Upstream: first-class Hermes ACP runtime in Buzz

[100yenadmin]

Parent: #1

Outcome

Buzz detects and launches Hermes as a first-class ACP runtime without any
Electric Sheep-specific behavior.

Implementation contract

• Base a fresh branch on block/buzz:main.
• Add Hermes to the Rust KNOWN_ACP_RUNTIMES catalog in
  desktop/src-tauri/src/managed_agents/discovery.rs.
• Recognize hermes and hermes-acp.
• Launch hermes with acp; do not duplicate the argument for hermes-acp.
• Treat hermes acp --check as binary/ACP dependency readiness only.
• Do not use --check or another invented CLI command to claim provider
  authentication.
• Set no command-level authentication probe for Hermes. Provider
  authentication and setup are discovered through the existing bounded ACP
  initialize/auth-method handshake when the runtime launches.
• Hermes's advertised terminal setup method may offer hermes acp --setup
  only after explicit user action.
• The runtime catalog may report Hermes as available and state that provider
  setup is checked on launch; it must not report authenticated based on
  --check.
• Keep runtime metadata in Rust and use the existing catalog/config pipeline.
• Use current Hermes source/docs for skill and configuration metadata.

Acceptance

• Catalog entry appears through the existing managed-agent API.
• Both supported binary names are discovered on normal macOS/Linux paths.
• Command construction is correct for each binary.
• Dependency-ready, dependency-check failure/unavailable, and invalid
  runtime states are tested without converting readiness into an
  authentication claim.
• Hermes has no command-level auth probe; the catalog truthfully represents
  provider authentication as handled by the ACP launch handshake.
• Existing Goose, Claude, Codex, and Buzz runtime tests remain green.
• just ci passes on the exact head.

Non-goals

No Hermes CLI auth probe, Supabase, evaOS, VM provisioning, branding,
credential copying, or managed business policy.

Stop

Stop if current Hermes ACP requires an incompatible protocol or if the change
cannot remain generic. Record the exact contract mismatch before broadening.

Delivery

Stage the generic upstream candidate as a draft PR to
electricsheephq/buzz:main. Do not submit it to block/buzz without separate
authority.

[100yenadmin]

Implementation preflight stopped before creating a worktree or branch because the current Hermes ACP contract does not satisfy this issue's required authentication probe.

Verified identities:

• block/buzz:main: 06e3d82b04ab326a36694264ffb4b9dd94ec5661
• fork main: same SHA
• fork electric/main: acfbb1bb6af54cb29cb152496ff43b8285dcb8cf
• architecture PR docs: define evaOS Teams Buzz and Hermes architecture #16: unchanged at ff11efa8ccc24486cb780544218cb0e62c26ec4e
• Hermes stable v2026.7.20: 3ef6bbd201263d354fd83ec55b3c306ded2eb72a
• current NousResearch/hermes-agent:main: d9165d7a678d4105f42921a7fc1886df3804531b

Exact mismatch:

• Both Hermes stable and current main provide hermes acp, hermes-acp, --check, and explicit --setup.
• --check is documented and implemented as an ACP dependency/adapter-import check. _run_check() imports acp and HermesACPAgent, prints Hermes ACP check OK, and exits successfully.
• It does not call Hermes provider detection (detect_provider() / has_provider()).
• Provider authentication is exposed only through the ACP initialize() / authenticate() handshake and its advertised auth methods.

Result: an unconfigured Hermes installation with valid ACP dependencies passes hermes acp --check. Buzz's current exit-code auth-probe path would therefore report it as authenticated, so the acceptance requirement to test a distinct unauthenticated state cannot be met truthfully with the mandated probe.

This triggers the issue's explicit stop condition. No Buzz files were edited; no worktree, branch, PR, focused test, CI run, or semantic review exists.

Owner decision required before resuming:

1. Hermes adds a non-interactive provider-auth readiness probe and this issue names it; or
2. this issue is revised so --check means dependency readiness only, with unauthenticated state defined through a bounded ACP initialize/authenticate handshake.

After that decision, re-run preflight from current block/buzz:main and only then create the required worktree.

[100yenadmin]

Owner correction applied: Option B is now the source-backed implementation contract.

• hermes acp --check is dependency/readiness-only.
• Hermes gets no command-level authentication probe in Buzz.
• Provider authentication and the explicit terminal setup method are discovered through the existing ACP initialize/auth-method handshake on launch.
• The catalog must not infer or display provider authentication from --check.
• No Hermes CLI probe will be invented.

