fix(kanban): claim-guard owner identity uses a clock-step-immune start token (t_21dfa673)

[Kyzcreig]

Card: t_21dfa673 (found by Argus in the t_3a06ba8f r6 review of #946).

Problem

_owner_identity compared psutil's epoch create_time() with integer wall-clock event stamps. psutil re-bases that epoch value on the current clock. So a wall-clock step of more than ~2 s between spawn and a later claim put a LIVE genuine owner outside [claimed_at-1, spawned_at+2]. It was then classified "recycled", and the claim guard let a second worker in. Reachability is low (a claimable card with a live prior owner, plus a clock step), but it is the original t_09180e10 double-worker shape.

Fix

• _set_worker_pid records start_token = psutil create_time(monotonic=True) in the spawned payload, read before the write txn. This is the kernel start stamp psutil itself uses for PID-reuse identity: Linux starttime since boot; macOS raw p_starttime (psutil HISTORY feat(delegation): add background=true for fire-and-forget subagent tasks NousResearch/hermes-agent#2570: not clock-adjusted).
• The owner is the process at the PID iff its current token matches within 0.05 s. No wall clock is involved, so a clock step or DB lock lag cannot flip the verdict.
• Legacy rows without a token keep the causal window. Unreadable input still fails closed (unverified). Other platforms, or no psutil: no token, so the window applies.

Tests (test_kanban_second_claim_class.py)

• Genuine owner under a +/-10 s simulated clock step stays verified and refused. The legacy-row arm documents that the window alone misclassifies it.
• Token miss at +0.5 s, -1 s and 2 h is recycled. A token match beats stale stamps.
• Legacy LEAD/LAG edges are pinned with literal values (holder 5 s outside each edge).
• The task_runs.started_at fallback for rows without a claimed event is pinned.
• The existing recycled-holder, lock-lag, unreadable and boot-time arms are kept (they now also shift or strip the token).

Local run of the 3 focused files (second_claim_class, reclaim_unprovable_liveness, diagnostics): 108 passed.
Mutants, each RED: token branch removed (6 failures), token not recorded (8), tolerance 1.0 and 60 (2 each), LEAD 60, LAG 60, and no started_at fallback.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Kyzcreig]

🤖 merged-by: apollo · lane: kanban-merge-pass · gate: BYPASS: FleetReview paused by Ace 2026-09-22 (state/fleetreview-pause marker present) · why: t_21dfa673: kanban claim guard: owner identity uses wall-clock window — a clock step >2s can; Argus off card review (Ace 13:08), CI green

[ang-prism]

FleetReview

Review: post-merge · head 4861a0824b6d · duration 3m 10s
Profile: light (merit: default light: lines 311<800, files 2<1000000, hunks 12<1000000, no hot path) · policy: below-size-and-path-gates
Roster: B-assert-ctx → gpt-6-sol (openai), C-assert-xhigh → claude-code-opus-5-5 (anthropic), F → gpt-6-sol (openai), L6 → gpt-6-sol (openai)

Post-merge review (fleetreview:post-merge override): this reviewed the merge commit against its first parent — the bytes that already shipped. It is not a pre-merge gate pass.

profile: light (rule: default light: lines 311<800, files 2<1000000, hunks 12<1000000, no hot path) · round 0 · members: B-assert-ctx, L6, C-assert-xhigh, F · families: anthropic,openai

Confidence: 3/5

Findings

• P1 hermes_cli/kanban_db.py:774 — PID reuse · agreed: B-assert-ctx (openai)
• P1 hermes_cli/kanban_db.py:7835 — Reboot Identity · agreed: B-assert-ctx,C-assert-xhigh (openai, anthropic)
• P1 hermes_cli/kanban_db.py:7777 — Include boot identity in Linux start tokens · agreed: C-assert-xhigh,F (anthropic, openai)
• P1 hermes_cli/kanban_db.py:7769 — Do not accept different process start ticks within a 50 ms window · agreed: F (openai)

---

FleetReview provenance · models: B=gpt-6-sol, C=claude-code-opus-5-5, F=gpt-6-sol · cost: $1.25 · duration: 3m 05s · rounds: 1 · files examined: 2