setup recipe and walk you through install, pairing, and troubleshooting:
+**Uninstalling:** `bash ~/.hermes/hermes-relay/uninstall.sh` reverses every install step in the opposite order. Idempotent, never touches state shared with other Hermes tools (`.env`, sessions DB, hermes-agent venv core). Flags: `--dry-run`, `--keep-clone`, `--remove-secret`. Or pull the script via curl if you've already removed the clone.
+
+**Requirements:** Android 8.0+ (SDK 26) for the Android app · macOS / Linux / Windows for the desktop CLI · [hermes-agent](https://github.com/NousResearch/hermes-agent) v0.8.0+, Python 3.11+ on the server.
+
+### For AI Agents
+
+If you have an AI assistant (Claude, GPT, etc.) and want it to install or maintain Hermes-Relay for you, paste the block below into the chat. The agent will fetch the canonical setup recipe from this repo and walk you through it — verification, pairing, troubleshooting included.
 
 ```text
-You are helping me install and maintain Hermes-Relay (https://github.com/Codename-11/hermes-relay) — a native Android client + a CLI + a Python plugin for the Hermes AI agent platform.
+You are helping me install and maintain Hermes-Relay (https://github.com/Codename-11/hermes-relay) — a native Android client + a desktop CLI + a Python plugin for the Hermes AI agent platform.
 
 Read the canonical setup recipe before acting:
   https://raw.githubusercontent.com/Codename-11/hermes-relay/main/skills/devops/hermes-relay-self-setup/SKILL.md
@@ -287,109 +146,210 @@ Read the canonical setup recipe before acting:
 Then guide me through:
 - Verifying hermes-agent is already installed (it's a prerequisite — Hermes-Relay is a plugin, not standalone)
 - Running the server-plugin install one-liner: `curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/install.sh | bash`
-- Connecting my phone by Vanilla Hermes API URL/key first, then optionally pairing Relay via `hermes pair` or `/hermes-relay-pair` for power tools; OR pairing my laptop via the Hermes-Relay CLI (`irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex` on Windows, then `hermes-relay pair --remote ws://<host>:8767`)
-- Verifying with `hermes-status` (server) or `hermes-relay doctor` (CLI)
+- Pairing my phone via `hermes-pair` or `/hermes-relay-pair` (Android), OR pairing my laptop via the `hermes-relay` desktop CLI (binary one-liner: `curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.sh | sh` or `irm https://raw.githubusercontent.com/Codename-11/hermes-relay/main/desktop/scripts/install.ps1 | iex` on Windows, then `hermes-relay pair --remote ws://<host>:8767`)
+- Verifying with `hermes-status` (server) or `hermes-relay doctor` (desktop CLI)
 
 Always confirm before running shell commands. Never restart hermes-gateway without asking. If any step fails, consult the Troubleshooting section in the SKILL.md and ask me for the exact error.
 ```
 
-Already installed? The same recipe is auto-loaded as a Hermes skill — invoke `/hermes-relay-self-setup` from any chat for re-setup or "is everything wired correctly?" checks.
+Already have Hermes-Relay installed? The same recipe is auto-loaded as a Hermes skill — invoke it from any chat with `/hermes-relay-self-setup` for re-setup, troubleshooting, or "is everything wired correctly?" checks. Single source, two delivery modes (raw URL pre-install + Hermes skill post-install), no drift.
 
-</details>
+## What It Does
+
+Talk to your Hermes agent from anywhere. Direct API streaming, session history, tool visualization — native on Android, native in the terminal, with the agent able to reach back through the relay and act on either surface.
+
+| Surface | Channel | What | Status |
+|---------|---------|------|--------|
+| Android | **Chat** | Stream conversations to Hermes via HTTP/SSE | Available |
+| Android | **Voice** | Real-time voice conversation via relay TTS/STT | Available |
+| Android | **Bridge** | Agent reads the screen and performs UI actions (tap, long-press, drag, type, clipboard, media, macros, events) | Available |
+| Android | **Terminal** | Secure remote shell via tmux | Phase 2 |
+| Desktop CLI | **Shell** | Full Hermes Ink TUI piped over PTY in tmux on the host. Bare `hermes-relay` drops you in. | Available (experimental) |
+| Desktop CLI | **Chat** | Structured-event REPL / one-shot / piped stdin. `--json` for scripting. REPL supports `/paste`, `/screenshot`, `/image <path>`. | Available (experimental) |
+| Desktop CLI | **In-shell paste / screenshot** | `Ctrl+A v` (clipboard image → server inbox → `/paste` auto-typed). `/screenshot` is multi-monitor by default. | Available (experimental) |
+| Desktop CLI | **Local tool routing** | Agent calls `desktop_read_file` / `_write_file` / `_terminal` / `_search_files` / `_patch` / `_clipboard_*` / `_screenshot` / `_open_in_editor` — runs on YOUR machine over the same relay | Available (experimental) |
+| Desktop CLI | **Daemon** | Headless tool router — keeps tools advertised even when no shell is open | Available (experimental) |
+| Desktop CLI | **Self-update** | `hermes-relay update` polls GitHub Releases, atomic-swaps the binary | Available (experimental) |
+
+## What's new in v0.6.0
+
+- **Connect from anywhere** — multi-endpoint pairing with first-class Tailscale support; plug in any VPN or reverse proxy mode. See [`docs/remote-access.md`](docs/remote-access.md).
+- **Multi-Connection support** — pair with multiple Hermes servers (home + work, dev + prod, etc.) and switch in one tap from the Chat top bar. Each Connection keeps its own sessions, personalities, profiles, and relay state; theme and safety preferences stay global. Existing installs migrate transparently.
+- **Agent Profiles** — the relay auto-discovers upstream Hermes profiles at `~/.hermes/profiles/*/` and the phone overlays the selected profile's model + `SOUL.md` on chat turns. Ephemeral, chat-only, clears on Connection switch. Gated by `RELAY_PROFILE_DISCOVERY_ENABLED` (default on).
+- **Consolidated agent sheet** — Profile + Personality selection and per-session analytics now live in one scrollable bottom sheet opened from the Chat top-bar agent name.
+
+See the [changelog](CHANGELOG.md) for the full list.
+
+## Features
+
+### Android
+
+- **Streaming chat** — Direct SSE to the Hermes API Server with real-time markdown rendering, session history, tool-call visualization, personality picker, searchable command palette (29+ gateway commands), file attachments, and send-while-streaming message queuing
+- **Multi-Connection + agent profiles** — Pair with multiple Hermes servers and switch targets from the top bar; select an upstream-discovered agent profile to overlay model + `SOUL.md` on chat turns. Three-layer model: Connection (server) → Profile (agent directory) → Personality (prompt preset)
+- **Voice mode** — Experimental server-mediated voice conversation via the relay; the sphere listens with you and performs the agent's reply as it speaks. Hermes owns chat, tool calls, and approvals, while relay voice output defaults to provider-neutral streaming TTS (`xai_tts` first) with realtime voice-agent providers kept as a separate lab mode.
+- **Phone control (bridge)** — The agent can read what's on screen and act on it — tap, long-press, drag, swipe, scroll, type, and press system keys — plus take screenshots, read/write the clipboard, and control system-wide media playback. Gesture reliability is hardened for dim/idle screens, and a smarter tap-fallback cascade handles apps where labels sit inside non-clickable wrappers
+- **Screen understanding** — Filtered accessibility-tree search, per-node property lookups with stable IDs, cheap screen-hash change detection, and multi-window reads (system overlays, popups, notification shade) so the agent can reason about UI without guessing
+- **Workflow automation** — Batched macro execution for multi-step flows, real-time accessibility event streaming for "wait until something happens" waits, and a raw-Intent escape hatch for apps that expose deep-link actions
+- **Notification companion** — Opt-in notification access so the agent can triage, summarize, and route incoming notifications
+- **Bridge safety rails** — Per-app blocklist (banking, payments, 2FA default-blocked), destructive-verb confirmation modal (send, pay, delete, transfer…), idle auto-disable timer, optional persistent-status overlay, full activity log
+- **Security & pairing** — QR-code pairing, Android Keystore session storage (StrongBox-preferred), TOFU cert pinning, per-channel time-bound grants, user-chosen session TTL
+- **Analytics** — Stats for Nerds with TTFT, token usage, stream health, and peak-time charts
+
+> Sideload builds add direct SMS, contact search, one-tap dialing, and location awareness — handy for fully hands-free voice intents like "text Sam I'll be 10 minutes late". See [Release tracks](https://codename-11.github.io/hermes-relay/guide/release-tracks) for the full sideload capability matrix.
+
+### Desktop CLI
+
+- **Shell mode (default)** — bare `hermes-relay` pipes the host's actual `hermes` Ink TUI through a PTY in tmux. Same banner, same skin, same slash commands as a local install. `Ctrl+A .` detaches (preserves tmux), `Ctrl+A k` kills, `Ctrl+A v` pastes a clipboard image, `Ctrl+A ?` re-prints chord help, `Ctrl+A Ctrl+A` literal.
+- **Chat mode** — REPL or one-shot or piped stdin. `--json` emits `GatewayEvent`s per line for `jq` / automation. REPL slash commands `/paste` (clipboard), `/screenshot` (multi-monitor by default; `primary` / `1` / `2` to narrow), `/image <path>` attach the next message.
+- **Local tool routing** — agent calls `desktop_read_file`, `desktop_write_file`, `desktop_terminal`, `desktop_search_files`, `desktop_patch`, `desktop_clipboard_read/write`, `desktop_screenshot`, `desktop_open_in_editor` — all run on YOUR machine over the same WSS relay. One-time per-URL consent gate; `--no-tools` kill-switch; non-TTY stdin fails closed; agent-proposed patches render as colored diffs with `y/n/e/r` interactive approval. Experimental `desktop_computer_*` control tools require `--experimental-computer-use` / `HERMES_RELAY_EXPERIMENTAL_COMPUTER_USE=1`, task-scoped grants, and visible local approval.
+- **Daemon mode** — `hermes-relay daemon` runs the tool router headless so the agent can reach you even when no shell is open. JSON-line lifecycle logs by default, auto-human on TTY. Fails closed on missing consent.
+- **Self-update** — `hermes-relay update` polls GitHub Releases (SemVer-max picker, prerelease-aware), verifies SHA256, atomic-swaps the binary on POSIX (running daemon keeps inode), cooperative `.new.exe` swap on Windows.
+- **Multi-endpoint pairing + reconnect-on-drop + TOFU cert pinning** — same as the Android app. One QR carries LAN + Tailscale + public; client races candidates in priority order, re-probes on every network change.
+- **Workspace awareness** — on connect, client advertises `cwd`, `git_root`, `git_branch`, `repo_name`, `hostname`, `platform`, `active_shell` to the relay (server-side prompt-context consumption coming).
+- **Conversation picker on attach** — without `--conversation` / `--new`, you get a numbered list of recent server-side hermes sessions to resume.
+- **One install, one binary, no Node required** — Bun-compiled native binaries via curl/irm one-liners; collision-safe `hermes` short alias auto-installed.
+
+## Getting Started
+
+**Android:**
+
+1. **Install the app** from the [link above](#1a-android-app)
+2. **Enter your Hermes server URL** (e.g. `http://192.168.1.100:8642`) during onboarding, or scan a QR via `/hermes-relay-pair`
+3. **Start chatting** — the app connects directly to the Hermes API Server
+
+**Desktop CLI:**
+
+1. **Install the binary** — [PowerShell `irm`](#1b-desktop-cli-experimental) (Windows) / curl (macOS / Linux) one-liner
+2. **Pair once** — `hermes-relay pair --remote ws://<host>:8767` (mint code via `hermes-pair` or `/hermes-relay-pair` on the server first)
+3. **Drop into the shell** — bare `hermes-relay` opens the full Hermes TUI in tmux on the host
+
+For detailed setup, server configuration, and feature guides, see the **[full documentation](https://codename-11.github.io/hermes-relay/)**.
+
+## How It Works
+
+```
+Phone        (HTTP/SSE) --> Hermes API Server (:8642)   [chat — direct]
+Phone        (HTTP)     --> Server (:8767)         [voice routes — API key or relay session]
+Phone        (WSS/HTTP) --> Server (:8767)         [terminal, bridge, media, sessions]
+Desktop CLI  (WSS)      --> Server (:8767)         [tui, terminal, desktop tools]
+```
+
+Chat from the Android app connects directly to the Hermes API Server with the Hermes API key — same pattern used by Open WebUI and other Hermes frontends. Voice calls the relay's `/voice/*` HTTP routes and authenticates with that Hermes API bearer when present, falling back to the relay session token for paired devices. Remote control surfaces such as terminal, bridge, TUI, media/session management, and desktop tools require relay pairing on `:8767`, so one scan can configure both the API route and the relay route without merging their auth models.
+
+## Documentation
+
+| | |
+|---|---|
+| **[User Guide](https://codename-11.github.io/hermes-relay/)** | **Getting started, both surfaces, features, configuration — start here** |
+| [Android](https://codename-11.github.io/hermes-relay/guide/) | Android-specific install + setup + features |
+| [Desktop CLI](https://codename-11.github.io/hermes-relay/desktop/) | Desktop CLI guide — shell/chat, pairing, subcommands, local tool routing |
+| [Architecture](https://codename-11.github.io/hermes-relay/architecture/) | How the system works under the hood |
+| [API Reference](https://codename-11.github.io/hermes-relay/reference/api.html) | Hermes API endpoints used by both surfaces |
+| [Specification](docs/spec.md) | Full spec — protocol, UI, phases, dependencies |
+| [Architecture Decisions](docs/decisions.md) | ADRs — framework, channels, auth, terminal |
+| [Upstream Integration Sync](docs/upstream-integration-sync.md) | Supported Hermes extension points vs server-owned compatibility layers |
+| [Changelog](CHANGELOG.md) | Release history (Android `android-v*`, Server `server-v*`, and Desktop `desktop-v*`) |
+
+---
 
 ## Development
 
+### Quick Start
+
+1. **File > Open** the repo root in Android Studio
+2. Wait for Gradle sync
+3. **Run** (Shift+F10) to deploy to emulator or device
+
+### Dev Scripts
+
 ```bash
-# Android: open the repo root in Android Studio, wait for Gradle sync, Run (Shift+F10).
-scripts/dev.bat build      # Build sideload debug APK
-scripts/dev.bat compile    # Compile sideload Kotlin only
-scripts/dev.bat test-one "com.hermesandroid.relay.SomeTest"  # Focused unit test
-scripts/dev.bat install-fast  # arm64 phone build + install + launch
+scripts/dev.bat build      # Build debug APK
 scripts/dev.bat release    # Build signed release APK
 scripts/dev.bat bundle     # Build release AAB for Google Play
-scripts/dev.bat run        # Build sideload + install + launch + logcat
-scripts/dev.bat test       # Run sideload debug unit tests
+scripts/dev.bat run        # Build + install + launch + logcat
+scripts/dev.bat test       # Run unit tests
 scripts/dev.bat version    # Show current version
-scripts/dev.bat relay      # Start the relay server (dev, no TLS)
+scripts/dev.bat relay      # Start Server (dev, no TLS)
 ```
 
-Gateway, session, streaming, reconnect, or authoritative-history changes use
-the reusable, on-demand [Gateway contract lab](docs/gateway-contract-testing.md).
-It includes deterministic protocol scenarios, current-upstream conformance,
-Android instrumentation, and opt-in physical-device certification; none of
-those lanes is scheduled automatically.
+### Repository Structure
+
+```
+hermes-relay/
+├── app/                       # Android app (Kotlin + Jetpack Compose)
+├── desktop/                   # Desktop CLI thin-client (@hermes-relay/cli — TS + Bun-compiled binary)
+├── relay_server/              # WSS Server (Python + aiohttp; thin shim → plugin/relay)
+├── plugin/                    # Hermes agent plugin
+│   ├── relay/                 #   - canonical relay (server.py, channels/, media, voice, desktop tools)
+│   ├── tools/                 #   - android_* bridge + desktop_* tool handlers
+│   └── pair.py                #   - QR pairing CLI + multi-endpoint payload builder
+├── skills/                    # Hermes agent skills
+│   └── devops/
+│       ├── hermes-relay-pair/         # /hermes-relay-pair slash-command skill
+│       ├── hermes-relay-self-setup/   # AI-agent setup recipe (Android + desktop)
+│       └── hermes-relay-desktop-setup/ # AI-agent recipe specifically for the desktop CLI
+├── user-docs/                 # VitePress documentation site (Android + desktop sections)
+├── docs/                      # Spec, decisions, security
+├── scripts/                   # Dev helper scripts
+├── .github/workflows/         # CI + release pipelines (ci-android / ci-server / ci-desktop)
+└── gradle/                    # Wrapper (8.13) + version catalog
+```
 
 ### Tech Stack
 
 | Component | Stack |
 |-----------|-------|
-| **Android app** | Kotlin 2.4, Jetpack Compose, Material 3, OkHttp |
-| **Hermes-Relay CLI** | TypeScript, Bun-compiled native binary, Node ≥21 (source/dev), zero runtime deps |
-| **Server / plugin** | Python 3.11+, aiohttp |
+| **Android App** | Kotlin 2.0, Jetpack Compose, Material 3, OkHttp |
+| **Desktop CLI** | TypeScript, Bun-compiled native binary, Node ≥21 (source/dev), zero runtime deps |
+| **Server** | Python 3.11+, aiohttp |
 | **Serialization** | kotlinx.serialization (Android) |
-| **Build** | AGP 9.3.1, Gradle 9.6.1, JVM toolchain 17 (Android); `tsc` + `bun build --compile` (CLI) |
-| **CI/CD** | GitHub Actions — lint, build, test, APK artifact, CLI binaries per platform |
-| **Min SDK** | 26 (Android 8.0) · Target SDK 36 |
+| **Build** | AGP 9, Gradle 8.13, JVM toolchain 17 (Android); `tsc` + `bun build --compile` (desktop) |
+| **CI/CD** | GitHub Actions (lint, build, test, APK artifact, desktop binaries per platform) |
+| **Min SDK** | 26 (Android 8.0) / Target SDK 35 |
 
-<details>
-<summary><b>Repository structure</b></summary>
-
-```
-hermes-relay/
-├── app/                       # Android app (Kotlin + Jetpack Compose)
-├── desktop/                   # Hermes-Relay CLI thin-client (TS + Bun-compiled binary)
-├── relay_server/              # WSS server (Python + aiohttp; thin shim → plugin/relay)
-├── plugin/                    # Hermes agent plugin
-│   ├── relay/                 #   - canonical relay (server.py, channels/, media, voice, machine tools)
-│   ├── tools/                 #   - android_* bridge + desktop_* tool handlers
-│   └── pair.py                #   - QR pairing CLI + multi-endpoint payload builder
-├── skills/devops/             # Hermes agent skills (pairing, self-setup, CLI setup recipes)
-├── user-docs/                 # VitePress documentation site
-├── docs/                      # Spec, decisions, security
-├── scripts/                   # Dev helper scripts
-├── .github/workflows/         # CI + release pipelines (ci-android / ci-plugin / ci-desktop)
-└── gradle/                    # Wrapper (8.13) + version catalog
-```
-
-</details>
-
-<details>
-<summary><b>Running the server / plugin from a clone</b></summary>
-
-<br>
-
-End users should follow the [recommended Hermes-Relay setup](#4--recommended-pair-relay-for-the-complete-experience) above. For local development:
+### Server (optional — bridge, terminal, TUI, media, and voice routes)
 
 ```bash
 hermes relay start --no-ssl          # if you installed the plugin
-python -m plugin.relay --no-ssl      # or from a repo checkout
+# or from a repo checkout:
+python -m plugin.relay --no-ssl
+```
 
-# Docker:
+Or with Docker:
+
+```bash
 docker build -t hermes-relay relay_server/ && docker run -d --network host --name hermes-relay hermes-relay
+```
 
-# Live-edit the plugin against a local Hermes:
+See [docs/relay-server.md](docs/relay-server.md) for TLS, systemd, and full setup.
+
+### Hermes Plugin (for contributors)
+
+End users should install via the [one-liner](#2-install-the-server-plugin-one-liner) at the top. For local development from a clone:
+
+```bash
+cp -r plugin ~/.hermes/plugins/hermes-relay
+# Or symlink for live edits:
 ln -s "$PWD/plugin" ~/.hermes/plugins/hermes-relay
 ```
 
-Then restart hermes and run `hermes pair` to verify. The 35 `android_*` and 25 `desktop_*` tools register regardless of hermes-agent version. See [docs/relay-server.md](docs/relay-server.md) for TLS, systemd, and full setup.
+Then restart hermes and run `hermes-pair` (dashed shell shim) or type `/hermes-relay-pair` in any Hermes chat surface to verify pairing. The 18 `android_*` and 9 `desktop_*` tools register regardless of hermes-agent version. **Note:** a top-level `hermes pair` CLI sub-command is *not* currently exposed — hermes-agent v0.8.0's top-level argparser doesn't yet forward to third-party plugins' `register_cli_command()` dict. Use the slash command or the dashed shim instead.
 
-</details>
-
-## Built for Hermes Agent
+## Hermes Agent
 
 Hermes-Relay is built for [Hermes Agent](https://github.com/NousResearch/hermes-agent) — an open-source AI agent platform by [Nous Research](https://nousresearch.com). See the [Hermes Agent docs](https://hermes-agent.nousresearch.com) for server setup, gateway configuration, and plugin development.
 
-## Questions, ideas, or bugs?
+## Found a bug? Let us know!
 
-Use [GitHub Discussions](https://github.com/Codename-11/hermes-relay/discussions) for setup questions, early ideas, broader conversation, and things you are building with Hermes-Relay. If something is reproducibly broken or you have a specific, actionable feature request, [open an issue](https://github.com/Codename-11/hermes-relay/issues/new). This is an indie project and every report helps shape where it goes next.
+This is an indie project and every report helps shape where it goes next. If something feels off, broken, or just weird — [open an issue](https://github.com/Codename-11/hermes-relay/issues/new). We read every one, and even a one-line "this didn't work on my Pixel 7" / "the alpha.14 Windows binary segfaults on my Surface" is genuinely useful.
 
 ## Star History
 
 <a href="https://www.star-history.com/?repos=Codename-11%2Fhermes-relay&type=date&legend=top-left">
  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&theme=dark&legend=top-left&sealed_token=LpoTO7nnGWAwvnRyEeMuKowbf1fe6tQP9n6EbjX-9HTG0uGPrSD_OaNkloMDIM5ugTCg_14LB3XpQTx7v4fBn7PAtMZhO87iIlK5lo42Z31x8myptmcmnQ" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&legend=top-left&sealed_token=LpoTO7nnGWAwvnRyEeMuKowbf1fe6tQP9n6EbjX-9HTG0uGPrSD_OaNkloMDIM5ugTCg_14LB3XpQTx7v4fBn7PAtMZhO87iIlK5lo42Z31x8myptmcmnQ" />
-   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&legend=top-left&sealed_token=LpoTO7nnGWAwvnRyEeMuKowbf1fe6tQP9n6EbjX-9HTG0uGPrSD_OaNkloMDIM5ugTCg_14LB3XpQTx7v4fBn7PAtMZhO87iIlK5lo42Z31x8myptmcmnQ" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&legend=top-left" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=Codename-11/hermes-relay&type=date&legend=top-left" />
  </picture>
 </a>
 

RELEASE.md

@@ -13,24 +13,20 @@ with optional prerelease identifiers.
 - `PATCH` — bug fixes, backwards compatible
 - Prerelease suffixes: `-alpha`, `-beta`, `-rc.N` (e.g. `0.2.0-beta.1`)
 
-Hermes-Relay ships three independently versioned production surfaces. Public
-GitHub Release titles use `Hermes-Relay <Surface> v<version>` (for example,
-`Hermes-Relay Android v1.13.0-rc.1`); immutable tag prefixes select the
-corresponding build and deployment lane.
+Hermes-Relay now ships three independently versioned surfaces:
 
 | Surface | Tag prefix | Version source | Bump script | Release workflow |
 |---|---|---|---|---|
-| Hermes-Relay Android | `android-v*` | `gradle/libs.versions.toml` | `scripts/bump-android-version.sh` | `.github/workflows/release-android.yml` |
-| Hermes-Relay Plugin | `server-v*` | `pyproject.toml` plus checked plugin/dashboard metadata | `scripts/bump-plugin-version.sh` | `.github/workflows/release-plugin.yml` |
-| Hermes-Relay CLI+UI | `desktop-v*` | `desktop/package.json` | `cd desktop && npm version --no-git-tag-version <version>` | `.github/workflows/release-cli.yml` |
+| Android app | `android-v*` | `gradle/libs.versions.toml` | `scripts/bump-android-version.sh` | `.github/workflows/release-android.yml` |
+| Server / Python package | `server-v*` | `pyproject.toml` plus checked plugin/dashboard metadata | `scripts/bump-server-version.sh` | `.github/workflows/release-server.yml` |
+| Desktop CLI | `desktop-v*` | `desktop/package.json` | `npm version` or manual package bump | `.github/workflows/release-desktop.yml` |
 
-This split is intentional. The plugin carries relay features for both Android
-and CLI clients, so plugin fixes can ship without forcing an Android app
-`versionCode` bump, and CLI alphas can continue on their own cadence. Historical
-Android releases before this naming split used bare `v*` tags. Historical
-plugin/server releases used `relay-v*` and `plugin-v*` tags. Historical
-desktop/CLI releases also include `cli-v*` tags. Those tags remain immutable;
-new releases use the canonical prefixes above.
+This split is intentional. The server now carries features for both Android
+and desktop, so server fixes can ship without forcing an Android app
+`versionCode` bump, and desktop CLI alphas can continue on their own cadence.
+Historical Android releases before this naming split used bare `v*` tags, and
+historical server releases used `relay-v*` tags. New releases use the explicit
+surface prefixes above.
 
 ### Android app versioning
 
@@ -74,87 +70,35 @@ bash scripts/bump-android-version.sh 0.6.2
 `scripts/bump-version.sh` remains as a backward-compatible alias for the
 Android script.
 
-### Plugin / Python package versioning
+### Server / Python package versioning
 
-Plugin version metadata lives in these plugin-owned files and must stay in
+Server version metadata lives in these server-owned files and must stay in
 lockstep:
 
 | File | Line | Purpose |
 |---|---|---|
 | `pyproject.toml` | `version = "..."` | Python package metadata |
-| `plugin/relay/__init__.py` | `__version__ = "..."` | runtime version reported by `/health` and `/relay/info` |
+| `plugin/relay/__init__.py` | `__version__ = "..."` | runtime version reported by `/health` |
 | `plugin/plugin.yaml` | `version: ...` | Hermes plugin metadata |
 | `plugin/dashboard/manifest.json` | `"version": "..."` | Hermes dashboard plugin metadata |
 | `plugin/dashboard/package.json` | `"version": "..."` | dashboard build/package metadata |
 | `plugin/dashboard/package-lock.json` | `"version": "..."` | locked dashboard package metadata |
 
-Always bump Plugin releases via:
+Always bump Server releases via:
 
 ```bash
-bash scripts/bump-plugin-version.sh 0.6.2
+bash scripts/bump-server-version.sh 0.6.2
 ```
 
 Check the current metadata with:
 
 ```bash
-python scripts/check-plugin-version-sync.py
+python scripts/check-server-version-sync.py
 ```
 
-Check all release tracks at once with:
-
-```bash
-python scripts/check-version-tracks.py
-```
-
-This aggregate check reports Android, Plugin, and CLI+UI versions
-side by side and validates that each track's own source files are internally
-consistent. It deliberately does not require all three tracks to share the same
-SemVer.
-
 The `server-v*` release workflow validates the tag against the same metadata,
-runs plugin tests, builds a wheel and sdist, generates checksums, and
-publishes a `Hermes-Relay Plugin vX.Y.Z` GitHub Release with the package
-artifacts.
-
-### CLI / tray versioning
-
-`desktop/package.json` is the CLI+UI release track's source of truth. Its version
-must match the generated CLI and Windows tray metadata. The tray is a compact
-management popup over the installed CLI and shared state; it has no chat,
-embedded terminal, plugins, voice, or separate desktop product surface. The public
-release remains one `Hermes-Relay CLI+UI` track containing CLI binaries plus the
-optional Windows installer.
-
-| File | Purpose |
-|---|---|
-| `desktop/package.json` | canonical CLI version |
-| `desktop/.bun-version` | exact Bun compiler/runtime for standalone binaries |
-| `desktop/package-lock.json` | npm root/workspace package metadata |
-| `desktop/src/version.ts` | compiled CLI runtime version |
-| `desktop/tray/Cargo.toml` | native systray package version |
-| `desktop/tray/Cargo.lock` | locked systray package version |
-| `desktop/tray/tauri.conf.json` | tray application and bundle version |
-| `desktop/tray/package.json` | tray UI package version |
-| `desktop/tray/package-lock.json` | locked tray UI package version |
-
-Prepare a new CLI version on its release-prep branch targeting `dev`, without
-creating a tag or npm-generated commit:
-
-```powershell
-cd desktop
-npm version --no-git-tag-version 0.4.0-alpha.2
-npm run check:version-sync
-npm run verify
-```
-
-The npm `version` lifecycle runs `sync:version`, which copies the canonical
-version into the generated CLI and tray metadata. If `package.json` was edited
-manually, run `npm run sync:version` before checking. `npm run verify` is the
-single Windows release-parity gate: version sync, type-check, tests, TypeScript
-build, compiled CLI smoke, and tray formatting, Clippy, check, and tests. CI runs
-the portable portions on every desktop change and the Windows tray gates separately.
-Release jobs read `desktop/.bun-version`; cross-built and Windows-built artifacts
-must not silently embed different Bun runtime versions.
+runs server tests, builds a wheel and sdist, generates checksums, and publishes
+a GitHub Release with the package artifacts.
 
 ## Branching policy
 
@@ -173,37 +117,12 @@ the accumulator: every merged PR appends bullets there. A release is a
 separate act, taken when the accumulated state on `dev` is worth shipping
 (see "When to cut a release" below). Cutting a release means opening a
 surface-specific release PR from `dev` into `main`, merging it `--no-ff`,
-then tagging `main`. Feature completion means merged and verified on `dev`; it
-does not mean released.
+then tagging `main`.
 
