Hermes Android v3.2.0

Hermes Android 3.2.0

Stable release covering all changes since v3.1.7. Application code is unchanged from the approved RC.5.

Usage, Portal and provider sign-in

• More → Usage brings together Nous Portal, OpenRouter, OpenAI, Claude and
  DeepSeek. Provider entries remain discoverable even when model discovery is
  empty, partial or unavailable; OpenAI uses the canonical provider identity.
• Nous Portal shows gateway status and profile-wide recorded usage/model
  analytics. Provider screens filter Hermes-recorded activity, including retired
  models. Neither is a provider balance, pricing catalogue or billing statement.
• Host-reported Codex and Claude OAuth account allowances are separate from paid
  OpenAI/Claude API usage. Show only reported five-hour/session and weekly windows,
  remaining percentages and reset timestamps. Missing values stay unavailable,
  accounts are not averaged, and unknown/model-specific window labels retain
  their scope. There is no invented daily quota, token budget or entitlement.
  Allowance and recorded-analytics reads have independent loading/retry paths.
• More → Usage → Provider sign-in and Settings → Provider sign-in use
  Dashboard device-code login for Nous, OpenAI Codex, MiniMax and xAI. Anthropic
  remains external-only; OpenRouter is absent from this audited OAuth catalogue.
  API-server and Desktop RPC transports do not implement this login flow.
• Only explicit taps open validated HTTPS provider pages externally. Codes stay
  transient in route memory and provider tokens stay on the host. Saved origin,
  prefix, authentication, profile and mTLS boundaries survive discovery, start,
  poll, cancellation and catalogue readback; authenticated redirects are rejected.
• Approval says Approval received; account verification unavailable, not
  Signed in as. Historical approved-session identity cannot verify the current
  host account. Approval refreshes only the same-profile OAuth catalogue, not
  generic model/analytics data. If catalogue loading fails, close and reopen this
  screen; it has no in-screen catalogue retry. Nous free-tier replacement may
  change host defaults; the app warns rather than promising token-only effects.
• OAuth and quota copy is translated across all 11 shipped ARB locales, including
  regional variants; the earlier RC.2 English-fallback description is historical.

See provider usage, OAuth safety
and account-readback limits.

Profile and cron model management

• More → Agent → Model now owns the profile default and auxiliary task
  assignments formerly under Settings. Choose and explicitly save a supported
  provider/model; accepted writes require exact readback. Existing per-chat
  overrides remain unchanged. Auxiliary task IDs supplied by newer hosts are
  retained, as are unknown current models and server expensive-model guards.
• Main-model editing requires matching host route metadata from
  /api/providers/custom-endpoints, not endpoint-free /api/model/info or a
  flattened config response. Missing, malformed or mismatched metadata disables
  main editing until Refresh; independent auxiliary controls remain usable.
• Recognised exact canonical provider/URL pairs are standard routes even when
  the host persists a nonempty URL. Active named custom routes take precedence;
  custom, local, overridden and unrecognised routes remain read-only. Catalogue
  api_url fields, hostname similarity or URL suffixes cannot establish safety.
  Readback repeats the route-safety check before reporting success.
• Crons → Edit → Model pins a provider/model for that job only. Follow
  default clears model, provider and base_url; selecting a discovered
  model also clears an old endpoint. Unchanged routes are omitted from updates.
  Custom/retired and endpoint-only pins remain visible and are not silently
  normalised. Endpoint editing is not offered; script-only mode retains but
  cannot change its pin. Confirmed saves require exact-job route readback.
• Discovery, writes and readback preserve selected-profile authority and the
  normalised saved Dashboard origin, prefix, authentication and mTLS identity.
  Explicit profiles never fall back to the launch profile. Late responses after
  connection replacement/disposal cannot confirm a stale save. Missing local TLS
  identity is retryable rather than a construction crash or unauthenticated retry.

See model management and
per-cron selection.

Chat, approval, discovery and accessibility fixes

• Searchable command palette for copy latest code, refresh, export, rename and
  archive actions. Code copying follows the latest visible assistant code block
  across received/saved handoff, not a stale reply or hidden background report.
• Composer code/bold/italic helpers and compact/200%-text/keyboard layouts remain
  usable. The new-chat sheet scrolls so every mode stays reachable on compact
  large-text screens.
• REST run approvals preserve canonical prompt identity and execution generation,
  reject malformed/stale authority rather than downgrading to legacy controls,
  and use the saved profile. Back cannot dismiss an approval while a response is
  submitting, preventing a concurrent denial.
• Untitled cron shells are hidden only with an explicit valid integer zero count
  and no raw/display preview. Unknown-count, titled and content-bearing rows
  remain available; this is presentation filtering, never server deletion.
• Follow-up LAN repairs bound probing/cancellation, validate health/model response
  shapes and retain the verified HTTPS scheme, port and scoped IPv6 identity.
  LAN discovery itself already shipped in 3.1.7; it is not new in 3.2.0.
• Feature clients consistently use the normalised Dashboard origin instead of
  accidentally routing requests through a different service/port.

The audited Git range also contains merged ancestor commits for batch
clarification parsing and collapsed Android-context notices, but their affected
model/presentation files are unchanged against the 3.1.7 tree. They are not
advertised as new stable-to-stable capabilities.

Installation and verification

Use app-arm64-v8a-release.apk for most phones. Production signer unchanged. Version 3.2.0, base 3026; split codes 30261 / 30262 / 30263 upgrade all RC.5 builds in place. Do not uninstall or clear app data.

5,174 Flutter tests passed locally, independent promotion review approved, and PR/main CI passed. Release workflow 41271576147 succeeded on attempt 2 at e92e38588ade1fd60225e00cae40c2ec54af1c6d. Attempt 1 stopped before publication on a pending-timer assertion in an unrelated push/navigation test; its focused local rerun and complete CI retry passed without source changes.

Downloaded all five published assets and verified hashes/sizes, package/version/ABI/production signatures, 22 packaged materials per APK, and exact source/relink contents against 1,112 tracked blobs. Main, immutable tag and release target are the same commit.

Merged #249, #250 and promotion #251; unrelated #248 is excluded. GitLab/F-Droid were not updated. Host endpoint and mobile-push compatibility limits remain as documented; upgrading the APK does not update the host.

Credits

Thanks to @rusty4444 and the contributors credited in the README. Original commit ancestry and licence notices are preserved. AI-assisted implementation, review, testing and release preparation.