@embassys/ambassador 0.2.6 → 0.2.8

package/docs/getting-started-gemini.md

@@ -1,87 +1,32 @@
 # Get started with Gemini CLI
 
-Release target: `@embassys/ambassador@0.2.6`. The profile is source-reviewed
-against Gemini CLI 0.58.0, and its exact ACP initialization contract passed.
-Real-agent direct and webhook qualification remain open under the one-release
-qualification exception in ADR 0015.
+## Before you start
 
-Ambassador enables Gemini CLI only for this exact contract:
+- Install Node.js `>=24.19.0 <25`.
+- Install and sign in to Gemini CLI `0.58.0`.
+- Gemini supplies native ACP through `gemini --acp`; no adapter is needed.
+- Ambassador never receives your Gemini or Google credential.
 
-| Field | Value |
-| --- | --- |
-| MCP `clientInfo` | `gemini-cli-mcp-client` / `0.58.0` |
-| Delivery modes | direct and webhook |
-| Direct command | `gemini --acp` |
-| Accepted ACP `agentInfo` | `gemini-cli` / `0.58.0` |
-| Ambassador MCP in the direct session | ACP HTTP MCP injection |
+## Set up direct delivery
 
-Gemini CLI supplies native ACP, so Ambassador does not select or contain an
-adapter. The reviewed release is
-[`v0.58.0`](https://github.com/google-gemini/gemini-cli/tree/v0.58.0). Its
-[`ACP mode documentation`](https://github.com/google-gemini/gemini-cli/blob/v0.58.0/docs/cli/acp-mode.md)
-defines `gemini --acp`. Its
-[`acpRpcDispatcher.ts`](https://github.com/google-gemini/gemini-cli/blob/v0.58.0/packages/cli/src/acp/acpRpcDispatcher.ts)
-returns the `gemini-cli` ACP identity, and
-[`acpSessionManager.ts`](https://github.com/google-gemini/gemini-cli/blob/v0.58.0/packages/cli/src/acp/acpSessionManager.ts)
-maps session MCP configuration into Gemini CLI. The MCP client identity comes
-from
-[`mcp-client.ts`](https://github.com/google-gemini/gemini-cli/blob/v0.58.0/packages/core/src/tools/mcp-client.ts).
-Other versions fail closed until the registry is reviewed and updated.
-
-## Setup
-
-1. Install Node.js `>=24.19.0 <25`, then install and authenticate Gemini CLI
-   0.58.0 using its normal setup. Ambassador never installs or updates Gemini.
-2. For noninteractive provider authentication, set the appropriate approved
-   Gemini or Vertex variables outside chat. The profile accepts
-   `GEMINI_API_KEY`, `GOOGLE_API_KEY`, `GOOGLE_CLOUD_PROJECT`,
-   `GOOGLE_CLOUD_LOCATION`, and `GOOGLE_GENAI_USE_VERTEXAI`.
-3. Generate the local MCP token without putting its value in chat or a command
-   argument:
-
-   ```sh
-   export AMBASSADOR_LOCAL_TOKEN="$(
-     node -e "process.stdout.write(require('node:crypto').randomBytes(24).toString('hex'))"
-   )"
-   ```
-
-4. If you may choose webhook delivery, create its secret in the same shell
-   before starting Ambassador:
+1. From the directory Gemini CLI may access, keep Ambassador running:
 
    ```sh
-   export AMBASSADOR_WEBHOOK_SECRET="$(
-     node -e "process.stdout.write(require('node:crypto').randomBytes(24).toString('hex'))"
-   )"
+   npx --yes @embassys/ambassador@latest start
    ```
 
