[Kyzcreig]

Fixes the FALSE POSITIVE in #853's connect() gate. Found by argus reviewing
#858; the defect is #853's, so it lands on #853's branch and #858 inherits it.

The bug

Both live-system guards decide "is this production?" from
hermes_state._real_platform_state_root(), which read os.path.expanduser("~")
— on POSIX, just $HOME.

But monkeypatch.setenv("HOME", tmp_path) is THE hermetic-isolation idiom in
this repo (51 test files use it). Under that idiom the test's own tmpdir IS the
platform-default production root for the process, so a hermetic board at
<tmp>/.hermes/kanban.db IS the live board — and the gate refused it.

Measured red, 2 files / 24 tests:

file	before
tests/gateway/test_kanban_dispatcher_standby.py	21 errors, all LiveBoardWriteRefused at setup
tests/tools/test_execute_code_session_provenance.py	3 failed (child process exits 1 on the same guard)

The fix — 4 functional lines

Anchor on the passwd entry instead of $HOME. It is a property of the UID,
so it does not move when a process rewrites $HOME — which is exactly the
discriminator between "the operator's real root" and "a test redirected HOME
here".

This is a structural discriminator, not a per-test marker. A
@pytest.mark.live_system_guard_bypass equivalent was the obvious seam (the
state.db guard has one) but it is a remember-to-do-it mitigation — the same
shape as the opt-in HERMES_KANBAN_SANDBOX=1 that already failed twice
(2026-08-08, 2026-09-21). A guard that fires on the standard isolation idiom
teaches people to disarm it globally; keeping it precise is what keeps it armed.

The old docstring's actual requirement — not reachable through a monkeypatchable
Path.home() — is preserved. $HOME only ever aliased the passwd entry when
nothing had redirected it.

Falls back to expanduser when pwd is unavailable (Windows) or names a
non-existent dir (service accounts, some container images): a bogus anchor would
point the deny-list at a root nothing resolves to and disarm the guard silently.

Fixed at the shared definition, so both members of the class get it — the
kanban board gate and hermes_state's state.db guard read the same function.

Verification

acceptance	result
1. standby	21 passed (was 21 errors)
2. provenance	8 passed (was 3 failed)
3. gate still refuses the real leak	two-door control on the #858 stack: 6/6 live doors REFUSED, effect-free (no .init.lock, no .bak, no ghost db), non-live scratch control still ALLOWED
4. fleet-brick	ALLOWED against the real ~/.hermes/kanban.db from a live worker env — production not bricked
5. measured FP trip set	2 files → 0 (harness re-run over all 10 $HOME-redirecting kanban files, not grepped)
6. mutation-proof	4/4 KILLED
7. test_kanban*.py	1019 passed / 5 failed / 3 skipped — byte-identical failure set to the base tree

Acceptance 3 note: argus's argus_two_door.py declares its synthetic live board
production by faking $HOME — the exact classification this PR removes, so it
dies on its own seed assert. Rather than weaken its assertions I re-ran the same
six doors with the root declared through
hermes_state._STATE_DB_GUARD_EXTRA_DENY_ROOTS, the documented injection point
tests/conftest.py and the guard's own test suite already use.

Acceptance 7 note: the card predicted 1023 passed. The base tree measures the
same 1019 / 5 / 3 — that count was taken against a different tree state, not
regressed by this PR. The failure sets diff clean, so the delta this change
causes is zero.

Mutation battery (each a different way to get the anchor wrong):

M1  revert to os.path.expanduser("~")   -> 8 failed, 21 errors   KILLED
M2  anchor on Path.home()               -> 5 failed, 24 errors   KILLED
M3  account home returns $HOME          -> 9 failed, 21 errors   KILLED
M4  account home always None            -> 8 failed, 21 errors   KILLED
baseline before/after                   -> 37 passed

M4 matters on its own: it proves the fallback is gated, not load-bearing by
accident.

New tests (tests/hermes_state/test_production_root_anchor.py, 8 tests) pin
both directions. A test that only pinned "the tmpdir isn't production" would
pass just as well if the guard went blind entirely — the failure mode that is
far worse than the false positive — so the real account root is pinned as
still-production, including while $HOME is redirected.

Card t_c64b9d44.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Kyzcreig]

FleetReview

Reviewed with 2 of 3 model families — openai unavailable.

Confidence: 3/5

Findings

• P1 hermes_state.py:618 — Production anchor now disagrees with how the app actually resolves its home ($HOME), so the guard goes blind when HOME != passwd pw_dir
• P2 hermes_state.py:582 — Uncached NSS lookup (pwd.getpwuid) + stat on every DB connect, including the dispatcher's tick loop
• P2 tests/hermes_state/test_production_root_anchor.py:96 — Tests assume home
• P2 tests/hermes_state/test_production_root_anchor.py:43 — _account_home() skips the implementation's isdir fallback, so 6 of 8 tests fail on exactly the hosts the fallback exists for

---

FleetReview provenance · models: C=claude-code-opus-5, D=grok-4.6, G=grok-4.6 · cost: $5.87 · duration: 22m 36s · rounds: 1 · files examined: 2

[Kyzcreig]

Landed by content on main via stack tip #874 (this head is an ancestor of #874's merged tip). Closing the ghost PR — apollo/fr-pause-0922.

[Kyzcreig]

Reopened — closed one step early: #874 is still in the merge queue, not merged. Will close by content once it lands. — apollo

[Kyzcreig]

Landed by content on main via stack tip #874 (merged 2026-09-23T03:27:59Z; this head is an ancestor of it). Closing the ghost PR — apollo/fr-pause-0922.