feat(android): add capability-gated hosted rooms

[JackHunzicker]

Summary

Draft: dependent Android client, not ready for independent release. Add hosted rooms to Android Bot Mode while keeping the owning Hermes Gateway responsible for execution, canonical history, files, and recovery. Unsupported gateways retain the read-only fallback.

Dependency and landing order

1. Resolve the hosted-room protocol in Hermes #98307 and its room-backend companion.
2. Integrate native Codex continuity/control fixes #105502 for the corresponding native-participant guarantees. That standalone runtime fix is not itself the room backend.
3. Validate the Desktop companion and this Android client against the accepted backend contract. Desktop is a sibling client, not an Android execution dependency.
4. Keep this PR draft until that backend reconciliation and matched integration verification are complete. Submission is not deployment or release approval.

Changes

• Discover owning-Gateway rooms; preserve canonical actor/thread provenance, immutable pending sends, retry targets, and foreground recovery.
• Add capability-gated history/search, edit/delete/reaction, shared read cursors, approval/whole-room Stop, room settings, verified files and export.
• Supply the Compose UI, transport/controller, declarative loopback fixture, and regressions as one feature.
• Document the fallback and release dependency; include version-qualified fixture screenshots and changelog entry.
• No dependency-file change, additional scheduler, server implementation, or history migration.

Verification

Current draft head 5c87fbd1d9260a96d2bd0a8eb85cd9a7e14e37f3 passed all required hosted checks, including Android tests, lint, build, the vanilla-upstream route contract, and listing-asset validation. The final follow-up changes documentation/screenshots, not Kotlin or build configuration. Green CI does not remove the backend dependency or the draft release boundary.

Local commands from the repository root, with ANDROID_HOME and ANDROID_SDK_ROOT set to the installed Android SDK:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/android-lane.ps1 gradle :app:testSideloadDebugUnitTest :app:testGooglePlayDebugUnitTest :app:lintSideloadDebug :app:lintGooglePlayDebug :app:assembleSideloadDebug :app:assembleGooglePlayDebug --console=plain

Passed at f09e2a094ff42b8075087ac825c46db4045e9e75: 3,063 tests per flavor, comprising 3,051 passed and 12 unchanged skips, with zero failures/errors; both lints and debug assemblies passed. The signed 7f4da68e commit has the identical tree. Some Gradle tasks reused up-to-date successful outputs; this was not an all-forced rebuild.

powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/android-lane.ps1 gradle :app:testGooglePlayDebugUnitTest --tests com.hermesandroid.relay.viewmodel.ChatViewModelGatewayInboundTurnTest.multipleQueuedMessagesDrainAsAnOwnedRunChain --console=plain

Passed: one test. The original intermittent inbound-queue failure also passed subsequent suites without a production change; its mechanism was not proven by a baseline execution.

powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/android-lane.ps1 gradle :app:testSideloadDebugUnitTest --rerun :app:testGooglePlayDebugUnitTest --rerun :app:lintSideloadDebug :app:lintGooglePlayDebug :app:assembleSideloadDebug :app:assembleGooglePlayDebug --console=plain

Historical forced reruns: Sideload 3,051 passed / 12 skipped; GooglePlay 3,050 passed / one failed / 12 skipped. The unchanged GitStateWriteViewModelTest.commit success callback fires only after successful response checked its callback before callback completion (expected alpha, got null); its focused rerun also failed. This is disclosed, not suppressed or described as a green forced run. The unchanged baseline now reproduces the failure directly, and the test-only correction is submitted separately as #560, with 33 related tests passing per flavor. That fix is deliberately not mixed into this feature.

powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/android-lane.ps1 gradle :app:standardPhoneApi36SideloadDebugAndroidTest '-Pandroid.testInstrumentationRunnerArguments.class=com.hermesandroid.relay.viewmodel.HostedRoomHistoryInstrumentedTest,com.hermesandroid.relay.viewmodel.HostedRoomInstrumentedTest' --console=plain

Earlier pinned UI source 28b9d879b776d45fcbaf07dda7c29ed9218d906f: six managed API36 cases passed. This is emulator/fixture evidence, not a physical-device or live-model result. No current-head three-device/vendor acceptance is claimed.

Screenshots

Six fixture captures, source provenance, and reproduction commands cover search, edit, reaction, revision rejection, shared reads, and unavailable capabilities. The history/action captures use the managed Android API36 emulator; shared-read/fallback captures use production Compose screenshot tests. All 11 tracked HostedRoom*.kt production/test files match between the pinned capture source and submitted 7f4da68e code; the newer build toolchain was not used to recapture them.

Compatibility / risk

Released vanilla Hermes does not acquire hosted-room writes from this Android PR. Methods/features must be advertised by the owning gateway; absent features remain unavailable. The gateway owns canonical state and task admission; Android remains a client. Exact identity/revision checks reject stale actions. There is no history migration or account configuration change. Rolling back the client does not remove gateway history.

The cancelled optional matched-bundle workflows did not publish a review candidate. They are not the Android required-check result and are not evidence of a backend compatibility test. A matched accepted-backend integration run remains outstanding before leaving draft.

Lineage / contributor credit

• Source PRs: Hermes #98307 by dokterdok is the backend protocol foundation; the room and Desktop companions are linked above. Existing upstream history/authorship is retained.
• This Android contribution is not a replacement or salvage of another Android PR. Its commits retain author-matching developer sign-offs.
• Translation expansion: N/A; existing fallback remains. Server/plugin and Desktop source changes: N/A in this Android PR.

Checklist

• Target branch is dev.
• Scope is focused and related PRs/dependencies are linked.
• Android lint and tests ran; exact results and historical failures are disclosed above.
• Translation validation: N/A, no translation changes.
• Server/plugin tests: N/A, no server/plugin source changes.
• Desktop tests: N/A, no Desktop source changes.
• Docs: relative links and published image targets checked; no docs-site source change or site-build claim.
• UI emulator/Compose evidence and version boundaries are stated above; physical-device/live-provider proof is not claimed.
• Conventional Commit messages and developer sign-offs retained.
• CHANGELOG.md updated for the user-visible feature.
• Public writing and fixture images checked for secrets/private infrastructure.
• Existing upstream authorship retained; no replacement Android PR requires additional salvage attribution.

[hermes-relay-triage]

🤖 Hermes-Relay automated PR intake

Thanks for the detailed hosted-rooms contribution!

The body provides a clear summary and scope, targets dev, links the upstream protocol/runtime dependencies, reports emulator and screenshot-test evidence, and explicitly discloses the later forced-rerun failure rather than presenting that suite as green.

Before review, please align the existing evidence with the PR template: add the missing Changes, Screenshots, Compatibility / risk, Lineage / contributor credit, and Checklist sections; list the exact verification commands with their results; and link the visual artifacts or state that visual proof remains outstanding. Please also mark each checklist item or give its N/A rationale.

A maintainer will review the upstream dependency, disclosed test failure, and broad Android/fixture scope.

[github-actions]

Review candidate unavailable

The build for PR #559 head 7f4da68ee1c1 completed with cancelled and did not publish a candidate bundle.

View workflow run

[github-actions]

Review candidate unavailable

The build for PR #559 head 7f4da68ee1c1 completed with cancelled and did not publish a candidate bundle.

View workflow run