-**Staging is an environment, not a branch.** Deploy an exact tested `dev` SHA or
-an immutable prerelease tag (`-alpha`, `-beta`, or `-rc.N`) cut from a
-release-prepared `dev` commit. Record that source in the Forge release
-issue/session. Never deploy a moving branch name as the source of record and
-never create a staging branch. Stable production tags are cut only from the new
-`main` tip after the approved `dev` → `main` release merge.
-
-### Normal contribution and release flow
-
-1. Fetch `origin/dev` and branch `feature/*`, `fix/*`, `docs/*`, or `chore/*`
-   from that exact ref in a dedicated worktree.
-2. Open the PR into `dev` and require CI to pass.
-3. Merge with a merge commit/no-ff according to repository policy.
-4. Accumulate user-facing work under `CHANGELOG.md` `[Unreleased]`.
-5. Treat the feature as complete when it is merged and verified on `dev`.
-6. Start a separate Forge release issue/session when a release train is approved.
-7. Create `release/<surface-version>` from current `origin/dev`, prepare the
-   affected surface version and notes there, and merge its PR into `dev`.
-8. Fast-forward local `dev` to the exact merged `origin/dev`, then open and
-   approve the release PR from `dev` into `main`.
-9. Tag the new `main` tip with the affected surface prefix.
-10. Build and publish that surface's artifacts, roll out or deploy from the
-    immutable tag, and verify the release and live environment.
-
-Do not back-merge a normal release. The `main` release merge already has the
-released `dev` tip as its integration parent, so merging it back only adds
-history noise. The release-backmerge workflow detects this topology and exits
-successfully without changing `dev`.
+**Server tracks `dev` for staging.** The hermes-host deployment pulls
+`dev` so merged features get exercised against real data before they
+reach a tag. Users (Play Store, sideload, `hermes-relay-update`) only
+see state that lives on `main` and on release tags.
 
 ### Branch names
 
@@ -213,12 +132,10 @@ successfully without changing `dev`.
 | `fix/<name>` | Focused bug fix | `fix/media-projection-fgs` |
 | `docs/<name>` | Docs-only changes larger than a typo | `docs/sideload-guide` |
 | `chore/<name>` | Cleanup / refactor / tooling | `chore/sync-version-sources` |
-| `integration/<batch>` | Maintainer-owned batch of reviewed branches | `integration/android-routing-batch` |
-| `release/<surface-version>` | Surface release preparation targeting `dev` | `release/android-1.13.0` |
 
-All of the above branch from current `origin/dev` and merge back to `dev`.
-There is no straight-to-main exemption — even single-file typos go through a
-task branch and PR into `dev`.
+All of the above branch off `dev` and merge back to `dev`. There is no
+straight-to-main exemption — even single-file typos go through a feature
+branch and PR into `dev`.
 
 ### Merge style: `--no-ff`
 
@@ -236,47 +153,32 @@ preserves the branch context as a visible merge commit in
 
 Squash merges lose that detail and are **not** the house style.
 
-### Version bumps happen on release-prep branches, NOT feature branches
+### Version bumps happen at release-prep on `dev`, NOT on feature branches
 
 Feature branches **never** touch `gradle/libs.versions.toml`,
-plugin-owned version metadata, or `desktop/package.json`.
+server-owned version metadata, or `desktop/package.json`.
 If two feature branches both bumped a release version, they'd collide on
 version files and, for Android, on `appVersionCode` (which must be
 monotonic).
 
-Version-bump commits land on `dev` through the release-prep PR as the final
-release-preparation commit. Android commits use
-`release(android): android-vX.Y.Z`; server commits
-use `release(server): server-vX.Y.Z`; desktop commits use
-`release(desktop): desktop-vX.Y.Z`. A release PR then merges `dev` →
+Version-bump commits live on `dev` as the last commit of release-prep
+work. Android commits use `release(android): android-vX.Y.Z`; server commits
+use `release(server): server-vX.Y.Z`; desktop commits use the existing
+`release: desktop-vX.Y.Z` convention. A release PR then merges `dev` →
 `main` with `--no-ff`, and the matching tag is cut from the resulting
 `main` tip.
 
 ### Branch protection
 
-Repository files define the contract and CI, but GitHub owns the default branch,
-branch protection, rulesets, allowed merge methods, and required-check settings.
-Those settings require an operator or infrastructure automation.
+Light branch protection is enabled:
 
-The intended settings are:
-
-- **`main`** — PRs required; `Required checks` required and current; force push
-  and deletion blocked. Normal work does not target this branch.
-- **`dev`** — PRs and `Required checks` required; force push and deletion
-  blocked. This is the normal contribution target. The release-backmerge
-  workflow is the sole exception: its automation identity may compare-and-swap
-  `dev` to an exact checked merge commit after a stable hotfix release.
-- **Merge policy** — merge commits allowed; squash and rebase merges disabled so
-  the no-ff contract cannot be bypassed in the GitHub UI.
-- **Default branch** — `main`, which remains the release-history branch and the
-  repository's canonical landing page. Normal contribution PRs must explicitly
-  target `dev`.
-
-As of the 2026-07-15 repository audit, the default branch was correctly `main`.
-The remaining GitHub-owned gaps were that `dev` had no protection, squash and
-rebase merges were enabled, and `main` protection did not apply to
-administrators. Those settings must be reconciled separately; this documentation
-PR does not mutate them.
+- **`main`** — direct pushes blocked; only release PRs from `dev` merge
+  here. PR must pass CI (Android + Server) before merge. Force push and
+  branch deletion blocked.
+- **`dev`** — direct pushes blocked for non-trivial work; feature
+  branches PR in. PR must pass CI. Force push and branch deletion
+  blocked.
+- Signed commits + review approval NOT required (solo-dev overhead).
 
 ## One-time Setup
 
@@ -373,34 +275,22 @@ for the full text.
 
 ### 3. Play Developer API service account (optional)
 
-Required for automated upload (the `android-v*` workflow's Play step, or local
-`gradlew publishGooglePlayReleaseBundle`). Manual UI uploads work without this.
+Required only if you want `gradlew publishReleaseBundle` to upload directly
+to Play Console. Manual UI uploads work without this.
 
-The service account is **created in Google Cloud Console** and then **authorized
-in Play Console** — two separate consoles. (Play Console's older "Setup > API
-access" page has been reorganized; there is no longer a "Setup" group. Use the
-paths below.)
-
-1. **Create the service account (Google Cloud Console).** Open
-   <https://console.cloud.google.com/iam-admin/serviceaccounts>, pick the project
-   (any project works; if Play Console's **API access** page already names a linked
-   project, use that one). **Create service account** → name it e.g.
-   `hermes-relay-publisher` → **Done**. No project roles needed.
-2. **Create a JSON key.** On the new service account → **Keys** tab → **Add key >
-   Create new key > JSON** → download. This file's *contents* are the secret.
-3. **Authorize it in Play Console.** Open the Play Console account-level left
-   sidebar → **Users and permissions** → **Invite new users** → paste the service
-   account's email (`...@...iam.gserviceaccount.com`). Under **App permissions**
-   (for `com.axiomlabs.hermesrelay`) or **Account permissions**, grant the
-   **Release** permissions — "Release apps to testing tracks" and "Release to
-   production, exclude devices, and use Play App Signing" — plus "View app
-   information". (Granting **Admin (all permissions)** also works but is broader
-   than needed.) **Invite user**.
-4. **Use it.** For CI, paste the JSON contents into the `PLAY_SERVICE_ACCOUNT_JSON`
-   repo secret (step 4 / secrets table). For local publish, save the JSON as
-   `play-service-account.json` in the repo root (already in `.gitignore`).
-5. Verify locally with `gradlew bootstrapGooglePlayReleaseResources` — succeeds
-   without auth errors once permissions propagate (allow a few minutes).
+1. Open <https://console.cloud.google.com/> and select the project linked
+   to your Play Console account (Play Console > Setup > API access shows
+   which one).
+2. **IAM & Admin > Service Accounts > Create Service Account** (e.g.
+   `hermes-relay-publisher`). No project roles needed.
+3. On the new service account, **Keys > Add key > Create new key > JSON**
+   and download the file.
+4. In Play Console > **Setup > API access**, find the service account,
+   click **Grant access**, and assign the **Release manager** role.
+5. Save the JSON as `play-service-account.json` in the repo root (already
+   in `.gitignore`).
+6. Verify with `gradlew bootstrapReleasePlayResources` — should succeed
+   without auth errors.
 
 ### 4. GitHub Actions secrets
 
@@ -432,27 +322,10 @@ it sit alongside in `[Unreleased]`, and ship them together. A release
 is a statement to users that "this is a thing worth updating to," so
 the threshold is intent-driven, not event-driven.
 
-If you want to dogfood a frozen `dev` release candidate without declaring GA,
-tag the exact release-prepared `dev` commit with a **prerelease** tag such as
-`android-vX.Y.Z-rc.N` or `server-vX.Y.Z-rc.N`. Android prereleases publish the
-side-by-side **HR Candidate** app and never upload to Play. Plugin prereleases
-publish opt-in packages for staging and do not automatically replace production.
-See [Review builds and release candidates](docs/review-candidates.md).
-
-For one-PR review, do not bump versions or create a tag. Apply the
-`review-candidate` label to an open PR targeting `dev`. It produces one
-short-lived matched Android + Relay artifact; the **HR Candidate** app uses a
-separate application ID and the Relay package requires an explicit staging or
-snapshot/rollback install.
-
-## Release train ownership
-
-Every release train gets its own Forge release issue/session. That owner records
-the exact tested staging source, reconciles the affected surface version and
-notes on `dev`, owns the `dev` → `main` PR, tags the new `main` tip, observes the
-artifact workflow, performs the rollout or deployment, and captures live
-verification. Feature implementation sessions stop at merged and verified on
-`dev`; they do not inherit release authority.
+If you want to dogfood accumulated `main` state without declaring GA,
+tag a **pre-release** (`android-vX.Y.Z-rc.N`). Users can opt in via
+`hermes-relay-update --branch rc/vX.Y.Z-rc.N` without being auto-pushed
+the unstable build.
 
 ## Release Process
 
@@ -477,12 +350,6 @@ the new app version and a higher `appVersionCode`.
 
 ### 2. Update release notes and changelog
 
-> Each surface has its own GitHub-Release-body file, all in the same format
-> (Summary + Added/Changed/Fixed + Install/Verify): `RELEASE_NOTES.md` (Android),
-> `PLUGIN_RELEASE_NOTES.md` (plugin), `CLI_RELEASE_NOTES.md` (CLI). This step covers
-> the Android artifacts; the plugin/CLI files are filled in their own release
-> sections below but follow the identical scrub and Keep-a-Changelog grouping.
-
 - `CHANGELOG.md` — promote the accumulated `[Unreleased]` block to a
   versioned header. The block already exists: every feature PR has
   been appending to it. All you do here is:
@@ -492,157 +359,25 @@ the new app version and a higher `appVersionCode`.
   3. Skim the new versioned block and tighten / reorder if needed —
      Keep-a-Changelog grouping (`Added` / `Changed` / `Fixed`) should
      already be in place from the accumulator phase.
-  4. **Per-surface split.** `[Unreleased]` accumulates entries from *all
-     three* surfaces (Android + CLI + plugin), but releases are
-     per-surface. Move only the entries for the surface you're cutting into
-     the new versioned block, and leave the other surfaces' entries under
-     the fresh `[Unreleased]` for their own `desktop-v*` / `server-v*` cut.
-     (Those tracks' GitHub-Release bodies come from `CLI_RELEASE_NOTES.md` /
-     `PLUGIN_RELEASE_NOTES.md`, so the split here only governs this file's
-     historical record.)
 - `RELEASE_NOTES.md` — body of the GitHub Release for this version
   (rewritten each release; the workflow uses this as-is). This is the
   operator-facing summary, not the CHANGELOG mirror. Keep the
-  **Download** section near the top, in the required format (#144):
-  1. A lead callout naming the **one file most people want** —
-     "Installing on your phone? Download
-     `hermes-relay-<version>-sideload-release.apk` and tap it"
-     (full feature set), with the Play Store link for the
-     conservative build.
-  2. One explicit line that the `.aab` is a Play Console upload
-     bundle and **cannot** be installed by tapping it on a phone.
-  3. The `SHA256SUMS.txt` verify line + sideload-guide link.
-  No download table, no parity/testing artifacts: releases attach
-  exactly **two** app artifacts — the sideload APK and the googlePlay
-  AAB — plus `SHA256SUMS.txt` covering exactly those two (the 2-asset
-  policy in `.github/workflows/release-android.yml`; the parity twins
-  stay reproducible from the tag via CI but are not attached).
-  Every artifact is version-tagged as
+  **Download** section near the top — it should spell out which file
+  to grab by its `-sideload-release.apk` / `-googlePlay-release.aab`
+  suffix (every artifact is version-tagged as
   `hermes-relay-<version>-<flavor>-<buildType>` via `archivesName`
-  in `app/build.gradle.kts`. Never rename the sideload APK — the
-  in-app update checker matches assets by `.apk` + `sideload` in the
-  name, and user-docs verify steps cite the filename.
-  The release workflow also retains
-  `app/build/outputs/mapping/{googlePlayRelease,sideloadRelease}/mapping.txt`
-  for 90 days in the `android-r8-mappings-<version>-<sha>` workflow
-  artifact. It is intentionally not a GitHub Release asset. To symbolicate an
-  in-app or sideload report, download the artifact for the exact version/SHA and
-  run Android's retrace tool with the matching flavor mapping:
-  `retrace <mapping.txt> <obfuscated-trace.txt>`. Play reports can additionally
-  use the mapping bundled into the uploaded AAB through Play Console.
-- `app/src/main/assets/changelog.json` — curated source for the in-app
-  **What's New** dialog and Android release history. Prepend one schema-3 entry
-  with a single descriptive release `title`, a plain-language `summary`, and a
-  complete `changes` inventory. Every user-visible change has a stable `id`, a
-  `kind` (`added`, `improved`, or `fixed`), a short title, a useful explanation,
-  and an optional `highlight: true`; select 1–4 highlights. Add `compatibility`
-  bullets only when users need an availability, migration, flavor, or Plugin
-  boundary, plus Android-only `playNotes`. The app derives toast counts and
-  previews from the same inventory and renders every change exactly once.
-- `app/src/main/assets/whats_new.txt` — legacy in-app fallback generated from
-  the newest structured entry. Do not edit it independently.
-- `app/src/googlePlay/play/release-notes/en-US/default.txt` — the Play
-  Console **"What's new"** text, which gradle-play-publisher reads at
-  upload to fill the Production-draft release notes. This is **separate**
-  from `RELEASE_NOTES.md` (that one is only the GitHub Release body) — if
-  this file is missing or stale, the Play draft ships with empty/wrong
-  notes (shipped empty in v1.1.0 until caught post-release). Keep it
-  **≤500 chars per language**, user-facing, Android-only.
-- `docs/play-store-listing.md` — Play Store listing copy. Its release-note
-  block and the Gradle Play Publisher note are generated from `playNotes`.
-  After editing the newest structured entry, run
-  `python scripts/check-android-release-notes.py --write`, then run it again
-  without `--write` to validate complete unique change records, 1–4 highlights,
-  the current Android version, GitHub-release/changelog headings, derived files, and Play's
-  **500-character** limit. Frame Play copy around the release's themes, not a
-  feature dump. Compare its **Foreground service
-  permissions** section with the merged `googlePlayRelease` manifest and
-  complete Play Console declarations for every declared service type before
-  approval; the Publisher API can upload a draft and still reject promotion
-  when an App content declaration is missing.
-
-#### Generate release copy from the verified changes
-
-When release copy is generated with an agent, this section is the canonical
-authoring contract; do not maintain a separate prompt file.
-
-1. Read the exact Android version/SHA, the Android-only entries selected from
-   `[Unreleased]`, the implemented behavior, and any compatibility or security
-   boundary that users must understand. Do not generate from commit titles or
-   a mixed-surface changelog block alone.
-2. Before editing release files, show a temporary coverage ledger in the task
-   output. Map every selected Android source change to one stable change id and
-   one kind (`added`, `improved`, or `fixed`), and mark whether it is a
-   highlight. The ledger is review evidence, not a committed public artifact;
-   no selected user-visible change may disappear silently or be counted twice.
-3. Write one release title that describes the release as a whole. Do not let a
-   narrow feature name, internal project label, or poetic codename replace the
-   title users see in the toast and history. Follow it with a one- or two-sentence
-   summary that gives the release's overall outcome without becoming a feature dump.
-4. Select 1–4 highlights from the complete change inventory. A highlight is a
-   strong reason to care, not a second copy of the change: the app presents it
-   once in the highlight section and derives the remaining counts and previews
-   from non-highlighted changes.
-5. Include every meaningful user-visible addition, improvement, and fix in
-   `changes`, using plain titles and enough explanation for someone to recognize
-   the affected behavior. Internal refactors, tests, CI mechanics, branch work,
-   and debugging history stay in `RELEASE_NOTES.md`, `CHANGELOG.md`, or engineering
-   records unless they materially change reliability, security, or compatibility.
-6. Write each surface for its audience:
-   - `RELEASE_NOTES.md`: concise Summary plus Added/Changed/Fixed; keep the
-     deterministic Download and Install/Verify scaffolding intact.
-   - `CHANGELOG.md`: complete, crisp public history for the released surface.
-   - `changelog.json`: overall title/summary, complete typed changes, selected
-     highlights, compatibility boundaries, and Play copy. Counts and previews
-     are derived; never author a parallel digest.
-   - `playNotes`: Android-only themes within the rendered 500-character limit.
-7. Before presenting the draft, check that wording begins with user outcomes,
-   avoids unexplained implementation terminology, uses exact public product
-   names, makes no unverified device claim, and passes the public-distribution
-   scrub below.
-
-#### Scrub for public distribution
-
-This is a **public repo** and these release-note files are user-facing. Before
-promoting the `[Unreleased]` block and writing the notes, scrub the
-versioned CHANGELOG block and all three release-notes artifacts for
-wording that shouldn't ship publicly. The CHANGELOG accumulates in a
-dev-log voice during the iteration phase — release-prep is where it
-becomes public copy. Check for and remove/rewrite:
-
-- **Personal names / quoted asides** — `git grep -niE "bailey|: \"" CHANGELOG.md`
-  on the new block. Attribute fixes impersonally ("a user reported"),
-  not by name. (Author identity already lives in git + the signing cert.)
-- **Private infrastructure** — server hostnames/IPs, `~/SYSTEM.md`,
-  internal deployment names, anything that should stay in the operator's
-  environment and not the repo. `grep -niE "192\.168|10\.0\.|hermes-host|SYSTEM\.md"`.
-  (Example IPs like `192.168.1.100` in install docs are fine.)
-- **Fork / branch plumbing + internal nicknames** — references to private
-  fork branches, rollout channels, or in-team incident nicknames read as
-  internal. Keep the *what changed*, drop the *where we staged it*.
-- **Personal example data** — genericize sample profile/agent names to
-  neutral placeholders so the copy doesn't expose a specific setup.
-
-The goal is that someone who has never seen the repo can read the block
-and the release notes and learn only what the software does.
+  in `app/build.gradle.kts`) and link to the sideload guide.
+  The v0.3.0 body is a good template.
+- `app/src/main/assets/whats_new.txt` — in-app "What's New" content
+  shown in the settings/about screen. Update with the version number
+  and a brief feature summary. Gets stale silently if forgotten
+  (v0.4.0 shipped with 0.1.0 content until caught post-release).
+- `docs/play-store-listing.md` — Play Store listing copy. Update
+  the version reference and the "Release Notes" section that gets
+  pasted into the Play Console "What's new" field.
 
 ### 3. Build and verify locally
 
-During release-note/version iteration, use the narrow release-prep lane:
-
-```powershell
-python scripts/android-prepush.py --release-prep
-```
-
-It runs release metadata checks plus the rendered Changelog/What's New tests in
-the serialized Android lane. Once the exact commit is pushed, current-head CI
-and Play preflight own lint, focused shards, both-flavor assemblies, signing,
-and final package scans. Do not repeat the complete local release build unless
-cloud execution is unavailable or explicit local artifact/device proof is
-needed.
-
-For that explicit full local proof:
-
 ```bat
 scripts\dev.bat bundle
 keytool -printcert -jarfile app\build\outputs\bundle\googlePlayRelease\hermes-relay-*-googlePlay-release.aab
@@ -662,44 +397,11 @@ prefixed `hermes-relay-<version>-` via `archivesName` in
 Optional device smoke test: `scripts\dev.bat release` then
 `adb install -r app\build\outputs\apk\sideload\release\hermes-relay-*-sideload-release.apk`.
 
-### 4. Run the private Play preflight from `dev`
+### 4. Commit on `dev`, merge to `main`, tag from `main`
 
-The release-prep commit lands on `dev` first. Before any public tag or GitHub
-Release exists, open **Actions → Hermes-Relay Android Play Preflight**, choose **Run
-workflow**, select the final `dev` branch, and enter the prepared version.
-
-The preflight workflow:
-
-1. requires the workflow to run from `dev` or untagged `main` with matching
-   version metadata;
-2. runs the release metadata, locale, and Android collection-API checks;
-3. builds and release-signs the same APK/AAB variants used by the public release;
-4. scans the final minified APK DEX for unsupported collection calls;
-5. uploads the Google Play AAB as a private **Production draft**; and
-6. retains the exact signed sideload APK, Play AAB, R8 mappings, manifest, and
-   checksums as one immutable 30-day artifact keyed to version and Git tree.
-
-No sideload APK or GitHub Release is published by preflight. A successful signed
-build, final package scans, and Production-draft upload is the automated Play
-release gate. The private artifact is immutable and hash-verified again before
-publication; the stable release workflow does not rebuild those bytes. Play
-Console pre-review and pre-launch reports are informational and non-blocking
-because their detailed results are not exposed through the release automation
-API. If the release source changes after preflight, rerun it—the approval
-workflow matches the complete Git tree, not just the version number.
-
-GitHub exposes manual workflows only after their workflow file exists on the
-default branch. For the first release that introduces this process, merge the
-release PR without creating a tag, run preflight from untagged `main`, and then
-use the approval workflow. This publishes no app artifacts before the automated
-Play upload gate.
-
-### 5. Merge to `main` and approve the public release
-
-After Play preflight passes, merge the release PR from `dev` to `main`
-with `--no-ff`. The merge commit may differ from the preflight commit, but its
-tree must be identical. If the merge changes the tree, rerun private preflight
-from untagged `main`:
+The release-prep commit lands on `dev` first. Then a release PR merges
+`dev` → `main` with `--no-ff`, and the `android-v<version>` tag is cut from the
+resulting merge commit on `main`:
 
 ```bash
 # From a clean dev checkout:
@@ -707,182 +409,80 @@ git checkout dev
 git pull --ff-only origin dev
 
 git add gradle/libs.versions.toml RELEASE_NOTES.md CHANGELOG.md \
-        app/src/main/assets/changelog.json app/src/main/assets/whats_new.txt \
-        app/src/googlePlay/play/release-notes/en-US/default.txt \
-        docs/play-store-listing.md
+        app/src/main/assets/whats_new.txt docs/play-store-listing.md
 git commit -m "release(android): android-v0.6.2"
 git push origin dev
 
-# Run Hermes-Relay Android Play Preflight from dev and require a successful workflow.
 # Open the release PR (dev -> main) and merge with --no-ff.
+# After merge, tag from the new main tip:
+git checkout main
+git pull --ff-only origin main
+git tag android-v0.6.2
+git push origin android-v0.6.2
 ```
 
-Then open **Actions → Hermes-Relay Android Release Approval**, choose **Run workflow**, select
-`main`, and enter the version. Starting the workflow is the release approval. It
-verifies that `main` has the exact preflighted tree and creates the
-`android-v<version>` tag. Because tags created with `GITHUB_TOKEN` do not trigger
-another workflow, approval dispatches the current release workflow definition
-from `main`; every release job explicitly checks out and verifies the immutable
-`android-v<version>` tag. This lets release-workflow fixes apply without moving
-an existing tag or changing its artifact tree. Manual stable tags are still
-guarded by the same preflight proof in the tag workflow.
+Pushing a tag matching `android-v*` triggers `.github/workflows/release-android.yml`,
+which builds, signs, checksums, and creates a GitHub Release. Watch the
+run under the **Actions** tab.
 
-The tag-triggered `.github/workflows/release-android.yml` downloads the exact
-private preflight artifact by ID, verifies its source workflow, manifest, tree,
-version, sizes, and hashes, reruns the package scanners, then changes the
-existing Play Production draft to `completed` (submitting it for review). Only
-after Play accepts that operation does it publish those same APK/AAB bytes on
-GitHub. A missing preflight, changed release tree, artifact mismatch, missing
-Play credential, or Play submission failure prevents public publication.
+Server/Python version files are intentionally not part of an Android app
+release unless the server package itself is also being released.
 
-Plugin/Python version files are intentionally not part of an Android app
-release unless the plugin package itself is also being released.
+### Server / Python package release
 
-### Plugin / Python package release
-
-Use this when plugin or relay behavior changes independently of Android app
-delivery, for example CLI channel support, bridge routes, pairing server fixes,
-voice auth, dashboard plugin UI, or packaging changes.
-
-First **rewrite `PLUGIN_RELEASE_NOTES.md`** — it is the GitHub Release body for
-`server-v*` tags (the same role `RELEASE_NOTES.md` plays for Android). Fill the
-Summary and the Added/Changed/Fixed groups from the plugin-relevant bullets in the
-promoted `CHANGELOG.md` block, keep the `__VERSION__` token in the Install command
-(the workflow substitutes it), and apply the same public-distribution scrub as §2.
-Name the promoted changelog heading `## [Plugin <version>]`; the compatibility
-tag remains `server-v<version>`.
+Use this when Server behavior changes independently of Android app
+delivery, for example desktop channel support, bridge routes, pairing
+server fixes, voice auth, or packaging changes.
 
 ```bash
 git checkout dev
 git pull --ff-only origin dev
 
-bash scripts/bump-plugin-version.sh 0.6.2
-git add pyproject.toml plugin/relay/__init__.py plugin/plugin.yaml plugin/dashboard/manifest.json plugin/dashboard/package.json plugin/dashboard/package-lock.json CHANGELOG.md PLUGIN_RELEASE_NOTES.md
+bash scripts/bump-server-version.sh 0.6.2
+git add pyproject.toml plugin/relay/__init__.py plugin/plugin.yaml plugin/dashboard/manifest.json plugin/dashboard/package.json plugin/dashboard/package-lock.json CHANGELOG.md
 git commit -m "release(server): server-v0.6.2"
 git push origin dev
 
 # Open the release PR (dev -> main) and merge with --no-ff.
-# Then run "Hermes-Relay Plugin and CLI+UI Release Approval" from main,
-# select plugin, and enter 0.6.2. The workflow selects and validates main
-# before it creates server-v0.6.2 and starts the immutable-tag release workflow.
+# After merge, tag from the new main tip:
+git checkout main
+git pull --ff-only origin main
+git tag server-v0.6.2
+git push origin server-v0.6.2
 ```
 
-For a Plugin prerelease, keep the release-prepared commit on `dev` and run the
-same trusted approval workflow from `main`; the version suffix makes it select
-and validate the exact `origin/dev` tip before creating the tag. Stable versions
-select `origin/main` instead.
-Direct `server-v*` tag pushes remain a recovery path and are guarded by the same
-branch-containment and metadata checks.
+Pushing `server-v*` triggers `.github/workflows/release-server.yml`, which
+validates all server-owned version metadata with
+`scripts/check-server-version-sync.py`, runs server tests, builds a wheel and
+sdist, generates `SHA256SUMS.txt`, and creates a GitHub Release for the server
+package.
 
-The approval workflow dispatches `.github/workflows/release-plugin.yml`, which
-validates all plugin-owned version metadata with
-`scripts/check-plugin-version-sync.py`. Run
-`python scripts/check-version-tracks.py` locally before tagging when a change
-touches more than one release surface. The workflow also runs plugin tests,
-builds a wheel and sdist, generates `SHA256SUMS.txt`, and creates a GitHub
-Release named `Hermes-Relay Plugin v<version>` for the plugin package.
+### 5. Upload to Play Console
 
-### CLI+UI release
-
-Use this when the standalone CLI, daemon, desktop tools, or Windows tray changes.
-Android and plugin versions do not need to move with it.
-
-First rewrite `CLI_RELEASE_NOTES.md` for the new CLI+UI release and promote only
-CLI/tray-relevant changelog bullets into the release block. The compatibility
-tag and source directory remain `desktop-v<version>` and `desktop/`. Then:
-
-```powershell
-git switch dev
-git pull --ff-only origin dev
-
-cd desktop
-npm version --no-git-tag-version 0.4.0-alpha.2
-npm run verify
-cd ..
-
-git add desktop/package.json desktop/package-lock.json desktop/src/version.ts `
-  desktop/tray/Cargo.toml desktop/tray/Cargo.lock CHANGELOG.md CLI_RELEASE_NOTES.md
-git commit -m "release(desktop): desktop-v0.4.0-alpha.2"
-git push origin dev
-
-# This is a prerelease: run "Hermes-Relay Plugin and CLI+UI Release Approval"
-# from main, select desktop, and enter 0.4.0-alpha.2. The workflow validates dev
-# before it creates the tag and starts the immutable-tag release workflow.
-```
-
-For a stable CLI+UI version, first merge the release PR from `dev` to `main`,
-then run the approval workflow from `main`. The version determines the source:
-prereleases select the exact `origin/dev` tip and stable releases select the
-exact `origin/main` tip before creating any tag. Direct `desktop-v*` tag pushes
-remain a recovery path.
-
-The release workflow rejects version drift and requires prerelease tags to be
-contained in `origin/dev` and stable tags to be contained in `origin/main`. It
-reruns CLI tests, builds all four standalone binaries, tests and packages the
-Windows tray, generates checksums, and publishes the GitHub Release.
-Trusted desktop CI and the release installer job share a Cargo/target cache
-keyed by the lockfile and exact tray sources. A `main` push for the release tree
-warms the exact cache before the immutable tag build; a miss safely performs the
-ordinary Rust/Tauri build.
-
-### 6. Play review and publishing behavior
-
-> **Stable Android releases require `PLAY_SERVICE_ACCOUNT_JSON`.** Preflight
-> uploads the Production draft; approval promotes that same version code to
-> `completed`. Play Console-only reports are informational and non-blocking.
-> Stable releases do not fall back to publishing GitHub first when Play
-> credentials or submission are unavailable.
->
-> This automated path is intentionally bundle-only. It uploads the
-> `googlePlayRelease` AAB and release-scoped "What's new" notes, but it does
-> not republish static listing assets such as screenshots, title, description,
-> icon, or feature graphic. Use the Play Store Listing workflow when those
-> assets change.
-
-If Play Console **Managed publishing** is enabled, an approved submission remains
-under **Changes ready to publish** until a Play Console user publishes it. If it
-is disabled, the production submission may become available after Google review.
-Either behavior begins only after the public-release approval described above.
-
-**Pick the track first.** The AAB is track-agnostic — the same
-`-googlePlay-release.aab` goes to whichever track you publish on. Choose by intent,
-not habit:
-
-- **Production** — the default for a stable GA release (`android-vX.Y.Z`). The
-  listing is live, so this is where real releases land. The org account is
-  D-U-N-S-verified, so the 14-day / 12-tester closed-testing gate does **not**
-  apply — you can publish straight to Production.
-- **Open / Closed testing** — only when you actually want a public/private beta
-  channel for this build.
-- **Internal testing** — only for a throwaway pre-release smoke check (e.g. a
-  prerelease tag), not for a GA. Don't default here.
-
-**Manual upload:**
+**Manual upload (default):**
 
 1. Download the file ending in `-googlePlay-release.aab` from the GitHub
-   Release assets (for example, `hermes-relay-1.0.0-googlePlay-release.aab`),
+   Release assets (for example, `hermes-relay-0.3.0-googlePlay-release.aab`),
    or use your local build at
    `app\build\outputs\bundle\googlePlayRelease\hermes-relay-<version>-googlePlay-release.aab`.
-2. In Play Console, open the track you chose above — for a GA that's
-   **Release > Production**.
+2. In Play Console: **Release > Testing > Internal testing** (the 14-day
+   closed-testing rule does NOT apply to this account — see "Google Play
+   Console developer account" above).
 3. **Create new release** > upload the AAB.
-4. Paste the Play "What's new" from `docs/play-store-listing.md` (≤500 chars) into
-   the release notes field. (`RELEASE_NOTES.md` is the GitHub-Release body, not the
-   Play field — don't paste that; it's over the limit.)
-5. **Review release** > **Start rollout** (set the staged-rollout percentage if you
-   want a gradual production ramp).
+4. Paste `RELEASE_NOTES.md` into the release notes field.
+5. **Review release** > **Start rollout.**
 
 **Automated upload (if `play-service-account.json` is configured):**
 
 ```bat
 scripts\dev.bat bundle
-gradlew publishReleaseBundle --track=production
+gradlew publishReleaseBundle
 ```
 
-The `play { }` block in `app/build.gradle.kts` defaults to the `internal` track
-with `DRAFT` status as a safety net for unattended runs, so pass `--track` explicitly
-for a real release: `--track=production` (GA), or `--track=alpha` (Closed) /
-`--track=beta` (Open) for a beta channel.
+Defaults to the `internal` track with `DRAFT` status (configured in the
+`play { }` block in `app/build.gradle.kts`). Override per-invocation with
+`--track=alpha` (= Closed testing), `--track=beta` (= Open testing), or
+`--track=production`.
 
 To promote an existing release between tracks without rebuilding:
 
@@ -890,26 +490,20 @@ To promote an existing release between tracks without rebuilding:
 gradlew promoteReleaseArtifact --from-track=internal --promote-track=alpha
 ```
 
-### 7. Tracks (a menu, not a mandatory ladder)
+### 6. Promote through tracks
 
-The org account is exempt from the 14-day / 12-tester closed-testing rule, so a
-stable GA publishes **straight to Production** — there is no required promotion
-chain. The other tracks are opt-in tools, not steps you must climb:
+Typical path:
 
-- **Production** — live on the Play Store. Where GA releases go.
-- **Open testing (beta)** — opt-in public beta channel.
-- **Closed testing (alpha)** — opt-in private beta (named tester lists).
-- **Internal testing** — throwaway smoke check (e.g. a prerelease tag), no tester
-  or time minimum.
+1. **Internal testing** — personal smoke test (no tester or time minimum)
+2. **Closed testing (alpha)** — optional for staged rollout; Axiom-Labs'
+   org account is exempt from the 14-day / 12-tester rule, so you can skip
+   straight from Internal to Production if the build is ready
+3. **Open testing (beta)** — optional public beta
+4. **Production** — live on the Play Store
 
-If you *do* stage through tracks, promote an existing release without rebuilding via
-the Play Console UI or:
+Promote via the Play Console UI or `gradlew promoteReleaseArtifact`.
 