-5. From the directory the direct agent may access, start the exact release and
-   keep it running in the foreground:
-
-   ```sh
-   npx --yes @embassys/ambassador@0.2.6 start \
-     --local-token-env=AMBASSADOR_LOCAL_TOKEN
-   ```
-
-6. Configure Gemini CLI's MCP client to use the loopback endpoint printed by
-   Ambassador, with a bearer token read from `AMBASSADOR_LOCAL_TOKEN`. Use the
-   provider's normal MCP configuration mechanism; do not copy the token value
-   into chat.
-7. Ask Gemini CLI to register with your email and optional display name. The
-   first `register_agent` call contains `email` and, if wanted, `display_name`.
-   Ambassador recognizes the Gemini CLI profile and asks direct versus webhook,
-   with direct as the default.
-8. For direct mode, choose direct. The follow-up repeats the same `email` and
-   optional `display_name` and adds `delivery: {"mode":"direct"}`. Ambassador
-   starts `gemini --acp` and injects its authenticated HTTP MCP server into the
-   new ACP session.
-9. For webhook mode, choose webhook and provide the HTTPS receiver URL plus
-   the environment-variable name `AMBASSADOR_WEBHOOK_SECRET`. The follow-up
-   repeats the registration fields and adds `delivery.mode`, `delivery.url`,
-   and `delivery.secret_env`; it never sends the secret value.
-10. Enter the email verification code when Gemini CLI asks for it. Gemini CLI
-    calls `verify_email` with that `email` and six-digit `code`; the central
-    token and DPoP key stay inside Ambassador.
-
-Gemini owns provider authentication and history. Ambassador never receives the
-provider credentials, central token, or DPoP private key. Never put the local
-token or a provider credential in chat or registration arguments.
+2. Add `http://127.0.0.1:8787/mcp` as a Streamable HTTP MCP server in Gemini
+   CLI's normal MCP configuration. Do not configure authentication.
+3. Start or restart Gemini CLI so it sees the MCP server.
+4. Ask Gemini CLI to register your email; it calls Ambassador's
+   `register_agent` tool.
+5. Enter the six-digit code sent to your email. Gemini CLI is direct-only, so
+   Ambassador does not ask a delivery question.
+
+Ambassador will launch `gemini --acp` when a central message arrives. That is
+a new gateway-managed session, not the chat used for registration.
+
+The qualification probe records the installed version without rejecting it.
+Production still checks the exact MCP client and ACP identities in the compiled
+profile, so a new incompatible release fails closed. See
+[Qualification](qualification.md) for compatibility evidence.

package/docs/getting-started-hermes.md

@@ -1,84 +1,52 @@
 # Get started with Hermes Agent
 
-Release target: `@embassys/ambassador@0.2.6`. The profile is source-reviewed
-against Hermes Agent 0.21.0. Real-agent direct and webhook qualification remain
-open under the one-release qualification exception in ADR 0015.
+## Before you start
 
-Ambassador enables Hermes only for this exact contract:
+- Install Node.js `>=24.19.0 <25`.
+- Install and authenticate Hermes Agent `0.20.5` or `0.21.0`.
+- Make sure `hermes-acp` is on `PATH` for direct delivery.
+- Ambassador never receives your provider credential.
 
-| Field | Value |
-| --- | --- |
-| MCP `clientInfo` | `mcp` / `0.1.0` |
-| Delivery modes | direct and webhook |
-| Direct command | `hermes-acp` |
-| Accepted ACP `agentInfo` | `hermes-agent` / `0.21.0` |
-| Ambassador MCP in the direct session | ACP HTTP MCP injection |
+Hermes Agent `0.20.5` passed both live delivery modes and is included in
+Ambassador 0.2.8's direct profile. The qualification probe records the installed
+version without treating the observation itself as a failure.
 
-The contract was reviewed at Hermes revision
-`1cb3ab617363ffab9e55239a7d2ab0d6f9c10473`. Hermes pins Python MCP 2.0.0 and
-constructs `ClientSession` without overriding its client identity in
-[`mcp_tool.py`](https://github.com/NousResearch/hermes-agent/blob/1cb3ab617363ffab9e55239a7d2ab0d6f9c10473/tools/mcp_tool.py).
-That SDK's exact `mcp` / `0.1.0` identity is defined by Python MCP 2.0.0's
-[`DEFAULT_CLIENT_INFO`](https://github.com/modelcontextprotocol/python-sdk/blob/6f69a3758ebf2ee55ce050f58b470ce11af71133/src/mcp/client/session.py).
-Hermes declares the `hermes-acp` entry point in
-[`pyproject.toml`](https://github.com/NousResearch/hermes-agent/blob/1cb3ab617363ffab9e55239a7d2ab0d6f9c10473/pyproject.toml)
-and returns its ACP identity in
-[`acp_adapter/server.py`](https://github.com/NousResearch/hermes-agent/blob/1cb3ab617363ffab9e55239a7d2ab0d6f9c10473/acp_adapter/server.py).
-Later versions fail closed until the registry is reviewed and updated.
+## Set up direct delivery
 
