feat: Hermes NCFED and Mobile Ask Border — NetClaw 1.8.0 (spec149)

.env.example

@@ -1051,3 +1051,11 @@ EQUINIX_SERVICENOW_PASSWORD=
 # HERMES_HOME=/absolute/path/to/hermes-home
 # NETCLAW_HERMES_HUD_PORT=8643
 # NETCLAW_HERMES_HUD_API_KEY is generated privately by the launcher; never put it in browser config.
+
+# Spec149: select Hermes explicitly (or use the persisted HUD selection).
+# NETCLAW_RUNTIME=hermes
+# HERMES_HOME=/absolute/path/to/your/HermesHome
+# Federation owns <selected-home>/netclaw-federation and uses existing N2N settings.
+# Separate simultaneous installations need distinct BGP_API_PORT/N2N listener ports.
+# Mobile minimum for uncertainty-aware recovery: 1.0.3+6. Hermes attachments unavailable.
+# Production Hermes model-guard/confinement is unqualified and remains fail-closed.

.specify/feature.json

@@ -1,3 +1,3 @@
 {
-  "feature_directory": "specs/148-hermes-hud-integration"
+  "feature_directory": "specs/149-hermes-ncfed-federation"
 }

AGENTS.md

@@ -145,6 +145,7 @@ When unsure about severity or approach: escalate. Say "I'd recommend verifying t
 - If a session is interrupted, the next session should check for incomplete changes
 
 ## Active Technologies
+- Spec 149 implementation: selected-runtime NCFED adapters and additive harness cards; isolated Python 3.12 federation/MCP, pinned Python 3.14 Hermes companion, separate private federation/HUD state and SQLite execution evidence. Mac controlled-provider acceptance covers all four internal runtime pairs, Hermes/Hermes and Hermes/OpenClaw external execution and authenticated mobile Ask Border. See spec149 verification; Linux/WSL production control and physical mobile qualification remain pending.
 
 - Spec 148 implementation: JavaScript ESM/Express/React HUD; HUD Node >=24.19 <25 or >=26.1; isolated bridge/tool Python 3.12 and companion Python 3.14; official MCP Node client 2.3.1 and isolated FastMCP 4.0.11/MCP Python SDK 2.3.0. General OpenClaw installer Node policy remains >=24.16 <25 or >=26.1.
 - Qualified Hermes baseline: v0.21.6, source 818c13be1dc4fd28987e1e881a9408224afd4535. Private MCP bridge/protected companion, schema-2 owned HUD bindings, SQLite admission/evidence records and installation-scoped browser storage. Mac and Ubuntu 26.04 WSL live/browser qualification is recorded in specs/148-hermes-hud-integration/closure.md; broader tool and platform qualification is not implied.

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 NetClaw source releases use `1.x.y`. Feature specs increment the minor version and reset the patch; fixes, documentation and maintenance increment the patch. Every release records its numbered specs. Component and mobile distribution versions are independent.
 
+## [1.8.0] - 2026-10-10
+
+- Add selected-installation Hermes NCFED Border/member execution, protected operator delegation, contextual peer chat and bounded qualified subnet work.
+- Carry additive harness metadata alongside capabilities without granting authority; preserve unknown values and existing enrollment/authorization.
+- Persist admission/effect ownership, uncertain outcomes and cancellation state without automatic replay.
+- Update Mobile to 1.0.3 (6): Summary Border type, durable request/reconnect recovery, voice-origin preservation, explicit media limits and Chat/Siri/Watch/Live Activity states. Signed build uploaded to App Store Connect; no public release.
+- Preserve existing OpenClaw paths and document actual acceptance coverage and remaining platform qualification.
+
+Spec [149-hermes-ncfed-federation](specs/149-hermes-ncfed-federation/spec.md). See [release notes](docs/releases/1.8.0.md).
+
 ## [1.7.0] - 2026-10-10
 
 - Connect Hermes to shared HUD Chat, Canvas, local Avatar, owned history and runtime panels through a private MCP bridge and protected companion.