The issue body has been corrected while preserving its generic observable outcome and non-goals.

Fresh implementation base verified:

block/buzz:main = d0ab3fdb054e0cfedbf21e4c5143ad6c671c10cc

The previously recorded mismatch is now a reconciled planning assumption, not an implementation blocker. Work resumes in the required fresh worktree.

[100yenadmin]

Implementation worktree created before the first source change.

• Worktree: /Volumes/LEXAR/repos/worktrees/evaos-teams/2-hermes-acp-runtime
• Branch: feature/2-hermes-acp-runtime
• Base/head before edits: d0ab3fdb054e0cfedbf21e4c5143ad6c671c10cc
• Base source: current block/buzz:main
• Delivery target: draft PR to electricsheephq/buzz:main

Scope remains the corrected generic Hermes ACP runtime contract only.

[100yenadmin]

Buzz #2 has reached its stable staging gate.

• Draft PR: feat(agents): add Hermes ACP runtime #17
• Branch: feature/2-hermes-acp-runtime
• Exact head: be38edde4d31a31f5a298b4e683cc1fa3987ff38
• Fresh upstream base: d0ab3fdb054e0cfedbf21e4c5143ad6c671c10cc
• Canonical CI: https://github.com/electricsheephq/buzz/actions/runs/30030545325 — success
• CodeQL: https://github.com/electricsheephq/buzz/actions/runs/30030541060 — success

Focused local proof on the pushed source state:

• Hermes Rust filter: 6 passed, 0 failed, 1 ignored subprocess fixture.
• Rust format and cargo clippy --lib -- -D warnings: passed.
• Focused Biome, TypeScript typecheck, and desktop file-size ratchets: passed.

Independent semantic review covered the initial head and one remediation-only
delta on the final head. Every finding has a terminal disposition:

1. P1, Hermes auth methods were not surfaced: fixed now with an explicit
   checked_on_launch state and the existing bounded ACP auth-method query.
2. P2, direct hermes-acp could not independently pass discovery/readiness:
   fixed now with command-specific hermes acp --check and
   hermes-acp --check construction.
3. P2, probe timeout could hang on supported platforms: fixed now with
   try_wait, cross-platform kill/reap, regular-file stderr capture, and a
   bounded subprocess test.

The delta review found all three resolved and no new P0/P1 or realistic
gate-relevant P2 finding.

Truth boundary: this proves a generic upstream-candidate source change, local
focused checks, canonical fork CI, and independent review on the exact draft PR
head. The PR remains draft. It is not merged, submitted to block/buzz,
released, deployed, or runtime/customer tested.

Next gate for #2 is owner-authorized readiness/merge handling in the Electric
fork, followed by separate authority for any external upstream submission.

[100yenadmin]

Hive status: the generic behavior represented by this issue was replayed into the upstream-first Hive source through merged PR #37.

This issue remains open only as an upstream contribution tracker. It is not a blocker for the Hive internal canary, and the old Electric staging PR is superseded by #37. Any external block/buzz submission requires separate authority, a fresh upstream base, current contract verification, focused tests, and its own CI/review.

[100yenadmin]

Upstream v0.5.0 disposition — redesign before submission

block/buzz merged BYOH in block#2773 at 95fdf97. It now includes a bundled Hermes preset and a generic custom ACP runtime seam, so the original KNOWN_ACP_RUNTIMES implementation shape in this issue must not be submitted upstream wholesale.

Current disposition:

• Upstream Hermes discovery and catalog presence: superseded by feat(acp): bring your own harness (BYOH) — generic ACP runtime seam + settings gallery block/buzz#2773.
• Truthful separation of ACP dependency readiness from provider authentication: retain only if v0.5.0 still lacks equivalent behavior on a reachable Hermes path.
• Hermes command construction and initialize/auth-method handshake coverage: compare and replay narrowly only for a demonstrated remaining delta.
• Electric VM, Supabase, entitlement, branding, or managed policy: still prohibited from the upstream candidate.

Exact next action is owned by Hive #69 after the Internal Canary: test the v0.5.0 Hermes preset against the current Hermes ACP contract, then close this issue as superseded or narrow it to the exact generic missing behavior. No upstream issue or PR was opened from the stale implementation shape.