feat(hermes): add Hermes as a first-class Firstmate primary backend

[vaskarvelas]

Intent

Make Hermes Agent a first-class Firstmate primary Captain's Assistant while keeping every crewmate visible through the Herdr backend; preserve existing harness behavior and block invisible delegation.

What Changed

• Added a new Hermes primary integration: .hermes/plugins/firstmate-primary/ plugin (__init__.py, plugin.yaml) and bin/fm-hermes-primary.sh, letting Hermes Agent act as a first-class Captain's Assistant primary.
• Extended spawn/backend/session-lock/harness-process libs (bin/fm-spawn.sh, bin/fm-backend.sh, bin/backends/herdr.sh, bin/fm-session-lock-lib.sh, bin/fm-harness-process-lib.sh, bin/fm-busy-lib.sh) so every crewmate stays visible through the Herdr backend and delegation cannot happen invisibly.
• Added coverage for the new behavior (tests/fm-hermes-primary.test.sh, tests/fm-hermes-harness.test.sh, tests/fm-secondmate-harness.test.sh, plus updates to fm-backend-herdr, fm-backend, fm-session-start, fm-spawn-dispatch-profile tests) and updated docs (docs/supervision-protocols/hermes.md, docs/architecture.md, docs/configuration.md, docs/codex-app-backend.md, README.md) to describe the new primary and fix stale duplicate backend lists.

Risk Assessment

✅ Low: The Hermes-primary integration (plugin, process-identity helpers, session-lock/harness-detection wiring, and docs) is additive, gated behind strict scope checks (persistent-CLI launch shape, cwd==root, valid state dir), fails closed on ambiguity, blocks delegate_task and unsafe watcher-arm shapes, explicitly refuses Hermes as a crewmate/secondmate runtime in fm-spawn.sh, and is backed by targeted tests (fm-hermes-primary.test.sh, fm-hermes-harness.test.sh, fm-spawn-dispatch-profile.test.sh) that assert exactly these behaviors; existing harness protocols and herdr crewmate-visibility contracts are left untouched.

Testing

Ran the 5 test files most directly covering this change via bin/fm-test-run.sh; all passed with zero failures, and the assertions directly exercise delegation-blocking and Herdr crewmate visibility, satisfying the required user intent.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

⚠️ **Rebase** - 1 warning

• ⚠️ .agents/skills/bootstrap-diagnostics/SKILL.md - branch carries 18 commit(s) that exist on your local main branch but were never pushed to origin/main; rebasing would bundle this unrelated work (154 file(s)) into the PR:
• 650c25b Merge remote-tracking branch 'origin/main'
• 64d7a09 Merge pull request fix(bin): coalesce watcher signals into one wake #4 from vaskarvelas/fm/herdr-primary-parent-label-fix-v2
• 5e385f0 no-mistakes(document): Recorded real presT E2E evidence from guarded Herdr lab run
• 08a19dd no-mistakes(document): Fixed stale ambient-server scoping fact in herdr-backend.md
• 071a116 no-mistakes(review): Scope herdr ambient-server routing to the exact matching session
• 5c41d37 fix(herdr): honor live server and launcher label
• 46b7673 fix: harden Codex App backend lifecycle
• 98c8b43 test: include Codex App in session-start backend list
• b3b2021 fix: satisfy shell lint for Codex App backend
• 8153173 feat: add Codex Desktop worker backend
• b85b5ab Merge pull request docs: polish README banner and repo housekeeping #2 from vaskarvelas/codex/chatgpt-desktop-worker
• 647503f ci: give portable serial checks completion headroom
• 4ed8d63 test: include Codex App in session-start backend list
• b99c579 ci: remove unsupported macOS compatibility job
• 7da3c27 fix: allow private-fork direct pull requests
• 12ff37a fix: satisfy shell lint for Codex App backend
• dd8e303 feat: add Codex Desktop worker backend
• da77f60 feat: add private upstream update flow (chore: initialize no-mistakes gate #1)

Push main to origin, or rebase your branch onto origin/main, before gating.

🔧 Fix applied.
1 warning still open:

• ⚠️ .agents/skills/bootstrap-diagnostics/SKILL.md - branch carries 18 commit(s) that exist on your local main branch but were never pushed to origin/main; rebasing would bundle this unrelated work (154 file(s)) into the PR:
• 650c25b Merge remote-tracking branch 'origin/main'
• 64d7a09 Merge pull request fix(bin): coalesce watcher signals into one wake #4 from vaskarvelas/fm/herdr-primary-parent-label-fix-v2
• 5e385f0 no-mistakes(document): Recorded real presT E2E evidence from guarded Herdr lab run
• 08a19dd no-mistakes(document): Fixed stale ambient-server scoping fact in herdr-backend.md
• 071a116 no-mistakes(review): Scope herdr ambient-server routing to the exact matching session
• 5c41d37 fix(herdr): honor live server and launcher label
• 46b7673 fix: harden Codex App backend lifecycle
• 98c8b43 test: include Codex App in session-start backend list
• b3b2021 fix: satisfy shell lint for Codex App backend
• 8153173 feat: add Codex Desktop worker backend
• b85b5ab Merge pull request docs: polish README banner and repo housekeeping #2 from vaskarvelas/codex/chatgpt-desktop-worker
• 647503f ci: give portable serial checks completion headroom
• 4ed8d63 test: include Codex App in session-start backend list
• b99c579 ci: remove unsupported macOS compatibility job
• 7da3c27 fix: allow private-fork direct pull requests
• 12ff37a fix: satisfy shell lint for Codex App backend
• dd8e303 feat: add Codex Desktop worker backend
• da77f60 feat: add private upstream update flow (chore: initialize no-mistakes gate #1)

Push main to origin, or rebase your branch onto origin/main, before gating.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• bin/fm-test-run.sh tests/fm-hermes-primary.test.sh
• bin/fm-test-run.sh tests/fm-hermes-harness.test.sh
• bin/fm-test-run.sh tests/fm-secondmate-harness.test.sh
• bin/fm-test-run.sh tests/fm-backend-herdr.test.sh
• bin/fm-test-run.sh tests/fm-backend.test.sh
• git status --short

⏭️ **Document** - skipped

• ℹ️ docs/verification/public-followup.md:96 - Dated compatibility-axis review (2026-07-30) lists primary harnesses without Hermes, now incomplete per firstmate-coding-guidelines' harness-review rule. Low priority: it's a frozen verification snapshot, not a live contract, and re-running that review is out of scope for this doc-staleness pass.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.