README.md

@@ -10,7 +10,7 @@ Work from chat, the visual HUD, your phone, or a Zoom meeting. Start with one Ne
 
 **Start here:** [Choose a runtime](#hermes-or-openclaw) · [Install](#quick-install) · [Capabilities](#what-it-does) · [RAG](#rag--answers-grounded-in-your-documents) · [GCF](#gcf--compact-network-evidence) · [Mobile](#netclaw-mobile--your-network-in-your-pocket) · [Zoom](#zoom--network-investigations-in-the-meeting) · [HUD](#visual-hud) · [Jev](#optional-jev-science-officer)
 
-**Project:** [Source version 1.7.0](VERSION) · [Release notes](docs/releases/1.7.0.md) · [Contributing — numbered specs + Spec Kit](CONTRIBUTING.md) · [Changelog](CHANGELOG.md)
+**Project:** [Source version 1.8.0](VERSION) · [Release notes](docs/releases/1.8.0.md) · [Contributing — numbered specs + Spec Kit](CONTRIBUTING.md) · [Changelog](CHANGELOG.md)
 
 **Reference:** [Architecture](#architecture) · [MCP servers](#mcp-servers-176) · [Skills](#skills-237) · [Workflows](#standard-workflows) · [Safety](#safety)
 
@@ -36,8 +36,10 @@ API uses a private MCP bridge and an authenticated companion on loopback `:8643`
 it does not connect directly to or restart your ordinary Hermes gateway. Hermes HUD
 acceptance passed on Mac and Ubuntu under Windows WSL2; native Windows uses WSL.
 
-Spec 148 delivers this shared HUD connection. **Spec 149 will add Hermes n2n/iN2N
-federation**, including the specialist-claw workflows described below.
+Spec 148 delivers the shared HUD connection. **NetClaw 1.8.0 / spec149 adds Hermes
+iN2N/eN2N and Mobile Ask Border** through protected execution. The initial qualified
+profile is subnet calculation; media attachments and production Hermes confinement
+remain unavailable. See [setup, mobile versions and tested scope](docs/HERMES-FEDERATION.md).
 [Runtime installation details](#agent-runtime--openclaw-or-hermes) · [Acceptance and exact tested platforms](specs/148-hermes-hud-integration/closure.md)
 
 The function-first HUD opens on standard Chat, with a Chat / Canvas interface switch,
@@ -226,8 +228,8 @@ Inspect the result with `hermes mcp list`.
 
 > **Scope:** the runtime choice covers install, onboarding, gateway, MCP
 > registration, skills, credentials and the shared HUD. Hermes HUD conversations
-> use the protected companion's qualified tools. **Spec 149** extends n2n/iN2N
-> federation to Hermes; current federation execution uses OpenClaw.
+> use the protected companion's qualified tools. **Spec149 / 1.8.0** adds protected Hermes iN2N/eN2N execution and Mobile Ask Border.
+> See [qualification and compatibility](docs/HERMES-FEDERATION.md); installed does not mean qualified.
 
 For the shared HUD, install `--runtime hermes --add "subnet-calc hermes-hud"`,
 then run `./scripts/netclaw hud select hermes "$HOME/.hermes"` and

SOUL.md

@@ -923,3 +923,16 @@ Optional Tasks support covers 298 tools across 35 integrations, led by 22 pyATS
 ## Hermes HUD boundary
 
 The shared HUD can select a protected Hermes companion. Its private conversation MCP is not an agent tool. Only source-qualified read-only tools and reviewed installed skill context may execute; currently the subnet calculator qualifies. Never imply broader installed-tool access, write execution or federation support. Respect owned conversation scope, unknown outcomes and exact approvals. See `docs/HERMES-HUD.md`; federation is spec 149.
+
+## Hermes federation qualification (spec149 / 1.8.0)
+
+The selected Hermes Border/member uses a private protected NCFED companion;
+OpenClaw remains the default when no runtime is selected. The initial receiver
+profile qualifies only the installed read-only subnet tool/skill; peer chat is
+conversation-only. HUD/mobile operator scope may delegate permitted subnet work,
+but no remote card, model claim or prompt grants operator authority. Missing harness
+metadata stays unknown. Preserve unknown/interrupted/cancellation-requested outcomes;
+never replay uncertain work. Hermes mobile media attachments are unavailable;
+voice-transcribed text and Siri voice origin are supported. Production Hermes
+model-guard/confinement remains unavailable and fails closed. See
+`docs/HERMES-FEDERATION.md` and spec149 verification before claiming broader support.