-```bat
-gradlew promoteReleaseArtifact --from-track=internal --promote-track=production
-```
-
-### 8. After release
+### 7. After release
 
 - Verify the GitHub Release has APK, AAB, and `SHA256SUMS.txt` attached.
 - Confirm the release body includes the **Download** section that tells
@@ -924,73 +518,46 @@ gradlew promoteReleaseArtifact --from-track=internal --promote-track=production
   (This step was only needed as a retrofit for v0.1.0 — v0.1.1+ inherit
   the Download section automatically from `RELEASE_NOTES.md`.)
 - Confirm Play Console shows the new versionCode on the target track.
-- Update `docs/project/DEVLOG.md` with a short entry for the release.
+- Update `DEVLOG.md` with a short entry for the release.
 
 ## CI Behavior
 
-Android, Plugin, dashboard, and desktop now have separate CI/release lanes.
+Android, Server, dashboard, and desktop now have separate CI/release lanes.
 This keeps a dashboard CSS fix from running the full server suite, and keeps
-plugin changes from forcing an Android app `versionCode` bump.
-
-Every successful `Required checks` run records a short-lived proof keyed to the
-checked Git tree. For the canonical `dev` → `main` release PR, CI first proves
-the simulated merge tree is identical to the `dev` tree. If an unexpired proof
-from a successful Required-checks run exists, the PR verifies and reuses it;
-otherwise it automatically falls back to the normal path-aware matrix. Content
-changes can never reuse an older proof because they change the tree hash.
+server changes from forcing an Android app `versionCode` bump.
 
 On every push of a tag matching `android-v*`, `.github/workflows/release-android.yml`:
 
-1. Verifies a stable tag resolves to a commit contained in `main`, or a
-   prerelease tag resolves to a commit contained in `dev`, and that the tag matches `appVersionName` in
+1. Validates the tag matches `appVersionName` in
    `gradle/libs.versions.toml` (mismatches fail the workflow).
-2. For stable releases, verifies and downloads the exact immutable Play
-   preflight artifact; prereleases run the focused CI slice and build the
-   side-by-side `sideloadCandidate` APK.
-3. Revalidates stable artifact hashes, DEX collection compatibility, packaged
-   native compatibility, and retained R8 mappings without recompiling.
-4. Generates candidate checksums when applicable; stable checksums come from
-   the verified preflight artifact and cover the two public files.
-5. For stable releases only, promotes the exact preflighted Production draft to
-   `completed`; prereleases never upload to Play.
-6. Creates a GitHub Release named `Hermes-Relay Android v<version>` with `RELEASE_NOTES.md` as
+2. Runs the Android debug build and the stable sideload pairing/connection
+   regression slice with explicit timeouts.
+3. Decodes `HERMES_KEYSTORE_BASE64` into `$RUNNER_TEMP/release.keystore`
+   and exports `HERMES_KEYSTORE_PATH` (skipped if the secret is unset).
+4. Builds both Android release artifacts:
+   `./gradlew bundleRelease assembleRelease`.
+5. Generates `SHA256SUMS.txt` covering both.
+6. Creates a GitHub Release named `Hermes-Relay-Android v<version>` with `RELEASE_NOTES.md` as
    the body. Attaches the APK, AAB, and `SHA256SUMS.txt`. Tags any version
    containing a dash (e.g. `android-v0.2.0-beta.1`) as a prerelease automatically.
-7. Prints a `$GITHUB_STEP_SUMMARY` with the release and Play result.
+7. Prints a `$GITHUB_STEP_SUMMARY` showing whether release signing
+   succeeded. If `HERMES_KEYSTORE_BASE64` is missing, the summary warns
+   that the artifacts are debug-signed and unsuitable for Play Store.
 
-For an approved multi-surface train, run **Hermes-Relay Coordinated Release
-Approval** from `main`, select the affected surfaces, and enter their prepared
-versions. It dispatches Android, Plugin, and CLI+UI approval jobs concurrently;
-each surface keeps its independent source, validation, tag, artifact, and
-publication workflow.
+On every push of a tag matching `server-v*`,
+`.github/workflows/release-server.yml`:
 
-On every direct push of a tag matching `server-v*`, or after an approved
-dispatch from `.github/workflows/approve-release-extensions.yml`,
-`.github/workflows/release-plugin.yml`:
-
-1. Verifies a stable tag commit is contained in `main`, or a prerelease tag is
-   contained in `dev`, then validates the tag against all server/plugin-owned version metadata checked by
-   `scripts/check-plugin-version-sync.py`, and requires the matching release
-   heading in `CHANGELOG.md`.
-2. Runs plugin syntax checks and the focused route/auth/session test slice.
+1. Validates the tag matches all server-owned version metadata checked by
+   `scripts/check-server-version-sync.py`.
+2. Runs server syntax checks and the focused route/auth/session test slice.
 3. Builds the Python wheel and sdist with `python -m build`.
 4. Generates `dist/SHA256SUMS.txt`.
-5. Creates a GitHub Release named `Hermes-Relay Plugin v<version>` with the wheel,
+5. Creates a GitHub Release named `Hermes-Relay-Server v<version>` with the wheel,
    sdist, and checksum file attached.
 
-On every direct push of a tag matching `desktop-v*`, or after an approved
-dispatch from `.github/workflows/approve-release-extensions.yml`,
-`.github/workflows/release-cli.yml` builds and publishes the CLI binaries and
-Windows tray installer. Its GitHub Release body comes from `CLI_RELEASE_NOTES.md`
-(rewritten per release — the CLI counterpart of `RELEASE_NOTES.md`); the workflow
-substitutes `__VERSION__` (bare, e.g. `0.3.0`) and `__TAG__` (full, e.g.
-`desktop-v0.3.0`) so the install/pin commands stay accurate. It requires stable
-tags to be contained in `main` and prerelease tags to be contained in `dev`,
-with a version matching `desktop/package.json` and a corresponding
-`CHANGELOG.md` release heading.
-Fill its Summary and
-Added/Changed/Fixed groups at CLI release-prep and apply the §2 public scrub.
-Dashboard-only changes are covered by
+On every push of a tag matching `desktop-v*`,
+`.github/workflows/release-desktop.yml` builds and publishes the desktop
+CLI binaries. Dashboard-only changes are covered by
 `.github/workflows/ci-dashboard.yml`, which builds the dashboard plugin,
 runs the dashboard API tests, and verifies the modal CSS markers are present
 in the built bundle.
@@ -1003,43 +570,12 @@ in the built bundle.
 | `HERMES_KEYSTORE_PASSWORD`  | Store password                      | Password set during `keytool -genkey`            |
 | `HERMES_KEY_ALIAS`          | Key alias                           | Alias set during `keytool -genkey`               |
 | `HERMES_KEY_PASSWORD`       | Key password                        | Usually the same as the store password          |
-| `PLAY_SERVICE_ACCOUNT_JSON` | Stable Play submission             | Paste the full Play Developer API service-account JSON (step 3) |
-
-Stable Android releases require `PLAY_SERVICE_ACCOUNT_JSON`. Preflight uploads
-the Production draft and the tag workflow promotes that exact version code to
-`completed`. The workflow does not fall back to manual upload or publish GitHub
-first. With Play Managed Publishing off, an approved release publishes
-automatically; with it on, Play holds the approved change for an operator action
-that the Developer API does not expose.
 
 ## Hotfix Recipe
 
-When production has a bug, use the same invariant for every surface:
-
-1. Branch from the affected immutable `android-v*`, `server-v*`, or `desktop-v*`
-   production tag, never from the moving `main` or `dev` branch.
-2. Make the smallest safe fix and add focused verification.
-3. Bump only the affected surface's patch version and release notes.
-4. Open the focused hotfix PR into `main` and merge with a merge commit/no-ff.
-5. Tag the new `main` tip with the affected surface's patch tag.
-6. Verify the artifacts and production rollout or deployment.
-7. Let the stable release workflow dispatch `Release Backmerge`. A
-   conflict-free candidate runs the same path-aware `Required checks` against
-   its exact SHA, then compare-and-swaps `dev` only if the base ref is unchanged.
-   Conflicts, failed checks, stale refs, or a denied update require a normal
-   reconciliation PR.
-
-`Release Backmerge` accepts only published stable `android-v*`, `server-v*`, or
-`desktop-v*` SemVer tags contained in `main`. It exits without mutation for a
-normal release whose integration parent is already in `dev`. For a selective
-hotfix, it pushes a temporary merge ref, dispatches `Required checks` with full
-base/head SHAs, and updates `dev` with an explicit force-with-lease only after
-that exact candidate passes. The lease is a compare-and-swap guard, not
-permission to rewrite history: the candidate's first parent must be the
-unchanged `dev` tip and its second parent the released commit. The repository
-ruleset must allow this workflow's automation identity to perform that one
-checked branch update; if it does not, the workflow fails closed and the
-reconciliation uses a PR.
+When production has a bug and you need to ship a fix without picking up
+unreleased work from `dev`, branch from the affected release tag and only
+bump the version source for the surface you are shipping.
 
 For an Android app hotfix:
 
@@ -1053,23 +589,17 @@ For an Android app hotfix:
 5. Open a PR from `fix/short-name` into `main`, merge with `--no-ff`.
 6. `git tag android-v0.6.2` from the new `main` tip and `git push origin android-v0.6.2`
    so Android release CI builds and publishes.
-7. Verify the automated Play submission, GitHub artifacts, and rollout.
-8. Verify the automated release backmerge completed. If it stopped, open a
-   reconciliation PR so `dev` picks up the hotfix and versionCode bump. Without
-   reconciliation, `dev`'s `appVersionCode` lags behind `main` and the next app
-   release bump collides.
+7. Upload to Play Console as normal.
+8. Merge `main` back into `dev` (`git checkout dev && git merge --no-ff main`)
+   so `dev` picks up the hotfix and the versionCode bump. Without this,
+   `dev`'s `appVersionCode` lags behind `main` and the next app release
+   bump collides.
 
-For a Plugin hotfix, branch from the affected `server-v*` tag, apply
-the fix, run `bash scripts/bump-plugin-version.sh <next-version>`, merge to
-`main`, tag `server-v<next-version>`, verify the package/deployment, and verify
-the automated release backmerge. Do not touch
+For a Server hotfix, branch from the affected `server-v*` tag, apply
+the fix, run `bash scripts/bump-server-version.sh <next-version>`, merge to
+`main`, and tag `server-v<next-version>`. Do not touch
 `gradle/libs.versions.toml` unless an Android app release is also shipping.
 
-For a CLI+UI hotfix, branch from the affected `desktop-v*` tag, update only
-`desktop/package.json` and its generated lock/runtime/tray metadata, merge to
-`main`, tag `desktop-v<next-version>`, verify all binaries and the installer,
-then verify the automated release backmerge or use the PR fallback.
-
 ## Troubleshooting
 
 **`Tag version (X) does not match appVersionName (Y)` in CI validate step**

RELEASE_NOTES.md

@@ -1,40 +1,33 @@
-# Hermes-Relay Android v1.15.1
+# Hermes-Relay-Android v0.8.1
 
-**Release Date:** September 2, 2026
+**Release Date:** May 26, 2026
+**Since v0.8.0:** A focused patch fixing a voice-mode crash. No new features.
+
+v0.8.1 is a patch release. If you don't use voice mode with barge-in enabled, v0.8.0 is unaffected — but updating is still recommended.
+
+---
 
 ## Download
 
-> Installing on your phone? Download `hermes-relay-1.15.1-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
+v0.8.1 ships in two Android build flavors. APK and AAB filenames are version-tagged:
 
-The `.aab` file is a Play Console upload bundle and cannot be installed by tapping it on a phone.
+| Flavor | File | Who it's for |
+|---|---|---|
+| Google Play | `hermes-relay-0.8.1-googlePlay-release.aab` | Upload this Android App Bundle to Play Console. It has no AccessibilityService, screen reading, screenshots, gestures, SMS/calls, contacts/location, overlays, wake locks, or unattended phone control. |
+| sideload | `hermes-relay-0.8.1-sideload-release.apk` | Direct-install APK for full Device Control. Installs as `com.axiomlabs.hermesrelay.sideload`. |
+| googlePlay APK | `hermes-relay-0.8.1-googlePlay-release.apk` | Parity/testing artifact. |
+| sideload AAB | `hermes-relay-0.8.1-sideload-release.aab` | Parity/testing artifact. |
 
-Verify the download against `SHA256SUMS.txt`. See the [sideload guide](https://hermes-relay.dev/docs/guide/sideload) for installation help.
+Verify integrity with `SHA256SUMS.txt` from the same release. See the [Sideload guide](https://codename-11.github.io/hermes-relay/guide/getting-started.html#sideload-apk) for APK install steps.
 
-## Summary
-
-This patch improves chat, media, and voice reliability. It reduces memory-heavy work, keeps attachment previews stable through rotation, and makes follow-up message behavior and voice errors easier to understand.
-
-## Changed
-
-- Choose Correct now or Queue next from a slim tray behind the composer. Chat settings sets the default; the tray overrides one message. Stop pauses the queue, Resume continues it, and editing or removing an item preserves its successors.
-- Chat and Voice use readable centered layouts on wider screens, including landscape Voice Focus.
+---
 
 ## Fixed
 
-- Correction and delivery labels remain visible inside user-message bubbles.
-- Voice errors open in a scrollable dialog with separate Retry and Dismiss actions.
-- Attachment previews remain open through rotation, and video previews preserve their proportions.
-- Release optimization preserves the native speech configuration required for wake-word startup.
-- Standard Hermes attachments download directly to disk with bounded size checks.
-- Session refresh avoids repeated request loops; history loads, Markdown, image previews, and media exports keep memory use bounded.
-- Image-generation progress stays visible through gaps between interim replies and returned media.
-- The first prompt waits for Gateway session readiness. Ownership refusals retain the prompt for retry and show the original server error.
+### Voice mode crash with barge-in on legacy TTS playback
 
-## Install / Verify
+Starting voice mode with **barge-in enabled** while the relay served audio over the legacy `/voice/synthesize` path crashed the app the instant the agent began speaking — the first word or two played, then the app died with `Player is accessed on the wrong thread`.
 
-- App version: **1.15.1** (versionCode **54**).
-- Standard Chat, sessions, profiles, Manage, voice, and ordinary media use current upstream Hermes. Speech-to-text still requires a configured provider on the host.
-- Hermes-Relay Plugin **1.11.1** remains the current optional plugin release; this Android patch does not require a new plugin version.
-- Paused text queues can be restored. Attachment bytes are not persisted in preferences; unrestorable attachment queues must be reviewed and sent again.
-- Explicit Direct API/API-only connections remain supported and are not used as silent failover for Dashboard-owned chats.
-- Granular Device Control and the system Voice Focus overlay remain sideload-only.
+The barge-in listener reads the audio session id from a background thread to attach the echo canceller, but Media3's `ExoPlayer` is thread-confined and throws when its `audioSessionId` getter is read off the main thread. `VoicePlayer.audioSessionId` is now backed by a thread-safe cache populated from main-thread playback callbacks, so it's safe to read from any thread.
+
+This only affected the **opt-in** barge-in feature on the legacy text-to-speech path; the provider-native Realtime Agent and Voice Output paths were never affected.

ROADMAP.md

@@ -1,6 +1,6 @@
 # Hermes-Relay Roadmap
 
-> Where Hermes-Relay is headed. Short, high-level, grouped by release milestone. For detailed implementation plans of active work see [`docs/plans/`](../plans/); for shipped work see [`CHANGELOG.md`](../../CHANGELOG.md); for the session-by-session narrative see [`DEVLOG.md`](DEVLOG.md).
+> Where Hermes-Relay is headed. Short, high-level, grouped by release milestone. For detailed implementation plans of active work see [`docs/plans/`](docs/plans/); for shipped work see [`CHANGELOG.md`](CHANGELOG.md); for the session-by-session narrative see [`DEVLOG.md`](DEVLOG.md).
 
 ## Vision
 
@@ -8,29 +8,29 @@ Native Android companion for the [Hermes agent platform](https://github.com/Nous
 
 ## Shipped
 
-- **v0.3.0** — Bridge channel (sideload), voice mode, notification companion, two build flavors, full safety rails system. [CHANGELOG](../../CHANGELOG.md#030---2026-04-13)
-- **v0.2.0** — Voice mode foundation, terminal preview, TOFU cert pinning, Paired Devices screen. [CHANGELOG](../../CHANGELOG.md)
+- **v0.3.0** — Bridge channel (sideload), voice mode, notification companion, two build flavors, full safety rails system. [CHANGELOG](CHANGELOG.md#030---2026-04-13)
+- **v0.2.0** — Voice mode foundation, terminal preview, TOFU cert pinning, Paired Devices screen. [CHANGELOG](CHANGELOG.md)
 - **v0.1.0** — Chat, sessions, QR pairing, encrypted storage, Play Store submission.
 
 ### Desktop track (parallel lane to Android) — **experimental**
 
-Release tags: `cli-v*` (separate cadence from Android `android-v*` and Plugin `plugin-v*`). Historical alpha prereleases used `desktop-v*`, and the installer/updater keep a migration fallback. Curl-installed prebuilt binaries (no Node required); Windows first, macOS / Linux same release. Workflows: [`ci-desktop.yml`](../../.github/workflows/ci-desktop.yml) + [`release-cli.yml`](../../.github/workflows/release-cli.yml).
+Release tags: `desktop-v*` (separate cadence from Android `android-v*` and Server `server-v*`). Curl-installed prebuilt binaries (no Node required); Windows first, macOS / Linux same release. Workflows: [`ci-desktop.yml`](.github/workflows/ci-desktop.yml) + [`release-desktop.yml`](.github/workflows/release-desktop.yml).
 
 **Shipped (2026-04-23 — first tagged release `desktop-v0.3.0-alpha.1`):**
 
-- **`@hermes-relay/cli` v0.1** — Node thin-client at [`desktop/`](../../desktop/). Remote chat + pair + status + tools subcommands over the relay's `tui` WSS channel. Shares `~/.hermes/remote-sessions.json` with the Android client (pair once, both work).
+- **`@hermes-relay/cli` v0.1** — Node thin-client at [`desktop/`](desktop/). Remote chat + pair + status + tools subcommands over the relay's `tui` WSS channel. Shares `~/.hermes/remote-sessions.json` with the Android client (pair once, both work).
 - **v0.2 — resilience + pairing UX** — multi-endpoint pairing (ADR 24: `--pair-qr` probes LAN/Tailscale/Public, strict-priority within-tier race, 4s timeout, 60s cache), reconnect-on-drop state machine (1s→30s exp backoff, 5min on 429, gate re-check post-sleep), TOFU cert pinning via pre-WS TLS probe (SPKI sha256, `sha256/<base64>` OkHttp-compatible).
 - **v0.2 — UX polish** — bare `hermes-relay` → `shell` (full Hermes CLI over PTY with `clear; exec hermes` after tmux settles); contextual connect banner (`Connected via LAN (plain) — server 0.6.0`); `status` surfaces grants + TTL + endpoint role from `auth.ok`; new `devices` subcommand talking to relay `GET/DELETE/PATCH /sessions` over HTTP.
 - **Phase B — client-side tool routing** — server-side `plugin/relay/channels/desktop.py` + `plugin/tools/desktop_tool.py` register `desktop_read_file` / `_write_file` / `_terminal` / `_search_files` / `_patch` via `tools.registry` (mirror of `android_*` pattern — **zero hermes-agent core change**). Client-side `DesktopToolRouter` attaches to the `desktop` channel, dispatches under a 30s AbortController, heartbeats `desktop.status` every 30s. One-time per-URL consent gate + `--no-tools` kill-switch.
 - **`hermes-relay daemon`** — headless WSS + tool router that keeps desktop tools serving without a visible shell. Fails closed on missing stored consent (`--allow-tools` escape hatch with an explicit `--token`). JSON-line logs by default, auto-human on TTY. Inherits transport's reconnect state machine; `setImmediate(exit)` to flush final log line before process dies.
 - **Pre-release hardening** — `hermes-relay doctor` (local diagnostic report, human + `--json`, no token leakage); `uninstall.{sh,ps1}` (3-tier: default keeps session store, `--purge` wipes it with cross-surface warning, `--service` stub); interactive first-run prompts (`resolveFirstRunUrl` — auto-picks single stored session, numbered picker for multiple, welcome banner for fresh install); version-aware install (`upgrading X → Y` readback pre-install, post-install confirmation).
-- **Self-setup skill** — [`skills/devops/hermes-relay-desktop-setup/SKILL.md`](../../skills/devops/hermes-relay-desktop-setup/SKILL.md) lets any Hermes agent install, pair, and troubleshoot the CLI with **live local diagnostics** via `desktop_terminal` (can read the user's Node version, PATH, binary location directly — something the Android setup skill can't match).
+- **Self-setup skill** — [`skills/devops/hermes-relay-desktop-setup/SKILL.md`](skills/devops/hermes-relay-desktop-setup/SKILL.md) lets any Hermes agent install, pair, and troubleshoot the CLI with **live local diagnostics** via `desktop_terminal` (can read the user's Node version, PATH, binary location directly — something the Android setup skill can't match).
 
-**Shipped — `desktop-v0.3.0-alpha.6` (seamless-local dev pass, done 2026-04-23):** Plan at [`docs/plans/2026-04-23-desktop-alpha-6-seamless-local.md`](../plans/2026-04-23-desktop-alpha-6-seamless-local.md). Nine features across six parallel agent workstreams, all opt-in: workspace-awareness envelope + active-editor signal (#1+#8), `hermes-relay update` self-update subcommand (#2), `desktop_open_in_editor` tool + interactive patch approval with unified-diff rendering (#3+#4), conversation picker on connect (#5), clipboard bridge + screenshot handlers (#9+#12), and a `hermes` alias so muscle-memory works without the `-relay` suffix (#13). Integration day: 2026-04-23.
+**Shipped — `desktop-v0.3.0-alpha.6` (seamless-local dev pass, done 2026-04-23):** Plan at [`docs/plans/2026-04-23-desktop-alpha-6-seamless-local.md`](docs/plans/2026-04-23-desktop-alpha-6-seamless-local.md). Nine features across six parallel agent workstreams, all opt-in: workspace-awareness envelope + active-editor signal (#1+#8), `hermes-relay update` self-update subcommand (#2), `desktop_open_in_editor` tool + interactive patch approval with unified-diff rendering (#3+#4), conversation picker on connect (#5), clipboard bridge + screenshot handlers (#9+#12), and a `hermes` alias so muscle-memory works without the `-relay` suffix (#13). Integration day: 2026-04-23.
 
-**Active — `desktop-v0.3.0-alpha.7` (native image paste):** Plan at [`docs/plans/2026-04-23-desktop-alpha-7-native-paste.md`](../plans/2026-04-23-desktop-alpha-7-native-paste.md). Two-repo workstream: client slash commands `/paste` (clipboard), `/screenshot` (primary display), `/image <path>` (file) land in `hermes-relay chat`, each echoes a one-line feedback and attaches the image to the next `prompt.submit` so the vision-capable model sees it in the same turn — parity with Claude Desktop's paste UX minus OS-level Ctrl+V (terminals don't pipe image bytes to stdin). Client half is new `desktop/src/chatAttach.ts` + slash-command branches in `desktop/src/commands/chat.ts`. Server half is ONE new `@method("image.attach.bytes")` on the fork's `tui_gateway/server.py` (branch `feat/image-attach-bytes` → merged to `axiom`); the fork's existing `_enrich_with_attached_images` already handles multimodal payload plumbing and session-scoped image state, so this release is almost entirely about bridging client-captured bytes to server-side state that's been there for months. Relay channel unchanged — `tui` is a transparent RPC forwarder. Graceful fallback when hermes-host hasn't been updated yet: client catches `method not found`, prints a pointer at the axiom rollout, REPL stays alive.
+**Active — `desktop-v0.3.0-alpha.7` (native image paste):** Plan at [`docs/plans/2026-04-23-desktop-alpha-7-native-paste.md`](docs/plans/2026-04-23-desktop-alpha-7-native-paste.md). Two-repo workstream: client slash commands `/paste` (clipboard), `/screenshot` (primary display), `/image <path>` (file) land in `hermes-relay chat`, each echoes a one-line feedback and attaches the image to the next `prompt.submit` so the vision-capable model sees it in the same turn — parity with Claude Desktop's paste UX minus OS-level Ctrl+V (terminals don't pipe image bytes to stdin). Client half is new `desktop/src/chatAttach.ts` + slash-command branches in `desktop/src/commands/chat.ts`. Server half is ONE new `@method("image.attach.bytes")` on the fork's `tui_gateway/server.py` (branch `feat/image-attach-bytes` → merged to `axiom`); the fork's existing `_enrich_with_attached_images` already handles multimodal payload plumbing and session-scoped image state, so this release is almost entirely about bridging client-captured bytes to server-side state that's been there for months. Relay channel unchanged — `tui` is a transparent RPC forwarder. Graceful fallback when hermes-host hasn't been updated yet: client catches `method not found`, prints a pointer at the axiom rollout, REPL stays alive.
 
-**Active — desktop control / computer-use:** Enhanced plan at [`docs/plans/desktop-control-computer-use-enhanced.md`](../plans/desktop-control-computer-use-enhanced.md); earlier MVP implementation record at [`docs/plans/desktop-computer-use-mvp.md`](../plans/desktop-computer-use-mvp.md). Windows now has the first Tauri tray/overlay app as the primary Easy/Standard install surface: pair, start/pause daemon, Devices/Revoke, Task Log, Settings, overlay status chip, emergency stop, and bundled CLI sidecar. The existing CLI and daemon remain the primary advanced/headless surface. `desktop_computer_*` schemas are registered on the normal desktop tool channel but advertised only behind the explicit experimental computer-use flag. Host input still requires desktop-tool consent plus a visible, task-scoped assist/control grant; there is no unrestricted or silent mouse/keyboard automation.
+**Active — desktop control / computer-use:** Enhanced plan at [`docs/plans/desktop-control-computer-use-enhanced.md`](docs/plans/desktop-control-computer-use-enhanced.md); earlier MVP implementation record at [`docs/plans/desktop-computer-use-mvp.md`](docs/plans/desktop-computer-use-mvp.md). Windows now has the first Tauri tray/overlay app as the primary Easy/Standard install surface: pair, start/pause daemon, Devices/Revoke, Task Log, Settings, overlay status chip, emergency stop, and bundled CLI sidecar. The existing CLI and daemon remain the primary advanced/headless surface. `desktop_computer_*` schemas are registered on the normal desktop tool channel but advertised only behind the explicit experimental computer-use flag. Host input still requires desktop-tool consent plus a visible, task-scoped assist/control grant; there is no unrestricted or silent mouse/keyboard automation.
 
 **Desktop control UX direction:** Tauri v2 (Rust + static web UI) is the native shell for the polished Easy-tier experience: tray icon, always-visible overlay chip, task log, settings, and one-click pause/emergency stop. Easy tier pairs once, shows a connected/observing chip, and exposes Devices / Revoke / Task Log / Settings / Emergency Stop from the tray. Standard tier adds full tray management; Advanced tier remains CLI + daemon + JSON policy (`~/.hermes/desktop-control.json`) for operators. The default policy baseline blocks password managers, credential prompts, banking/payment/crypto surfaces, OS security/admin settings, and private-key/token material until locally overridden.
 
