fix(kanban): C4 backfill — close 11 board-gate bypasses (t_027d7fe7)

[ang-fleet-workers]

C4 retro-backfill (FleetReview 2026-09-27), kanban/board gates slice. Card t_027d7fe7, parent t_a2bf7813. Base 5a9d284.

Every one of the 21 instances was re-checked at base. Result: 11 confirmed and fixed here, 1 confirmed and routed to a follow-up card, 4 false positives, 5 dropped. That is 9 of 21 not fixed (43%), well above the report's 15-20% estimate.

Fixed (each has a test that fails on base and passes with the fix, plus a control)

Finding	Fix	Test
#951 kanban.py _caller_session_id	In the gateway, only the per-turn session contextvar counts. The resolver's os.environ fallback returns whichever chat's session is in the shared env, so a sessionless /kanban now resolves to None	c4_board_gates::test_gateway_sessionless_*
#956 kanban_db _spawned_owner_alive	The skip now uses the run's own claim-time max_runtime_seconds, not the card's current value (which can be shortened after release)	second_claim_class::test_cap_shortened_after_release_*
#960 goals.kanban_handoff_rejection	A judge error from a caller that inherited this card's worker env (the goal worker's CLI child) now refuses the handoff. Real operators still fail open	c4_board_gates::test_goal_worker_cli_child_*
#999 kanban_db _REVIEW_NA_INABILITY	Matches can't and curly-apostrophe n’t	review_coverage_gate (4 new params)
#999 dashboard plugin_api	A running card whose run was claimed from review can no longer be moved to todo/triage/scheduled. The move is refused before the reviewer worker is signalled; ready still resumes review	c4_board_gates::test_dashboard_*
#1021 kanban_db _terminate_reclaimed_worker	With no spawned bound and no start token, a "verified" identity is downgraded to unverified: the worker is held and never sent SIGTERM. The liveness verdict is unchanged	c4_board_gates::test_missing_spawn_evidence_*
#1034 kanban_survivor.preserve	_state() and the row-shape check moved inside a HOLD handler. A malformed survivor row now HOLDs with workspace_held	c4_board_gates::test_malformed_survivor_row_*
#1074 x2 kanban_db _actor_profiles / check_home_session	The caller session's owner profile now outranks the env profile. The raw env-profile assignee shortcut was removed. --operator and assignee authority can no longer come from a root-home repoint that reads default	c4_board_gates::test_root_repoint_*
#1081 tools/kanban_tools request_changes	A non-worker send-back on a parked review needs a bindable chat session, the same rule as the CLI (_operator_review_session_ref). Sessionless, cron and delegate-child callers are refused	review_sendback::test_tool_parked_send_back_refused_*
#1234 kanban_pr_freshness.check	Only the card's own handoff PRs (metadata.pr_url/pr/pr_urls, --survivor-pr) are armed for fleet-merge. A PR mentioned only in the prose still routes the card to review but is never armed	pr_freshness::test_e2e_pr_only_mentioned_*

Existing tests I changed (each one encoded the bypass):

• pr_freshness test_e2e_green_slice_armed_milestone_not: now names the PR in metadata.pr_url.
• second_claim_class test_expired_bounded_run_*: bounds the RUN, not the card afterwards.
• reclaim_unprovable_liveness test_reclaim_requeues_when_termination_actually_succeeded: seeds the dispatcher's spawned event.
• review_sendback tool tests: now run with a chat session.

Confirmed, not fixed here

• fix(kanban): budget per-tick relay spawns against eligible subs #985 pool budget starves the review lane: confirmed. The ready loop spends admitted_this_tick, and the reservation only holds back a spawn slot. This is a scheduling design change, so it goes to follow-up card t_becb0042.