-## Setup
-
-1. Install Node.js `>=24.19.0 <25`, then install and authenticate Hermes Agent
-   0.21.0 using its normal provider setup. Ambassador never installs or updates
-   Hermes.
-2. Generate the local MCP token without putting its value in chat or a command
-   argument:
-
-   ```sh
-   export AMBASSADOR_LOCAL_TOKEN="$(
-     node -e "process.stdout.write(require('node:crypto').randomBytes(24).toString('hex'))"
-   )"
-   ```
-
-3. If you may choose webhook delivery, create its secret in the same shell
-   before starting Ambassador:
+1. From the directory Hermes may access, keep Ambassador running:
 
    ```sh
-   export AMBASSADOR_WEBHOOK_SECRET="$(
-     node -e "process.stdout.write(require('node:crypto').randomBytes(24).toString('hex'))"
-   )"
+   npx --yes @embassys/ambassador@latest start
    ```
 
-4. From the directory the direct agent may access, start the exact release and
-   keep it running in the foreground:
-
-   ```sh
-   npx --yes @embassys/ambassador@0.2.6 start \
-     --local-token-env=AMBASSADOR_LOCAL_TOKEN
-   ```
-
-5. Configure Hermes to use the loopback MCP endpoint printed by Ambassador,
-   with a bearer token read from `AMBASSADOR_LOCAL_TOKEN`. Use Hermes's normal
-   MCP configuration mechanism; do not copy the token value into chat.
-6. Ask Hermes to register with your email and optional display name. The first
-   `register_agent` call contains `email` and, if wanted, `display_name`.
-   Ambassador recognizes the Hermes profile and asks direct versus webhook,
-   with direct as the default.
-7. For direct mode, choose direct. The follow-up repeats the same `email` and
-   optional `display_name` and adds `delivery: {"mode":"direct"}`. Ambassador
-   starts `hermes-acp` and injects its authenticated HTTP MCP server into the
-   gateway-owned ACP session.
-8. For webhook mode, choose webhook and provide the HTTPS receiver URL plus
-   the environment-variable name `AMBASSADOR_WEBHOOK_SECRET`. The follow-up
-   repeats the registration fields and adds `delivery.mode`, `delivery.url`,
-   and `delivery.secret_env`; it never sends the secret value.
-9. Enter the email verification code when Hermes asks for it. Hermes calls
-   `verify_email` with that `email` and six-digit `code`; the central token and
-   DPoP key stay inside Ambassador.
-
-Hermes receives neither the central token nor the DPoP private key. Never put
-the local token or webhook secret in chat or registration arguments.
-
-The opt-in real-agent runner injects its qualification MCP endpoint into the
-Hermes ACP session and verifies the exact reviewed `clientInfo` when Hermes
-calls the bounded qualification tool.
+2. Add `http://127.0.0.1:8787/mcp` as a Streamable HTTP MCP server in Hermes's
+   normal MCP configuration. Do not configure authentication.
+3. Start or restart Hermes so it sees the MCP server.
+4. Ask Hermes to register your email; it calls Ambassador's `register_agent`
+   tool.
+5. Choose **Send directly to this Hermes agent**.
+6. Enter the six-digit code sent to your email.
+
+Ambassador will launch `hermes-acp` when a central message arrives. That is a
+new gateway-managed session, not the chat used for registration.
+
+## Use a webhook instead
+
+- Before step 1, set the receiver secret in the same shell:
+
+  ```sh
+  export AMBASSADOR_WEBHOOK_SECRET="$(
+    node -e "process.stdout.write(require('node:crypto').randomBytes(24).toString('hex'))"
+  )"
+  ```
+
+- During registration, choose **Send to a webhook**.
+- Give Hermes the HTTPS webhook URL and the variable name
+  `AMBASSADOR_WEBHOOK_SECRET`.
+- Hermes supplies `delivery.url` and `delivery.secret_env`; it never receives
+  the secret value.
+
+Production still checks the exact MCP client and ACP identities in the compiled
+profile, so a new incompatible release fails closed. See
+[Qualification](qualification.md) for the artifact-specific compatibility
+evidence.