@@ -47,11 +47,11 @@ Release tags: `cli-v*` (separate cadence from Android `android-v*` and Plugin `p
 
 **Earlier alpha.2–alpha.5 workstreams (now in-flight / done — see DEVLOG 2026-04-23 entries for specifics):**
 
-- **`hermes-relay update` subcommand + auto-update nudge.** The binary self-update path polls the GitHub Releases API, prefers `cli-v*`, falls back to historical `desktop-v*` prereleases during migration, compares to `readVersion()`, and downloads the binary directly + `rename` over the current one (Windows can rename while running; Linux/macOS atomic replace is fine for long-lived daemons because the running process keeps the old inode open). Add a once-per-day background check in `daemon` mode that emits `update_available` as a log event — opt-in via `--check-updates`, never auto-installs without user action. Signing prerequisite: SmartScreen/Gatekeeper would warn on every auto-downloaded binary until we sign, so this is behind code signing.
+- **`hermes-relay update` subcommand + auto-update nudge.** The binary today does NOT self-update — users have to re-run the `curl | sh` / `irm | iex` one-liner to pick up a new release. Close the gap: `hermes-relay update` polls the GitHub Releases API, filters to `desktop-v*`, compares to `readVersion()`, and either shells out to the installer or downloads the binary directly + `rename` over the current one (Windows can rename while running; Linux/macOS atomic replace is fine for long-lived daemons because the running process keeps the old inode open). Add a once-per-day background check in `daemon` mode that emits `update_available` as a log event — opt-in via `--check-updates`, never auto-installs without user action. Signing prerequisite: SmartScreen/Gatekeeper would warn on every auto-downloaded binary until we sign, so this is behind code signing.
 - **Workspace-awareness — desktop client sends cwd/git/hostname on connect.** Biggest lingering "is the agent working against the right tree?" problem. On WSS auth, the client advertises an ephemeral workspace descriptor — `cwd`, `git_root`, `git_branch`, `git_status_summary` (staged/modified counts), `repo_name`, `hostname`, `platform`, `active_shell`. Server-side `DesktopHandler` stashes it as live session metadata (NOT persistent state). New hermes-agent plugin hook injects a one-line ephemeral prompt prefix into the session context — *"Active desktop workspace: machine=Bailey-PC · repo=hermes-relay · branch=dev · staged=3"* — so the LLM reads it every turn without the operator having to explain. Also default `desktop_terminal` / `desktop_read_file` / `desktop_search_files` `cwd` to the repo root when unset. Expose the snapshot in `hermes-relay doctor` + `hermes-relay status` + a new `hermes-relay workspace` subcommand + a relay dashboard tab so both operator and agent have a common view. Pair with a `.hermes/workspace-context.json` file-based fallback for when the socket path can't be reached. Requires: new WSS envelope (`desktop.workspace` on connect), hermes-agent plugin hook for ephemeral context injection, schema coordination with the upstream `ContextVar` multi-client work.
 - **Service installers** — `scripts/install-service-{win,linux,mac}.{ps1,sh}` — Windows Service via `sc.exe create`, `systemd --user` unit with `loginctl enable-linger`, `launchctl load` plist for macOS. Auto-start on login so the daemon is always reachable.
 - **Multi-client routing on the `desktop` channel** — replace single-client MVP with per-token indexing + device-id reconnect handoff. Hermes session state carries `desktop_session_token` via a new `ContextVar` in `gateway/session_context.py` (hermes-agent PR candidate — won't affect Android). Natural pairing with the workspace-awareness envelope — the ContextVar scheme determines which client's workspace the active session sees.
-- **Harden `release-cli.yml` retag semantics.** The `softprops/action-gh-release` step failed during the alpha.1 retag with `tag_name already_exists` after deleting + re-uploading all 5 assets; recovered by `gh api` cleanup (delete orphan draft + PATCH draft→false on the release with the real assets). Follow-up: pin the action version, add `make_latest: false` + explicit `release_id` lookup, or switch to `ncipollo/release-action` which handles retags without the duplicate-draft creation.
+- **Harden `release-desktop.yml` retag semantics.** The `softprops/action-gh-release` step failed during the alpha.1 retag with `tag_name already_exists` after deleting + re-uploading all 5 assets; recovered by `gh api` cleanup (delete orphan draft + PATCH draft→false on the release with the real assets). Follow-up: pin the action version, add `make_latest: false` + explicit `release_id` lookup, or switch to `ncipollo/release-action` which handles retags without the duplicate-draft creation.
 - **Signed binaries** — Windows EV code-signing (~$300/yr, DigiCert or SSL.com) + Apple Developer ID + notarization ($99/yr). Removes SmartScreen/Gatekeeper warnings. Prerequisite for the auto-update path.
 - **npm registry publication** — future v1.0 distribution work. The package name is local workspace metadata today; current install paths are GitHub Release binaries or local clone + `npm link`.
 - **HMAC verification on QR payloads** — defer until a client-accessible secret story exists (same deferral as the Android app). Not blocking GA.
@@ -64,7 +64,7 @@ Moving the Play Store listing from a personal account to the DUNS-verified Axiom
 
 ## Next — v0.4: Bridge feature expansion
 
-Detailed plan: [`docs/plans/2026-04-13-bridge-feature-expansion.md`](../plans/2026-04-13-bridge-feature-expansion.md).
+Detailed plan: [`docs/plans/2026-04-13-bridge-feature-expansion.md`](docs/plans/2026-04-13-bridge-feature-expansion.md).
 
 Expands the bridge channel's tool surface substantially, ports reliability patterns from the broader Hermes-Android ecosystem, and ships a per-app playbook skill so the agent has ready-made procedures for common apps out of the box.
 
@@ -84,16 +84,16 @@ Expands the bridge channel's tool surface substantially, ports reliability patte
 
 Small follow-ons to v0.4 deliberately deferred to keep the v0.4.0 release surface focused.
 
-**Unattended access mode** *(sideload-only).* ~~Opt-in toggle on the Bridge tab that acquires `FULL_WAKE_LOCK + ACQUIRE_CAUSES_WAKEUP`, raises `SCREEN_OFF_TIMEOUT` to max while active, and requests `KeyguardManager.requestDismissKeyguard()` so the agent can drive the device while the user is away.~~ **SHIPPED in v0.4.1** — see [`CHANGELOG.md`](../../CHANGELOG.md#041---unreleased). Final shape: opt-in toggle on the Bridge tab (sideload-only) that acquires `SCREEN_BRIGHT_WAKE_LOCK | ACQUIRE_CAUSES_WAKEUP | ON_AFTER_RELEASE` per bridge action, calls `KeyguardManager.requestDismissKeyguard()` via the registered MainActivity host, and reports `keyguard_blocked` (HTTP 423) when a credential lock blocks the action. Hard-bounded by the existing bridge auto-disable timer; persistent foreground-service notification + amber "Unattended ON" status-overlay chip stay visible while active; first-enable shows a scary dialog explaining the security model and credential-lock limitation. The original spec mentioned a WiFi-disconnect failsafe — rejected during implementation because Tailscale / VPN invalidates the "leaving WiFi = leaving LAN" assumption; the existing relay-disconnect detection (master toggle drops on disconnect → `UnattendedAccessManager.release()`) plus the auto-disable timer cover that surface.
+**Unattended access mode** *(sideload-only).* ~~Opt-in toggle on the Bridge tab that acquires `FULL_WAKE_LOCK + ACQUIRE_CAUSES_WAKEUP`, raises `SCREEN_OFF_TIMEOUT` to max while active, and requests `KeyguardManager.requestDismissKeyguard()` so the agent can drive the device while the user is away.~~ **SHIPPED in v0.4.1** — see [`CHANGELOG.md`](CHANGELOG.md#041---unreleased). Final shape: opt-in toggle on the Bridge tab (sideload-only) that acquires `SCREEN_BRIGHT_WAKE_LOCK | ACQUIRE_CAUSES_WAKEUP | ON_AFTER_RELEASE` per bridge action, calls `KeyguardManager.requestDismissKeyguard()` via the registered MainActivity host, and reports `keyguard_blocked` (HTTP 423) when a credential lock blocks the action. Hard-bounded by the existing bridge auto-disable timer; persistent foreground-service notification + amber "Unattended ON" status-overlay chip stay visible while active; first-enable shows a scary dialog explaining the security model and credential-lock limitation. The original spec mentioned a WiFi-disconnect failsafe — rejected during implementation because Tailscale / VPN invalidates the "leaving WiFi = leaving LAN" assumption; the existing relay-disconnect detection (master toggle drops on disconnect → `UnattendedAccessManager.release()`) plus the auto-disable timer cover that surface.
 
 **Voice intent local dispatch loop.** The v0.4 voice intent handler builds `bridge.command` envelopes and routes them through the `ChannelMultiplexer` → WSS → relay → back-to-phone path, which the relay correctly rejects with `ignoring unexpected bridge.command from phone` (the wire protocol is server→phone only by design). Voice intents are phone-local, so the dispatch should be local: extend `BridgeCommandHandler` with a `handleLocalCommand(envelope)` entry point that runs the existing `when(path)` dispatch + the full Tier 5 safety check pipeline (blocklist → destructive verb modal → action executor) in-process, and have `RealVoiceBridgeIntentHandler.dispatch()` call it instead of `multiplexer.send()`. Single source of truth for "bridge command → action" preserved; safety modals still fire for destructive verbs; no WSS round-trip for an action that's happening on the same device. Caught by Bailey's on-device test 2026-04-14 after the multiplexer-wiring fix unblocked the dispatch path.
 
-**~~Tiered permission checklist with JIT permission errors~~ — shipped on `feature/tiered-permissions` (v0.4.1).** See [CHANGELOG.md](../../CHANGELOG.md) under `[Unreleased] → v0.4.1 Bridge fast-follows` for the landed surface. Original scope:
+**~~Tiered permission checklist with JIT permission errors~~ — shipped on `feature/tiered-permissions` (v0.4.1).** See [CHANGELOG.md](CHANGELOG.md) under `[Unreleased] → v0.4.1 Bridge fast-follows` for the landed surface. Original scope:
 
 - Tiered checklist with sideload-only sections gated on `BuildFlavor.SIDELOAD` (Core bridge / Notification companion / Voice & camera / Sideload features), Optional pills, runtime-permission launchers, ON_RESUME re-probes — done.
 - JIT permission-denied surfacing — bridge tool error envelope carries canonical `code` + `permission` aliases, Python `ResolveResult` types in `plugin/tools/resolve_result.py`, agent-tool wrappers upgrade `permission_denied` responses to structured LLM-readable envelopes, voice-mode JIT chip deep-links to `Settings.ACTION_APPLICATION_DETAILS_SETTINGS` for the running package — done.
 
-**Voice intent → server session sync.** ✅ **Shipped 2026-04-16** — see [CHANGELOG `[Unreleased]`](../../CHANGELOG.md#unreleased) for the implementation. Picked option (d) (not in the original menu): synthesize OpenAI-format `assistant` (with `tool_calls`) + `tool` (with `tool_call_id`) message pairs from local voice-intent traces and pass them under a new `messages` field on the existing `/v1/runs` and `/api/sessions/{id}/chat/stream` payloads. LLMs are trained on this exact shape so they read it as natural conversation history rather than a system-prompt side note (lower retry risk than option (b)). Zero server changes (option (a) avoided), no double-dispatch (option (c) avoided). Idempotency via a `syncedToServer` flag on each trace.
+**Voice intent → server session sync.** ✅ **Shipped 2026-04-16** — see [CHANGELOG `[Unreleased]`](CHANGELOG.md#unreleased) for the implementation. Picked option (d) (not in the original menu): synthesize OpenAI-format `assistant` (with `tool_calls`) + `tool` (with `tool_call_id`) message pairs from local voice-intent traces and pass them under a new `messages` field on the existing `/v1/runs` and `/api/sessions/{id}/chat/stream` payloads. LLMs are trained on this exact shape so they read it as natural conversation history rather than a system-prompt side note (lower retry risk than option (b)). Zero server changes (option (a) avoided), no double-dispatch (option (c) avoided). Idempotency via a `syncedToServer` flag on each trace.
 
 **Original problem statement (preserved for context):** Voice intents currently dispatch in-process (good for latency) and append a **local-only** trace to chat history (good for visual continuity), but the server-side session never sees them — so the gateway LLM has no memory of prior voice actions when the user follows up via text or voice. Symptom: user says "open Chrome" via voice (works), then says "did that work?" → LLM responds "I have no prior context for what you're asking about". Caught by Bailey's on-device test 2026-04-14: "The chat is resetting on voice or with our tools?" — actually voice intents bypass chat entirely, but the user-visible effect is the same.
 
@@ -109,7 +109,7 @@ Small follow-ons to v0.4 deliberately deferred to keep the v0.4.0 release surfac
 
 **Files.** New `hermes_relay_bootstrap/_command_middleware.py` (~150 LOC), one-line append in `_patch.py` inside `_maybe_register_routes`, stdlib `unittest` coverage in `plugin/tests/test_bootstrap_command_middleware.py` mirroring the existing `test_bootstrap_patch.py` harness. Mirrors the upstream Option B PR exactly so the two can be reviewed side-by-side.
 
-**Phase 2 — stateful dispatch on the session chat stream endpoint (unblocked by PR #33134).** Since `/api/sessions/{id}/chat/stream` now ships natively in upstream, a separate middleware (or a follow-up upstream PR) can add a preprocessor **scoped to that endpoint only**, leveraging the `session_id` in the URL as the persistence handle. At that point stateful commands become a dict write against session-scoped state — `session.model_override = new_model` — without needing to refactor `GatewayRouter` or plumb api_server into the router. Much smaller than a full router refactor, and it matches upstream's partition: `/v1/*` stays stateless and statefulness lives on `/api/sessions/*`.
+**Phase 2 — stateful dispatch on the session chat stream endpoint (unblocked by PR #33134 / commit `f7527b0`).** Since `/api/sessions/{id}/chat/stream` now ships natively in upstream, a separate middleware (or a follow-up upstream PR) can add a preprocessor **scoped to that endpoint only**, leveraging the `session_id` in the URL as the persistence handle. At that point stateful commands become a dict write against session-scoped state — `session.model_override = new_model` — without needing to refactor `GatewayRouter` or plumb api_server into the router. Much smaller than a full router refactor, and it matches upstream's partition: `/v1/*` stays stateless, statefulness lives on `/api/sessions/*`.
 
 ## Future — v0.5+
 
@@ -117,7 +117,7 @@ Shape subject to change. Each theme needs a separate design + plan pass before i
 
 ### Desktop thin-client — Phase B (client-side tool routing)
 
-v0.1 ships a remote-chat CLI. Phase B is the bigger win: **per-tool dispatch routing** so file/terminal/browser tools run against the user's machine while state tools (memory, skills, sessions, cron) stay on the server. An earlier private design note supplied the initial decomposition. Key insertion point is hermes-agent `model_tools.py::handle_function_call()` (~line 517) — before `registry.dispatch()`, consult a session-scoped routing table populated by a relay handshake extension where the client advertises which tools it can service. Isomorphic to how `android_*` tools already flow through the `bridge.command` channel. Proposed branch: `fork/tool-relay` on the hermes-agent fork; upstream issue to open before merging. Blocked on: (a) the handshake extension in `plugin/relay/auth.py` to carry the advertised-tools list, (b) a new `desktop.command` channel mirroring `bridge.command` semantics, (c) the upstream PR conversation.
+v0.1 ships a remote-chat CLI. Phase B is the bigger win: **per-tool dispatch routing** so file/terminal/browser tools run against the user's machine while state tools (memory, skills, sessions, cron) stay on the server. Design detailed in the vault under `Axiom-Vault/3. System/Projects/Hermes-Relay/Desktop Client.md`. Key insertion point is hermes-agent `model_tools.py::handle_function_call()` (~line 517) — before `registry.dispatch()`, consult a session-scoped routing table populated by a relay handshake extension where the client advertises which tools it can service. Isomorphic to how `android_*` tools already flow through the `bridge.command` channel. Proposed branch: `fork/tool-relay` on the hermes-agent fork; upstream issue to open before merging. Blocked on: (a) the handshake extension in `plugin/relay/auth.py` to carry the advertised-tools list, (b) a new `desktop.command` channel mirroring `bridge.command` semantics, (c) the upstream PR conversation.
 
 ### Observability & introspection
 - Real-time accessibility event streaming for reactive workflows (`android_events`, `android_event_stream`)
@@ -154,6 +154,6 @@ Dedicated **"Hermes Phone"** — a device (or phone ROM) that boots straight int
 
 New ideas enter via: direct proposals in GitHub issues, comparison passes against similar projects, community feedback from users and contributors, or internal research that turns into a shipped prototype.
 
-Active work waves (like the v0.4 bridge feature expansion above) get their detailed implementation plans in [`docs/plans/`](../plans/). When a plan wave ships, its plan file is archived or removed and the items migrate into [`CHANGELOG.md`](../../CHANGELOG.md).
+Active work waves (like the v0.4 bridge feature expansion above) get their detailed implementation plans in [`docs/plans/`](docs/plans/). When a plan wave ships, its plan file is archived or removed and the items migrate into [`CHANGELOG.md`](CHANGELOG.md).
 
 Have an idea? [Open an issue](https://github.com/Codename-11/hermes-relay/issues/new) — every one is read.

SECURITY.md

@@ -1,91 +0,0 @@
-# Security Policy
-
-Hermes-Relay can give a remote AI agent real control of a phone and, via the
-CLI, of a paired desktop. We take security reports seriously and welcome
-responsible disclosure.
-
-For the architecture, threat model, and the `googlePlay` vs. `sideload`
-capability boundary, see [`docs/security.md`](docs/security.md). This document
-covers **how to report a problem**.
-
-## Reporting a Vulnerability
-
-**Please do not open a public issue, discussion, or pull request for a security
-vulnerability.** Public reports expose users before a fix is available.
-
-Use one of these private channels instead:
-
-1. **GitHub Private Vulnerability Reporting (preferred).** Go to the
-   repository's **Security** tab → **Report a vulnerability**, or
-   [open a draft advisory directly](https://github.com/Codename-11/hermes-relay/security/advisories/new).
-   This keeps the whole exchange private and threaded with the code.
-2. **Email** — `security@codename-11.dev`. Use this if you can't use GitHub.
-   If you'd like to encrypt the report, say so in a first contact message and
-   we'll arrange a key.
-
-### What to include
-
-A good report lets us reproduce and assess impact quickly:
-
-- The affected surface — **Android app** (and which flavor, `googlePlay` or
-  `sideload`), **relay plugin / server**, **desktop CLI**, or the **docs site**.
-- Affected version(s) — app version/code, plugin version, or CLI version.
-- A clear description of the issue and its security impact.
-- Step-by-step reproduction, a proof of concept, or a minimal example.
-- Any suggested remediation, if you have one.
-
-> ⚠️ **Scrub secrets before sending.** Remove API keys, relay session tokens,
-> pairing codes, real hostnames/IPs, and personal data from logs, traces, and
-> screenshots.
-
-## What to Expect
-
-This is an indie, open-source project, so timelines are best-effort rather than
-contractual:
-
-- **Acknowledgement** of your report — typically within **5 business days**.
-- An initial **assessment and severity triage** after we can reproduce it.
-- **Coordinated disclosure:** we'll work with you on a fix and a disclosure
-  timeline, and credit you in the advisory and release notes if you'd like
-  (or keep you anonymous if you prefer).
-- A public GitHub Security Advisory and a `CHANGELOG.md` entry once a fix ships.
-
-## Scope
-
-**In scope** — vulnerabilities in code this project ships:
-
-- The Android app (`app/`) on either flavor.
-- The relay plugin and server (`plugin/`).
-- The desktop CLI (`desktop/`).
-- The pairing, auth, transport, media, and tool-routing surfaces.
-
-**Out of scope** — please report these to the right place instead:
-
-- **Your own Hermes server configuration** (missing TLS, an exposed dashboard,
-  weak provider keys). The relay connects only to endpoints you configure; how
-  you deploy and secure your Hermes host is outside this app. See
-  [`docs/security.md`](docs/security.md) and the relay-server docs for hardening
-  guidance.
-- **Upstream [hermes-agent](https://github.com/NousResearch/hermes-agent)**
-  issues — report those to the upstream project (a heads-up to us is welcome if
-  it affects how Hermes-Relay should behave).
-- **Third-party dependencies** — report upstream; if a dependency issue affects
-  Hermes-Relay users, tell us so we can pin or patch.
-- Findings that require a **rooted device, a physical-access attacker, or a
-  malicious app already granted Accessibility/overlay permissions** — these are
-  outside the model documented in `docs/security.md`, though we'll still read
-  the report.
-
-## Safe Harbor
-
-We consider security research conducted in good faith under this policy to be
-authorized. We will not pursue or support legal action against researchers who:
-
-- Make a good-faith effort to avoid privacy violations, data destruction, and
-  service disruption.
-- Test only against **their own devices, installs, and Hermes servers** — never
-  another person's data or infrastructure.
-- Report promptly and give us a reasonable chance to remediate before any
-  public disclosure.
-
-Thank you for helping keep Hermes-Relay and its users safe.

TODO.md

@@ -0,0 +1,99 @@
+# Hermes-Relay — TODO
+
+Open items that don't fit a formal Phase plan but shouldn't be lost. Items move from here into a Plan in `docs/spec.md` or an Obsidian Phase plan once they're ready to schedule.
+
+For shipped work, see `DEVLOG.md`. For architectural decisions, see `docs/decisions.md`.
+
+---
+
+## Hands-free agentic voice backlog
+
+Goal: make Hermes usable for hands-free work without leaving the operator blind
+to tool state, safety prompts, or the current task.
+
+- **Waveform output-start sync** — current input waveform timing feels good, but
+  the agent-output waveform can unfold and begin movement before audible speech
+  starts. Split "preparing audio" from "speaking audio" in the visual layer, or
+  gate the unfolded Speaking waveform on the first real playback frame/audio
+  amplitude. Processing can stay as the folded circular spinner until output is
+  actually audible.
+- **Voice command layer** — reserve local commands that bypass normal agent
+  routing: "pause", "resume", "stop talking", "cancel", "repeat that", "open
+  overlay", "return to Hermes", and "new chat". These should work while the
+  agent is thinking, speaking, or using tools.
+- **Spoken tool progress** — when Hermes uses tools, voice mode should speak
+  short status updates such as "I'm checking the relay logs" or "I found an
+  error" without waiting for final assistant text. Long tool calls should emit
+  periodic, low-noise progress updates.
+- **Realtime tool timeline parity** — the voice overlay should render the same
+  live thinking blocks, streaming assistant text, and tool call progress as the
+  normal chat surface without requiring exit/reload.
+- **Hands-free confirmation flow** — risky actions need first-class spoken and
+  visual confirmation: "yes", "no", "cancel", "confirm", plus a visible and
+  audible countdown for destructive actions.
+- **Voice session memory/status** — add a compact "where are we?" summary for
+  the current voice task: active objective, last tool result, pending next step,
+  and whether the agent is waiting on the user.
+- **Mode presets** — add presets such as Hands-free, Low latency, Careful tool
+  mode, and Quiet/visual-only. Hands-free should favor Continuous listening,
+  spoken tool progress, confirmations, and overlay availability.
+- **Barge-in hardening** — keep barge-in experimental until echo/self-recording
+  is solved. The target path is proper AEC, playback-ducking, and a rule that
+  output audio can never become a user turn.
+- **Audio quality guardrails** — normalize output volume across realtime and
+  fallback TTS providers, keep pronunciation hints/profile voice tuning, and
+  measure provider-specific delay, chunk gaps, and tail clipping.
+- **Pluggable Realtime Agent media transports** — add an OpenAI-first WebRTC
+  transport option for Realtime Agent so mobile audio can use provider-native
+  jitter buffering, interruption, and media handling instead of only relay
+  WebSocket PCM. Design this as a provider transport interface
+  (`websocket`, `webrtc`, future `livekit`/SIP-style bridges) so other
+  realtime providers can opt in without forking the Hermes broker/tool
+  contract. Hermes must still own tools, memory, confirmations, current data,
+  and durable transcript state.
+- **Voice engine selector** — implemented as an opt-in experimental Realtime
+  Agent engine in `docs/plans/2026-05-19-realtime-hermes-voice-agent.md`.
+  Follow-up work is provider-native turn-taking, richer confirmation handling,
+  and quality/latency evaluation before promotion beyond Experimental.
+- **Realtime-native Hermes bridge prototype** — first relay-brokered slice
+  implemented in `docs/plans/2026-05-19-realtime-hermes-voice-agent.md`.
+  Remaining work: let OpenAI/xAI realtime sessions own more of the live speech
+  turn while still proxying every tool, confirmation, memory, and Android bridge
+  action through Hermes/relay safety.
+
+---
+
+## Research / open questions
+
+### Proper Hermes plugin / skill / tool distribution
+
+**Status:** open question, no plan yet.
+
+We currently distribute Hermes-Relay via a one-shot `install.sh` that clones the repo, `pip install -e`s the package into the user's hermes-agent venv, and registers `skills/` via the `external_dirs` config knob. This works but it's a custom protocol — every project that wants to ship a Hermes plugin reinvents it.
+
+Things to look into:
+
+- **Does upstream hermes-agent have or plan a canonical plugin registry / package format?** If yes, we should migrate to it. If no, we may want to propose one upstream so third-party plugins (ours and others) get a standard install path.
+- **Skill distribution as separate from plugin distribution** — right now skills ride along with the plugin install via `external_dirs`. Should skills be installable independently (e.g. `hermes skill install <git-url>`)? Would that fragment maintenance or improve reuse?
+- **Tool registration discoverability** — `android_*` tools register at gateway import time. There's no canonical "list installed plugin tools" API. Would adding one to upstream make sense, or is `gateway tool list` already enough?
+- **Versioning + compatibility ranges** — `pip install -e` doesn't enforce version pins between hermes-agent and our plugin. A breaking change in upstream's plugin loader could silently break us. Do we need a `hermes_compat: ">=0.8.0,<1.0.0"` field somewhere?
+- **`hermes-relay-self-setup` SKILL.md as a precedent** — we just shipped a self-installing skill that an LLM can fetch from a raw GitHub URL and execute. Does this pattern generalize? Could it become a recommended way for any third-party Hermes project to ship setup automation?
+- **Bootstrap injection shrink path** — `hermes_relay_bootstrap/` monkey-patches `aiohttp.web.Application` to inject endpoints into vanilla/partial upstream. Upstream commit `f7527b0` via PR #33134 now covers baseline sessions/chat/fork/message history, and `/v1/skills` covers list metadata. Do **not** delete the bootstrap wholesale yet: Relay still depends on compatibility routes that upstream lacks or does not match (`/api/sessions/search`, `/api/memory`, `/api/config`, legacy `/api/skills` detail routes, `/api/available-models`, and voice aliases). Shrink per route group only after native parity or client migration.
+- **Gateway slash-command preprocessor — upstream Stage 1 PR.** Follow-up to the native session-control baseline from PR #33134 / commit `f7527b0`. Intercepts known gateway commands on `/v1/runs` + `/v1/chat/completions`, dispatches the stateless ones (`/help`, `/commands`) via `gateway_help_lines()`, returns a deterministic "use a channel with session state" notice for the stateful majority. Currently being prepared in `C:/Users/Bailey/Desktop/Open-Projects/hermes-agent-pr-prep/` on branch `feat/api-server-gateway-commands`; awaiting subagent's code + draft PR body before pushing. See `docs/upstream-contributions.md` §5.
+- **Gateway slash-command preprocessor — bootstrap middleware (Stage 1 equivalent).** Sibling shim in `hermes_relay_bootstrap/_command_middleware.py` that mirrors the upstream Stage 1 PR as an aiohttp middleware injected at bootstrap time. Ships the hallucination fix to vanilla-upstream installs before the upstream PR lands. Planned for v0.4.1, after the current bridge feature branch wraps. See `ROADMAP.md` v0.4.1 entry.
+- **Stage 2 — stateful slash-command dispatch on `/api/sessions/{id}/chat/stream`.** Unblocked by upstream PR #33134 / commit `f7527b0`. Add a preprocessor scoped to the session chat stream endpoint only, using `session_id` as the persistence handle. Separate upstream PR + matching bootstrap middleware. See `docs/upstream-contributions.md` §5 ("Stage 2").
+
+When the answer becomes clearer, this section becomes either an ADR in `docs/decisions.md` or a Plan under `Plans/`.
+
+---
+
+## Smaller deferred items
+
+- **MediaProjection consent flow** — wired in MainActivity (2026-04-12), needs end-to-end test on a real device
+- **WorkManager upgrade for auto-disable timer** — currently a coroutine `Job + delay()` in `AutoDisableWorker.kt`; documented at top of file. Upgrade when androidx.work joins the classpath
+- **Wave 3 voice-bridge multi-turn confirmation** — currently a 5s TTS countdown with cancel; conversational confirmation is the follow-up
+- **LLM client wiring for `android_navigate`** — `_default_vision_model` is stubbed; production swap to a real Anthropic/OpenAI vision client
+- **Real screenshots of each flavor's a11y permission dialog** — for `user-docs/guide/release-tracks.md`
+- **`llms.txt` standard** — explicitly skipped in favor of the `hermes-relay-self-setup` SKILL.md path; revisit if the standard gains traction in the agent ecosystem
+- **`markdown-renderer` 0.40.x API update** — pinned at `0.30.0` in `gradle/libs.versions.toml` because 0.40.2 introduced breaking API changes that `app/src/main/kotlin/com/hermesandroid/relay/ui/components/MarkdownContent.kt` hasn't been updated for. Specifically: `markdownColor()` drops `codeText`/`linkText`, `MarkdownCodeBlock`/`MarkdownCodeFence` inner lambdas now take a 3rd `TextStyle` arg, and `MarkdownHighlightedCode`'s 3rd param is now `TextStyle` instead of `Highlights.Builder`. Dependabot auto-merged the bump on 2026-04-13 which silently broke CI; reverted for the v0.3.0 release. Update requires reading the new library API docs and testing in Studio — not a blind fix. Consider adding a dependabot ignore rule for `markdown-renderer` major bumps until this is handled.
+- **Dependabot auto-merge guardrails** — Dependabot merged breaking bumps despite CI failing. Investigate why `.github/workflows/dependabot-auto-merge.yml` isn't gating on CI status, and consider adding an ignore rule for packages we know need manual attention on major bumps (`markdown-renderer`, compose BOM, activity-compose).

app/build.gradle.kts

@@ -1,8 +1,5 @@
 import java.util.Properties
 
-fun String.asBuildConfigString(): String =
-    "\"" + replace("\\", "\\\\").replace("\"", "\\\"") + "\""
-
 plugins {
     id("com.android.application")
     id("org.jetbrains.kotlin.plugin.compose")
@@ -10,19 +7,6 @@ plugins {
     alias(libs.plugins.play.publisher)
 }
 
