Hermes
v0.0.6

Authenticated site messaging and push-to-talk audio. An early development release for Apple Silicon Mac.

Download for Mac · arm64

Install

1. Download the DMG, open it, and drag Hermes into Applications.
2. Open Hermes from Applications. macOS will say it cannot verify the developer because this build is not notarized: close that dialog, open System Settings → Privacy & Security, scroll to Security and choose Open Anyway next to Hermes, then confirm. Follow Apple’s instructions. Verify the checksum first. Do not disable Gatekeeper globally.
3. Allow microphone access when you explicitly join audio. If previously denied, enable Hermes under Privacy & Security → Microphone.

Your first sign-in

Ask your Hermes administrator for a single-use account invitation. Choose I have an invitation in the app, enter the code, set your own password and press Activate account. There is no public registration. The release endpoint and organization are prefilled. Existing users can sign in directly. Credentials are never included in this download.

Choose your site and a channel, then send a message. Your administrator can create channels and invite a second participant. Audio stays off until an administrator explicitly permits cloud audio in site policy. Each participant then selects a voice channel, joins audio and holds PTT to speak. Release PTT to stop transmitting. Reopening the desktop restores a valid OS-protected session, never the microphone.

What works

Persistent messages, live presence, teams and channels, authorized WebRTC/TURN voice, invitations, device enrollment/revocation, and explicit transfer policies. Connection status and diagnostics are available in the app. Local demo mode is deliberate and separate.

Known limitations

Development service: no production SLA, accreditation or CUI authorization. Single backend host; no SSO or automatic app updater. Translation and physical radio integration are unavailable in this release. Hardware microphone/speaker, clean-Mac and second-physical-device acceptance require your manual check. Automated media tests use synthetic audio. Network policy must allow TURN UDP/TCP 3478 or TLS 5349; 443-only media networks are not supported. Existing peer media cannot be forcibly revoked solely by closing signaling.

Verify the download

SHA-256 checksums · Release metadata

716de18bde8b7068d5f1983e3ce8394fd798161a28c220b75201d40ca8e977f6