TOOLS.md

@@ -1013,3 +1013,16 @@ discovery and unverified endpoint/agent operations. See [operator guidance](docs
 ## Selected-runtime HUD
 
 Use `./scripts/netclaw hud status` for observation and `./scripts/netclaw hud` for an owner-requested launch. Selection persists separately from credentials. Hermes uses the selected home, private stdio conversation bridge and pinned isolated companion; no OpenClaw credential/history fallback. The initial eligible tool is the reviewed IPv4 subnet calculator (/24 through /30). Native Windows Hermes requires Ubuntu on WSL2. See `docs/HERMES-HUD.md` for setup, exact versions and recovery. The eight private bridge tools must never be registered with an agent.
+
+## Hermes federation qualification (spec149 / 1.8.0)
+
+The selected Hermes Border/member uses a private protected NCFED companion;
+OpenClaw remains the default when no runtime is selected. The initial receiver
+profile qualifies only the installed read-only subnet tool/skill; peer chat is
+conversation-only. HUD/mobile operator scope may delegate permitted subnet work,
+but no remote card, model claim or prompt grants operator authority. Missing harness
+metadata stays unknown. Preserve unknown/interrupted/cancellation-requested outcomes;
+never replay uncertain work. Hermes mobile media attachments are unavailable;
+voice-transcribed text and Siri voice origin are supported. Production Hermes
+model-guard/confinement remains unavailable and fails closed. See
+`docs/HERMES-FEDERATION.md` and spec149 verification before claiming broader support.

VERSION

@@ -1 +1 @@
-1.7.0
+1.8.0

config/hermes-hud-tool-policy.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "note": "Individually reviewed read-only implementation. No annotations grant permission. Other registered tools remain unqualified.",
+  "note": "Individually reviewed subnet tool and scoped operator NCFED subset. Operator effects require a private one-use broker permit. Receiver profiles exclude all orchestration tools. No annotations grant permission.",
   "servers": {
     "subnet-calc-mcp": {
       "component": "subnet-calc",
@@ -15,6 +15,27 @@
       ],
       "reviewedCommit": "5178da6f83ebd894fa7331a62e1087ec9550751b",
       "sourceRepository": "https://github.com/automateyournetwork/GeminiCLI_SubnetCalculator_Extension.git"
+    },
+    "n2n-mcp": {
+      "component": "n2n",
+      "source": "mcp-servers/n2n-mcp/server.py",
+      "tools": [
+        "n2n_status",
+        "n2n_risk_status",
+        "n2n_member_list",
+        "n2n_member_health",
+        "n2n_peer_capabilities",
+        "n2n_invoke",
+        "n2n_delegate",
+        "n2n_route",
+        "n2n_chat",
+        "n2n_task_status",
+        "n2n_task_result"
+      ],
+      "argumentPolicy": "federation-operator",
+      "sourceHashes": [
+        "8849663b12e9e05e61cc2a9b0b49600171c0a23da4319270e8616e8016edb493"
+      ]
     }
   }
 }

config/installer-access.json

@@ -178,6 +178,28 @@
         "hermes_hud_events",
         "hermes_hud_approval",
         "hermes_hud_stop"
+      ],
+      "private_variants": {
+        "federation": {
+          "script": "mcp-servers/hermes-hud-mcp/federation_server.py",
+          "tools": [
+            "hermes_federation_status",
+            "hermes_federation_open",
+            "hermes_federation_submit",
+            "hermes_federation_request_status",
+            "hermes_federation_history",
+            "hermes_federation_stop"
+          ]
+        }
+      }
+    },
+    "n2n": {
+      "servers": [
+        "n2n-mcp"
+      ],
+      "script": "mcp-servers/n2n-mcp/server.py",
+      "expected_tools": [
+        "n2n_status"
       ]
     }
   }