-val supportedHermesDevAbis = setOf("arm64-v8a", "armeabi-v7a", "x86", "x86_64")
-val hermesDevAbi = providers.gradleProperty("hermes.devAbi").orNull
-val candidateKind = providers.gradleProperty("candidate.kind").orElse("review").get()
-val candidateLabel = providers.gradleProperty("candidate.label").orElse("Local review").get()
-val candidateSourceRef = providers.gradleProperty("candidate.sourceRef").orElse("local").get()
-val candidateSourceSha = providers.gradleProperty("candidate.sourceSha").orElse("unknown").get()
-hermesDevAbi?.let { requestedAbi ->
-    require(requestedAbi in supportedHermesDevAbis) {
-        "Unsupported hermes.devAbi '$requestedAbi'. Expected one of: " +
-            supportedHermesDevAbis.sorted().joinToString()
-    }
-}
-
 // Rename output artifacts to include the app version. AGP respects
 // `archivesName` for both APK (assemble*) and AAB (bundle*) outputs, so
 // this single line produces `hermes-relay-<version>-<flavor>-<buildType>`
@@ -43,7 +27,7 @@ android {
     // and `applicationId` is the runtime install identity; they don't have
     // to match.
     namespace = "com.hermesandroid.relay"
-    compileSdk = 37
+    compileSdk = 36
 
     defaultConfig {
         // Axiom-Labs, LLC Play Console listing. Changed from the original
@@ -53,30 +37,14 @@ android {
         // exempt from Play's 14-day closed-testing rule. See RELEASE.md.
         applicationId = "com.axiomlabs.hermesrelay"
         minSdk = 26
-        targetSdk = 36
+        targetSdk = 35
         versionCode = libs.versions.appVersionCode.get().toInt()
         versionName = libs.versions.appVersionName.get()
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 
-        // Optional local-only fast path for device iteration. Native voice/VAD
-        // dependencies make the universal sideload APK very large, while a
-        // connected phone needs only its own ABI. Release and normal debug
-        // builds remain universal unless the developer explicitly supplies
-        // -Phermes.devAbi=<abi>.
-        hermesDevAbi?.let { requestedAbi ->
-            ndk {
-                abiFilters += requestedAbi
-            }
-        }
-
         // Feature flags — DEV_MODE enables all experimental features in debug builds
         buildConfigField("boolean", "DEV_MODE", "false")
-        buildConfigField("boolean", "CANDIDATE_BUILD", "false")
-        buildConfigField("String", "CANDIDATE_KIND", "".asBuildConfigString())
-        buildConfigField("String", "CANDIDATE_LABEL", "".asBuildConfigString())
-        buildConfigField("String", "CANDIDATE_SOURCE_REF", "".asBuildConfigString())
-        buildConfigField("String", "CANDIDATE_SOURCE_SHA", "".asBuildConfigString())
     }
 
     signingConfigs {
@@ -138,26 +106,12 @@ android {
         }
     }
 
-    // Structural guard: the sideload flavor is distributed via GitHub Releases /
-    // F-Droid / ADB and must NEVER be uploaded to Play Console (it declares the
-    // unattended Device Control surface Play forbids). gradle-play-publisher
-    // generates a publish task per variant, so the aggregate `publishReleaseBundle`
-    // would otherwise try BOTH flavors. Disabling sideload here means only
-    // `publishGooglePlayReleaseBundle` can ever reach Play — see the `play { }`
-    // block below and .github/workflows/release-android.yml.
-    playConfigs {
-        register("sideload") {
-            enabled.set(false)
-        }
-    }
-
     buildTypes {
         debug {
             buildConfigField("boolean", "DEV_MODE", "true")
         }
         release {
             isMinifyEnabled = true
-            isShrinkResources = true
             ndk {
                 debugSymbolLevel = "SYMBOL_TABLE"
             }
@@ -173,18 +127,6 @@ android {
                 signingConfigs.getByName("debug")
             }
         }
-        create("candidate") {
-            initWith(getByName("release"))
-            applicationIdSuffix = ".candidate"
-            versionNameSuffix = "-candidate"
-            isDebuggable = false
-            matchingFallbacks += listOf("release")
-            buildConfigField("boolean", "CANDIDATE_BUILD", "true")
-            buildConfigField("String", "CANDIDATE_KIND", candidateKind.asBuildConfigString())
-            buildConfigField("String", "CANDIDATE_LABEL", candidateLabel.asBuildConfigString())
-            buildConfigField("String", "CANDIDATE_SOURCE_REF", candidateSourceRef.asBuildConfigString())
-            buildConfigField("String", "CANDIDATE_SOURCE_SHA", candidateSourceSha.asBuildConfigString())
-        }
     }
 
     compileOptions {
@@ -209,21 +151,6 @@ android {
         }
     }
 
-    packaging {
-        jniLibs {
-            // sherpa-onnx v1.13.4 and the Silero VAD both use ONNX Runtime.
-            // Keep them on sherpa's 1.27.0 baseline and package one shared core.
-            pickFirsts += "**/libonnxruntime.so"
-
-            // The Android app calls only sherpa's JNI facade. These native C/C++
-            // API facades are development surfaces and are not loaded by the app.
-            excludes += setOf(
-                "**/libsherpa-onnx-c-api.so",
-                "**/libsherpa-onnx-cxx-api.so",
-            )
-        }
-    }
-
     // JVM unit tests run against the stubbed Android SDK jar, where every
     // platform API method throws RuntimeException("... not mocked") by
     // default. With returnDefaultValues = true, those stubs instead
@@ -239,68 +166,6 @@ android {
         // Robolectric (VoicePlayerTest) needs merged Android resources +
         // manifest on the unit-test classpath to bootstrap its sandbox.
         unitTests.isIncludeAndroidResources = true
-        // [POC] Roborazzi runs without its Gradle plugin (the plugin needs AGP's
-        // removed TestedExtension). Force record mode via the test-JVM system
-        // property the plugin would otherwise inject, so captureRoboImage writes.
-        // Heap: the Roborazzi store renders (1080×2160 native graphics) share a
-        // worker JVM with the Robolectric suites; Gradle's 512m default OOMs
-        // once both are in the same run.
-        unitTests.all {
-            it.systemProperty("roborazzi.test.record", "true")
-            it.maxHeapSize = "2g"
-        }
-
-        // On-demand only. Keep each form factor as an individually selected
-        // Gradle-managed device; there is deliberately no aggregate matrix
-        // task or scheduled emulator job. See docs/android-emulator-testing.md.
-        managedDevices {
-            localDevices {
-                create("compactPhoneApi36") {
-                    device = "Pixel 2"
-                    apiLevel = 36
-                    systemImageSource = "aosp"
-                    require64Bit = true
-                    testedAbi = "x86_64"
-                }
-                create("standardPhoneApi36") {
-                    device = "Pixel 6"
-                    apiLevel = 36
-                    systemImageSource = "aosp"
-                    require64Bit = true
-                    testedAbi = "x86_64"
-                }
-                create("largePhoneApi36") {
-                    device = "Pixel 7 Pro"
-                    apiLevel = 36
-                    systemImageSource = "aosp"
-                    require64Bit = true
-                    testedAbi = "x86_64"
-                }
-                create("foldableApi36") {
-                    device = "Pixel Fold"
-                    apiLevel = 36
-                    systemImageSource = "aosp"
-                    require64Bit = true
-                    testedAbi = "x86_64"
-                }
-                create("tabletApi36") {
-                    device = "Pixel Tablet"
-                    apiLevel = 36
-                    systemImageSource = "aosp"
-                    require64Bit = true
-                    testedAbi = "x86_64"
-                }
-                create("futureApi37Ps16k") {
-                    device = "Pixel 7 Pro"
-                    apiLevel = 37
-                    systemImageSource = "google_apis_playstore"
-                    require64Bit = true
-                    testedAbi = "x86_64"
-                    pageAlignment =
-                        com.android.build.api.dsl.ManagedVirtualDevice.PageAlignment.FORCE_16KB_PAGES
-                }
-            }
-        }
     }
 }
 
@@ -320,17 +185,6 @@ kotlin {
     jvmToolchain(17)
 }
 
-// [screenshots] Host-side screenshot tests render MessageBubble -> MarkdownContent,
-// whose code-highlighter (dev.snipme.highlights) ships Java-21 bytecode. The build
-// toolchain pins test execution to JDK 17, which can't load class-file v65, so run
-// unit tests on a 21 JVM. Compile target stays 17; on-device (dexed) is unaffected.
-// foojay (settings.gradle.kts) auto-provisions the 21 JDK if absent.
-tasks.withType<Test>().configureEach {
-    javaLauncher.set(
-        javaToolchains.launcherFor { languageVersion.set(JavaLanguageVersion.of(21)) }
-    )
-}
-
 dependencies {
     // Compose BOM
     val composeBom = platform(libs.compose.bom)
@@ -357,8 +211,6 @@ dependencies {
 
     // Activity
     implementation(libs.activity.compose)
-    implementation(libs.browser)
-    implementation(libs.appcompat)
 
     // Core
     implementation(libs.core.ktx)
@@ -367,42 +219,19 @@ dependencies {
     implementation(libs.okhttp)
     implementation(libs.okhttp.sse)
 
-    // Media3 ExoPlayer + lifecycle-aware Compose video surface.
+    // Media3 ExoPlayer — gapless TTS queue playback (replaces MediaPlayer in VoicePlayer)
     implementation(libs.media3.exoplayer)
-    implementation(libs.media3.ui.compose)
 
     // android-vad Silero — on-device VAD for barge-in (B2)
     // Bundled ONNX Silero model (~2.2 MB); pulled from JitPack.
     implementation(libs.android.vad.silero)
 
-    // Experimental, opt-in local keyword spotting. Models are downloaded only
-    // after the user enables the feature; no model binary is bundled in APKs.
-    // Keep the shared runtime aligned with sherpa-onnx v1.13.4.
-    implementation(libs.onnxruntime.android)
-    implementation(libs.sherpa.onnx)
-
-    // Google Play In-App Update — googlePlay flavor ONLY (FLEXIBLE flow).
-    // Scoped via the `googlePlayImplementation` configuration so it never
-    // ships in the sideload APK, which updates via the GitHub-releases
-    // UpdateChecker instead. The `app/src/googlePlay/.../update/` impl
-    // references AppUpdateManager; the `app/src/sideload/.../update/` impl
-    // never touches this library.
-    "googlePlayImplementation"(libs.play.app.update)
-    "googlePlayImplementation"(libs.play.app.update.ktx)
-
     // Markdown rendering
     implementation(libs.markdown.renderer.m3)
     implementation(libs.markdown.renderer.code)
 
-    // Coil 3 — async image loading for generated images in chat
-    implementation(libs.coil.compose)
-    implementation(libs.coil.gif)
-    implementation(libs.coil.network.okhttp)
-    implementation(libs.exifinterface)
-
     // QR Code scanning (ML Kit + CameraX)
     implementation(libs.mlkit.barcode)
-    implementation(libs.zxing.core)
     implementation(libs.camera.core)
     implementation(libs.camera.camera2)
     implementation(libs.camera.lifecycle)
@@ -420,9 +249,6 @@ dependencies {
 
     // Security
     implementation(libs.security.crypto)
-    // Force a Tink newer than security-crypto's transitive one — older Tink's
-    // HybridConfig removeFirst()/removeLast() trips the Android-15 crash lint.
-    implementation(libs.tink.android)
 
     // DataStore
     implementation(libs.datastore.preferences)
@@ -440,28 +266,8 @@ dependencies {
     // across priority groups against real local sockets so the behavior we
     // validate matches on-device.
     testImplementation(libs.okhttp.mockwebserver)
-    // Konsist — enforces the ADR 34 upstream/relay/shared package fence as a JUnit test
-    testImplementation(libs.konsist)
     androidTestImplementation(libs.compose.ui.test.junit4)
-    // Compose UI Test still declares Espresso 3.5.0 transitively. API 37
-    // removed the reflected InputManager.getInstance() seam; Espresso 3.7.0
-    // uses Context.getSystemService and is the current stable AndroidX line.
-    androidTestImplementation("androidx.test.espresso:espresso-core:3.7.0")
-    androidTestImplementation("androidx.test:runner:1.7.0")
-    androidTestImplementation("androidx.test.ext:junit:1.3.0")
-    // On-device vanilla-Gateway contract tests exercise the production
-    // Dashboard ticket + WebSocket stack over real loopback sockets.
-    androidTestImplementation(libs.okhttp.mockwebserver)
     debugImplementation(libs.compose.ui.tooling)
     debugImplementation(libs.compose.ui.test.manifest)
-
-    // [POC] Roborazzi host-side screenshot rendering (src/test, Robolectric).
-    // Renders real composables on the JVM at an exact canvas — no device, no
-    // status bar, no clipping. See StoreScreenshotTest.
-    testImplementation("io.github.takahirom.roborazzi:roborazzi:1.73.0")
-    testImplementation("io.github.takahirom.roborazzi:roborazzi-compose:1.73.0")
-    testImplementation(libs.compose.ui.test.junit4)
-    testImplementation(libs.compose.ui.test.manifest)
-    testImplementation("androidx.test.ext:junit:1.3.0")
 }
 

app/proguard-rules.pro

@@ -55,9 +55,6 @@
 -keep class androidx.camera.** { *; }
 -dontwarn androidx.camera.**
 
-# sherpa-onnx JNI resolves Kotlin configuration classes and fields by name.
--keep class com.k2fsa.sherpa.onnx.** { *; }
-
 # ── General ──────────────────────────────────────────────────────────
 -keepattributes SourceFile,LineNumberTable
 -renamesourcefileattribute SourceFile

app/src/androidTest/kotlin/com/hermesandroid/relay/data/ConnectionReviewSeedTest.kt

@@ -1,48 +0,0 @@
-package com.hermesandroid.relay.data
-
-import android.content.Context
-import androidx.test.core.app.ApplicationProvider
-import androidx.test.ext.junit.runners.AndroidJUnit4
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.runBlocking
-import org.junit.Test
-import org.junit.runner.RunWith
-
-/** Local device-review helper. Never runs in or ships with the application APK. */
-@RunWith(AndroidJUnit4::class)
-class ConnectionReviewSeedTest {
-
-    @Test
-    fun seedOfflineSecondaryConnection() = runBlocking {
-        val context = ApplicationProvider.getApplicationContext<Context>()
-        val store = ConnectionStore(context)
-        store.isHydrated.first { it }
-        if (store.connections.value.none { it.id == REVIEW_ID }) {
-            store.addConnection(
-                Connection(
-                    id = REVIEW_ID,
-                    label = "Lab NAS",
-                    apiServerUrl = "",
-                    relayUrl = "",
-                    tokenStoreKey = Connection.buildTokenStoreKey(REVIEW_ID),
-                    dashboardUrl = "http://192.0.2.10:9119",
-                    lastUsedAt = System.currentTimeMillis() - 2L * 24L * 60L * 60L * 1_000L,
-                ),
-            )
-        }
-    }
-
-    @Test
-    fun removeOfflineSecondaryConnection() = runBlocking {
-        val context = ApplicationProvider.getApplicationContext<Context>()
-        val store = ConnectionStore(context)
-        store.isHydrated.first { it }
-        if (store.connections.value.any { it.id == REVIEW_ID }) {
-            store.removeConnection(REVIEW_ID)
-        }
-    }
-
-    private companion object {
-        const val REVIEW_ID = "00000000-0000-4000-8000-000000000220"
-    }
-}

app/src/androidTest/kotlin/com/hermesandroid/relay/plugins/ui/PluginDocumentRendererTest.kt

@@ -1,70 +0,0 @@
-package com.hermesandroid.relay.plugins.ui
-
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.ui.test.assertIsDisplayed
-import androidx.compose.ui.test.isToggleable
-import androidx.compose.ui.test.junit4.createComposeRule
-import androidx.compose.ui.test.onNodeWithText
-import androidx.compose.ui.test.performClick
-import com.hermesandroid.relay.plugins.document.PluginDocumentState
-import com.hermesandroid.relay.plugins.document.PluginElement
-import com.hermesandroid.relay.plugins.document.PluginPage
-import com.hermesandroid.relay.plugins.document.PluginText
-import com.hermesandroid.relay.plugins.document.PluginValue
-import org.junit.Assert.assertEquals
-import org.junit.Rule
-import org.junit.Test
-
-class PluginDocumentRendererTest {
-    @get:Rule
-    val composeTestRule = createComposeRule()
-
-    @Test
-    fun pageRendersBindingsAndEmitsControlledStateChanges() {
-        var interaction: PluginInteraction? = null
-        val page = PluginPage(
-            id = "home",
-            title = PluginText.Binding("title", "Fallback"),
-            content = PluginElement.Group(
-                id = "root",
-                children = listOf(
-                    PluginElement.Text(
-                        id = "message",
-                        text = PluginText.Binding("message"),
-                    ),
-                    PluginElement.Toggle(
-                        id = "enabled-toggle",
-                        label = PluginText.Literal("Enabled"),
-                        binding = "enabled",
-                    ),
-                ),
-            ),
-        )
-        val state = PluginDocumentState(
-            mapOf(
-                "title" to PluginValue.StringValue("Status plugin"),
-                "message" to PluginValue.StringValue("Everything is healthy"),
-                "enabled" to PluginValue.BooleanValue(false),
-            ),
-        )
-
-        composeTestRule.setContent {
-            MaterialTheme {
-                PluginPageRenderer(page, state, { interaction = it })
-            }
-        }
-
-        composeTestRule.onNodeWithText("Status plugin").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Everything is healthy").assertIsDisplayed()
-        composeTestRule.onNode(isToggleable()).performClick()
-
-        assertEquals(
-            PluginInteraction.ValueChanged(
-                elementId = "enabled-toggle",
-                key = "enabled",
-                value = PluginValue.BooleanValue(true),
-            ),
-            interaction,
-        )
-    }
-}

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/components/AmbientVisualizationVisibilityTest.kt

@@ -1,100 +0,0 @@
-package com.hermesandroid.relay.ui.components
-
-import androidx.compose.foundation.layout.Box
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.CompositionLocalProvider
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.testTag
-import androidx.compose.ui.test.junit4.v2.createComposeRule
-import androidx.compose.ui.test.onNodeWithTag
-import androidx.compose.ui.test.onNodeWithText
-import androidx.test.platform.app.InstrumentationRegistry
-import com.hermesandroid.relay.R
-import com.hermesandroid.relay.ui.components.avatar.AgentAvatar
-import com.hermesandroid.relay.ui.components.avatar.AvatarRenderState
-import com.hermesandroid.relay.ui.components.avatar.AvatarSource
-import com.hermesandroid.relay.ui.components.avatar.LocalAgentAvatar
-import com.hermesandroid.relay.ui.components.avatar.LocalBackgroundVisualizationEnabled
-import com.hermesandroid.relay.viewmodel.InteractionMode
-import com.hermesandroid.relay.viewmodel.VoiceState
-import com.hermesandroid.relay.viewmodel.VoiceUiState
-import org.junit.Rule
-import org.junit.Test
-
-class AmbientVisualizationVisibilityTest {
-
-    @get:Rule
-    val composeTestRule = createComposeRule()
-
-    @Test
-    fun voiceMode_backgroundOff_hidesSphereAndKeepsVoiceUi() {
-        composeTestRule.setContent {
-            AmbientTestProviders(enabled = false) {
-                TestVoiceOverlay()
-            }
-        }
-
-        composeTestRule.onNodeWithTag(AMBIENT_RENDERER_TAG).assertDoesNotExist()
-        composeTestRule.onNodeWithText(targetString(R.string.voice_overlay_tap_mic)).assertExists()
-    }
-
-    @Test
-    fun voiceMode_backgroundOn_rendersSphere() {
-        composeTestRule.setContent {
-            AmbientTestProviders(enabled = true) {
-                TestVoiceOverlay()
-            }
-        }
-
-        composeTestRule.onNodeWithTag(AMBIENT_RENDERER_TAG).assertExists()
-    }
-
-    @Composable
-    private fun AmbientTestProviders(enabled: Boolean, content: @Composable () -> Unit) {
-        MaterialTheme {
-            CompositionLocalProvider(
-                LocalAgentAvatar provides TaggedAmbientRenderer,
-                LocalBackgroundVisualizationEnabled provides enabled,
-                content = content,
-            )
-        }
-    }
-
-    @Composable
-    private fun TestVoiceOverlay() {
-        VoiceModeOverlay(
-            uiState = VoiceUiState(
-                voiceMode = true,
-                state = VoiceState.Idle,
-                interactionMode = InteractionMode.TapToTalk,
-            ),
-            onMicTap = {},
-            onMicRelease = {},
-            onInterrupt = {},
-            onDismiss = {},
-            onModeChange = {},
-            onClearError = {},
-        )
-    }
-
-    private fun targetString(id: Int): String =
-        InstrumentationRegistry.getInstrumentation().targetContext.getString(id)
-
-    private object TaggedAmbientRenderer : AgentAvatar {
-        override val id = "ambient-test"
-        override val label = "Ambient test"
-        override val description = "Test renderer"
-        override val source = AvatarSource.BUILT_IN
-        override val reactivity = SphereReactivity()
-
-        @Composable
-        override fun Render(state: AvatarRenderState, modifier: Modifier) {
-            Box(modifier = modifier.testTag(AMBIENT_RENDERER_TAG))
-        }
-    }
-
-    private companion object {
-        const val AMBIENT_RENDERER_TAG = "ambientVisualizationRenderer"
-    }
-}

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/components/BridgeMasterToggleTest.kt

@@ -4,6 +4,7 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.ui.test.assertIsOff
 import androidx.compose.ui.test.isToggleable
 import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.compose.ui.test.onNode
 import androidx.compose.ui.test.performClick
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/components/PowerFeatureGateUiTest.kt

@@ -1,66 +0,0 @@
-package com.hermesandroid.relay.ui.components
-
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.ui.test.assertIsDisplayed
-import androidx.compose.ui.test.junit4.createComposeRule
-import androidx.compose.ui.test.onNodeWithText
-import org.junit.Rule
-import org.junit.Test
-
-class PowerFeatureGateUiTest {
-
-    @get:Rule
-    val composeTestRule = createComposeRule()
-
-    @Test
-    fun requiresPairingCard_showsPairToUnlock() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                PowerFeatureGateCard(
-                    title = "Terminal",
-                    summary = "Open a server shell through your paired relay session.",
-                    status = PowerFeatureGateStatus.RequiresPairing,
-                    onPrimaryAction = {},
-                )
-            }
-        }
-
-        composeTestRule.onNodeWithText("Requires pairing").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Pair to unlock").assertIsDisplayed()
-        composeTestRule.onNodeWithText("This feature uses relay grants", substring = true).assertIsDisplayed()
-    }
-
-    @Test
-    fun expiredPairingCard_showsPairAgain() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                PowerFeatureGateCard(
-                    title = "Bridge",
-                    summary = "Let Hermes send approved bridge commands to this phone.",
-                    status = PowerFeatureGateStatus.PairingExpired,
-                    onPrimaryAction = {},
-                )
-            }
-        }
-
-        composeTestRule.onNodeWithText("Pairing expired").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Pair again").assertIsDisplayed()
-    }
-
-    @Test
-    fun dashboardSignInCard_usesDashboardLanguage() {
-        composeTestRule.setContent {
-            MaterialTheme {
-                PowerFeatureGateCard(
-                    title = "Manage",
-                    summary = "Open dashboard-backed management features.",
-                    status = PowerFeatureGateStatus.DashboardSignInRequired,
-                    onPrimaryAction = {},
-                )
-            }
-        }
-
-        composeTestRule.onNodeWithText("Dashboard sign-in required").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Open sign-in").assertIsDisplayed()
-    }
-}

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/components/UnattendedAccessRowTest.kt

@@ -6,6 +6,7 @@ import androidx.compose.ui.test.assertIsNotEnabled
 import androidx.compose.ui.test.assertIsEnabled
 import androidx.compose.ui.test.isToggleable
 import androidx.compose.ui.test.junit4.createComposeRule
+import androidx.compose.ui.test.onNode
 import androidx.compose.ui.test.onNodeWithText
 import org.junit.Rule
 import org.junit.Test

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/onboarding/OnboardingFlowTest.kt

@@ -1,19 +1,22 @@
 package com.hermesandroid.relay.ui.onboarding
 
-import android.app.Application
 import androidx.compose.ui.test.assertIsDisplayed
 import androidx.compose.ui.test.assertIsEnabled
+import androidx.compose.ui.test.assertIsNotDisplayed
+import androidx.compose.ui.test.hasText
 import androidx.compose.ui.test.junit4.createComposeRule
 import androidx.compose.ui.test.onNodeWithText
 import androidx.compose.ui.test.performClick
-import androidx.test.core.app.ApplicationProvider
+import androidx.compose.ui.test.performScrollTo
 import com.hermesandroid.relay.ui.theme.HermesRelayTheme
-import com.hermesandroid.relay.viewmodel.ConnectionViewModel
 import org.junit.Rule
 import org.junit.Test
 
 /**
- * Instrumented tests for the Standard-first onboarding pager.
+ * Instrumented tests for the onboarding pager flow.
+ *
+ * These tests require an Android device or emulator because they use
+ * Compose UI testing APIs and interact with real Compose components.
  */
 class OnboardingFlowTest {
 
@@ -21,211 +24,270 @@ class OnboardingFlowTest {
     val composeTestRule = createComposeRule()
 
     private fun setOnboardingContent() {
-        val app = ApplicationProvider.getApplicationContext<Application>()
-        val connectionViewModel = ConnectionViewModel(app)
         composeTestRule.setContent {
             HermesRelayTheme {
                 OnboardingScreen(
-                    connectionViewModel = connectionViewModel,
-                    onComplete = {},
+                    onComplete = { _, _, _ -> }
                 )
             }
         }
     }
 
+    // --- Page 1: Welcome ---
+
     @Test
-    fun firstPage_showsHermesForAndroidTitle() {
+    fun firstPage_showsHermesRelayTitle() {
         setOnboardingContent()
 
         composeTestRule
-            .onNodeWithText("Hermes-Relay for Android")
+            .onNodeWithText("Hermes-Relay")
             .assertIsDisplayed()
     }
 
     @Test
-    fun firstPage_showsStandardFirstDescription() {
+    fun firstPage_showsWelcomeDescription() {
         setOnboardingContent()
 
         composeTestRule
-            .onNodeWithText("Chat with Hermes and manage your dashboard from your phone.")
+            .onNodeWithText("Your AI agent, in your pocket. Chat, control, and connect — all from your phone.")
             .assertIsDisplayed()
+    }
+
+    // --- Skip button ---
+
+    @Test
+    fun skipButton_isAlwaysVisible_onFirstPage() {
+        setOnboardingContent()
+
         composeTestRule
-            .onNodeWithText("Standard")
+            .onNodeWithText("Skip")
             .assertIsDisplayed()
+    }
+
+    // --- Navigation: Next button ---
+
+    @Test
+    fun nextButton_isDisplayed_onFirstPage() {
+        setOnboardingContent()
+
         composeTestRule
-            .onNodeWithText("Advanced")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Setup Guide")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Hermes Docs")
+            .onNodeWithText("Next")
             .assertIsDisplayed()
     }
 
     @Test
-    fun nextButton_navigatesForward_toChatPage() {
+    fun nextButton_navigatesForward_toPage2() {
         setOnboardingContent()
 
+        // Page 1 -> Page 2
         composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
 
+        // Page 2 is "Talk to Your Agent"
         composeTestRule
-            .onNodeWithText("Chat")
+            .onNodeWithText("Talk to Your Agent")
             .assertIsDisplayed()
     }
 
     @Test
-    fun canNavigateForward_throughStandardAndPowerPages() {
+    fun canNavigateForward_throughAllPages() {
         setOnboardingContent()
 
-        composeTestRule.onNodeWithText("Hermes-Relay for Android").assertIsDisplayed()
+        // Page 1: Hermes-Relay (Welcome)
+        composeTestRule.onNodeWithText("Hermes-Relay").assertIsDisplayed()
         composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
 
-        composeTestRule.onNodeWithText("Chat").assertIsDisplayed()
+        // Page 2: Talk to Your Agent (Chat)
+        composeTestRule.onNodeWithText("Talk to Your Agent").assertIsDisplayed()
         composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
 
-        composeTestRule.onNodeWithText("Manage").assertIsDisplayed()
+        // Page 3: Remote Terminal
+        composeTestRule.onNodeWithText("Remote Terminal").assertIsDisplayed()
         composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
 
-        composeTestRule.onNodeWithText("Power tools").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Connect").performClick()
+        // Page 4: Device Bridge
+        composeTestRule.onNodeWithText("Device Bridge").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
 
-        composeTestRule.onNodeWithText("Add gateway").assertIsDisplayed()
+        // Page 5: Connect to Hermes
+        composeTestRule.onNodeWithText("Connect to Hermes").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Next").performClick()
+        composeTestRule.waitForIdle()
+
+        // Page 6: Relay Server (last page)
+        composeTestRule.onNodeWithText("Relay Server").assertIsDisplayed()
     }
 
+    // --- Back button ---
+
     @Test
     fun backButton_hiddenOnFirstPage() {
         setOnboardingContent()
 
+        // On page 1, Back should not exist
         composeTestRule
             .onNodeWithText("Back")
             .assertDoesNotExist()
     }
 
     @Test
-    fun backButton_navigatesBackward() {
+    fun backButton_visibleOnPage2() {
         setOnboardingContent()
 
         composeTestRule.onNodeWithText("Next").performClick()
         composeTestRule.waitForIdle()
-        composeTestRule.onNodeWithText("Chat").assertIsDisplayed()
 
-        composeTestRule.onNodeWithText("Back").performClick()
-        composeTestRule.waitForIdle()
-        composeTestRule.onNodeWithText("Hermes-Relay for Android").assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Back")
+            .assertIsDisplayed()
     }
 
     @Test
-    fun addGatewayPage_leadsWithStandardGatewayMethods() {
+    fun backButton_navigatesBackward() {
+        setOnboardingContent()
+
+        // Go to page 2
+        composeTestRule.onNodeWithText("Next").performClick()
+        composeTestRule.waitForIdle()
+        composeTestRule.onNodeWithText("Talk to Your Agent").assertIsDisplayed()
+
+        // Go back to page 1
+        composeTestRule.onNodeWithText("Back").performClick()
+        composeTestRule.waitForIdle()
+        composeTestRule.onNodeWithText("Hermes-Relay").assertIsDisplayed()
+    }
+
+    // --- Page 5: Connect page ---
+
+    @Test
+    fun connectPage_hasApiServerUrlField() {
+        setOnboardingContent()
+        navigateToPage(4) // 0-indexed, page 5 is index 4
+
+        composeTestRule
+            .onNodeWithText("API Server URL")
+            .assertIsDisplayed()
+    }
+
+    @Test
+    fun connectPage_hasApiKeyField() {
         setOnboardingContent()
         navigateToPage(4)
 
         composeTestRule
-            .onNodeWithText("Hermes nearby")
+            .onNodeWithText("API Key (optional)", substring = true)
             .assertIsDisplayed()
+    }
+
+    @Test
+    fun connectPage_whereDoIFindThis_showsHelpDialog() {
+        setOnboardingContent()
+        navigateToPage(4)
+
+        // Tap "Where do I find this?"
         composeTestRule
-            .onNodeWithText("Remote gateway")
+            .onNodeWithText("Where do I find this?")
+            .performClick()
+        composeTestRule.waitForIdle()
+
+        // Dialog should show
+        composeTestRule
+            .onNodeWithText("Do I need an API key?")
             .assertIsDisplayed()
+    }
+
+    @Test
+    fun connectPage_helpDialog_canBeDismissed() {
+        setOnboardingContent()
+        navigateToPage(4)
+
+        composeTestRule.onNodeWithText("Where do I find this?").performClick()
+        composeTestRule.waitForIdle()
+
+        // Dialog is showing
+        composeTestRule.onNodeWithText("Do I need an API key?").assertIsDisplayed()
+
+        // Dismiss it
+        composeTestRule.onNodeWithText("Got it").performClick()
+        composeTestRule.waitForIdle()
+
+        // Dialog should be gone
         composeTestRule
-            .onNodeWithText("Scan Hermes setup QR")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Recommended")
+            .onNodeWithText("Do I need an API key?")
             .assertDoesNotExist()
     }
 
