Root Kernel Hermes Agent v0.20.5

Root Kernel Hermes Agent is the Root Kernel downstream distribution of NousResearch Hermes Agent. This release is built directly on upstream Hermes Agent v2026.8.19 (package version 0.20.5) and carries only the behavior gaps reproduced and reviewed against that exact target.

Baseline: direct update from Root Kernel v0.19.1 to v0.20.5. Upstream peeled commit: fcbd1076a93841fa88855acce810e342a5b78101. Root Kernel release commit: b1b2553f6c3e1d89686830a55043f4d22f1a7ea3. Object, commit, and package identity were verified; no cryptographic-signature claim is made.

What differs from upstream Hermes Agent

CJK-aware offline session recovery

Loads the existing CJK tokenizer extension at the separate-output recovery and verification connection boundaries. Korean, Japanese, and Chinese session histories retain canonical counts, SQLite integrity, CJK FTS integrity, and working search after hermes sessions recover.

Fail-closed skill-write approval

Blocks skill mutation when the write-approval gate cannot be imported, initialized, or evaluated. Normal allowed, staged, blocked, and approved-replay behavior remains governed by the upstream approval implementation.

Exact OpenAI Codex credential ownership

Adds profile-local pinning by exact credential ID or unique label. Missing, ambiguous, dead, exhausted, or unavailable pins fail closed; sibling credentials and singleton fallbacks cannot substitute for the configured account. Labelled reauthentication updates exactly the pinned OAuth row, with locked latest-state reconciliation and cross-store rollback protection.

Configure one of the following in the owning profile's approved secret environment:

• HERMES_CREDENTIAL_PIN_OPENAI_CODEX_ID
• HERMES_CREDENTIAL_PIN_OPENAI_CODEX_LABEL

Exact ID takes precedence.

Discord thread ownership and role-mention fail-close

Adds persistent first-owner-wins thread admission shared across profiles and across live and recovered messages. Participation alone does not grant ownership, unsafe role-only mentions fail closed, and optional free-response auto-threading occurs only for admitted owned messages.

Bool-safe CLI return-code propagation

Only exact nonzero integers returned by top-level handlers become process exit codes. Python booleans remain successful returns, while native argparse exits and handler-raised SystemExit behavior remain unchanged.

Deliberately omitted downstream carries

• Root Kernel-specific Kanban lifecycle, schema, tool, prompt, watcher, mutex, and workflow-banner extensions are not included. This release uses native upstream Kanban behavior.
• Downstream hermes doctor warning filtering is not included. Upstream diagnostics are accepted as-is.

Verification and activation

• Exact changed-path and omitted-feature guards passed.
• Final selected verification scope: 144 files, 1,520 passed, 2 Windows-only skips.
• Seventeen exact-snapshot independent review rounds completed; the final review reported zero blocking security, correctness, or scope findings.
• Four production profiles migrated from state schema 23 to 26 and config schema 33 to 38 with SQLite integrity OK and zero foreign-key violations.
• Four gateways restarted from the v0.20.5 live environment, and bounded identity/model probes passed for every active profile.
• The version branch, annotated release tag, and live branch converge on b1b2553f6c3e1d89686830a55043f4d22f1a7ea3.

Governance

Current behavior, configuration, evidence, carry retirement rules, publication state, and rollback authority are maintained in:

• root-kernel/feature.md
• root-kernel/ledger.md
• root-kernel/carry.yaml

Every retained carry has an explicit retirement rule and should be removed when a later upstream release passes an equivalent behavioral contract without downstream code.