Hermes SEG v260918 Auto Recipient Provisioning (#332): read the relay recipient roster from a directory on a schedule, then stage it for review or provision it unattended. Three connectors, all Community edition: LDAP / Active Directory Google Workspace via the Admin SDK (#336), works on every Workspace tier Microsoft 365 via Microsoft Graph (#337) Enumeration and authentication are independent, so the directory the recipient list is read from need not be the one recipients authenticate against. Provisioning recipients who authenticate remotely is Pro, as RemoteAuth always has been. RemoteAuth TLS (#335): certificates are written where slapd can read them, an uploaded CA is combined with the system trust store instead of replacing it, client certificates are supported, and the Test Connection probe judges whether the bind was accepted rather than whether the user could read anything. Quarantine release links are rotated off a weak key derivation. Links issued in the 72 hours before upgrading stop working; the messages are still releasable from the User Portal. MariaDB (#339): the configured binary log expiry never ran, because every automatic purge waits for a replica that does not exist. The database healthcheck passed no credentials, so it logged a failed login every ten seconds while reporting healthy regardless.