[teknium1]

Kanban workers boot on store-Python / PM installs, unknown assignees leave a board trace, PR acceptance reads GitHub as the card's assignee profile, and a dead credential at worker startup exits terminal instead of burning the retry budget.

Per issue

• Fixes kanban dispatcher: worker spawn argv guard checks importability in parent, unsound for bare-interpreter child (ModuleNotFoundError: hermes_cli) #122299, fixes Kanban worker spawn dies with 'No module named hermes_cli' on PM/source installs: module-argv guard trusts find_spec, but the worker env strips the PYTHONPATH that provides it #122487, fixes Kanban workers crash after hermes update: dispatcher picks '-m hermes_cli.main' from a find_spec probe polluted by the gateway bootstrap sys.path #122500 — hermes_cli/kanban_db_dispatch.py::_default_spawn now pins the running install's root on the worker env's PYTHONPATH whenever the module argv (sys.executable -m hermes_cli.main) is chosen, via cron's existing pin_hermes_tree_on_pythonpath ([Bug]: Restart-safe external cron worker fails on dispatch due to symlink resolution in sys.executable #112729). Root cause in one sentence: _resolve_hermes_argv's find_spec("hermes_cli") answers a question about the GATEWAY (where the launcher bootstrap injected the repo root into sys.path), while the worker env scrub strips Hermes-owned PYTHONPATH entries from the CHILD, so the bare interpreter died with ModuleNotFoundError: hermes_cli. hermes_cli.main → hermes_bootstrap → activate_dependencies then selects the committed PM dependency generation in the child, so a store Python with an empty site-packages boots too. A resolved shim path ($HERMES_BIN, which hermes) owns its imports and is left alone. Same class fixed in the Bot Chat delivery runner (cron/scheduler_delivery.py, module argv after served_profile_child_env). Salvages fix(kanban): carry the module argv's import root to the worker env #122420 by @liuhao1024 (earliest; fix(kanban): spawn workers through the installation-bound launcher bootstrap #125088 by @intellectronica reaches the same outcome by switching the argv to -I -c <bootstrap> and fix(launch): publish launchers on a runtime that can spawn a child (kanban/cron workers) #123041 by @strokesws by republishing launchers — both superseded by the smaller pin, which keeps the argv shape gateway/status.py's cmdline matchers recognise).
• Fixes Kanban dispatcher silently drops cards with an unknown assignee — card sits in ready forever with zero board diagnostics #122422 — _dispatch_lane_task writes a per-task skipped_nonspawnable event {"assignee": <name>} when the assignee profile does not exist, so hermes kanban show/tail name the missing profile. Written once per card (only when the card's latest event is not already this skip), because unlike a respawn guard the condition never expires: one row per tick forever, or one per foreign home per tick on a shared board (Kanban dispatch requires assignee profiles to exist locally: one-agent-per-container fleets sharing a board silently drop every cross-agent card #101015), would have been the noise. Salvages fix(kanban): write per-task event when dispatcher skips unknown assignee #122567 by @Finn763.
• Part of Kanban dispatch requires assignee profiles to exist locally: one-agent-per-container fleets sharing a board silently drop every cross-agent card #101015 — the silent cross-home drop is now visible on the card (the event above). The remaining atom (a self-identity filter so the container that IS the assignee claims it) is a shared-board claim-policy question settled as an opt-in allowlist by 2d46af3 (kanban.dispatch_profiles, Kanban dispatcher claims across homes on a shared board: profile_exists("default") is unconditionally True, so every home can claim default-assigned cards #110995/fix(kanban): per-home dispatch claim allowlist for shared boards (#110995) #111004) rather than zero-config identity mapping; not changed here.
• Fixes [Bug]: kanban: PR acceptance uses the ambient gh login, so it fails when the card's repo needs the assignee profile's GitHub identity #122689 — hermes_cli/kanban_pr_acceptance.py::_api runs gh api under served_profile_child_env(target_home=<assignee home>, inherit_credentials=True): the assignee profile's own GH_TOKEN/GH_CONFIG_DIR (its .env + external sources), launch residue scrubbed. A 401/403/404 or a null GraphQL repository is classified auth naming the repository instead of a retryable infra. The assignee home is resolved exactly as the dispatcher resolves the worker's home (resolve_profile_env). Salvages fix(kanban): PR acceptance runs gh as the assignee profile's login #122714 by @dskwe (trimmed: the second commit's operation×status refusal ladder is not taken).
• Part of [Bug]: kanban dispatcher claims and spawns a worker without probing the profile's model — a dead credential costs a claim plus a full worker lifetime #122703 — a startup credential failure with relogin_required (revoked key, model access disabled) now exits KANBAN_TERMINAL_PROVIDER_EXIT_CODE (78) so the dispatcher blocks the card at once instead of charging the whole failure_limit; unknown startup failures keep exit 1; a turn result still takes precedence. Salvages fix(kanban): preserve credential startup failure exit codes #122716 by @Wenfengcheng. The pre-claim model probe half (fix(kanban): probe model/provider pins before the worker lifecycle is spent #122893 by @strzhao, +735) is a new capability with a per-tick network cost and is left for a decision — not relabelled away, see not_covered in the lane report.