False positives (no change)

• feat(kanban): home = session lineage (home_ids) + kanban.home_guard default refuse #982 test_kanban_home_lineage mock: I removed the _caller_session_lineage monkeypatch and ran the file: 22 passed, and the cross-key refusal still holds with the real fallback. The mock hides no bypass.
• feat(kanban): post-#951 — worker cards inherit parent home; list home-first + --all; pings carry home; task_events actor provenance #987 _worker_owns_card any link kind: @_home_session_guarded("link", task_param="child_id") on link_tasks. A worker cannot link itself onto a foreign card without a takeover, which is audited.
• feat(kanban): full-review coverage gate on request_changes (t_164f0178) #999 zero-width join: probe _review_na_reason_ok('n/a: could​not run mutation tests') → False. The existing param 'n/a: c​ould n​ot run' already covers it.
• feat(kanban): reviewer-swarm gates — per-profile cap mapping, load-gated spawns, review round cap, milestone-only review #1002 policy-skip dependency bypass: complete_task itself runs if not _parents_satisfied(conn, task_id): return False first, and inside its write txn.

Dropped

• revert(kanban): drop #890 sandbox-neutralised-pin warning (audit DROP, t_e23eb483) #1214 x3 (sandbox-neutralised-pin warning and its tests): the removal was the deliberate audit-DROP revert (revert(kanban): drop #890 sandbox-neutralised-pin warning (audit DROP, t_e23eb483) #1214, FINAL.md in docs(audit): fork-PR audit roll-up — FINAL table + ROLLUP (1,116 rows) #1128). Restoring it would reverse a ruled decision. The live-board R1 guard still refuses test contexts.
• feat(kanban): review_coverage records carry the reviewed PR head (head_sha) (t_7fee0f83) #1129 reviewer head_sha approval completes an open PR: this is intended per the in-code contract ("the PR it approved is OPEN by definition and the land queue merges it from that record"). The finding is a design question, not a bypass.
• fix(kanban): request-changes opens the review run for a parked review card (t_f31e2ff3) #1081 dashboard author spoof: the dashboard has no trusted per-user identity to derive from (comments use the same payload.author). There is nothing to fix without adding an auth identity.

Verification

Local runs are narrow only, through ~/.hermes/scripts/test-gate on the runtime venv (py3.11); CI is the suite. The 5 directly affected files: 187 passed with the fix. With the source reverted to base and the tests kept: 20 failed. The failures are exactly the new and changed regressions; controls pass on base. On a wider neighbour set, every other failure also fails identically on unmodified base (CLI tests that pick up this worker's env). ruff F/E9: no new findings.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[ang-fleet-lander]

🤖 merged-by: apollo · lane: kanban-merge-pass · gate: ADVISORY (FleetReview not green for 66dfd3e): fleetreview-advisory-20260927-standing.md · why: t_027d7fe7: C4 backfill slice: hermes-agent kanban/board gates — 21 instances (kanban_db.py ; Argus off card review (Ace 13:08), CI green

[ang-prism]

FleetReview

Review: post-merge · head 85829dbd5fc7 · duration 17m 06s
Profile: light (merit: default light: lines 558<800, files 13<1000000, hunks 27<1000000, no hot path) · policy: changed-lines>400
Roster: B-assert-ctx → gpt-6-sol (openai), B-state → gpt-6-sol (openai), F → gpt-6-sol (openai), G → grok-4.6 (xai)

Post-merge review (fleetreview:post-merge override): this reviewed the merge commit against its first parent — the bytes that already shipped. It is not a pre-merge gate pass.

profile: light (rule: default light: lines 558<800, files 13<1000000, hunks 27<1000000, no hot path) · round 0 · members: B-assert-ctx, B-state, F, G · families: openai,xai

Confidence: 1/5

Findings

• P0 tests/hermes_cli/test_kanban_c4_board_gates.py:3 — Tests Fail · agreed: B-assert-ctx (openai)
• P0 tests/hermes_cli/test_kanban_c4_board_gates.py:212 — Missing fixes · agreed: B-assert-ctx (openai)
• P0 tests/hermes_cli/test_kanban_c4_board_gates.py:146 — Failing regressions · agreed: B-state (openai)
• P1 plugins/kanban/dashboard/plugin_api.py:1005 — Ready move can discard an active review when a new parent blocks the card · agreed: F (openai)
• P0 hermes_cli/kanban_db.py:12765 — Regex import crash · agreed: G (xai)

---

FleetReview provenance · models: B=gpt-6-sol, D=grok-4.6, F=gpt-6-sol · cost: $2.24 · duration: 17m 04s · rounds: 1 · files examined: 13