the process beside your agent.

Committed messages live in SQLite with per-thread sequence numbers. On reconnect, a device supplies its last sequence for each thread. The gateway sends the later committed messages in order, then signals that synchronization is complete.

Your phone can catch up without asking a transient stream to be the permanent record. The client still needs a valid cursor and a successful connection.

Storage and cursorsReplay test

The agent connection uses a durable SQLite inbox and outbox. Commands and events carry sequence identities and acknowledgement state. Losing the connection does not delete the queued command.

When an agent replays an event whose acknowledgement was lost, the gateway can acknowledge it without adding the same event to the conversation again. This protects delivery and transcript projection; it does not make arbitrary external actions execute exactly once.

Delivery contractLost-acknowledgement tests

On reconnect, the gateway and a compatible runtime reconcile sequence cursors and flush unacknowledged commands. The runner connection also uses receipts to distinguish completed operations from operations that still need delivery.

Recovery is deliberately narrower than restarting every action. Interrupted work can require attention, and incompatible protocol versions are rejected. A restart test checks that a committed agent event is projected once across gateway reassembly.

Resume reconciliationRestart replay testRunner connection

A small plugin connects out from Hermes Agent to CozyGateway. For session administration, the gateway probes known Hermes API routes and response shapes before advertising support. Exact session detail and limited compatibility have different capability versions.

An older or unreachable Hermes API does not acquire a working-looking control just because the app knows how to draw one. If a session mutation times out, the gateway reports an ambiguous outcome and asks for a refresh instead of blindly retrying it.

Hermes discoveryAmbiguous outcomesCompatibility tests

Pairing uses a single-use code that expires. Your phone stores its device token in the Keychain; the gateway stores the token’s hash. Device credentials can be revoked, including closing that device’s live socket.

Notification content uses AES-256-GCM encryption before it reaches the push relay. The relay still handles routing metadata. Your gateway and chosen model provider are part of the message-processing boundary; this is not a claim of zero-knowledge chat.

Push encryptionIndependent decryption testsAccess and trust model

The website installer pins a named release and checks the downloaded files against SHA-256 values. Services use the platform’s lifecycle: launchd on macOS, a systemd user service on Linux, and a current-user Scheduled Task on Windows, with Docker documented separately.

Keep your host available, retain your gateway data, and maintain backups. A durable local database is not a backup, and operating-system sleep, network availability, and model-provider failures still affect the work.

Install and service checksDocker operationCozyAgents execution policy