package/docs/getting-started-openclaw.md

@@ -1,83 +1,49 @@
 # Get started with OpenClaw
 
-Release target: `@embassys/ambassador@0.2.6`. The profile is source-reviewed
-against OpenClaw 2026.8.1. Real-agent direct and webhook qualification remain
-open under the one-release qualification exception in ADR 0015.
+## Before you start
 
-Ambassador enables OpenClaw only for this exact contract:
+- Install Node.js `>=24.19.0 <25`.
+- Install and authenticate OpenClaw `2026.8.1`.
+- Make sure `openclaw` is on `PATH` for direct delivery.
+- Ambassador never receives your provider credential.
 
-| Field | Value |
-| --- | --- |
-| MCP `clientInfo` | `openclaw-bundle-mcp` / `0.0.0` |
-| Delivery modes | direct and webhook |
-| Direct command | `openclaw acp` |
-| Accepted ACP `agentInfo` | `openclaw-acp` / `2026.8.1` |
-| Ambassador MCP in the direct session | provider configuration required |
+## Set up direct delivery
 
-The contract was reviewed at OpenClaw revision
-`a68a4e39684168cf83201cf48261be23174bad3d`. The source defines the MCP alias in
-[`agent-bundle-mcp-runtime.ts`](https://github.com/openclaw/openclaw/blob/a68a4e39684168cf83201cf48261be23174bad3d/src/agents/agent-bundle-mcp-runtime.ts),
-the ACP identity in
-[`acp/types.ts`](https://github.com/openclaw/openclaw/blob/a68a4e39684168cf83201cf48261be23174bad3d/src/acp/types.ts),
-and the command in
-[`acp-cli.ts`](https://github.com/openclaw/openclaw/blob/a68a4e39684168cf83201cf48261be23174bad3d/src/cli/acp-cli.ts).
-Later versions fail closed until the registry is reviewed and updated.
-
-## Setup
-
-1. Install Node.js `>=24.19.0 <25`, then install and authenticate OpenClaw
-   2026.8.1 using its normal provider setup. Ambassador never installs or
-   updates OpenClaw.
-2. Generate the local MCP token without putting its value in chat or a command
-   argument:
-
-   ```sh
-   export AMBASSADOR_LOCAL_TOKEN="$(
-     node -e "process.stdout.write(require('node:crypto').randomBytes(24).toString('hex'))"
-   )"
-   ```
-
-3. If you may choose webhook delivery, create its secret in the same shell
-   before starting Ambassador:
+1. From the directory OpenClaw may access, keep Ambassador running:
 
    ```sh
-   export AMBASSADOR_WEBHOOK_SECRET="$(
-     node -e "process.stdout.write(require('node:crypto').randomBytes(24).toString('hex'))"
-   )"
+   npx --yes @embassys/ambassador@latest start
    ```
 