-    @Test
-    fun manualSetup_showsHermesAddressWithoutApiCredentials() {
-        setOnboardingContent()
-        navigateToPage(4)
+    // --- Page 6: Relay page ---
 
-        composeTestRule.onNodeWithText("Remote gateway").performClick()
-        composeTestRule.waitForIdle()
+    @Test
+    fun relayPage_showsOptionalMessaging() {
+        setOnboardingContent()
+        navigateToPage(5) // Last page
 
         composeTestRule
-            .onNodeWithText("Hermes address")
+            .onNodeWithText("This is optional", substring = true)
             .assertIsDisplayed()
     }
 
     @Test
-    fun manualSetup_findButton_isShown() {
+    fun relayPage_showsRelayUrlField() {
         setOnboardingContent()
-        navigateToPage(4)
-
-        composeTestRule.onNodeWithText("Remote gateway").performClick()
-        composeTestRule.waitForIdle()
+        navigateToPage(5)
 
         composeTestRule
-            .onNodeWithText("Find Hermes")
+            .onNodeWithText("Relay URL (optional)")
+            .assertIsDisplayed()
+    }
+
+    // --- Get Started button ---
+
+    @Test
+    fun lastPage_showsGetStartedButton() {
+        setOnboardingContent()
+        navigateToPage(5)
+
+        composeTestRule
+            .onNodeWithText("Get Started")
             .assertIsDisplayed()
     }
 
     @Test
-    fun cloudSetup_requestsTheHostedDashboardAddress() {
+    fun lastPage_getStartedButton_isEnabled_withDefaultUrl() {
         setOnboardingContent()
-        navigateToPage(4)
-
-        composeTestRule.onNodeWithText("Nous-hosted Hermes").performClick()
-        composeTestRule.waitForIdle()
+        navigateToPage(5)
 
+        // Default URL is "http://localhost:8642" which is non-blank
         composeTestRule
-            .onNodeWithText("Connect to Nous-hosted Hermes")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Use the complete HTTPS address shown for your hosted agent.")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun addGatewayPage_keepsPairingOptional() {
-        setOnboardingContent()
-        navigateToPage(4)
-
-        composeTestRule.onNodeWithText("Advanced").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule
-            .onNodeWithText("Pair Relay by code")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Power-user path for Terminal, Bridge, Relay sessions, and grants")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun powerPage_linksToPermissionReview() {
-        setOnboardingContent()
-        navigateToPage(3)
-
-        composeTestRule
-            .onNodeWithText("Review permissions")
-            .assertIsDisplayed()
+            .onNodeWithText("Get Started")
             .assertIsEnabled()
     }
 
+    // --- Skip button visibility across pages ---
+
     @Test
-    fun skipButton_visibleOnIntroPages_andWizardSkipOnAddGatewayPage() {
+    fun skipButton_visibleOnAllPages() {
         setOnboardingContent()
 
-        repeat(4) {
-            composeTestRule.onNodeWithText("Skip").assertIsDisplayed()
-            composeTestRule.onNodeWithText(if (it == 3) "Connect" else "Next").performClick()
-            composeTestRule.waitForIdle()
-        }
+        // Check skip on first page
+        composeTestRule.onNodeWithText("Skip").assertIsDisplayed()
 
-        composeTestRule
-            .onNodeWithText("Skip for now — set up later in Settings")
-            .assertIsDisplayed()
+        // Navigate through all pages and check skip
+        for (i in 0 until 5) {
+            composeTestRule.onNodeWithText("Next").performClick()
+            composeTestRule.waitForIdle()
+            composeTestRule.onNodeWithText("Skip").assertIsDisplayed()
+        }
     }
 
+    // --- Helper ---
+
     private fun navigateToPage(pageIndex: Int) {
         repeat(pageIndex) {
-            composeTestRule.onNodeWithText(if (it == 3) "Connect" else "Next").performClick()
+            composeTestRule.onNodeWithText("Next").performClick()
             composeTestRule.waitForIdle()
         }
     }

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/screens/BotChatScreenBindingInstrumentedTest.kt

@@ -1,160 +0,0 @@
-package com.hermesandroid.relay.ui.screens
-
-import android.os.Handler
-import android.os.Looper
-import android.view.accessibility.AccessibilityNodeInfo
-import androidx.activity.compose.setContent
-import androidx.compose.material3.MaterialTheme
-import androidx.lifecycle.Lifecycle
-import androidx.test.core.app.ActivityScenario
-import androidx.test.platform.app.InstrumentationRegistry
-import com.hermesandroid.relay.data.BotGatewayRoute
-import com.hermesandroid.relay.data.BotGatewayRouteKey
-import com.hermesandroid.relay.data.BotRosterEntry
-import com.hermesandroid.relay.data.Profile
-import com.hermesandroid.relay.network.upstream.ChatHandler
-import com.hermesandroid.relay.network.upstream.DashboardApiClient
-import com.hermesandroid.relay.network.upstream.GatewayChatClient
-import com.hermesandroid.relay.network.upstream.models.MessageItem
-import com.hermesandroid.relay.viewmodel.AndroidGatewayContractFixture
-import com.hermesandroid.relay.viewmodel.ChatViewModel
-import java.util.concurrent.TimeUnit
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.serialization.json.JsonPrimitive
-import okhttp3.OkHttpClient
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Test
-
-/** On-device proof for the route-owned first-composition collection boundary. */
-class BotChatScreenBindingInstrumentedTest {
-    private lateinit var fixture: AndroidGatewayContractFixture
-    private lateinit var gatewayScope: CoroutineScope
-    private lateinit var dashboardClient: DashboardApiClient
-    private lateinit var gatewayClient: GatewayChatClient
-    private lateinit var viewModel: ChatViewModel
-    private lateinit var handler: ChatHandler
-    private var activityScenario: ActivityScenario<BotChatBindingTestActivity>? = null
-
-    @Before
-    fun setUp() {
-        fixture = AndroidGatewayContractFixture()
-        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
-        dashboardClient = DashboardApiClient(
-            baseUrl = fixture.server.url("/").toString().trimEnd('/'),
-            okHttpClient = OkHttpClient(),
-        )
-        gatewayClient = GatewayChatClient(
-            initialDashboardClient = dashboardClient,
-            okHttpClient = OkHttpClient(),
-            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
-            scope = gatewayScope,
-            reconnectJitterUnit = { 0.0 },
-        )
-        viewModel = ChatViewModel()
-        handler = ChatHandler()
-    }
-
-    @After
-    fun tearDown() {
-        activityScenario?.close()
-        viewModel.updateGatewayClient(null)
-        gatewayClient.shutdown()
-        gatewayScope.cancel()
-        dashboardClient.shutdown()
-        fixture.shutdown()
-    }
-
-    @Test
-    fun fastInitialHistoryRendersBeforeNavigationAndSurvivesLifecycleResume() {
-        val route = BotGatewayRoute(
-            key = BotGatewayRouteKey("fixture-gateway", PROFILE_NAME),
-            connectionLabel = "Fixture gateway",
-        )
-        val bot = BotRosterEntry(
-            profile = Profile(
-                name = PROFILE_NAME,
-                model = "fixture-model",
-                description = "Fixture profile",
-            ),
-            displayName = "Research",
-            route = route,
-        )
-        val scenario = ActivityScenario.launch(BotChatBindingTestActivity::class.java)
-            .also { activityScenario = it }
-
-        scenario.onActivity { activity ->
-            activity.setContent {
-                MaterialTheme {
-                    BotChatScreen(
-                        route = route,
-                        bot = bot,
-                        sessionId = STORED_SESSION_ID,
-                        gatewayClient = gatewayClient,
-                        dashboardClient = dashboardClient,
-                        chatViewModel = viewModel,
-                        onBack = {},
-                        handlerFactory = { handler },
-                        historyLoader = { _, _, _ ->
-                            Result.success(
-                                listOf(
-                                    MessageItem(
-                                        id = HISTORY_ID,
-                                        sessionId = STORED_SESSION_ID,
-                                        role = "assistant",
-                                        content = JsonPrimitive(HISTORY_TEXT),
-                                        timestamp = 1.0,
-                                        finishReason = "stop",
-                                    ),
-                                ),
-                            )
-                        },
-                        profileIconFlow = { _, _ -> MutableStateFlow(null) },
-                    )
-                }
-            }
-        }
-
-        waitUntil { handler.messages.value.singleOrNull()?.content == HISTORY_TEXT }
-        waitUntil { renderedTextExists(HISTORY_TEXT) }
-
-        scenario.moveToState(Lifecycle.State.STARTED)
-        scenario.moveToState(Lifecycle.State.RESUMED)
-        waitUntil { renderedTextExists(HISTORY_TEXT) }
-        assertEquals(0, fixture.rpcCount("prompt.submit"))
-    }
-
-    private fun renderedTextExists(expected: String): Boolean {
-        val instrumentation = InstrumentationRegistry.getInstrumentation()
-        instrumentation.waitForIdleSync()
-        val root = instrumentation.uiAutomation.rootInActiveWindow ?: return false
-        return root.containsText(expected)
-    }
-
-    private fun AccessibilityNodeInfo.containsText(expected: String): Boolean {
-        if (text?.toString() == expected || contentDescription?.toString() == expected) return true
-        return (0 until childCount).any { index -> getChild(index)?.containsText(expected) == true }
-    }
-
-    private fun waitUntil(condition: () -> Boolean) {
-        val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(5)
-        while (System.nanoTime() < deadline) {
-            if (condition()) return
-            Thread.sleep(25)
-        }
-        assertTrue("Condition was not satisfied within 5 seconds", condition())
-    }
-
-    private companion object {
-        const val PROFILE_NAME = "research"
-        const val STORED_SESSION_ID = "20260829_120000_bot_chat"
-        const val HISTORY_ID = "persisted-bot-history"
-        const val HISTORY_TEXT = "Durable Bot Chat history is ready."
-    }
-}

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/screens/ChatDebugDrawerInstrumentedTest.kt

@@ -1,65 +0,0 @@
-package com.hermesandroid.relay.ui.screens
-
-import androidx.activity.ComponentActivity
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.material3.Text
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.testTag
-import androidx.compose.ui.test.assertIsDisplayed
-import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
-import androidx.compose.ui.test.longClick
-import androidx.compose.ui.test.onNodeWithContentDescription
-import androidx.compose.ui.test.onNodeWithTag
-import androidx.compose.ui.test.onNodeWithText
-import androidx.compose.ui.test.performClick
-import androidx.compose.ui.test.performTouchInput
-import androidx.compose.ui.unit.dp
-import com.hermesandroid.relay.network.upstream.GatewayConnectionState
-import com.hermesandroid.relay.ui.components.ChatDebugDrawer
-import com.hermesandroid.relay.ui.components.ChatDebugOverlay
-import com.hermesandroid.relay.ui.components.chatDebugHeaderGesture
-import com.hermesandroid.relay.ui.theme.HermesRelayTheme
-import org.junit.Assert.assertEquals
-import org.junit.Rule
-import org.junit.Test
-
-class ChatDebugDrawerInstrumentedTest {
-    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
-
-    @Test
-    fun longPressOpensDiagnosticsBelowHeaderAndCloseRestoresChat() {
-        compose.setContent {
-            var open by remember { mutableStateOf(false) }
-            HermesRelayTheme(appThemeId = "hermes-relay", themePreference = "dark") {
-                Box(Modifier.fillMaxSize()) {
-                    Text("Hermes", Modifier.fillMaxWidth().height(64.dp).testTag("header")
-                        .chatDebugHeaderGesture(true, onClick = {}, onHold = { open = true }))
-                    ChatDebugOverlay(open, 64.dp, onClose = { open = false }) {
-                        ChatDebugDrawer(
-                            profile = "Server Default", model = "Example", sessionId = "session",
-                            gateway = true, signedIn = true, signInRequired = false,
-                            socketState = GatewayConnectionState.Ready, preparing = false,
-                            streaming = false, loadingHistory = false, directoryUnavailable = false,
-                            failure = null, onClose = { open = false }, onConnections = {},
-                        )
-                    }
-                }
-            }
-        }
-        val header = compose.onNodeWithTag("header")
-        val before = header.fetchSemanticsNode().boundsInRoot
-        header.performTouchInput { longClick() }
-        compose.onNodeWithText("Session diagnostics").assertIsDisplayed()
-        assertEquals(before, header.fetchSemanticsNode().boundsInRoot)
-        compose.onNodeWithContentDescription("Close session diagnostics").performClick()
-        compose.onNodeWithText("Session diagnostics").assertDoesNotExist()
-        header.assertIsDisplayed()
-    }
-}

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/screens/EmptyStateTest.kt

@@ -1,52 +1,157 @@
 package com.hermesandroid.relay.ui.screens
 
-import android.app.Application
-import androidx.compose.material3.MaterialTheme
 import androidx.compose.ui.test.assertIsDisplayed
 import androidx.compose.ui.test.junit4.createComposeRule
-import androidx.compose.ui.test.onNodeWithContentDescription
 import androidx.compose.ui.test.onNodeWithText
-import androidx.test.core.app.ApplicationProvider
-import com.hermesandroid.relay.viewmodel.ConnectionViewModel
-import com.hermesandroid.relay.viewmodel.TerminalViewModel
+import androidx.compose.material3.MaterialTheme
 import org.junit.Rule
 import org.junit.Test
 
 /**
- * Instrumented smoke tests for the current Terminal and Bridge surfaces.
+ * Instrumented tests for Terminal and Bridge empty state screens.
  */
 class EmptyStateTest {
 
     @get:Rule
     val composeTestRule = createComposeRule()
 
-    @Test
-    fun terminalScreen_showsCurrentTopBar() {
-        val app = ApplicationProvider.getApplicationContext<Application>()
-        val terminalViewModel = TerminalViewModel(app)
-        val connectionViewModel = ConnectionViewModel(app)
+    // --- Terminal Screen ---
 
+    @Test
+    fun terminalScreen_showsTitle() {
         composeTestRule.setContent {
             MaterialTheme {
-                TerminalScreen(
-                    terminalViewModel = terminalViewModel,
-                    connectionViewModel = connectionViewModel,
-                )
+                TerminalScreen()
             }
         }
 
-        composeTestRule.onNodeWithText("Terminal").assertIsDisplayed()
-        composeTestRule.onNodeWithContentDescription("Search scrollback").assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Remote Terminal")
+            .assertIsDisplayed()
     }
 
     @Test
-    fun bridgeScreen_showsCurrentTopBar() {
+    fun terminalScreen_showsPhase2Chip() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                TerminalScreen()
+            }
+        }
+
+        composeTestRule
+            .onNodeWithText("Coming in Phase 2")
+            .assertIsDisplayed()
+    }
+
+    @Test
+    fun terminalScreen_showsDescription() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                TerminalScreen()
+            }
+        }
+
+        composeTestRule
+            .onNodeWithText("Secure shell access", substring = true)
+            .assertIsDisplayed()
+    }
+
+    @Test
+    fun terminalScreen_showsTopBarTitle() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                TerminalScreen()
+            }
+        }
+
+        composeTestRule
+            .onNodeWithText("Terminal")
+            .assertIsDisplayed()
+    }
+
+    @Test
+    fun terminalScreen_showsPlannedFeatures() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                TerminalScreen()
+            }
+        }
+
+        composeTestRule
+            .onNodeWithText("Full ANSI terminal emulator", substring = true)
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("tmux session management", substring = true)
+            .assertIsDisplayed()
+    }
+
+    // --- Bridge Screen ---
+
+    @Test
+    fun bridgeScreen_showsTitle() {
         composeTestRule.setContent {
             MaterialTheme {
                 BridgeScreen()
             }
         }
 
-        composeTestRule.onNodeWithText("Bridge").assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Device Bridge")
+            .assertIsDisplayed()
+    }
+
+    @Test
+    fun bridgeScreen_showsPhase3Chip() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                BridgeScreen()
+            }
+        }
+
+        composeTestRule
+            .onNodeWithText("Coming in Phase 3")
+            .assertIsDisplayed()
+    }
+
+    @Test
+    fun bridgeScreen_showsDescription() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                BridgeScreen()
+            }
+        }
+
+        composeTestRule
+            .onNodeWithText("Let your Hermes agent interact with your phone", substring = true)
+            .assertIsDisplayed()
+    }
+
+    @Test
+    fun bridgeScreen_showsTopBarTitle() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                BridgeScreen()
+            }
+        }
+
+        composeTestRule
+            .onNodeWithText("Bridge")
+            .assertIsDisplayed()
+    }
+
+    @Test
+    fun bridgeScreen_showsPlannedFeatures() {
+        composeTestRule.setContent {
+            MaterialTheme {
+                BridgeScreen()
+            }
+        }
+
+        composeTestRule
+            .onNodeWithText("Agent-controlled device interaction", substring = true)
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Permission management", substring = true)
+            .assertIsDisplayed()
     }
 }

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/screens/PermissionsStatusScreenTest.kt

@@ -1,45 +0,0 @@
-package com.hermesandroid.relay.ui.screens
-
-import androidx.compose.ui.test.assertIsDisplayed
-import androidx.compose.ui.test.junit4.createComposeRule
-import androidx.compose.ui.test.onNodeWithText
-import androidx.compose.ui.test.performScrollTo
-import com.hermesandroid.relay.ui.theme.HermesRelayTheme
-import org.junit.Rule
-import org.junit.Test
-
-class PermissionsStatusScreenTest {
-
-    @get:Rule
-    val composeTestRule = createComposeRule()
-
-    @Test
-    fun permissionsScreen_showsStandardAndOnDemandRows() {
-        composeTestRule.setContent {
-            HermesRelayTheme {
-                PermissionsStatusScreen(
-                    onBack = {},
-                    onOpenBridge = {},
-                )
-            }
-        }
-
-        composeTestRule
-            .onNodeWithText("Permissions and capabilities")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Chat and Manage")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("No Android runtime permission needed. API/dashboard auth is configured separately.")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Camera")
-            .performScrollTo()
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Microphone")
-            .performScrollTo()
-            .assertIsDisplayed()
-    }
-}

app/src/androidTest/kotlin/com/hermesandroid/relay/viewmodel/ChatActivityReceiptInstrumentedTest.kt

@@ -1,183 +0,0 @@
-package com.hermesandroid.relay.viewmodel
-
-import android.os.Handler
-import android.os.Looper
-import androidx.activity.ComponentActivity
-import androidx.compose.foundation.layout.Column
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.testTag
-import androidx.compose.ui.test.assertIsDisplayed
-import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
-import androidx.compose.ui.test.onNodeWithContentDescription
-import androidx.compose.ui.test.onNodeWithTag
-import androidx.compose.ui.test.onNodeWithText
-import androidx.compose.ui.test.performClick
-import androidx.lifecycle.Lifecycle
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.hermesandroid.relay.data.AgentDisplay
-import com.hermesandroid.relay.data.ChatActivityPhase
-import com.hermesandroid.relay.data.InMemoryChatActivityStore
-import com.hermesandroid.relay.data.projectChatActivityReceipts
-import com.hermesandroid.relay.network.upstream.ChatHandler
-import com.hermesandroid.relay.network.upstream.DashboardApiClient
-import com.hermesandroid.relay.network.upstream.GatewayChatClient
-import com.hermesandroid.relay.network.upstream.HermesApiClient
-import com.hermesandroid.relay.ui.components.ChatActivityReceipt
-import com.hermesandroid.relay.ui.components.GatewayBackgroundProcessSheet
-import com.hermesandroid.relay.ui.components.GatewayBackgroundProcessStrip
-import com.hermesandroid.relay.ui.components.SubagentPreviewVisibility
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.runBlocking
-import kotlinx.serialization.json.buildJsonObject
-import kotlinx.serialization.json.put
-import okhttp3.OkHttpClient
-import okhttp3.WebSocket
-import org.junit.After
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Rule
-import org.junit.Test
-
-/** Real Gateway callbacks drive production activity surfaces through Android lifecycle changes. */
-class ChatActivityReceiptInstrumentedTest {
-    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
-
-    private lateinit var fixture: AndroidGatewayContractFixture
-    private lateinit var gatewayScope: CoroutineScope
-    private lateinit var gateway: GatewayChatClient
-    private lateinit var handler: ChatHandler
-    private lateinit var viewModel: ChatViewModel
-    private lateinit var socket: WebSocket
-    private val owner = AgentDisplay.profileContextKey("fixture-connection", "research")
-
-    @Before
-    fun setUp() {
-        fixture = AndroidGatewayContractFixture().also { it.profileName = "research" }
-        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
-        val http = OkHttpClient()
-        gateway = GatewayChatClient(
-            initialDashboardClient = DashboardApiClient(fixture.server.url("/").toString().trimEnd('/'), okHttpClient = http),
-            okHttpClient = http,
-            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
-            scope = gatewayScope,
-            reconnectJitterUnit = { 0.0 },
-        )
-        handler = ChatHandler().also { it.setSessionId(STORED_SESSION_ID) }
-        viewModel = ChatViewModel().also {
-            it.initialize(HermesApiClient(fixture.server.url("/").toString(), "fixture-key"), handler)
-            it.streamingEndpoint = "gateway"
-            it.setSessionProfileNameProvider { "research" }
-            it.setProfileMessageLoader { Result.success(emptyList()) }
-            it.setChatActivityStore(InMemoryChatActivityStore())
-            it.switchProfileContext(owner, STORED_SESSION_ID)
-            it.updateGatewayClient(gateway)
-            it.setChatVisible(true)
-        }
-        compose.setContent {
-            val messages by viewModel.messages.collectAsStateWithLifecycle()
-            val records by viewModel.activityRecords.collectAsStateWithLifecycle()
-            val children by viewModel.subagentActivities.collectAsStateWithLifecycle()
-            val retained by viewModel.retainedActivityPreview.collectAsStateWithLifecycle()
-            val childPreview by viewModel.subagentChildPreview.collectAsStateWithLifecycle()
-            val session by viewModel.currentSessionId.collectAsStateWithLifecycle()
-            var sheetOpen by remember { mutableStateOf(false) }
-            MaterialTheme {
-                Column {
-                    GatewayBackgroundProcessStrip(
-                        processes = emptyList(), subagentActivities = children,
-                        subagentPreviewVisibility = SubagentPreviewVisibility(), loading = false,
-                        onClick = { viewModel.openCurrentActivityPreview(); sheetOpen = true },
-                        modifier = Modifier.testTag("active-activity"),
-                    )
-                    projectChatActivityReceipts(messages, records, owner, session).forEach { message ->
-                        message.activityRecord?.let { record ->
-                            ChatActivityReceipt(
-                                record = record,
-                                onClick = { sheetOpen = viewModel.openRetainedActivity(record) },
-                                modifier = Modifier.testTag("activity-receipt"),
-                            )
-                        }
-                    }
-                }
-                if (sheetOpen) {
-                    GatewayBackgroundProcessSheet(
-                        processes = retained?.processes.orEmpty(),
-                        subagentActivities = retained?.record?.previewActivities() ?: children,
-                        subagentChildPreview = childPreview,
-                        subagentPreviewVisibility = SubagentPreviewVisibility(),
-                        loading = false, stoppingProcessIds = emptySet(),
-                        onRefresh = viewModel::refreshBackgroundProcesses,
-                        onStop = viewModel::stopBackgroundProcess,
-                        onDismissProcess = viewModel::dismissBackgroundProcess,
-                        onOpenSubagentChild = viewModel::openSubagentChildPreview,
-                        onDismiss = { viewModel.closeActivityPreview(); sheetOpen = false },
-                        readOnlyHistory = retained != null,
-                        historyNotice = "Recorded activity. Available child history is read-only.",
-                    )
-                }
-            }
-        }
-        assertTrue(runBlocking { gateway.prewarmAwait(STORED_SESSION_ID) })
-        socket = fixture.awaitServerSocket()
-        fixture.awaitRpc("session.resume")
-    }
-
-    @After
-    fun tearDown() {
-        viewModel.updateGatewayClient(null)
-        gateway.shutdown()
-        gatewayScope.cancel()
-        fixture.shutdown()
-    }
-
-    @Test
-    fun detachedCompletionLeavesReopenableReceiptAcrossActivityResume() {
-        viewModel.sendMessage("Delegate a background task")
-        fixture.awaitRpc("prompt.submit")
-        socket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
-        socket.send(fixture.event("subagent.start", buildJsonObject {
-            put("subagent_id", "receipt-child")
-            put("delegation_id", "receipt-delegation")
-            put("task_count", 1)
-            put("goal", "Inspect activity lifecycle")
-        }, LIVE_SESSION_ID))
-        compose.waitUntil(5_000) { viewModel.subagentActivities.value.size == 1 }
-        compose.onNodeWithTag("active-activity").assertIsDisplayed()
-        socket.send(fixture.event("message.complete", buildJsonObject { put("text", "Launched") }, LIVE_SESSION_ID))
-        compose.waitUntil(5_000) { !handler.isStreaming.value }
-        compose.onNodeWithTag("active-activity").assertIsDisplayed()
-
-        socket.send(fixture.event("subagent.complete", buildJsonObject {
-            put("subagent_id", "receipt-child")
-            put("delegation_id", "receipt-delegation")
-            put("status", "completed")
-        }, LIVE_SESSION_ID))
-        compose.waitUntil(5_000) { viewModel.activityRecords.value.singleOrNull()?.phase == ChatActivityPhase.COMPLETE }
-        compose.onNodeWithTag("active-activity").assertDoesNotExist()
-        compose.onNodeWithTag("activity-receipt").assertIsDisplayed().performClick()
-        compose.onNodeWithText("Chat activity").assertIsDisplayed()
-        compose.onNodeWithText("Recorded activity. Available child history is read-only.").assertIsDisplayed()
-        compose.onNodeWithText("Stop").assertDoesNotExist()
-        compose.onNodeWithContentDescription("Close activity preview").performClick()
-        compose.onNodeWithTag("activity-receipt").assertIsDisplayed()
-
-        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
-        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
-        compose.onNodeWithTag("active-activity").assertDoesNotExist()
-        compose.onNodeWithTag("activity-receipt").assertIsDisplayed().performClick()
-        compose.onNodeWithText("Chat activity").assertIsDisplayed()
-    }
-
-    private companion object {
-        const val STORED_SESSION_ID = "20260821_120000_fixture"
-        const val LIVE_SESSION_ID = "fixture-live-1"
-    }
-}

app/src/androidTest/kotlin/com/hermesandroid/relay/viewmodel/GatewayExternalFixtureInstrumentedTest.kt