WHEN × WHERE (profile-scope table)

• L5 (child processes) × T1/T2/T3/T4/T6: kanban worker + Bot Chat delivery runner — both spawn through build_subprocess_env/served_profile_child_env, never os.environ.copy(); the pin edits only the built child env.
• L5 × T2/T3/T7: gh acceptance child — served_profile_child_env(target_home=B); B-only .env GH_TOKEN resolves, launch GH_TOKEN/GH_CONFIG_DIR residue absent.
• L3 (dispatcher ticker) × T2/T10: the skip event is idempotent across ticks and across homes sharing one kanban.db.

Validation

Item	Test	origin/main	this head
#122299/#122487/#122500	tests/hermes_cli/test_kanban_db.py::test_default_spawn_pins_repo_root_on_module_worker_pythonpath (FakePopen; module argv → PYTHONPATH[0] == install root; shim argv → untouched)	1 failed (KeyError: 'PYTHONPATH')	3 passed (with the two existing _resolve_hermes_argv tests)
#122422 / #101015	tests/hermes_cli/test_kanban_dispatch_unknown_assignee_event.py (event named after one tick; exactly one after three ticks; dry-run writes none)	2 failed	2 passed
#122689	tests/hermes_cli/test_kanban_pr_acceptance.py::test_acceptance_runs_gh_as_the_assignee_profile (ambient GH_TOKEN=launch-token + GH_CONFIG_DIR residue vs B's .env GH_TOKEN=b-token; fake gh dumps its env and returns repository: null)	1 failed	1 passed (file: 3 passed)
#122703	tests/hermes_cli/test_kanban_credential_startup_exit.py (revoked→78 / quota→75 / unknown→1 × quiet × worker; turn result precedence)	6 failed	15 passed

ruff check clean on touched files; check_no_tmp_literals.py clean; audit_pr_attribution.py --fix: all contributor emails mapped; git diff --check clean. Subset suite (kanban + single-query + cron bot-chat delivery files) run result is recorded in the lane report.

Infographic

DEGRADED — image_generate refused (fal.ai balance exhausted: "User is locked. Reason: Exhausted balance"); style picked was holo-tcg. No image embedded.

Review fixes

• MAJOR kanban_pr_acceptance.py::_gh_env (assignee with no own GH_TOKEN/GH_CONFIG_DIR fell through to the launch user's ~/.config/gh because HOME/XDG stay the launch process's) → for a routed assignee home whose child env has none of GH_TOKEN/GITHUB_TOKEN/GH_CONFIG_DIR, GH_CONFIG_DIR is pinned to <profile_home>/gh; gh exits 4 ("authentication required"), which _api now classifies auth naming the profile. Popping XDG_CONFIG_HOME was not needed: gh consults GH_CONFIG_DIR first. Test: test_kanban_pr_acceptance.py::test_assignee_without_own_gh_login_never_falls_through_to_ambient_login (red → green).
• MINOR (a) _assignee_profile_home fail-open → profile resolution moved inside collect_acceptance (assignee= replaces profile_home=); an assigned card whose profile cannot be resolved raises _GateAuthError → classification=auth naming the profile, gh never spawned. Only unassigned cards keep the ambient env. Test: test_assigned_card_with_unresolvable_profile_is_auth_not_ambient.
• MINOR (b) docs → kanban.md: GH_TOKEN must live in the profile's .env/secret source; a shell/systemd export is scrubbed and never re-added.
• MINOR (c) Codex 200/non-JSON refresh body → invalid_json_relogin=False in hermes_cli/auth_codex.py (same as xAI), so the exit-78 startup gate cannot turn an edge misfire into a sticky terminal block. The 401–403 edge path (_codex_refresh_failure_error) is unchanged.
• MINOR (d) docs → kanban.md worker telemetry table gains the skipped_nonspawnable {assignee} row; the gave_up row notes that a startup relogin-required credential failure exits 78 (other startup failures 1).

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 37beb48 — fix(review): PR acceptance never falls through to the launch}

⚠️ Warnings

CI timings · View report · View job

Wall time 58m39s vs 1m29s (+3853.9%). 2 faster,

• Detect affected areas: -52.0s
• All required checks pass: -1.0s