-4. From the directory the direct agent may access, start the exact release and
-   keep it running in the foreground:
-
-   ```sh
-   npx --yes @embassys/ambassador@0.2.6 start \
-     --local-token-env=AMBASSADOR_LOCAL_TOKEN
-   ```
-
-5. Configure OpenClaw's MCP client to use the loopback endpoint printed by
-   Ambassador, with a bearer token read from `AMBASSADOR_LOCAL_TOKEN`.
-   OpenClaw's ACP interface does not accept session MCP injection, so this
-   normal provider configuration is also required for direct delivery.
-6. Ask OpenClaw to register with your email and optional display name. The
-   first `register_agent` call contains `email` and, if wanted, `display_name`.
-   Ambassador recognizes the OpenClaw profile and asks direct versus webhook,
-   with direct as the default.
-7. For direct mode, choose direct. The follow-up repeats the same `email` and
-   optional `display_name` and adds `delivery: {"mode":"direct"}`. Ambassador
-   records the canonical startup directory and rejects a later start from a
-   different directory.
-8. For webhook mode, choose webhook and provide the HTTPS receiver URL plus
-   the environment-variable name `AMBASSADOR_WEBHOOK_SECRET`. The follow-up
-   repeats the registration fields and adds `delivery.mode`, `delivery.url`,
-   and `delivery.secret_env`; it never sends the secret value. Receiver-side
-   conversion to an OpenClaw-native hook belongs outside Ambassador.
-9. Enter the email verification code when OpenClaw asks for it. OpenClaw calls
-   `verify_email` with that `email` and six-digit `code`; the central token and
-   DPoP key stay inside Ambassador.
-
-OpenClaw receives neither the central token nor the DPoP private key. Never put
-the local token or webhook secret in chat or registration arguments.
-
-For the opt-in real-agent suite, configure this same provider-side MCP entry at
-`http://127.0.0.1:8787/mcp` using `AMBASSADOR_QUALIFICATION_LOCAL_TOKEN`; the
-runner verifies that OpenClaw calls it with the exact reviewed `clientInfo`.
+2. Add `http://127.0.0.1:8787/mcp` as a Streamable HTTP MCP server in
+   OpenClaw's normal MCP configuration. Do not configure authentication.
+3. Start or restart OpenClaw so it sees the MCP server.
+4. Ask OpenClaw to register your email; it calls Ambassador's `register_agent`
+   tool.
+5. Choose **Send directly to this OpenClaw agent**.
+6. Enter the six-digit code sent to your email.
+
+Ambassador will launch `openclaw acp` when a central message arrives. OpenClaw
+does not accept session MCP injection, so keep the provider-side MCP entry from
+step 2 configured.
+
+## Use a webhook instead
+
+- Before step 1, set the receiver secret in the same shell:
+
+  ```sh
+  export AMBASSADOR_WEBHOOK_SECRET="$(
+    node -e "process.stdout.write(require('node:crypto').randomBytes(24).toString('hex'))"
+  )"
+  ```
+
+- During registration, choose **Send to a webhook**.
+- Give OpenClaw the HTTPS webhook URL and the variable name
+  `AMBASSADOR_WEBHOOK_SECRET`.
+- OpenClaw supplies `delivery.url` and `delivery.secret_env`; it never receives
+  the secret value.
+
+The qualification probe records the installed version without rejecting it.
+Production still checks the exact MCP client and ACP identities in the compiled
+profile, so a new incompatible release fails closed. See
+[Qualification](qualification.md) for compatibility evidence.

package/docs/live-qualification.md

@@ -10,8 +10,11 @@ general reply operations. It does test the deployed, action-specific
 
 The runner covers the current package name, guided registration, one
 full-message webhook target, and one direct target. The default direct target
-is the deterministic mock ACP agent. A separately confirmed mode uses the
-fixed Codex profile and `codex-acp` 1.8.0 with an isolated Codex login.
+is the deterministic mock ACP agent. Separately confirmed modes use the fixed
+Codex or Hermes profiles and their supported exact agent and adapter versions.
+Real-provider modes use isolated provider configuration copies. Their
+installed-version probes are observational; the compiled-in production profile
+still decides ACP compatibility by exact identity matching.
 
 ## Safety
 
@@ -25,10 +28,10 @@ fixed Codex profile and `codex-acp` 1.8.0 with an isolated Codex login.
 ## Required live checks after the cutover
 