@@ -1,266 +0,0 @@
-package com.hermesandroid.relay.viewmodel
-
-import android.os.Handler
-import android.os.Looper
-import androidx.activity.ComponentActivity
-import androidx.compose.foundation.layout.Column
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.testTag
-import androidx.compose.ui.test.assertCountEquals
-import androidx.compose.ui.test.assertIsDisplayed
-import androidx.compose.ui.test.assertTextEquals
-import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
-import androidx.compose.ui.test.onAllNodesWithText
-import androidx.compose.ui.test.onNodeWithTag
-import androidx.compose.ui.test.onAllNodesWithContentDescription
-import androidx.compose.ui.test.onNodeWithContentDescription
-import androidx.compose.ui.test.onNodeWithText
-import androidx.compose.ui.test.performClick
-import androidx.test.platform.app.InstrumentationRegistry
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.hermesandroid.relay.data.MessageRole
-import com.hermesandroid.relay.network.upstream.ChatHandler
-import com.hermesandroid.relay.network.upstream.DashboardApiClient
-import com.hermesandroid.relay.network.upstream.GatewayChatClient
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.runBlocking
-import kotlinx.serialization.json.Json
-import kotlinx.serialization.json.JsonArray
-import kotlinx.serialization.json.JsonObject
-import kotlinx.serialization.json.JsonPrimitive
-import kotlinx.serialization.json.contentOrNull
-import kotlinx.serialization.json.jsonObject
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertTrue
-import org.junit.Assume.assumeTrue
-import org.junit.Rule
-import org.junit.Test
-import java.util.concurrent.TimeUnit
-
-/**
- * Opt-in physical-device/emulator adapter for the shared Python fixture.
- *
- * Pass `-e gatewayFixtureBaseUrl http://127.0.0.1:8765` after exposing the
- * host fixture with `adb reverse`. With no argument this test alone is skipped;
- * the embedded regression remains fully standalone.
- */
-class GatewayExternalFixtureInstrumentedTest {
-
-    @get:Rule
-    val compose = createAndroidComposeRule<ComponentActivity>()
-
-    private var gatewayScope: CoroutineScope? = null
-    private var gatewayClient: GatewayChatClient? = null
-    private var viewModel: ChatViewModel? = null
-
-    @After
-    fun tearDown() {
-        viewModel?.updateGatewayClient(null)
-        gatewayClient?.shutdown()
-        gatewayScope?.cancel()
-    }
-
-    @Test
-    fun terminalGapActivate_externalFixtureRecoversFromAuthoritativeHttpHistory() {
-        val fixtureBaseUrl = InstrumentationRegistry.getArguments()
-            .getString(ARG_FIXTURE_BASE_URL)
-            ?.trim()
-            ?.trimEnd('/')
-        assumeTrue(
-            "Pass -e $ARG_FIXTURE_BASE_URL <url> to run the external fixture lane",
-            !fixtureBaseUrl.isNullOrBlank(),
-        )
-        requireNotNull(fixtureBaseUrl)
-
-        val okHttp = OkHttpClient.Builder()
-            .callTimeout(10, TimeUnit.SECONDS)
-            .build()
-        val initialState = readFixtureJson(okHttp, "$fixtureBaseUrl/__fixture__/state")
-        assertEquals("terminal_gap_activate", initialState["scenario"]?.jsonString())
-        assertEquals("1", initialState["remaining_turns"].toString())
-        val dashboard = DashboardApiClient(fixtureBaseUrl, okHttp)
-        val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO).also { gatewayScope = it }
-        val gateway = GatewayChatClient(
-            initialDashboardClient = dashboard,
-            okHttpClient = okHttp,
-            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
-            scope = scope,
-            reconnectJitterUnit = { 0.0 },
-        ).also { gatewayClient = it }
-        val handler = ChatHandler().also { it.setSessionId(STORED_SESSION_ID) }
-        val vm = ChatViewModel().also {
-            // Deliberately omit HermesApiClient: this lane has no API-server
-            // fallback surface, so a passing turn proves Gateway ownership.
-            it.initialize(null, handler)
-            it.streamingEndpoint = "gateway"
-            it.setProfileMessageLoaderWithMode { profile, sessionId, mode ->
-                dashboard.getSessionMessages(sessionId, profile, mode)
-            }
-            it.updateGatewayClient(gateway)
-            it.setChatVisible(true)
-        }.also { viewModel = it }
-
-        compose.setContent {
-            val messages by vm.messages.collectAsStateWithLifecycle()
-            val streaming by vm.isStreaming.collectAsStateWithLifecycle()
-            MaterialTheme {
-                Column(Modifier.testTag("external-contract-transcript")) {
-                    Text(
-                        text = if (streaming) "STREAMING" else "IDLE",
-                        modifier = Modifier.testTag("external-stream-state"),
-                    )
-                    messages.forEach { message ->
-                        Text(
-                            text = "${message.role.name}:${message.content}",
-                            modifier = Modifier.testTag("external-message-${message.id}"),
-                        )
-                    }
-                }
-            }
-        }
-
-        assertTrue(runBlocking { gateway.prewarmAwait(STORED_SESSION_ID) })
-        vm.sendMessage("Exercise terminal gap.")
-
-        compose.waitUntil(10_000) {
-            !handler.isStreaming.value &&
-                !gateway.hasActiveTurn() &&
-                handler.messages.value.any {
-                    it.role == MessageRole.ASSISTANT && it.content == AUTHORITATIVE_ANSWER
-                }
-        }
-
-        compose.onNodeWithTag("external-contract-transcript").assertIsDisplayed()
-        compose.onNodeWithTag("external-stream-state").assertTextEquals("IDLE")
-        compose.onAllNodesWithText("${MessageRole.ASSISTANT.name}:$AUTHORITATIVE_ANSWER")
-            .assertCountEquals(1)
-
-        val messages = handler.messages.value
-        assertEquals(
-            1,
-            messages.count {
-                it.role == MessageRole.ASSISTANT && it.content == AUTHORITATIVE_ANSWER
-            },
-        )
-        assertEquals(1, messages.count { it.role == MessageRole.USER })
-        assertFalse(messages.any { it.isStreaming || it.isThinkingStreaming })
-        assertEquals("gateway", vm.streamingEndpoint)
-
-        val evidence = readFixtureJson(okHttp, "$fixtureBaseUrl/__fixture__/evidence")
-        assertEquals("terminal_gap_activate", evidence["scenario"]?.jsonString())
-        val entries = evidence["entries"] as? JsonArray ?: JsonArray(emptyList())
-        assertEquals(1, entries.rpcCount("prompt.submit"))
-        assertEquals(1, entries.rpcCount("session.activate"))
-
-        val state = readFixtureJson(okHttp, "$fixtureBaseUrl/__fixture__/state")
-        assertEquals("terminal_gap_activate", state["scenario"]?.jsonString())
-        assertEquals("2", state["history_rows"].toString())
-    }
-
-    private fun readFixtureJson(client: OkHttpClient, url: String): JsonObject {
-        val request = Request.Builder().url(url).get().build()
-        return client.newCall(request).execute().use { response ->
-            check(response.isSuccessful) { "fixture HTTP ${response.code}" }
-            Json.parseToJsonElement(response.body.string()).jsonObject
-        }
-    }
-
-    @Test
-    fun queuedStopResume_preservesWorkAcrossLifecycleAndUsesExplicitResume() {
-        val base = InstrumentationRegistry.getArguments().getString(ARG_FIXTURE_BASE_URL)?.trimEnd('/')
-        assumeTrue("Pass a queued_stop_resume fixture URL", !base.isNullOrBlank())
-        requireNotNull(base)
-        val http = OkHttpClient.Builder().callTimeout(10, TimeUnit.SECONDS).build()
-        assertEquals("queued_stop_resume", readFixtureJson(http, "$base/__fixture__/state")["scenario"]?.jsonString())
-        val dashboard = DashboardApiClient(base, http)
-        val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO).also { gatewayScope = it }
-        val gateway = GatewayChatClient(
-            initialDashboardClient = dashboard, okHttpClient = http, scope = scope,
-            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
-            reconnectJitterUnit = { 0.0 },
-        ).also { gatewayClient = it }
-        val handler = ChatHandler().also { it.setSessionId(STORED_SESSION_ID) }
-        val vm = ChatViewModel().also {
-            it.initialize(null, handler)
-            it.streamingEndpoint = "gateway"
-            it.setProfileMessageLoaderWithMode { profile, session, mode -> dashboard.getSessionMessages(session, profile, mode) }
-            it.updateGatewayClient(gateway)
-            it.switchProfileContext(com.hermesandroid.relay.data.AgentDisplay.profileContextKey("fixture-queue", null), STORED_SESSION_ID)
-        }.also { viewModel = it }
-        compose.setContent {
-            val queue by vm.queuedMessages.collectAsStateWithLifecycle()
-            val paused by vm.queuePaused.collectAsStateWithLifecycle()
-            com.hermesandroid.relay.ui.theme.HermesRelayTheme(themePreference = "dark") {
-                androidx.compose.material3.Surface {
-                    Column {
-                        com.hermesandroid.relay.ui.components.ChatBusyActionSelector(
-                            com.hermesandroid.relay.data.BusyMessageAction.QueueNext, {}, onStop = vm::cancelStream,
-                        )
-                        com.hermesandroid.relay.ui.components.ChatMessageQueue(
-                            queue, paused, vm::resumeQueue, vm::clearQueue, {}, vm::removeQueuedAt, canEdit = true,
-                        )
-                    }
-                }
-            }
-        }
-        assertTrue(runBlocking { gateway.prewarmAwait(STORED_SESSION_ID) })
-        compose.runOnIdle { vm.sendMessage("Original work") }
-        compose.waitUntil(10_000) { handler.isStreaming.value && vm.steerableTurn.value }
-        compose.runOnIdle {
-            vm.sendMessage("Remove this follow-up", com.hermesandroid.relay.data.BusyMessageAction.QueueNext)
-            vm.sendMessage("Keep this follow-up", com.hermesandroid.relay.data.BusyMessageAction.QueueNext)
-        }
-        compose.onAllNodesWithContentDescription("Remove queued message")[0].performClick()
-        compose.onNodeWithContentDescription("Stop streaming").performClick()
-        compose.onNodeWithText("Queue paused").assertIsDisplayed()
-        assertEquals(listOf("Keep this follow-up"), vm.queuedMessages.value)
-
-        compose.activityRule.scenario.moveToState(androidx.lifecycle.Lifecycle.State.CREATED)
-        compose.activityRule.scenario.moveToState(androidx.lifecycle.Lifecycle.State.RESUMED)
-        compose.onNodeWithText("Keep this follow-up").assertIsDisplayed()
-        compose.onNodeWithText("Resume").performClick()
-        try {
-            compose.waitUntil(15_000) {
-                vm.queuedMessages.value.isEmpty() && !handler.isStreaming.value &&
-                    handler.messages.value.any { it.content == "Resumed follow-up." }
-            }
-        } catch (error: androidx.compose.ui.test.ComposeTimeoutException) {
-            throw AssertionError(
-                "Synthetic queue fixture did not settle: queued=${vm.queuedMessages.value.size}, " +
-                    "paused=${vm.queuePaused.value}, streaming=${handler.isStreaming.value}, " +
-                    "messages=${handler.messages.value.map { it.role to it.content }}, " +
-                    "error=${handler.error.value}",
-                error,
-            )
-        }
-        val evidence = readFixtureJson(http, "$base/__fixture__/evidence")["entries"] as JsonArray
-        assertEquals(2, evidence.rpcCount("prompt.submit"))
-        assertEquals(1, evidence.rpcCount("session.interrupt"))
-        assertEquals(0, evidence.rpcCount("session.redirect"))
-        assertEquals("gateway", vm.streamingEndpoint)
-    }
-
-    private fun JsonArray.rpcCount(method: String): Int = count { element ->
-        val entry = element as? JsonObject ?: return@count false
-        entry["kind"]?.jsonString() == "rpc" && entry["method"]?.jsonString() == method
-    }
-
-    private fun kotlinx.serialization.json.JsonElement.jsonString(): String? =
-        (this as? JsonPrimitive)?.contentOrNull
-
-    private companion object {
-        const val ARG_FIXTURE_BASE_URL = "gatewayFixtureBaseUrl"
-        const val STORED_SESSION_ID = "20260821_120000_fixture"
-        const val AUTHORITATIVE_ANSWER = "Persisted after the socket gap."
-    }
-}

app/src/androidTest/kotlin/com/hermesandroid/relay/viewmodel/GatewayForegroundRecoveryInstrumentedTest.kt

@@ -1,715 +0,0 @@
-package com.hermesandroid.relay.viewmodel
-
-import android.os.Handler
-import android.os.Looper
-import androidx.activity.ComponentActivity
-import androidx.compose.foundation.layout.Column
-import androidx.compose.material3.Button
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.platform.testTag
-import androidx.compose.ui.Modifier
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.ui.test.assertIsDisplayed
-import androidx.compose.ui.test.assertTextEquals
-import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
-import androidx.compose.ui.test.onAllNodesWithTag
-import androidx.compose.ui.test.onNodeWithTag
-import androidx.lifecycle.Lifecycle
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.hermesandroid.relay.data.MessageRole
-import com.hermesandroid.relay.data.AgentDisplay
-import com.hermesandroid.relay.data.ChatTurnAssistantCheckpoint
-import com.hermesandroid.relay.data.ChatTurnCheckpoint
-import com.hermesandroid.relay.data.ChatTurnCheckpointStore
-import com.hermesandroid.relay.data.ChatTurnUserCheckpoint
-import com.hermesandroid.relay.network.upstream.ChatHandler
-import com.hermesandroid.relay.network.upstream.DashboardApiClient
-import com.hermesandroid.relay.network.upstream.GatewayChatClient
-import com.hermesandroid.relay.network.upstream.HermesApiClient
-import com.hermesandroid.relay.network.upstream.models.MessageItem
-import com.hermesandroid.relay.ui.components.GatewayBackgroundProcessStrip
-import com.hermesandroid.relay.ui.components.SubagentPreviewVisibility
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.runBlocking
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.serialization.json.Json
-import kotlinx.serialization.json.JsonObject
-import kotlinx.serialization.json.JsonPrimitive
-import kotlinx.serialization.json.buildJsonObject
-import kotlinx.serialization.json.contentOrNull
-import kotlinx.serialization.json.put
-import okhttp3.OkHttpClient
-import okhttp3.Response
-import okhttp3.WebSocket
-import okhttp3.WebSocketListener
-import okhttp3.mockwebserver.Dispatcher
-import okhttp3.mockwebserver.MockResponse
-import okhttp3.mockwebserver.MockWebServer
-import okhttp3.mockwebserver.RecordedRequest
-import org.junit.After
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Before
-import org.junit.Rule
-import org.junit.Test
-import java.util.concurrent.ConcurrentLinkedQueue
-import java.util.concurrent.LinkedBlockingQueue
-import java.util.concurrent.TimeUnit
-import java.util.concurrent.atomic.AtomicInteger
-
-/**
- * On-device contract coverage for issue #365.
- *
- * This deliberately uses the production [GatewayChatClient], [ChatViewModel],
- * and [ChatHandler]. [DeviceGatewayFixture] supplies only the upstream HTTP/WSS
- * boundary, so Android main-looper dispatch and Compose collection are real.
- */
-class GatewayForegroundRecoveryInstrumentedTest {
-
-    @get:Rule
-    val compose = createAndroidComposeRule<ComponentActivity>()
-
-    private lateinit var fixture: AndroidGatewayContractFixture
-    private lateinit var gatewayScope: CoroutineScope
-    private lateinit var gatewayClient: GatewayChatClient
-    private lateinit var handler: ChatHandler
-    private lateinit var viewModel: ChatViewModel
-    private lateinit var serverSocket: WebSocket
-
-    @Volatile
-    private var persistedHistory: List<MessageItem> = emptyList()
-    private val historySignInRequired = MutableStateFlow(false)
-
-    @Before
-    fun setUp() {
-        fixture = AndroidGatewayContractFixture().also { it.profileName = PROFILE_NAME }
-        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
-        val okHttp = OkHttpClient()
-        gatewayClient = GatewayChatClient(
-            initialDashboardClient = DashboardApiClient(
-                baseUrl = fixture.server.url("/").toString().trimEnd('/'),
-                okHttpClient = okHttp,
-            ),
-            okHttpClient = okHttp,
-            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
-            scope = gatewayScope,
-            reconnectJitterUnit = { 0.0 },
-        )
-        handler = ChatHandler().also { it.setSessionId(STORED_SESSION_ID) }
-        viewModel = ChatViewModel().also {
-            it.initialize(
-                HermesApiClient(fixture.server.url("/").toString(), "fixture-key"),
-                handler,
-            )
-            it.streamingEndpoint = "gateway"
-            it.setSessionProfileNameProvider { PROFILE_NAME }
-            it.setProfileMessageLoader { Result.success(persistedHistory) }
-            it.updateGatewayClient(gatewayClient)
-            it.setChatVisible(true)
-        }
-
-        compose.setContent {
-            val messages by viewModel.messages.collectAsStateWithLifecycle()
-            val streaming by viewModel.isStreaming.collectAsStateWithLifecycle()
-            val children by viewModel.subagentActivities.collectAsStateWithLifecycle()
-            val signInRequired by historySignInRequired.collectAsStateWithLifecycle()
-            MaterialTheme {
-                Column(Modifier.testTag("contract-transcript")) {
-                    GatewayBackgroundProcessStrip(
-                        processes = emptyList(),
-                        subagentActivities = children,
-                        subagentPreviewVisibility = SubagentPreviewVisibility(),
-                        loading = false,
-                        onClick = {},
-                        modifier = Modifier.testTag("child-activity"),
-                    )
-                    Text(
-                        text = if (streaming) "STREAMING" else "IDLE",
-                        modifier = Modifier.testTag("stream-state"),
-                    )
-                    messages.forEach { message ->
-                        Text(
-                            text = "${message.role.name}:${message.content}",
-                            modifier = Modifier.testTag("message-${message.id}"),
-                        )
-                    }
-                    if (signInRequired) {
-                        Button(
-                            onClick = {},
-                            modifier = Modifier.testTag("dashboard-sign-in-recovery"),
-                        ) {
-                            Text("SIGN IN")
-                        }
-                    }
-                }
-            }
-        }
-
-        assertTrue(runBlocking { gatewayClient.prewarmAwait(STORED_SESSION_ID) })
-        serverSocket = fixture.awaitServerSocket()
-        fixture.awaitRpc("session.resume")
-    }
-
-    @After
-    fun tearDown() {
-        viewModel.updateGatewayClient(null)
-        gatewayClient.shutdown()
-        gatewayScope.cancel()
-        fixture.shutdown()
-    }
-
-    @Test
-    fun detachedChildActivity_survivesParentTerminalAndActivityResume() {
-        viewModel.sendMessage("Delegate a background task")
-        fixture.awaitRpc("prompt.submit")
-        serverSocket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
-        serverSocket.send(fixture.event("subagent.start", buildJsonObject {
-            put("subagent_id", "detached-child")
-            put("goal", "Inspect")
-        }, LIVE_SESSION_ID))
-        compose.waitUntil(5_000) { viewModel.subagentActivities.value.size == 1 }
-        compose.onNodeWithTag("child-activity").assertIsDisplayed()
-        serverSocket.send(fixture.event("message.complete", buildJsonObject { put("text", "Launched") }, LIVE_SESSION_ID))
-        compose.waitUntil(5_000) { !handler.isStreaming.value }
-        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
-        serverSocket.send(fixture.event("subagent.progress", buildJsonObject {
-            put("subagent_id", "detached-child")
-            put("text", "Still working")
-        }, LIVE_SESSION_ID))
-        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
-        compose.waitUntil(5_000) { viewModel.subagentActivities.value.single().events.last().text == "Still working" }
-        compose.onNodeWithTag("child-activity").assertIsDisplayed()
-        assertFalse(viewModel.subagentActivities.value.single().isTerminal)
-        compose.onNodeWithTag("stream-state").assertTextEquals("IDLE")
-        serverSocket.send(fixture.event("subagent.complete", buildJsonObject {
-            put("subagent_id", "detached-child")
-            put("status", "completed")
-        }, LIVE_SESSION_ID))
-        compose.waitUntil(5_000) { viewModel.subagentActivities.value.single().isTerminal }
-        compose.onNodeWithTag("child-activity").assertDoesNotExist()
-    }
-
-    @Test
-    fun terminalGapActivate_recoversForegroundTurnWithoutNavigationOrCrossSessionLeak() {
-        viewModel.sendMessage("Run a long foreground task")
-        fixture.awaitRpc("prompt.submit")
-
-        // A multiplexed Gateway shares one socket. Foreign-session events must
-        // neither render nor settle the visible turn.
-        serverSocket.send(fixture.event("message.start", null, FOREIGN_SESSION_ID))
-        serverSocket.send(
-            fixture.event(
-                "message.delta",
-                buildJsonObject { put("text", FOREIGN_ANSWER) },
-                FOREIGN_SESSION_ID,
-            ),
-        )
-        serverSocket.send(
-            fixture.event(
-                "message.complete",
-                buildJsonObject { put("text", FOREIGN_ANSWER) },
-                FOREIGN_SESSION_ID,
-            ),
-        )
-
-        serverSocket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
-        serverSocket.send(
-            fixture.event(
-                "tool.start",
-                buildJsonObject {
-                    put("tool_id", "tool-foreground")
-                    put("name", "terminal")
-                },
-                LIVE_SESSION_ID,
-            ),
-        )
-        serverSocket.send(
-            fixture.event(
-                "message.delta",
-                buildJsonObject { put("text", PARTIAL_ANSWER) },
-                LIVE_SESSION_ID,
-            ),
-        )
-
-        compose.waitUntil(5_000) { handler.isStreaming.value }
-        compose.onNodeWithTag("stream-state").assertTextEquals("STREAMING")
-        compose.onNodeWithTag("contract-transcript").assertIsDisplayed()
-        assertFalse(handler.messages.value.any { it.content.contains(FOREIGN_ANSWER) })
-
-        // Exercise the real Activity collection boundary while the turn is
-        // still live. STARTED models a covered/backgrounded activity without
-        // destroying the test host; returning to RESUMED must preserve the
-        // same turn and transcript without navigation.
-        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
-        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
-        compose.waitUntil(5_000) { handler.isStreaming.value }
-        compose.onNodeWithTag("stream-state").assertTextEquals("STREAMING")
-
-        // The server finishes while this socket is detached. The replacement
-        // socket cannot replay message.complete; exact-session activation
-        // reports running=false and history is now authoritative.
-        persistedHistory = listOf(
-            MessageItem(
-                id = PERSISTED_ANSWER_ID,
-                sessionId = STORED_SESSION_ID,
-                role = "assistant",
-                content = JsonPrimitive(AUTHORITATIVE_ANSWER),
-            ),
-        )
-        fixture.recoveryRunning = false
-        serverSocket.close(1011, "fixture foreground gap")
-        serverSocket = fixture.awaitServerSocket()
-        fixture.awaitRpc("session.activate")
-
-        compose.waitUntil(5_000) {
-            !handler.isStreaming.value &&
-                handler.messages.value.singleOrNull()?.id == PERSISTED_ANSWER_ID
-        }
-        compose.onNodeWithTag("contract-transcript").assertIsDisplayed()
-        compose.onNodeWithTag("stream-state").assertTextEquals("IDLE")
-        compose.onNodeWithTag("message-$PERSISTED_ANSWER_ID")
-            .assertTextEquals("${MessageRole.ASSISTANT.name}:$AUTHORITATIVE_ANSWER")
-
-        val visible = handler.messages.value
-        assertEquals(1, visible.size)
-        assertEquals(AUTHORITATIVE_ANSWER, visible.single().content)
-        assertFalse(visible.single().isStreaming)
-        assertFalse(visible.any { it.content.contains(PARTIAL_ANSWER) })
-        assertFalse(visible.any { it.content.contains(FOREIGN_ANSWER) })
-        assertEquals(
-            "history catch-up must not duplicate the authoritative assistant row",
-            1,
-            compose.onAllNodesWithTag("message-$PERSISTED_ANSWER_ID").fetchSemanticsNodes().size,
-        )
-        assertEquals(
-            "the prompt must never be resubmitted during recovery",
-            1,
-            fixture.rpcCount("prompt.submit"),
-        )
-        assertEquals(
-            "the exact live session should be activated once",
-            1,
-            fixture.rpcCount("session.activate"),
-        )
-        assertEquals(0, fixture.requestsTo("/v1/chat/completions"))
-    }
-
-    @Test
-    fun terminalGapActiveList_settlesExactOwnedTurnAndRendersAuthoritativeHistory() {
-        viewModel.sendMessage("Run an Android-owned task")
-        fixture.awaitRpc("prompt.submit")
-        serverSocket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
-        serverSocket.send(
-            fixture.event(
-                "message.delta",
-                buildJsonObject { put("text", PARTIAL_ANSWER) },
-                LIVE_SESSION_ID,
-            ),
-        )
-        compose.waitUntil(5_000) { handler.isStreaming.value }
-        compose.onNodeWithTag("stream-state").assertTextEquals("STREAMING")
-
-        persistedHistory = listOf(
-            MessageItem(
-                id = PERSISTED_ANSWER_ID,
-                sessionId = STORED_SESSION_ID,
-                role = "assistant",
-                content = JsonPrimitive(AUTHORITATIVE_ANSWER),
-            ),
-        )
-        fixture.activeSessionStatus = "idle"
-        runBlocking { gatewayClient.listActiveSessions() }
-
-        compose.waitUntil(5_000) {
-            !handler.isStreaming.value &&
-                !gatewayClient.hasActiveTurn() &&
-                handler.messages.value.singleOrNull()?.id == PERSISTED_ANSWER_ID
-        }
-        compose.onNodeWithTag("stream-state").assertTextEquals("IDLE")
-        compose.onNodeWithTag("message-$PERSISTED_ANSWER_ID")
-            .assertTextEquals("${MessageRole.ASSISTANT.name}:$AUTHORITATIVE_ANSWER")
-        assertEquals(1, fixture.rpcCount("prompt.submit"))
-        assertEquals(0, fixture.rpcCount("session.interrupt"))
-        assertEquals(0, fixture.rpcCount("session.activate"))
-        assertEquals(0, fixture.requestsTo("/v1/chat/completions"))
-    }
-
-    @Test
-    fun desktopOwnedTurn_remainsReadOnlyAcrossAndroidForegroundLifecycle() {
-        viewModel.setChatVisible(false)
-        viewModel.updateGatewayClient(null)
-        gatewayClient.shutdown()
-        gatewayScope.cancel()
-
-        val controlMethods = setOf(
-            "session.resume",
-            "session.activate",
-            "session.interrupt",
-            "prompt.submit",
-        )
-        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
-        val okHttp = OkHttpClient()
-        gatewayClient = GatewayChatClient(
-            initialDashboardClient = DashboardApiClient(
-                baseUrl = fixture.server.url("/").toString().trimEnd('/'),
-                okHttpClient = okHttp,
-            ),
-            okHttpClient = okHttp,
-            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
-            scope = gatewayScope,
-            reconnectJitterUnit = { 0.0 },
-        )
-        viewModel.setChatTurnCheckpointStore(null)
-        viewModel.updateGatewayClient(gatewayClient)
-        assertTrue(runBlocking { gatewayClient.observeAwait() })
-        serverSocket = fixture.awaitServerSocket()
-        viewModel.switchProfileContext(
-            AgentDisplay.profileContextKey("fixture-connection", PROFILE_NAME),
-            STORED_SESSION_ID,
-        )
-        viewModel.updateSessionActivityDirectory(listOf(PROFILE_NAME to STORED_SESSION_ID))
-
-        val baseline = controlMethods.associateWith(fixture::rpcCount)
-        val baselineActiveList = fixture.rpcCount("session.active_list")
-        fixture.activeSessionStatus = "working"
-
-        viewModel.setChatVisible(true)
-        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
-        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
-        viewModel.setChatVisible(false)
-        viewModel.setChatVisible(true)
-        fixture.awaitRpcCount("session.active_list", baselineActiveList + 1)
-
-        controlMethods.forEach { method ->
-            assertEquals(
-                "passive lifecycle sent $method",
-                baseline.getValue(method),
-                fixture.rpcCount(method),
-            )
-        }
-        viewModel.updateGatewayClient(null)
-        gatewayClient.shutdown()
-        assertEquals(
-            "observer teardown interrupted the Desktop turn",
-            baseline.getValue("session.interrupt"),
-            fixture.rpcCount("session.interrupt"),
-        )
-    }
-
-    @Test
-    fun normalCompletion_genericHistory401RetainsTranscriptAndRequiresProfileSignIn() {
-        bindDashboardHistoryFailure(
-            body = "Unauthorized",
-            profileName = PROFILE_NAME,
-        )
-
-        viewModel.sendMessage("Keep this local transcript")
-        fixture.awaitRpc("prompt.submit")
-        serverSocket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
-        serverSocket.send(
-            fixture.event(
-                "message.delta",
-                buildJsonObject { put("text", LOCAL_COMPLETION) },
-                LIVE_SESSION_ID,
-            ),
-        )
-        serverSocket.send(
-            fixture.event(
-                "message.complete",
-                buildJsonObject { put("text", LOCAL_COMPLETION) },
-                LIVE_SESSION_ID,
-            ),
-        )
-
-        compose.waitUntil(15_000) {
-            historySignInRequired.value &&
-                !handler.isStreaming.value &&
-                handler.messages.value.any { it.content == LOCAL_COMPLETION }
-        }
-        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
-        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
-
-        compose.onNodeWithTag("contract-transcript").assertIsDisplayed()
-        compose.onNodeWithTag("stream-state").assertTextEquals("IDLE")
-        compose.onNodeWithTag("dashboard-sign-in-recovery").assertIsDisplayed()
-        assertFalse(viewModel.isLoadingHistory.value)
-        assertTrue(handler.messages.value.any { it.content == "Keep this local transcript" })
-        assertTrue(handler.messages.value.any { it.content == LOCAL_COMPLETION })
-        assertNull(viewModel.chatFailure.value)
-        assertExactProfileHistoryOnly(PROFILE_NAME)
-    }
-
-    @Test
-    fun recoveredCompletion_sessionExpiredHistoryRetainsSettledTranscript() {
-        bindDashboardHistoryFailure(
-            body = """{"reason":"session_expired"}""",
-            profileName = PROFILE_NAME,
-        )
-        val now = System.currentTimeMillis()
-        val contextKey = AgentDisplay.profileContextKey("fixture-connection", PROFILE_NAME)
-        viewModel.setChatTurnCheckpointStore(
-            MemoryCheckpointStore(
-                ChatTurnCheckpoint(
-                    contextKey = contextKey,
-                    profileKey = PROFILE_NAME,
-                    sessionId = STORED_SESSION_ID,
-                    liveSessionId = LIVE_SESSION_ID,
-                    transport = "gateway",
-                    user = ChatTurnUserCheckpoint("recovered-user", "Resume this turn", now - 2_000L),
-                    assistant = ChatTurnAssistantCheckpoint(
-                        id = "recovered-assistant",
-                        content = "Recovered partial",
-                        timestamp = now - 1_900L,
-                    ),
-                    priorUserMessageCount = 0,
-                    baselineAssistantCount = 0,
-                    startedAt = now - 2_000L,
-                    updatedAt = now,
-                ),
-            ),
-        )
-        fixture.recoveryRunning = true
-        handler.setSessionId(null)
-        viewModel.switchProfileContext(contextKey, STORED_SESSION_ID)
-        fixture.awaitRpc("session.activate")
-
-        serverSocket.send(
-            fixture.event(
-                "message.delta",
-                buildJsonObject { put("text", RECOVERED_COMPLETION) },
-                LIVE_SESSION_ID,
-            ),
-        )
-        serverSocket.send(
-            fixture.event(
-                "message.complete",
-                buildJsonObject { put("text", RECOVERED_COMPLETION) },
-                LIVE_SESSION_ID,
-            ),
-        )
-
-        compose.waitUntil(15_000) {
-            historySignInRequired.value && !handler.isStreaming.value
-        }
-        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
-        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
-
-        compose.onNodeWithTag("contract-transcript").assertIsDisplayed()
-        compose.onNodeWithTag("stream-state").assertTextEquals("IDLE")
-        compose.onNodeWithTag("dashboard-sign-in-recovery").assertIsDisplayed()
-        assertFalse(viewModel.isLoadingHistory.value)
-        assertTrue(
-            "recovered completion was not retained: ${handler.messages.value}",
-            handler.messages.value.any { it.content.contains(RECOVERED_COMPLETION.trim()) },
-        )
-        assertFalse(handler.messages.value.any { it.isStreaming || it.isThinkingStreaming })
-        assertNull(viewModel.chatFailure.value)
-        assertExactProfileHistoryOnly(PROFILE_NAME)
-    }
-
-    private fun bindDashboardHistoryFailure(body: String, profileName: String) {
-        fixture.profileName = profileName
-        fixture.historyFailureBody = body
-        val dashboard = DashboardApiClient(
-            baseUrl = fixture.server.url("/").toString().trimEnd('/'),
-            okHttpClient = OkHttpClient(),
-        )
-        viewModel.setProfileMessageLoaderWithMode { profile, sessionId, mode ->
-            dashboard.getSessionMessages(sessionId, profile, mode)
-        }
-        viewModel.setDashboardSignInRequiredHandler {
-            historySignInRequired.value = true
-        }
-    }
-
-    private fun assertExactProfileHistoryOnly(profileName: String) {
-        val historyRequests = fixture.historyRequestPaths()
-        assertTrue("no Dashboard history request was observed", historyRequests.isNotEmpty())
-        assertTrue(
-            "history escaped the exact profile: $historyRequests",
-            historyRequests.all { it.contains("profile=$profileName") },
-        )
-    }
-
-    private companion object {
-        const val STORED_SESSION_ID = "20260821_120000_fixture"
-        const val LIVE_SESSION_ID = "fixture-live-1"
-        const val FOREIGN_SESSION_ID = "live-foreign"
-        const val PERSISTED_ANSWER_ID = "persisted-foreground-answer"
-        const val PARTIAL_ANSWER = "Partial foreground answer"
-        const val AUTHORITATIVE_ANSWER = "Foreground task finished."
-        const val FOREIGN_ANSWER = "Wrong session content"
-        const val PROFILE_NAME = "research"
-        const val LOCAL_COMPLETION = "Completed before Dashboard auth expired."
-        const val RECOVERED_COMPLETION = " and then recovered to completion."
-    }
-}
-
-private class MemoryCheckpointStore(
-    private var checkpoint: ChatTurnCheckpoint?,
-) : ChatTurnCheckpointStore {
-    override suspend fun read(): ChatTurnCheckpoint? = checkpoint
-
-    override suspend fun write(checkpoint: ChatTurnCheckpoint) {
-        this.checkpoint = checkpoint
-    }
-
-    override suspend fun clear() {
-        checkpoint = null
-    }
-}
-
-/** Minimal real-socket implementation of the vanilla Gateway contract used above. */
-internal class AndroidGatewayContractFixture {
-    val server = MockWebServer()
-    private val json = Json { ignoreUnknownKeys = true }
-    private val sockets = LinkedBlockingQueue<WebSocket>()
-    private val allSockets = ConcurrentLinkedQueue<WebSocket>()
-    private val rpcLog = ConcurrentLinkedQueue<Pair<String, JsonObject>>()
-    private val requestPaths = ConcurrentLinkedQueue<String>()
-    private val ticketCount = AtomicInteger(0)
-
-    @Volatile
-    var recoveryRunning = false
-
-    @Volatile
-    var activeSessionStatus: String? = null
-
-    @Volatile
-    var historyFailureBody: String? = null
-
-    @Volatile
-    var profileName: String = "default"
-
-    private val listener = object : WebSocketListener() {
-        override fun onOpen(webSocket: WebSocket, response: Response) {
-            sockets.add(webSocket)
-            allSockets.add(webSocket)
-            webSocket.send(event("gateway.ready", null, null))
-        }
-
-        override fun onMessage(webSocket: WebSocket, text: String) {
-            val frame = json.parseToJsonElement(text) as? JsonObject ?: return
-            val method = (frame["method"] as? JsonPrimitive)?.contentOrNull ?: return
-            val id = (frame["id"] as? JsonPrimitive)?.contentOrNull?.toLongOrNull() ?: return
-            val params = frame["params"] as? JsonObject ?: JsonObject(emptyMap())
-            rpcLog.add(method to params)
-
-            val result = when (method) {
-                "session.resume" -> sessionSnapshot("fixture-live-1")
-                "session.activate" -> sessionSnapshot(
-                    (params["session_id"] as? JsonPrimitive)?.contentOrNull ?: "fixture-live-1",
-                )
-                "session.active_list" -> buildJsonObject {
-                    put("sessions", kotlinx.serialization.json.buildJsonArray {
-                        activeSessionStatus?.let { status ->
-                            add(buildJsonObject {
-                                put("id", LIVE_SESSION_ID)
-                                put("session_key", STORED_SESSION_ID)
-                                put("status", status)
-                                put("last_active", 1.0)
-                            })
-                        }
-                    })
-                }
-                "prompt.submit", "session.interrupt" -> buildJsonObject { put("ok", true) }
-                else -> JsonObject(emptyMap())
-            }
-            webSocket.send(
-                buildJsonObject {
-                    put("jsonrpc", "2.0")
-                    put("id", id)
-                    put("result", result)
-                }.toString(),
-            )
-        }
-    }
-
-    init {
-        server.dispatcher = object : Dispatcher() {
-            override fun dispatch(request: RecordedRequest): MockResponse {
-                val path = request.path.orEmpty()
-                requestPaths.add(path)
-                return when {
-                    path.startsWith("/api/auth/ws-ticket") -> MockResponse()
-                        .setResponseCode(200)
-                        .setHeader("Content-Type", "application/json")
-                        .setBody(
-                            """{"ticket":"device-${ticketCount.incrementAndGet()}","ttl_seconds":30}""",
-                        )
-                    path.startsWith("/api/ws") -> MockResponse().withWebSocketUpgrade(listener)
-                    path.startsWith("/api/sessions/") && path.contains("/messages") &&
-                        historyFailureBody != null -> MockResponse()
-                        .setResponseCode(401)
-                        .setHeader("Content-Type", "application/json")
-                        .setBody(historyFailureBody.orEmpty())
-                    else -> MockResponse().setResponseCode(404)
-                }
-            }
-        }
-        server.start()
-    }
-
-    private fun sessionSnapshot(sessionId: String): JsonObject = buildJsonObject {
-        put("session_id", sessionId)
-        put("running", recoveryRunning)
-        put("status", if (recoveryRunning) "streaming" else "idle")
-        put("info", buildJsonObject { put("profile_name", profileName) })
-    }
-
-    fun event(type: String, payload: JsonObject?, sessionId: String?): String =
-        buildJsonObject {
-            put("jsonrpc", "2.0")
-            put("method", "event")
-            put("params", buildJsonObject {
-                put("type", type)
-                payload?.let { put("payload", it) }
-                sessionId?.let { put("session_id", it) }
-            })
-        }.toString()
-
-    fun awaitServerSocket(): WebSocket =
-        sockets.poll(5, TimeUnit.SECONDS) ?: error("Gateway WebSocket did not open")
-
-    fun awaitRpc(method: String): JsonObject {
-        val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(15)
-        while (System.nanoTime() < deadline) {
-            rpcLog.firstOrNull { it.first == method }?.let { return it.second }
-            Thread.sleep(20)
-        }
-        error("Gateway RPC $method not observed; saw ${rpcLog.map { it.first }}")
-    }
-
-    fun awaitRpcCount(method: String, count: Int) {
-        val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(15)
-        while (System.nanoTime() < deadline) {
-            if (rpcCount(method) >= count) return
-            Thread.sleep(20)
-        }
-        error("Gateway RPC $method count $count not observed; saw ${rpcLog.map { it.first }}")
-    }
-
-    fun requestsTo(path: String): Int = requestPaths.count { it.startsWith(path) }
-
-    fun historyRequestPaths(): List<String> = requestPaths.filter {
-        it.startsWith("/api/sessions/") && it.contains("/messages")
-    }
-
-    fun rpcCount(method: String): Int = rpcLog.count { it.first == method }
-
-    fun shutdown() {
-        allSockets.forEach { socket -> runCatching { socket.close(1001, "teardown") } }
-        runCatching { server.shutdown() }
-    }
-
-    private companion object {
-        const val STORED_SESSION_ID = "20260821_120000_fixture"
-        const val LIVE_SESSION_ID = "fixture-live-1"
-    }
-}

