fix(gateway): word and send shutdown notices as the owning profile by iainlane · Pull Request #128952 · NousResearch/hermes-agent

iainlane · 2026-09-30T04:46:06Z

Stack

All campaign PRs in this section target main. This list records logical merge order. Nesting means the parent PR must merge before its child. Every prerequisite for a dependent must merge first. Only adjacent layers are shown; each linked PR description lists its other dependencies.

This PR has no prerequisites and can merge at any time. Its nested dependents must merge afterwards.

fix(gateway): word and send shutdown notices as the owning profile #128952
- feat(matrix): present identity-bound approval cards #126288
- fix(cron): preserve profile bot selection during reconnects #130639

A multiplexed gateway could send shutdown notices in the wrong language, ignore a secondary profile's opt-out, or inspect an interrupted cron job in another profile's store. Bind each notice to its owning home and resolve the job, wording, preference and delivery adapters inside that scope. The default profile is bound explicitly even when a named profile launched the gateway.

Interrupted-run records include their owning home. One failed profile does not prevent later notices, and deduplication includes the profile and job ID. Manual cron runs and interrupted-run notices use the same gateway adapter policy. Credentialless satellite profiles can use only exact enabled primary routes.

History and current source

This seven-record revision composes the complete original snapshots onto captured upstream 3637c512fc3211bdccb61b7140d09ac1018508ba. Every original author and committer header, date, timezone and full message prefix remains intact. All seven records remain non-empty. Only the first extraction record adds a composition rationale. The original contribution cf5be078b89016b68fb766fd65aa7625520ece93 remains in the credited copy of the owning-profile notice change.

The complete shutdown notice, tool-process teardown and cron interruption methods move to their existing topical siblings. Each interruption method preserves the actual captured-upstream body and the original late imports of scheduler-owned mutable state. The sole conflict selects the current unquoted return annotation for _install_fire_secret_scope; every other path joins automatically. The current session-end, watchdog and owning-profile contracts remain unchanged.

Review the own layer above the captured upstream revision.

Current verification and limits

The canonical runner passes 171 cases in 16 complete files with zero resource, runtime, unraisable-exception or unhandled-thread warnings. Four Linux-only skips are recorded separately. All selected files execute through interpreter shutdown with zero retries. Real temporary homes exercise A/B/A language and preference changes, satellite adapter routing and failure isolation.

The complete current-upstream profile module reproduces the expected owning-language and opt-out assertion failure, with four preserved controls. The candidate's complete five-case module passes. The failed control file is excluded from passing totals.

Both full original and candidate 17-file captures leave tests/cron/test_scheduler.py non-green because existing fixtures leave event loops and sockets unclosed. Each file reports two resource-induced failures and 93 partial passes. The entire file and every partial pass are excluded. Warning collection occurs at different later test IDs, so the review does not claim identical failed IDs. The three complete defining classes are byte- and AST-identical on the old parent, captured upstream, actual original head and candidate. This is a separate existing fixture follow-up; no production or fixture repair is included here.

Every tracked Python, configuration, lock and runner input is authenticated against the exact Git blob before and after the original, candidate and causal executions. The canonical runner is restored exactly. The complete 16-path type comparison reports 158 findings on the actual original head, 163 on captured upstream and 156 on the candidate. Every candidate occurrence matches a complete original or upstream lexical span, full statement AST, relative statement position and occurrence count. Existing extracted-owner paths are normalised explicitly. No findings are introduced. Ruff and changed-line whitespace checks pass; the same 15 inherited formatting paths remain non-green.

Local joins with the frozen audit base and captured upstream are clean and produce the exact candidate tree. Earlier 266-case verification and other historical results describe their recorded revisions. No fresh native Matrix or hosted CI acceptance is claimed. The Linux skips require the corresponding host lane.

The startup-notice repair, ticker-wide adapter parity and stored-session profile repair remain separate continuations. This change preserves the Matrix status-notice integration point.

whyyagswhy · 2026-09-30T04:46:35Z

Independent verification on the PR head (acdadf2): shutdown suites 45/45 green across 4 files on Linux. Wording and sending shutdown notices as the owning profile holds. No findings.