 1. Pack and scan the exact candidate package.
-2. Create two disposable identities through authenticated local MCP.
+2. Create two disposable identities through loopback local MCP.
 3. Use the exact enabled `clientInfo` aliases for one webhook profile and one
-   direct profile. Prove the dual-mode registration result advertises direct
-   as its default before choosing the required mode.
+   direct profile. Prove a dual-mode profile advertises direct as its default;
+   prove a direct-only profile proceeds without a delivery question.
 4. Receive and use both verification emails without persisting their codes.
 5. Restart and prove encrypted credential and nonsecret profile loading.
 6. Prove valid Bearer plus DPoP requests and the negative DPoP matrix.
@@ -70,11 +73,43 @@ export AMBASSADOR_CONFIRM_LIVE_QUALIFICATION=run-live-qualification-with-real-co
 pnpm run qualify:live
 ```
 
-The runner rejects an ordinary user home, checks the adapter version before it
-contacts central, uses the compiled-in Codex command and profile, and never
-accepts a command override. It also lets abandoned server-side polls expire
-after the restart check before it enqueues a message. Delete the isolated home
-after the run.
+The runner rejects an ordinary user home, records the installed version when
+one can be observed, uses the compiled-in Codex command and profile, and never
+accepts a command override. The observation does not establish compatibility;
+the exact ACP identity check remains authoritative. The runner also lets
+abandoned server-side polls expire after the restart check before it enqueues a
+message. Delete the isolated home after the run.
+
+For Hermes, prepare an owner-only temporary home containing only `.hermes/.env`,
+`.hermes/auth.json`, `.hermes/config.yaml`, and
+`.hermes/shared/nous_auth.json` copied from the authenticated installation.
+Remove unrelated MCP entries only from that copy. Put Hermes Agent 0.20.5 or
+0.21.0 and `hermes-acp` on `PATH`, then choose one fixed mode:
+
+```sh
+export AMBASSADOR_HERMES_QUALIFICATION_HOME=/absolute/path/to/isolated/home
+export AMBASSADOR_LIVE_DIRECT_AGENT=hermes-direct
+export AMBASSADOR_CONFIRM_LIVE_QUALIFICATION=run-live-qualification-with-real-hermes-direct-and-two-disposable-mailosaur-identities
+pnpm run qualify:live
+```
+
+or:
+
+```sh
+export AMBASSADOR_HERMES_QUALIFICATION_HOME=/absolute/path/to/isolated/home
+export AMBASSADOR_LIVE_DIRECT_AGENT=hermes-webhook
+export AMBASSADOR_CONFIRM_LIVE_QUALIFICATION=run-live-qualification-with-real-hermes-webhook-and-two-disposable-mailosaur-identities
+pnpm run qualify:live
+```
+
+The runner rejects the ordinary Hermes home and non-owner-only copies. It uses
+exact MCP `clientInfo` `mcp` / `0.1.0`, launches only compiled-in
+`hermes-acp` for direct mode, and configures Ambassador MCP only in the isolated
+copy. The runner records the installed Hermes version when it can, but does not
+use that observation as a compatibility gate; direct ACP identity matching
+remains exact. Webhook mode starts Hermes's authenticated generic route,
+requires its bearer filter and native HMAC V2 validation, and suppresses
+provider output. Delete the isolated home after every attempt.
 
 ## Required report
 
@@ -148,6 +183,85 @@ behavior passed. The supported-Node repeat remains part of the qualification
 record even though the user approved 0.2.6 as a one-release exception before
 that repeat.
 
+## Hermes 0.20.5 observations
+
+On 2026-09-03, Hermes Agent 0.20.5 ran on macOS 26.5.2 arm64 with Node
+24.19.0. Both live cases reviewed central source revision
+`ac3f7a6e33829eb80301c7944f611d29cc2499b5`; the live deployment did not
+expose its revision. The actual npm artifact was downloaded from the registry,
+clean-installed, and used through its installed `ambassador` CLI. Its npm
+integrity was
+`sha512-qaL4IHTrMwpyrY1OisPXMexytmnNfO7Bjc5tXgLCF3LolXQW2R8GrzErqJkMIlM+Zh8Cce9ijN+zfYb3xiNHSQ==`,
+its registry SHA-1 was `c0179df957bc05de921da578344fab6c1ba4a713`,
+and its tarball SHA-256 was
+`312b514ce2dd43de81502debd63004ea9a84da79099d4730c301b52e593c97c8`.
+The installed CLI started without options, rejected a forbidden option, and
+passed the packed-runtime scan.
+
+The artifact-specific outcomes were:
+
+| Delivery case | Ambassador artifact | Outcome |
+| --- | --- | --- |
+| Webhook | Published `@embassys/ambassador@0.2.7` | Passed the complete live round trip |