app/src/candidate/AndroidManifest.xml

@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-    <application
-        android:icon="@mipmap/ic_launcher_candidate"
-        android:label="HR Candidate"
-        android:roundIcon="@mipmap/ic_launcher_candidate_round"
-        tools:replace="android:icon,android:label" />
-</manifest>

app/src/candidate/res/mipmap-anydpi-v26/ic_launcher_candidate.xml

@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/candidate_icon_background" />
-    <foreground android:drawable="@drawable/ic_launcher_foreground" />
-</adaptive-icon>

app/src/candidate/res/mipmap-anydpi-v26/ic_launcher_candidate_round.xml

@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/candidate_icon_background" />
-    <foreground android:drawable="@drawable/ic_launcher_foreground" />
-</adaptive-icon>

app/src/candidate/res/values/colors.xml

@@ -1,4 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <color name="candidate_icon_background">#FFB300</color>
-</resources>

app/src/debug/AndroidManifest.xml

@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <application>
-        <activity
-            android:name="com.hermesandroid.relay.ui.screens.BotChatBindingTestActivity"
-            android:exported="false"
-            android:screenOrientation="portrait" />
-        <activity
-            android:name="com.hermesandroid.relay.ui.screens.VoiceSettingsDesignQaActivity"
-            android:exported="true"
-            android:screenOrientation="portrait" />
-        <activity
-            android:name="com.hermesandroid.relay.ui.screens.ImageGenerationDesignQaActivity"
-            android:exported="true"
-            android:screenOrientation="portrait" />
-    </application>
-</manifest>

app/src/debug/kotlin/com/hermesandroid/relay/ui/screens/BotChatBindingTestActivity.kt

@@ -1,6 +0,0 @@
-package com.hermesandroid.relay.ui.screens
-
-import androidx.activity.ComponentActivity
-
-/** Empty debug-only host populated by the Bot Chat lifecycle instrumentation. */
-class BotChatBindingTestActivity : ComponentActivity()

app/src/debug/kotlin/com/hermesandroid/relay/ui/screens/ImageGenerationDesignQaActivity.kt

@@ -1,196 +0,0 @@
-package com.hermesandroid.relay.ui.screens
-
-import android.os.Bundle
-import androidx.activity.ComponentActivity
-import androidx.activity.compose.setContent
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.aspectRatio
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.Image
-import androidx.compose.foundation.background
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.material3.Button
-import androidx.compose.material3.ExperimentalMaterial3Api
-import androidx.compose.material3.FilterChip
-import androidx.compose.material3.Icon
-import androidx.compose.material3.IconButton
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Scaffold
-import androidx.compose.material3.Text
-import androidx.compose.material3.TopAppBar
-import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.automirrored.filled.ArrowBack
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.key
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.clip
-import androidx.compose.ui.layout.ContentScale
-import androidx.compose.ui.res.painterResource
-import androidx.compose.ui.unit.dp
-import com.hermesandroid.relay.R
-import com.hermesandroid.relay.ui.components.ImageGenerationPlaceholder
-import com.hermesandroid.relay.ui.components.ImageGenerationResultTransition
-import com.hermesandroid.relay.ui.components.ImageGenerationVisualStyle
-import com.hermesandroid.relay.ui.theme.HermesRelayTheme
-
-/**
- * Debug-build-only live host for fast image-generation motion tuning.
- *
- * Launch directly:
- * adb shell am start -n <applicationId>/
- *   com.hermesandroid.relay.ui.screens.ImageGenerationDesignQaActivity
- */
-class ImageGenerationDesignQaActivity : ComponentActivity() {
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        val themePreference = intent.getStringExtra("theme") ?: "auto"
-        setContent {
-            HermesRelayTheme(themePreference = themePreference) {
-                ImageGenerationDesignQaScene(onBack = ::finish)
-            }
-        }
-    }
-}
-
-@OptIn(ExperimentalMaterial3Api::class)
-@Composable
-private fun ImageGenerationDesignQaScene(onBack: () -> Unit) {
-    var restartKey by remember { mutableIntStateOf(0) }
-    var durationMillis by remember { mutableIntStateOf(4_800) }
-    var visualStyle by remember { androidx.compose.runtime.mutableStateOf(ImageGenerationVisualStyle.LatentGrid) }
-    var showResult by remember { androidx.compose.runtime.mutableStateOf(false) }
-
-    Scaffold(
-        topBar = {
-            TopAppBar(
-                title = { Text("Image generation lab") },
-                navigationIcon = {
-                    IconButton(onClick = onBack) {
-                        Icon(
-                            imageVector = Icons.AutoMirrored.Filled.ArrowBack,
-                            contentDescription = "Back",
-                        )
-                    }
-                },
-            )
-        },
-    ) { padding ->
-        Column(
-            modifier = Modifier
-                .fillMaxSize()
-                .padding(padding)
-                .padding(16.dp),
-            verticalArrangement = Arrangement.spacedBy(16.dp),
-        ) {
-            Text(
-                text = "Live debug preview · no generation request",
-                style = MaterialTheme.typography.labelMedium,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            Row(
-                modifier = Modifier.fillMaxWidth(),
-                horizontalArrangement = Arrangement.spacedBy(8.dp),
-            ) {
-                listOf(
-                    ImageGenerationVisualStyle.LatentGrid to "Grid",
-                    ImageGenerationVisualStyle.ParticleOrb to "Orb",
-                    ImageGenerationVisualStyle.Constellation to "Nodes",
-                ).forEach { (style, label) ->
-                    FilterChip(
-                        selected = visualStyle == style,
-                        onClick = { visualStyle = style },
-                        label = { Text(label) },
-                    )
-                }
-            }
-            key(restartKey, durationMillis, visualStyle) {
-                val startedAtMillis = remember { System.currentTimeMillis() }
-                ImageGenerationResultTransition(
-                    generating = !showResult,
-                    startedAtMillis = startedAtMillis,
-                    animationDurationMillis = durationMillis,
-                    visualStyle = visualStyle,
-                ) {
-                    Column(
-                        modifier = Modifier
-                            .fillMaxWidth()
-                            .clip(RoundedCornerShape(18.dp))
-                            .background(MaterialTheme.colorScheme.surfaceVariant),
-                    ) {
-                        Image(
-                            painter = painterResource(R.drawable.image_generation_transition_preview),
-                            contentDescription = "Generated landscape preview",
-                            contentScale = ContentScale.Crop,
-                            modifier = Modifier
-                                .fillMaxWidth()
-                                .aspectRatio(16f / 9f),
-                        )
-                        Row(
-                            modifier = Modifier
-                                .fillMaxWidth()
-                                .padding(horizontal = 12.dp, vertical = 8.dp),
-                            horizontalArrangement = Arrangement.SpaceBetween,
-                        ) {
-                            Text(
-                                text = "Generated image",
-                                style = MaterialTheme.typography.labelSmall,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            )
-                            Text(
-                                text = "12.4s",
-                                style = MaterialTheme.typography.labelSmall,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            )
-                        }
-                    }
-                }
-            }
-            Text(
-                text = "Cycle speed",
-                style = MaterialTheme.typography.labelMedium,
-            )
-            Row(
-                modifier = Modifier.fillMaxWidth(),
-                horizontalArrangement = Arrangement.spacedBy(8.dp),
-            ) {
-                listOf(
-                    7_200 to "Slow",
-                    4_800 to "Normal",
-                    3_200 to "Fast",
-                ).forEach { (duration, label) ->
-                    FilterChip(
-                        selected = durationMillis == duration,
-                        onClick = { durationMillis = duration },
-                        label = { Text(label) },
-                    )
-                }
-            }
-            Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
-                Button(
-                    onClick = {
-                        showResult = true
-                    },
-                    enabled = !showResult,
-                ) {
-                    Text("Reveal result")
-                }
-                Button(
-                    onClick = {
-                        showResult = false
-                        restartKey++
-                    },
-                ) {
-                    Text("Restart")
-                }
-            }
-        }
-    }
-}

app/src/debug/kotlin/com/hermesandroid/relay/ui/screens/VoiceSettingsDesignQaActivity.kt

@@ -1,128 +0,0 @@
-package com.hermesandroid.relay.ui.screens
-
-import android.os.Bundle
-import androidx.activity.ComponentActivity
-import androidx.activity.compose.setContent
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.Card
-import androidx.compose.material3.CardDefaults
-import androidx.compose.material3.ExperimentalMaterial3Api
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Scaffold
-import androidx.compose.material3.Text
-import androidx.compose.material3.TopAppBar
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.unit.dp
-import com.hermesandroid.relay.network.relay.RealtimeProviderInfo
-import com.hermesandroid.relay.ui.theme.HermesRelayTheme
-import com.hermesandroid.relay.viewmodel.VoicePreviewUiState
-
-/** Debug-build-only deterministic host for design QA screenshots. */
-class VoiceSettingsDesignQaActivity : ComponentActivity() {
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        val themePreference = intent.getStringExtra("theme") ?: "auto"
-        setContent { HermesRelayTheme(themePreference = themePreference) { VoiceSettingsDesignQaScene() } }
-    }
-}
-
-@OptIn(ExperimentalMaterial3Api::class)
-@Composable
-private fun VoiceSettingsDesignQaScene() {
-    val provider = remember {
-        RealtimeProviderInfo(
-            id = "xai_tts",
-            name = "xAI Grok TTS",
-            status = "ready",
-            models = listOf("grok-tts", "grok-tts-fast"),
-            voices = listOf("eve", "ara", "sal", "rex", "leo"),
-            model_labels = mapOf("grok-tts" to "Grok TTS"),
-            voice_labels = mapOf("eve" to "Eve", "ara" to "Ara", "sal" to "Sal"),
-            recommended_voices = listOf("eve", "ara"),
-            supports_tts = true,
-        )
-    }
-    var selectedSection by remember { mutableStateOf(VoiceSettingsSection.Output) }
-    var selectedVoice by remember { mutableStateOf("eve") }
-    var expanded by remember { mutableStateOf(false) }
-    val allVoices = remember {
-        listOf(
-            VoiceChoice("eve", "Eve", "Warm · expressive", recommended = true),
-            VoiceChoice("ara", "Ara", "Clear · balanced", recommended = true),
-            VoiceChoice("sal", "Sal", "Calm · grounded"),
-            VoiceChoice("rex", "Rex", "Direct · confident"),
-            VoiceChoice("leo", "Leo", "Bright · conversational"),
-        )
-    }
-
-    Scaffold(topBar = { TopAppBar(title = { Text("Voice") }) }) { padding ->
-        Column(
-            modifier = Modifier
-                .fillMaxSize()
-                .padding(padding)
-                .verticalScroll(rememberScrollState())
-                .padding(16.dp),
-            verticalArrangement = Arrangement.spacedBy(12.dp),
-        ) {
-            Card(
-                modifier = Modifier.fillMaxWidth(),
-                colors = CardDefaults.cardColors(
-                    containerColor = MaterialTheme.colorScheme.primaryContainer.copy(alpha = 0.58f),
-                ),
-            ) {
-                Column(modifier = Modifier.padding(16.dp)) {
-                    Text("Hermes Chat + Voice Output", style = MaterialTheme.typography.titleMedium)
-                    Text("Default profile · Profile voice", color = MaterialTheme.colorScheme.onSurfaceVariant)
-                }
-            }
-            VoiceSettingsTabs(selectedSection) { selectedSection = it }
-            VoiceProviderGroupCard(
-                provider = provider,
-                providerValue = provider.id,
-                enabled = true,
-                providerChoices = listOf(VoiceChoice(provider.id, provider.name.orEmpty())),
-                onEnabledChange = {},
-                onProviderChange = {},
-                controlsEnabled = true,
-            )
-            ModelAndVoiceGroupCard(
-                modelValue = "grok-tts",
-                modelChoices = listOf(VoiceChoice("grok-tts", "Grok TTS")),
-                voices = previewVoiceChoices(allVoices, selectedVoice),
-                allVoices = allVoices,
-                selectedVoice = selectedVoice,
-                previewState = VoicePreviewUiState(
-                    selectionKey = "voice:eve",
-                    isPlaying = true,
-                    amplitude = 0.42f,
-                ),
-                onModelChange = {},
-                onVoiceChange = { selectedVoice = it },
-                onPreviewVoice = {},
-                enabled = true,
-            )
-            LanguageQualityCard(
-                expanded = expanded,
-                onExpandedChange = { expanded = it },
-                language = "English",
-                languages = listOf(VoiceChoice("en", "English")),
-                onLanguageChange = {},
-                sampleRate = "24000",
-                sampleRates = listOf(VoiceChoice("24000", "24 kHz")),
-                onSampleRateChange = {},
-                enabled = true,
-            )
-        }
-    }
-}

app/src/googlePlay/kotlin/com/hermesandroid/relay/update/UpdateAvailabilityFactory.kt

@@ -1,199 +0,0 @@
-package com.hermesandroid.relay.update
-
-import android.app.Activity
-import android.content.Context
-import android.util.Log
-import com.google.android.play.core.appupdate.AppUpdateInfo
-import com.google.android.play.core.appupdate.AppUpdateManager
-import com.google.android.play.core.appupdate.AppUpdateManagerFactory
-import com.google.android.play.core.appupdate.AppUpdateOptions
-import com.google.android.play.core.install.InstallState
-import com.google.android.play.core.install.InstallStateUpdatedListener
-import com.google.android.play.core.install.model.AppUpdateType
-import com.google.android.play.core.install.model.InstallStatus
-import com.google.android.play.core.install.model.UpdateAvailability
-import kotlinx.coroutines.suspendCancellableCoroutine
-import kotlin.coroutines.resume
-
-/**
- * === update (googlePlay flavor): factory ===
- *
- * Backs [UpdateAvailabilitySource] onto Google Play's In-App Update API,
- * FLEXIBLE flow. Mirrors `voice/VoiceBridgeIntentFactory`'s flavor-split
- * factory pattern: both flavors export this exact function signature +
- * package, so the UI layer has one static call site and no reflection / no
- * `#if` gating.
- */
-fun createUpdateAvailabilitySource(context: Context): UpdateAvailabilitySource =
-    PlayUpdateAvailabilitySource(context.applicationContext)
-
-private const val TAG = "PlayUpdate"
-
-/**
- * Google Play FLEXIBLE in-app update source.
- *
- * - [check] queries `AppUpdateManager.appUpdateInfo`. If Play reports
- *   `UPDATE_AVAILABLE` and FLEXIBLE is allowed, returns [UpdateStatus.Available]
- *   (or [UpdateStatus.Downloaded] / [UpdateStatus.Downloading] if a previously
- *   started flexible update is already mid-flight). Anything else →
- *   [UpdateStatus.UpToDate].
- * - [startUpdate] launches Play's FLEXIBLE consent + background download and
- *   registers an [InstallStateUpdatedListener] so DOWNLOADED is reported back
- *   asynchronously via [onStatusChanged].
- * - [completeUpdate] calls `AppUpdateManager.completeUpdate()` which restarts
- *   the app to install the staged APK.
- *
- * Robustness: every Play interaction is wrapped in try/catch. On any failure
- * (no Play services, sideloaded "googlePlay" build on an AOSP device, RESULT
- * errors) it degrades to [UpdateStatus.UpToDate] / [UpdateStatus.Unsupported]
- * — the banner just never shows. Play is never a crash surface.
- */
-private class PlayUpdateAvailabilitySource(
-    private val appContext: Context,
-) : UpdateAvailabilitySource {
-
-    override var onStatusChanged: ((UpdateStatus) -> Unit)? = null
-
-    private val manager: AppUpdateManager? = runCatching {
-        AppUpdateManagerFactory.create(appContext)
-    }.getOrNull()
-
-    /** Cached label/code from the last [check] so async listener events can label themselves. */
-    @Volatile private var lastVersionCode: Long? = null
-
-    private val installListener = InstallStateUpdatedListener { state: InstallState ->
-        when (state.installStatus()) {
-            InstallStatus.DOWNLOADING ->
-                onStatusChanged?.invoke(
-                    UpdateStatus.Downloading(
-                        versionLabel = labelFor(lastVersionCode),
-                        versionCode = lastVersionCode,
-                        // bytesDownloaded()/totalBytesToDownload() are base
-                        // app-update InstallState methods (Long); no ktx import.
-                        bytesDownloaded = state.bytesDownloaded(),
-                        totalBytes = state.totalBytesToDownload(),
-                    )
-                )
-            InstallStatus.DOWNLOADED ->
-                onStatusChanged?.invoke(
-                    UpdateStatus.Downloaded(
-                        versionLabel = labelFor(lastVersionCode),
-                        versionCode = lastVersionCode,
-                    )
-                )
-            else -> Unit // INSTALLING / INSTALLED / FAILED / CANCELED → no banner change
-        }
-    }
-
-    @Volatile private var listenerRegistered = false
-
-    override suspend fun check(): UpdateStatus {
-        val mgr = manager ?: return UpdateStatus.Unsupported
-        return try {
-            val info = mgr.awaitAppUpdateInfo()
-            lastVersionCode = info.availableVersionCode().toLong()
-            when {
-                // A previously started FLEXIBLE update already finished downloading.
-                info.installStatus() == InstallStatus.DOWNLOADED -> {
-                    ensureListener(mgr)
-                    UpdateStatus.Downloaded(
-                        versionLabel = labelFor(lastVersionCode),
-                        versionCode = lastVersionCode,
-                    )
-                }
-                info.updateAvailability() == UpdateAvailability.DEVELOPER_TRIGGERED_UPDATE_IN_PROGRESS ||
-                    info.installStatus() == InstallStatus.DOWNLOADING -> {
-                    ensureListener(mgr)
-                    UpdateStatus.Downloading(
-                        versionLabel = labelFor(lastVersionCode),
-                        versionCode = lastVersionCode,
-                    )
-                }
-                info.updateAvailability() == UpdateAvailability.UPDATE_AVAILABLE &&
-                    info.isUpdateTypeAllowed(AppUpdateType.FLEXIBLE) ->
-                    UpdateStatus.Available(
-                        versionLabel = labelFor(lastVersionCode),
-                        versionCode = lastVersionCode,
-                        openUrl = null,
-                    )
-                else -> UpdateStatus.UpToDate
-            }
-        } catch (t: Throwable) {
-            Log.w(TAG, "appUpdateInfo check failed; treating as up-to-date", t)
-            UpdateStatus.UpToDate
-        }
-    }
-
-    override fun startUpdate(activity: Activity?): Boolean {
-        val mgr = manager ?: return false
-        if (activity == null) return false
-        return try {
-            ensureListener(mgr)
-            mgr.appUpdateInfo
-                .addOnSuccessListener { info: AppUpdateInfo ->
-                    val canStart = info.updateAvailability() == UpdateAvailability.UPDATE_AVAILABLE &&
-                        info.isUpdateTypeAllowed(AppUpdateType.FLEXIBLE)
-                    val resuming = info.updateAvailability() ==
-                        UpdateAvailability.DEVELOPER_TRIGGERED_UPDATE_IN_PROGRESS
-                    if (canStart || resuming) {
-                        runCatching {
-                            mgr.startUpdateFlow(
-                                info,
-                                activity,
-                                AppUpdateOptions.newBuilder(AppUpdateType.FLEXIBLE).build(),
-                            )
-                        }.onFailure { Log.w(TAG, "startUpdateFlow failed", it) }
-                    }
-                }
-                .addOnFailureListener { Log.w(TAG, "startUpdate appUpdateInfo failed", it) }
-            true
-        } catch (t: Throwable) {
-            Log.w(TAG, "startUpdate failed", t)
-            false
-        }
-    }
-
-    override fun completeUpdate() {
-        val mgr = manager ?: return
-        runCatching { mgr.completeUpdate() }
-            .onFailure { Log.w(TAG, "completeUpdate failed", it) }
-    }
-
-    override fun dispose() {
-        val mgr = manager ?: return
-        if (listenerRegistered) {
-            runCatching { mgr.unregisterListener(installListener) }
-            listenerRegistered = false
-        }
-        onStatusChanged = null
-    }
-
-    private fun ensureListener(mgr: AppUpdateManager) {
-        if (!listenerRegistered) {
-            runCatching { mgr.registerListener(installListener) }
-                .onSuccess { listenerRegistered = true }
-                .onFailure { Log.w(TAG, "registerListener failed", it) }
-        }
-    }
-
-    // Play exposes only the numeric versionCode, not a marketing version
-    // string, so the banner copy stays generic ("A new version"). The code is
-    // still carried on the status for per-version dismissal keying.
-    private fun labelFor(@Suppress("UNUSED_PARAMETER") code: Long?): String = "A new version"
-}
-
-// === END update (googlePlay) ===
-
-/**
- * `await()` for Play's [AppUpdateInfo] task without pulling in
- * `kotlinx-coroutines-play-services`. Named `await…` (not the ktx
- * `requestAppUpdateInfo`) to avoid any overload ambiguity with the
- * `app-update-ktx` suspend extension. Resumable + cancels cleanly if the
- * coroutine is torn down.
- */
-private suspend fun AppUpdateManager.awaitAppUpdateInfo(): AppUpdateInfo =
-    suspendCancellableCoroutine { cont ->
-        appUpdateInfo
-            .addOnSuccessListener { info -> if (cont.isActive) cont.resume(info) }
-            .addOnFailureListener { e -> if (cont.isActive) cont.cancel(e) }
-    }

app/src/googlePlay/kotlin/com/hermesandroid/relay/voice/VoiceBridgeIntentFactory.kt

@@ -1,8 +1,8 @@
 package com.hermesandroid.relay.voice
 
-import com.hermesandroid.relay.network.relay.ChannelMultiplexer
-import com.hermesandroid.relay.network.shared.LocalDispatchResult
-import com.hermesandroid.relay.network.relay.models.Envelope
+import com.hermesandroid.relay.network.ChannelMultiplexer
+import com.hermesandroid.relay.network.handlers.LocalDispatchResult
+import com.hermesandroid.relay.network.models.Envelope
 
 /**
  * Local in-process bridge dispatcher type. The Play flavor never invokes

app/src/googlePlay/play/contact-email.txt

@@ -1 +0,0 @@
-info@axiom-labs.dev

app/src/googlePlay/play/default-language.txt

@@ -1 +0,0 @@
-en-US

app/src/googlePlay/play/listings/en-US/full-description.txt

@@ -1,59 +0,0 @@
-Hermes-Relay is the native Android companion for the Hermes agent you run. Chat, talk hands-free, continue sessions, and manage models, keys, skills, profiles, and automations from your phone.
-
-It is not a hosted AI service. Your Hermes agent stays on infrastructure you control, and the app talks only to instances you configure.
-
-QUICK START
-
-1. Start the Hermes Dashboard/Gateway on your computer or home server with hermes dashboard.
-2. Install Hermes-Relay from Google Play.
-3. For the recommended full setup, install the Hermes-Relay plugin on the host and refresh the Web Dashboard. A Relay page will appear.
-4. Scan Connect mobile app from Android Connect. Then scan Pair new device from Android Settings > Connections.
-
-The QR codes are separate on purpose. Connect mobile app adds the standard Dashboard/Gateway connection. Pair new device grants a time-limited Hermes-Relay session for the additional capabilities you approve.
-
-Standard Hermes without the plugin is supported. Choose Find Hermes on LAN or enter the Dashboard address you open in a browser, normally http://<host>:9119. Pair the Hermes-Relay plugin later when you want the full experience.
-
-HOW IT WORKS
-
-Chat, sessions, Manage, sign-in, and standard voice use the unmodified Hermes Dashboard/Gateway. The separate Hermes API server is an optional fallback for advanced or headless setups; it is not required for the normal Android connection.
-
-The encouraged Hermes-Relay plugin adds Terminal/TUI, notifications, media handoff, enhanced voice, Relay sessions, desktop-tool handoff, and time-limited per-feature grants. When upstream Hermes provides a compatible capability, Hermes-Relay prefers it instead of duplicating it.
-
-GOOGLE PLAY AND SIDELOAD
-
-The Google Play build includes Chat, voice, sessions, Manage, profiles, notifications, media, and Terminal/TUI when the Hermes-Relay plugin is paired.
-
-Google Play does not include Android Device Control. It cannot read the phone screen, tap, type, swipe, take device screenshots, send SMS, place calls, or access contacts or location.
-
-Device Control is available only in the signed Sideload build on this project's GitHub Releases. It requires the Sideload app, a paired Hermes-Relay plugin, explicit Android accessibility permission, and the app's safety controls.
-
-FEATURES
-
-- Streaming Chat with reasoning, markdown, tool progress, attachments, mid-turn steering, edit-and-resend, and searchable commands.
-- Manage models and provider keys, edit profiles, and browse, install, or update skills through the Hermes Dashboard.
-- Hands-free voice through your server's speech providers. Hermes-Relay pairing adds per-profile voices and an experimental realtime engine.
-- Create, switch, search, rename, pin, archive, and continue sessions.
-- Connect multiple Hermes servers and switch in one tap; add LAN, Tailscale, or public routes.
-- Pair the Hermes-Relay plugin for Terminal/TUI, notifications, media, enhanced voice, Relay sessions, and per-feature grants.
-- Inspect connection readiness, routes, response timing, token usage, and stream health without exposing credentials.
-
-SECURITY AND PRIVACY
-
-- Dashboard sessions and Hermes-Relay tokens use encrypted Android storage.
-- Cleartext is limited to trusted local-network setups. Use a VPN or HTTPS remotely.
-- No telemetry, ads, tracking, or third-party analytics SDKs.
-- Notification and microphone access are optional and user-controlled.
-- App traffic goes only to servers you configure.
-
-REQUIREMENTS
-
-- Android 8.0 or later.
-- A reachable Hermes Dashboard/Gateway.
-- The Hermes-Relay plugin is encouraged for the complete experience but never blocks standard Hermes.
-- Network access through a local network, VPN, or operator-managed internet route.
-
-OPEN SOURCE
-
-Hermes-Relay is MIT licensed. Source, setup guides, downloads, and issue tracking are on GitHub.
-
-This community project is not affiliated with or endorsed by NousResearch.

app/src/googlePlay/play/listings/en-US/short-description.txt

@@ -1 +0,0 @@
-Your Hermes agent on Android — chat, voice, sessions, and Manage.

app/src/googlePlay/play/listings/en-US/title.txt

@@ -1 +0,0 @@
-Hermes-Relay