Shutdown notice delivery and tool process teardown were embedded in the large shutdown module. Cron interruption marking also shared the large scheduler module, although the gateway invokes that operation directly. Move those topics into sibling modules before changing profile notice behaviour. Keep the scheduler's mutable execution state in its existing module and resolve that state when interruption functions run. Shutdown methods remain available through the runner's mixin hierarchy, and the process teardown methods resolve the original shutdown class lazily. Update internal imports, patch targets and developer documentation to refer to the defining modules. Compose the extraction against the frozen upstream99a source. Retain the existing session-end mixin alongside notices and process teardown. Move the three current interruption functions without changing their bodies, apart from late imports of scheduler-owned state. Keep the watchdog in its current defining liveness module. Compose the preserved extraction against captured upstream3637. Keep the current unquoted fire-secret-scope return annotation. The three moved cron interruption bodies remain exact upstream, apart from their original late imports of scheduler-owned mutable state. All other current scheduler and shutdown declarations remain in the automatic join.

On a multiplexed gateway, shutdown notices used the launch profile's language and notification settings. Interrupted cron jobs in secondary profiles could also lose their notices because the notifier read the launch profile's cron store and used only its adapters. Resolve each notice inside the owning profile's runtime scope and read that profile's notification settings. Bind the default profile explicitly when the multiplex host was launched with a named profile. Interrupted cron runs now include their profile home, so the notifier reads the right cron store and selects the same delivery adapters as a manual cron run. The profile selection is shared by both delivery paths. Guard each interrupted run separately so a failure in one profile does not prevent later profiles from receiving their notices. Deduplicate by profile and job ID, including cases where profiles have the same job ID. Tests alternate between two profile homes with different languages and notification settings. They exercise the notices through each profile's own adapter and the routing rules for credentialless satellite profiles. (cherry picked from commit 3899b1b) Adapt the credited source to current main6d499 after mechanical shutdown and interruption extraction. Internal callers import the new defining modules; all original profile notice contracts remain. Original-source-commit: cf5be07

The shared delivery helper accepts the primary profile as None, while satellite detection expects a profile identifier. Return the primary adapter map directly before calling satellite detection. Route entries always specify a secondary profile, so this preserves primary delivery. Declare the runner's restart flag in the extracted notice mixin and use an explicit string for the platform value passed to notice destinations. These contracts retain the existing runtime values without relying on incomplete enum or mixin inference.

The worker-launch doubles raised TimeoutExpired even when wait() had no timeout. Terminal ledger results allow the gateway to return before the worker exits, so the existing background reaper invokes that blocking wait. The doubles then raised in its thread and failed strict warning checks on unmodified main. Let a blocking wait complete the fake worker while preserving timeout failures for bounded waits. Keep the original launch, adoption and Python-path assertions unchanged.

The extracted notice mixin invokes delivery selection and thread metadata methods that GatewayRunner provides through its other components. Declare those two callable contracts with their actual argument and result types so the sibling expresses its concrete host requirements. The metadata callback preserves the existing gateway method's optional routing arguments and extensible metadata values. No runtime wrapper or fallback implementation is added.

The multi-target delivery tests return predetermined futures from a mocked executor. The mock never schedules the submitted send coroutine, so each attempt leaked an unstarted coroutine and strict warning checks failed during collection or teardown on unmodified main. Close the coroutine when the fake executor accepts it and retain the original future outcomes. These tests assert fallback attempts and error aggregation, not SMTP transport execution. Closing the unscheduled input is the fake executor's cleanup responsibility, without suppressing a production warning or changing the delivery assertions. The cron profile-gate test also patched a removed housekeeping helper. Patch the current production binding so the wiring test does not start an unrelated housekeeping thread with its intentionally minimal ticker fake. Keep every existing profile-gate assertion unchanged.

The credited repair explains why shutdown notices need the owning profile. Keep that rationale in its commit message and describe the resulting scope and adapter requirements in the method documentation. Remove the comment beside the ordinary notice-key assignment. Only comments and docstrings change. The production AST is unchanged when docstrings are excluded.