config/openclaw.json

@@ -686,10 +686,14 @@
       }
     },
     "n2n-mcp": {
+      "transport": "stdio",
       "command": "python3",
       "args": [
         "-u",
-        "mcp-servers/n2n-mcp/server.py"
+        "scripts/component-launch.py",
+        "n2n",
+        "--server",
+        "n2n-mcp"
       ],
       "env": {
         "BGP_DAEMON_API": "${BGP_DAEMON_API:-http://127.0.0.1:8179}"

docs/HERMES-FEDERATION.md

@@ -0,0 +1,102 @@
+# Hermes federation and NetClaw Mobile — 1.8.0
+
+Spec149 adds Hermes execution to the existing NCFED transports, including Border
+and member roles. Spec148's HUD companion remains separate: federation owns its
+own private ledger and processes under the selected home's `netclaw-federation/`.
+A capability card describes a peer; it never authorizes execution or selects a
+local runtime. Missing harness/version metadata is **unknown**.
+
+## Install and select
+
+Complete `hermes setup`, then use the same selected home for installation and
+launch. For a custom home, export its absolute `HERMES_HOME` before these commands:
+
+```sh
+./scripts/install.sh --runtime hermes --add "subnet-calc n2n"
+export NETCLAW_RUNTIME=hermes
+./scripts/peering-setup.sh
+./scripts/peering-setup.sh start
+./scripts/peering-setup.sh status
+```
+
+The n2n component installs the isolated protocol/bridge dependencies and pinned
+Hermes companion without requiring OpenClaw or installing the browser UI. Add
+`hermes-hud` separately for HUD Chat/Canvas/local Avatar. CLI and HUD selection
+share the installation identity. `status` is read-only; `stop` only addresses the
+selected installation's owned daemon. Use different local ports for concurrently
+running installations. Do not copy ownership manifests between homes.
+
+Configure iN2N/eN2N and enrollment through the existing Risk and peering commands.
+Existing consent, possession proof, member scope, grants, approvals, rate/token
+budgets and revocation checks still apply. Remote chat has no tools. A remote
+skill receiver has only its qualified skill tools; it cannot promote itself to
+an operator, manage grants, launch a shell or orchestrate another Risk.
+
+## Qualified execution
+
+The initial protected profile is the registered, reviewed IPv4 subnet calculator
+(`/24` through `/30`) and installed `subnet-calculator` skill. Local HUD/mobile
+operator requests may observe federation, perform bounded subnet calls, open
+owned peer chats and delegate/poll permitted subnet work through n2n MCP. Installed
+or advertised tools outside this profile are **not execution-qualified**.
+
+Hermes members use private homes, a minimal skill/configuration slice and their
+own state. To prepare an inspectable member from a configured Hermes Border:
+
+```sh
+python3 scripts/in2n-member-home.py --runtime hermes --risk lab --member subnet
+python3 scripts/in2n-migrate.py --risk lab --border-endpoint 127.0.0.1:11790 --staging ./hermes-migration
+```
+
+These are separate alternatives: each preserves an existing member config rather
+than overwriting it. Add the endpoint and one-use enrollment token to the generated
+private `.env`, and launch with `N2N_MEMBER_ENV_FILE` using the recorded n2n Python.
+Never source credentials into a shared shell or copy Border communications keys.
+Mixed runtime deployments keep each member's own selected configuration/runtime.
+Generating a systemd file does not prove a service is active or confined.
+
+Hermes production model-guard/confinement qualification is pending and fails
+closed. The Mac acceptance uses explicitly isolated **testing** mode and read-only
+subnet work. Do not treat it as production configuration-change authorization.
+
+## Mobile compatibility
+
+Use **NetClaw Mobile 1.0.3 (build 6) or later** for full uncertainty-aware Hermes
+behavior. This candidate was signed and uploaded to App Store Connect; it is not
+an App Store public-release announcement. Existing enrollment and NCFED method
+names remain unchanged. Older clients can still send text; unknown/interrupted
+outcomes project to a failed state with an explanation instead of silent pending,
+but cannot provide the new durable lost-receipt recovery or harness summary.
+
+Authenticated `n2n/edge/ask` requests receive explicit operator execution scope,
+bound to installation, enrolled device/key generation and conversation. The client
+persists a request ID before sending; reconnect looks up that admission instead of
+resubmitting it. Progress, results and cancellation use the existing task methods.
+Siri preserves `origin: voice`; transcribed speech is text input. Siri, Watch and
+Live Activity show uncertain/interrupted/cancellation-requested outcomes explicitly.
+A requested stop is not a confirmed stop. **Check status; do not replay uncertain work.**
+
+The Summary page displays Border type, version, model and advertised capabilities.
+Metadata absent from older Borders remains unknown. Disconnected information is
+labeled as last received rather than current state.
+
+**Photo, video and audio-file attachments are unavailable with the protected
+Hermes Border.** They are rejected before execution; the app explains the limit
+and preserves the draft. Text produced by voice transcription is supported.
+Existing OpenClaw attachment paths remain, with regression tests; this does not
+claim new physical-camera/microphone qualification.
+
+## Evidence and recovery
+
+See [spec149 verification](../specs/149-hermes-ncfed-federation/verification.md) for
+actual host/runtime coverage and [handoff](../specs/149-hermes-ncfed-federation/validation-handoff.md)
+for unrun platforms. Controlled-provider tests run the real pinned Hermes agent
+and real MCP subnet tool over authenticated local NCFED transports; they are not
+hosted-model or physical-device tests.
+
+After a crash, a pre-dispatch request becomes interrupted; work that may have
+executed becomes outcome_unknown. Owned late results can reconcile it. Retain
+unresolved ledgers and task records. For source rollback, stop the selected
+installation, preserve its complete home/databases and restore the matching source
+and isolated runtime. Do not downgrade a migrated database in place or erase
+uncertain work. Existing owner config, identity, skills and histories are preserved.

