Evidence record / hermes-agent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-hermes-agent-network-exposed-a2a-refuses-dispatch-with-an-empty-trusted-peer-list
Network-exposed A2A refuses dispatch with an empty trusted-peer list. On a non-loopback bind, a token-authenticated A2A adapter with no trusted peers previously accepted peers after authentication. It now refuses dispatch unless peers are listed or allow-all is explicitly enabled. Loopback empty-list behavior remains compatible; bearer/peer-token authentication is still a precondition for network access.
Channel: tagged-release (first stable v0.21.6). Half: defect. Date: 2026-10-01.
Operator consequence: Populate A2A_TRUSTED_PEERS before upgrading exposed adapters to v0.21.6+. An empty list is no longer permission for every authenticated peer; intentional allow-all requires an explicit setting.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-hermes-agent-network-exposed-a2a-refuses-dispatch-with-an-empty-trusted-peer-list
Profile citations
- Hermes Agent / claim / a2a-empty-peer-list
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-hermes-agent-network-exposed-a2a-refuses-dispatch-with-an-empty-trusted-peer-listgithub.com/NousResearch/hermes-agent/commit/a0cad39f5d55a2c7e2f0cbea2198358b5a3d55b0tagged commit file2026-10-13-hermes-agent-network-exposed-a2a-refuses-dispatch-with-an-empty-trusted-peer-listNousResearch/hermes-agent / plugins/platforms/a2a/security.py#L74-L115
Versioned source: run artifact