A queued message leaves its adapter slot before voice transcription and recursive turn preparation finish. Sender deletion could therefore miss that input and allow the deleted text or audio to start the next turn. Overlapping busy handlers also replaced the lane's single reservation. Keep each preparing input in the existing dispatch reservations until steering, redirecting or turn dispatch claims it. Withdrawal rebuilds the remaining contributions in place, including admission copies, so waiting preparers cannot continue with a detached event. Revision checks repeat transcription and inbound preparation after partial withdrawal and check again after transcript echoes and processing hooks. Cancellation restores unclaimed input in FIFO order and releases the captured reservation. A previous task's completion cannot release a new owner. Shutdown snapshots and capacity checks enumerate all accepted reservations, while new intake preparations do not bypass queue limits. The two lifecycle contracts reproduce deletion during STT, transcript echoes, admission rewrites and recursive preparation. They also verify partial voice retention, overlapping busy input and the irreversible claim boundary under cancellation. Automatic durable restoration remains a separate consumer of the pending snapshots. The pending-input protocol resolves the session key before the pause gate. The existing paused-turn test used a bare runner and a source without thread identity, so it failed before checking the paused reply. Construct a real GatewayRunner, MessageEvent and SessionSource while preserving its three original paused-reply assertions. This owner integrates only the pause-fixture hunk from original campaign correction 61048ea. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations. This unit-fixture correction provides no new native validation.

Shutdown notices now resolve translations in their topical module. The native import-lifetime test still warmed the locale through the old shutdown module and failed before exercising transport cleanup. Warm through the defining translation module so the existing deadline and cleanup assertions exercise the shutdown path again. The paused-turn fixture omitted fields that canonical session identity reads before the pause gate. Construct a real runner, message and source for that integration case. Its existing paused-reply assertions remain unchanged. All assertions in both affected files are preserved. Historical correction attribution for PR NousResearch#130938. Original-campaign-source: 61048ea Integrated-pause-owner: e647f73 Original-public-owner: 5a17889 This empty commit records the original correction author, date and full message. Only its real-runner, MessageEvent and SessionSource pause-test hunk is integrated into this owner. All existing pause-reply assertions remain unchanged. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations; it is not integrated here. No fresh native validation or complete record374 closure is claimed.

A queued message leaves its adapter slot before voice transcription and recursive turn preparation finish. Sender deletion could therefore miss that input and allow the deleted text or audio to start the next turn. Overlapping busy handlers also replaced the lane's single reservation. Keep each preparing input in the existing dispatch reservations until steering, redirecting or turn dispatch claims it. Withdrawal rebuilds the remaining contributions in place, including admission copies, so waiting preparers cannot continue with a detached event. Revision checks repeat transcription and inbound preparation after partial withdrawal and check again after transcript echoes and processing hooks. Cancellation restores unclaimed input in FIFO order and releases the captured reservation. A previous task's completion cannot release a new owner. Shutdown snapshots and capacity checks enumerate all accepted reservations, while new intake preparations do not bypass queue limits. The two lifecycle contracts reproduce deletion during STT, transcript echoes, admission rewrites and recursive preparation. They also verify partial voice retention, overlapping busy input and the irreversible claim boundary under cancellation. Automatic durable restoration remains a separate consumer of the pending snapshots. The pending-input protocol resolves the session key before the pause gate. The existing paused-turn test used a bare runner and a source without thread identity, so it failed before checking the paused reply. Construct a real GatewayRunner, MessageEvent and SessionSource while preserving its three original paused-reply assertions. This owner integrates only the pause-fixture hunk from original campaign correction 61048ea. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations. This unit-fixture correction provides no new native validation.

Shutdown notices now resolve translations in their topical module. The native import-lifetime test still warmed the locale through the old shutdown module and failed before exercising transport cleanup. Warm through the defining translation module so the existing deadline and cleanup assertions exercise the shutdown path again. The paused-turn fixture omitted fields that canonical session identity reads before the pause gate. Construct a real runner, message and source for that integration case. Its existing paused-reply assertions remain unchanged. All assertions in both affected files are preserved. Historical correction attribution for PR NousResearch#130938. Original-campaign-source: 61048ea Integrated-pause-owner: e647f73 Original-public-owner: 5a17889 This empty commit records the original correction author, date and full message. Only its real-runner, MessageEvent and SessionSource pause-test hunk is integrated into this owner. All existing pause-reply assertions remain unchanged. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations; it is not integrated here. No fresh native validation or complete record374 closure is claimed.