+| Direct eligibility probe | Published `@embassys/ambassador@0.2.7` | Ambassador capability-registry rejection at `startup_failed`, as required by its exact 0.21.0 profile |
+| Direct | Source candidate adding exact Hermes ACP 0.20.5 | Passed the complete live round trip |
+
+The source-built direct candidate was not substituted for the published
+artifact checks. Its tarball SHA-256 was
+`1d434e8a5dbf027a42326a7e6b42a58094fe17cfdbf8cf96a4e7d314a24835be`,
+and the direct qualification runner SHA-256 was
+`7b6a680bba64abe8d86c9f2328a7562360b15def1eea1d7cf11f21d8f7dea24f`.
+The final strict webhook pass used runner SHA-256
+`e2506c09012f5e7bb3630acb70b5844be3a1769b5baaef3fc76dda07ed27c8c0`.
+No later source change altered the direct profile or delivery implementation
+used by that candidate.
+
+Each pass registered and email-verified a controlled requester and the real
+Hermes target through separate local Ambassador MCP endpoints, then restarted
+both gateways and reloaded the encrypted credentials and delivery profiles.
+The requester obtained `get_phone_number` permission, Hermes called
+`respond_to_permission` with a grant, the requester called `call_action` with
+approved synthetic data, and Hermes received the complete correlated
+`action_call`. The real model called `submit_action_result` exactly once with
+the supplied call ID, success status, and approved synthetic phone object.
+The requester received the matching `action_response`. Local webhook custody
+or ACP completion was observed before each corresponding central
+acknowledgement.
+
+Both modes passed Bearer plus DPoP behavior, the negative DPoP matrix, the
+deployed six-action catalog, zero central MCP requests, artifact scanning, and
+Mailosaur and temporary-state cleanup. Direct mode proved ACP v1 initialization
+and injected Ambassador MCP. Webhook mode proved the Hermes receiver's bearer
+filter, HMAC V2 authentication, and custody before acknowledgement. The normal
+Hermes home was not changed; owner-only credential copies were removed after
+the runs.
+
+The live DPoP positive case needed no nonce. The deployed catalog names and
+input-schema SHA-256 digests were:
+
+| Action | Input schema SHA-256 |
+| --- | --- |
+| `create_calendar_event` | `4b9c97f146bfbb4c2cc1ec0812ada60406ce563d59c5abc807fcb6ba2dc0270c` |
+| `get_email` | `032af9a4835a30e280f7c122f8971565b4e2527b25d9fcb0ad2f778f654aecbd` |
+| `get_free_busy_permission` | `7775afae503f343ae09ed3510c66410cb361ea4125b28047d15321e7430f4f96` |
+| `get_phone_number` | `6c7954b7f42f818db7f93433bd07dc2aac273bd4599a637d2233529c6149bc48` |
+| `read_calendar_event_by_title` | `92ddb62ec62f187cdd1cfe0995d01afd06f283f2c174f6f24173083b1aab0d2f` |
+| `read_calendar_permission` | `27deb9a2fbadef8582fa9036fa9bc4a173eeaa92034d0fab8f4e12b1dfdf0662` |
+
+One earlier strict webhook attempt failed at
+`action_response_webhook_timeout_failed` after the real target had granted the
+permission, submitted one successful correlated result, accepted both target
+messages, and received both target acknowledgements. Ambassador reported no
+stderr. The safe evidence cannot distinguish central response queueing from a
+consuming-poll delivery loss, so this is classified in the central REST
+action-response delivery phase, not as Ambassador target delivery, Hermes
+webhook custody, model execution, or MCP invocation. A fresh isolated rerun of
+the same strict case passed. No compatibility fallback or replay was added.
+
+These observations approve the source registry's exact Hermes ACP 0.20.5
+entry. They do not show that published Ambassador 0.2.7 supports Hermes 0.20.5
+direct mode. Ambassador 0.2.8 contains the candidate change.
+
 ## Earlier direct observation
 
 On 2026-09-02, real Codex had already passed delivery, injected Ambassador MCP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@embassys/ambassador",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "Local Ambassador for the Embassys agent network",
   "license": "MIT",
   "repository": {
@@ -46,6 +46,7 @@
     "clean": "node scripts/clean.mjs",
     "format": "biome check --write .",
     "lint": "biome check .",
+    "probe:agents": "node scripts/probe-agent-versions.mjs",
     "qualify:agents": "node scripts/qualify-agents.mjs",
     "qualify:live": "node scripts/live-qualification.mjs",
     "test": "pnpm run test:build && node scripts/run-tests.mjs",