docs/HERMES-HUD.md

@@ -1,5 +1,8 @@
 # Hermes in the NetClaw HUD
 
+> **1.8.0 / spec149:** Hermes Border/member federation and Mobile Ask Border now use a separate protected companion. See [Hermes federation setup, qualified tools and mobile limits](HERMES-FEDERATION.md). Production confinement is not newly qualified.
+
+
 NetClaw 1.7.0 (spec 148) connects the shared HUD to a dedicated, protected Hermes agent. Federation follows in spec 149. Mac and WSL live/browser acceptance is recorded in [the closure record](../specs/148-hermes-hud-integration/closure.md), including the exact qualified hosts and explicitly unverified environments.
 
 ## Install and launch
@@ -30,7 +33,8 @@ Native Windows launchers refuse Hermes with WSL guidance before starting OpenCla
 | Model and effort | Configured agent model; per-conversation model/effort selection unavailable |
 | Usage | Actual per-request provider counters when returned; otherwise unknown |
 | Attachments, APPLY/configuration execution | Unavailable in this release |
-| Hosted Avatar, n2n/iN2N | Unavailable; local Avatar remains supported, federation is spec 149 |
+| Hosted Avatar | Unavailable; local Avatar remains supported |
+| iN2N/eN2N | Available when the selected federation daemon is ready; bounded spec149 profile, see [guide](HERMES-FEDERATION.md) |
 
 Installed tools are not automatically safe to execute. The companion excludes shell, code, delegation, shared memory, arbitrary files/history, plugin tools, and unreviewed MCPs. New eligible tools require implementation review, policy qualification and tests. This deliberately narrow first qualification does **not** claim general Hermes network-tool parity. Direct terminal presentation and its existing endpoint/change controls remain separate.
 

docs/N2N-RISK.md

@@ -1,5 +1,8 @@
 # A Risk of NetClaws — Internal Federation (iN2N)
 
+> **1.8.0 / spec149:** Hermes Border/member federation and Mobile Ask Border now use a separate protected companion. See [Hermes federation setup, qualified tools and mobile limits](HERMES-FEDERATION.md). Production confinement is not newly qualified.
+
+
 > A **risk** is the (real) collective noun for a group of lobsters. NetClaw is a
 > lobster. So a coordinated group of NetClaws is **a risk of NetClaws** — and,
 > for a security-adjacent product, the pun is intentional.