A queued message leaves its adapter slot before voice transcription and recursive turn preparation finish. Sender deletion could therefore miss that input and allow the deleted text or audio to start the next turn. Overlapping busy handlers also replaced the lane's single reservation. Keep each preparing input in the existing dispatch reservations until steering, redirecting or turn dispatch claims it. Withdrawal rebuilds the remaining contributions in place, including admission copies, so waiting preparers cannot continue with a detached event. Revision checks repeat transcription and inbound preparation after partial withdrawal and check again after transcript echoes and processing hooks. Cancellation restores unclaimed input in FIFO order and releases the captured reservation. A previous task's completion cannot release a new owner. Shutdown snapshots and capacity checks enumerate all accepted reservations, while new intake preparations do not bypass queue limits. The two lifecycle contracts reproduce deletion during STT, transcript echoes, admission rewrites and recursive preparation. They also verify partial voice retention, overlapping busy input and the irreversible claim boundary under cancellation. Automatic durable restoration remains a separate consumer of the pending snapshots. The pending-input protocol resolves the session key before the pause gate. The existing paused-turn test used a bare runner and a source without thread identity, so it failed before checking the paused reply. Construct a real GatewayRunner, MessageEvent and SessionSource while preserving its three original paused-reply assertions. This owner integrates only the pause-fixture hunk from original campaign correction 61048ea. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations. This unit-fixture correction provides no new native validation. Cancellation before transcript ownership keeps the provisional input for shutdown recovery. Exact durable input ownership excludes active input from pending capacity. Withdrawal closes at the original synchronous dispatch boundary, separately from recovery ownership. Plugin consumption, lease refusal and completed handlers still finish their dispatch claims.

Shutdown notices now resolve translations in their topical module. The native import-lifetime test still warmed the locale through the old shutdown module and failed before exercising transport cleanup. Warm through the defining translation module so the existing deadline and cleanup assertions exercise the shutdown path again. The paused-turn fixture omitted fields that canonical session identity reads before the pause gate. Construct a real runner, message and source for that integration case. Its existing paused-reply assertions remain unchanged. All assertions in both affected files are preserved. Historical correction attribution for PR NousResearch#130938. Original-campaign-source: 61048ea Integrated-pause-owner: e647f73 Original-public-owner: 5a17889 This empty commit records the original correction author, date and full message. Only its real-runner, MessageEvent and SessionSource pause-test hunk is integrated into this owner. All existing pause-reply assertions remain unchanged. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations; it is not integrated here. No fresh native validation or complete record374 closure is claimed.

A queued message leaves its adapter slot before voice transcription and recursive turn preparation finish. Sender deletion could therefore miss that input and allow the deleted text or audio to start the next turn. Overlapping busy handlers also replaced the lane's single reservation. Keep each preparing input in the existing dispatch reservations until steering, redirecting or turn dispatch claims it. Withdrawal rebuilds the remaining contributions in place, including admission copies, so waiting preparers cannot continue with a detached event. Revision checks repeat transcription and inbound preparation after partial withdrawal and check again after transcript echoes and processing hooks. Cancellation restores unclaimed input in FIFO order and releases the captured reservation. A previous task's completion cannot release a new owner. Shutdown snapshots and capacity checks enumerate all accepted reservations, while new intake preparations do not bypass queue limits. The two lifecycle contracts reproduce deletion during STT, transcript echoes, admission rewrites and recursive preparation. They also verify partial voice retention, overlapping busy input and the irreversible claim boundary under cancellation. Automatic durable restoration remains a separate consumer of the pending snapshots. The pending-input protocol resolves the session key before the pause gate. The existing paused-turn test used a bare runner and a source without thread identity, so it failed before checking the paused reply. Construct a real GatewayRunner, MessageEvent and SessionSource while preserving its three original paused-reply assertions. This owner integrates only the pause-fixture hunk from original campaign correction 61048ea. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations. This unit-fixture correction provides no new native validation. Withdrawal closes at the original synchronous dispatch boundary, separately from durable recovery ownership. A provisional input remains recoverable after withdrawal closes; an input with durable ownership is neither withdrawn nor counted against pending capacity.

Shutdown notices now resolve translations in their topical module. The native import-lifetime test still warmed the locale through the old shutdown module and failed before exercising transport cleanup. Warm through the defining translation module so the existing deadline and cleanup assertions exercise the shutdown path again. The paused-turn fixture omitted fields that canonical session identity reads before the pause gate. Construct a real runner, message and source for that integration case. Its existing paused-reply assertions remain unchanged. All assertions in both affected files are preserved. Historical correction attribution for PR NousResearch#130938. Original-campaign-source: 61048ea Integrated-pause-owner: e647f73 Original-public-owner: 5a17889 This empty commit records the original correction author, date and full message. Only its real-runner, MessageEvent and SessionSource pause-test hunk is integrated into this owner. All existing pause-reply assertions remain unchanged. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations; it is not integrated here. No fresh native validation or complete record374 closure is claimed.

