fix(approvals): normalize routed household profile guard

hermes_cli/write_approval_commands.py

@@ -24,9 +24,13 @@
 HOUSEHOLD_PROFILES = frozenset({"family", "home", "partner", "kid-1", "kid-2"})
 
 
-def approval_toggle_allowed(profile_name: str) -> bool:
+def approval_toggle_allowed(profile_name: str | None) -> bool:
     """Return whether a profile may change its durable-write approval gates."""
-    return (profile_name or "").strip().lower() not in HOUSEHOLD_PROFILES
+    normalized = (profile_name or "").strip().lower()
+    # Missing profile identity must fail closed. In a multiplexed gateway, an
+    # unstamped route must never inherit toggle permission from an unknown
+    # process/default profile.
+    return bool(normalized) and normalized not in HOUSEHOLD_PROFILES
 
 
 def approval_profile_name(source_profile: str | None, active_profile: str | None) -> str:

tests/gateway/test_household_approval_toggle_guard.py

@@ -40,4 +40,4 @@ def test_routed_profile_wins_over_active_profile(
 ):
     resolved = approval_profile_name(source_profile, active_profile)
     assert resolved == expected
-    assert approval_toggle_allowed(resolved) is (expected != "family")
+    assert approval_toggle_allowed(resolved) is (bool(expected) and expected != "family")

tests/tools/test_write_approval.py

@@ -42,6 +42,8 @@ def test_household_profiles_cannot_toggle_approval_gate():
 
     for profile in ("family", "home", "partner", "kid-1", "kid-2"):
         assert approval_toggle_allowed(profile) is False
+    assert approval_toggle_allowed("") is False
+    assert approval_toggle_allowed(None) is False
     assert approval_toggle_allowed("dev") is True
     assert approval_toggle_allowed("rescue") is True