A queued message leaves its adapter slot before voice transcription and recursive turn preparation finish. Sender deletion could therefore miss that input and allow the deleted text or audio to start the next turn. Overlapping busy handlers also replaced the lane's single reservation. Keep each preparing input in the existing dispatch reservations until steering, redirecting or turn dispatch claims it. Withdrawal rebuilds the remaining contributions in place, including admission copies, so waiting preparers cannot continue with a detached event. Revision checks repeat transcription and inbound preparation after partial withdrawal and check again after transcript echoes and processing hooks. Cancellation restores unclaimed input in FIFO order and releases the captured reservation. A previous task's completion cannot release a new owner. Shutdown snapshots and capacity checks enumerate all accepted reservations, while new intake preparations do not bypass queue limits. The two lifecycle contracts reproduce deletion during STT, transcript echoes, admission rewrites and recursive preparation. They also verify partial voice retention, overlapping busy input and the irreversible claim boundary under cancellation. Automatic durable restoration remains a separate consumer of the pending snapshots. The pending-input protocol resolves the session key before the pause gate. The existing paused-turn test used a bare runner and a source without thread identity, so it failed before checking the paused reply. Construct a real GatewayRunner, MessageEvent and SessionSource while preserving its three original paused-reply assertions. This owner integrates only the pause-fixture hunk from original campaign correction 61048ea. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations. This unit-fixture correction provides no new native validation. Withdrawal closes at the original synchronous dispatch boundary, separately from durable recovery ownership. A provisional input remains recoverable after withdrawal closes; an input with durable ownership is neither withdrawn nor counted against pending capacity.

Shutdown notices now resolve translations in their topical module. The native import-lifetime test still warmed the locale through the old shutdown module and failed before exercising transport cleanup. Warm through the defining translation module so the existing deadline and cleanup assertions exercise the shutdown path again. The paused-turn fixture omitted fields that canonical session identity reads before the pause gate. Construct a real runner, message and source for that integration case. Its existing paused-reply assertions remain unchanged. All assertions in both affected files are preserved. Historical correction attribution for PR NousResearch#130938. Original-campaign-source: 61048ea Integrated-pause-owner: e647f73 Original-public-owner: 5a17889 This empty commit records the original correction author, date and full message. Only its real-runner, MessageEvent and SessionSource pause-test hunk is integrated into this owner. All existing pause-reply assertions remain unchanged. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations; it is not integrated here. No fresh native validation or complete record374 closure is claimed.

A queued message leaves its adapter slot before voice transcription and recursive turn preparation finish. Sender deletion could therefore miss that input and allow the deleted text or audio to start the next turn. Overlapping busy handlers also replaced the lane's single reservation. Keep each preparing input in the existing dispatch reservations until steering, redirecting or turn dispatch claims it. Withdrawal rebuilds the remaining contributions in place, including admission copies, so waiting preparers cannot continue with a detached event. Revision checks repeat transcription and inbound preparation after partial withdrawal and check again after transcript echoes and processing hooks. Cancellation restores unclaimed input in FIFO order and releases the captured reservation. A previous task's completion cannot release a new owner. Shutdown snapshots and capacity checks enumerate all accepted reservations, while new intake preparations do not bypass queue limits. The two lifecycle contracts reproduce deletion during STT, transcript echoes, admission rewrites and recursive preparation. They also verify partial voice retention, overlapping busy input and the irreversible claim boundary under cancellation. Automatic durable restoration remains a separate consumer of the pending snapshots. The pending-input protocol resolves the session key before the pause gate. The existing paused-turn test used a bare runner and a source without thread identity, so it failed before checking the paused reply. Construct a real GatewayRunner, MessageEvent and SessionSource while preserving its three original paused-reply assertions. This owner integrates only the pause-fixture hunk from original campaign correction 61048ea. The native locale-warming hunk has separate NousResearch#126281 and NousResearch#128952 union destinations. This unit-fixture correction provides no new native validation. Cancellation before transcript ownership keeps the provisional input for shutdown recovery. Exact durable input ownership excludes active input from pending capacity. Withdrawal closes at the original synchronous dispatch boundary, separately from recovery ownership. Plugin consumption, lease refusal and completed handlers still finish their dispatch claims. Retain linked pending reservations until cancelled processing completes. The completion callback and waiter share reconciliation for each original input, so non-durable input returns to the queue once and durable input is excluded. Preserve the existing synchronous withdrawal boundary and current ownership fixtures when composing the updated prerequisite.