fix(kanban): sync allowlisted forced skills before blocking

[hehehe0803]

Summary

• Extends Kanban forced-skill preflight from “detect missing skill and block” to “try one explicit allowlisted profile-skill sync, then block if still missing.”
• Keeps failure closed by default: no policy file, no sync script, non-allowlisted profile, non-allowlisted skill, or failed sync all leave the task blocked before worker spawn.
• Preserves worker crash-loop protection by raising a deterministic MissingForcedSkillsError before Popen rather than letting hermes -p ... --skills missing fail at CLI startup.
• Improves skill resolvability checks to cover directory names, relative paths, frontmatter name, plugin-qualified skills, env overlay roots, and profile skills.external_dirs.
• Adds conservative catalog-based skill suggestions for Kanban PM/orchestrator task-skill selection.

Why

Kanban tasks can force-load skills through task.skills. If a profile-scoped worker lacks one of those skills, the worker dies before the agent loop can explain/block the task. PR #30025 fixed the first half by gating forced skills on resolvability. This branch adds the operational follow-up: if a local install has an explicit allowlisted profile-skill sync policy, attempt sync once before blocking.

This prevents repeated “missing forced skill” document/task crashes when the fix is safe and mechanical, while still avoiding broad implicit mutation of profile skill directories.

Related

• Related upstream PR: fix(kanban): gate task.skills on resolvability to prevent worker crash loops #30025 — fix(kanban): gate task.skills on resolvability to prevent worker crash loops
• Related Kanban DB hardening batch: fix(kanban): batch-salvage 8 SQLite corruption hardening fixes (closes #31158, refs #29610) #32857
• Included in that batch / historical corruption hardening: fix(kanban): add post-commit page_count invariant check to write_txn #32300

Test plan

• python -m py_compile hermes_cli/kanban_db.py tests/hermes_cli/test_kanban_db.py
• scripts/run_tests.sh tests/hermes_cli/test_kanban_db.py
  • Result: 166 passed, 0 failed

[hehehe0803]

Follow-up context for reviewers:

This branch builds on the forced-skill crash-loop mitigation in #30025.

What changed here:

• fix(kanban): gate task.skills on resolvability to prevent worker crash loops #30025: gate missing task.skills so a worker does not crash at CLI startup.
• This PR: before blocking, attempt exactly one local policy-driven profile-skill sync when the target profile and missing skills are explicitly allowlisted.
• If policy/script is absent, the profile/skill is not allowlisted, or sync fails, it still fails closed and blocks before spawn.

Related Kanban hardening context:

• fix(kanban): gate task.skills on resolvability to prevent worker crash loops #30025 — forced skill resolvability gate / crash-loop prevention.
• fix(kanban): batch-salvage 8 SQLite corruption hardening fixes (closes #31158, refs #29610) #32857 — Kanban SQLite corruption hardening batch.
• fix(kanban): add post-commit page_count invariant check to write_txn #32300 — post-commit page-count invariant hardening, later folded into fix(kanban): batch-salvage 8 SQLite corruption hardening fixes (closes #31158, refs #29610) #32857.

Local verification:

• python -m py_compile hermes_cli/kanban_db.py tests/hermes_cli/test_kanban_db.py
• scripts/run_tests.sh tests/hermes_cli/test_kanban_db.py → 166 passed.

[hehehe0803]

Pushed one follow-up commit after initial CI: chore(release): map noestelar contributor email, because this branch includes #30025 commits and the attribution check requires noe@nousresearch.com in AUTHOR_MAP.

[hehehe0803]

Related-work / non-duplication scan before this PR is treated as the active forced-skill path:

I checked the nearby Kanban/skills PRs and issues so we do not create yet another overlapping branch by accident.

Closest PRs:

• fix(kanban): gate task.skills on resolvability to prevent worker crash loops #30025 — minimal task.skills resolvability gate to prevent worker crash loops. This PR builds on that safety model and adds the allowlisted sync-before-block step.
• fix: preflight kanban task skills before spawning #33747 — also preflights Kanban task skills before spawning. It appears overlapping with the fail-closed preflight part; the remaining distinction to preserve here is the explicit local-policy sync attempt before blocking.
• fix(kanban): gate kanban-worker skill inject on true name-resolvability (fix Unknown skill(s) worker death) #34738 — fixes the always-injected kanban-worker skill guard to mirror real name-resolvability and avoid ambiguous/not-found startup failures. Complementary: this PR covers per-task forced skills and sync policy, not only the built-in worker skill injection.
• test(kanban): isolate PID liveness tests #37132 — narrow PID/liveness test isolation only; not functionally overlapping.

Closest issues / RFCs:

• Kanban: task-scoped read-only skill overlays and orchestrator skill catalog #33245 — broader task-scoped read-only skill overlays + orchestrator skill catalog. This PR should stay the narrow operational bridge: allowlisted profile sync before blocking. The broader read-only/task-scoped skill injection design still belongs in Kanban: task-scoped read-only skill overlays and orchestrator skill catalog #33245 / a separate RFC.
• sync_skills writes into profile homes that delegate to default via external_dirs, causing skill name collisions that crash worker agents #28126 — profile sync + external_dirs collision risk. Relevant safety constraint: sync-before-block must remain explicit/allowlisted and fail-closed so it does not reintroduce broad profile shadow/collision behavior.
• fix(cli): unknown skills should warn instead of crash to prevent Kanban worker auto-blocking #27136 — CLI unknown-skill warning vs crash. For Kanban task.skills, fail-closed/block-before-spawn is still safer than silently skipping required procedure.

Conclusion: #33640 is not redundant if scoped narrowly to "allowlisted sync-before-block for forced Kanban task skills" and kept separate from #33245's broader read-only overlay/catalog design. If #33747 is preferred as the base for preflight, this PR's unique part should be reconciled as the sync-before-block extension rather than maintained as a parallel duplicate.

[teknium1]

Thanks for tracing the forced-skill worker failure; the underlying current-main issue is real: hermes_cli/kanban_db.py:8036-8039 forwards task skills directly, and an all-missing set raises during CLI preload (cli.py:15926-15947).

Problems

• The new HERMES_SKILLS_EXTERNAL_DIRS preflight branch does not match the worker's resolver. Current external roots come only from skills.external_dirs in the active profile config (agent/skill_utils.py:420-500), so a preflight-approved env-only skill can still fail at child startup.
• The sync path adds non-secret HERMES_PROFILE_SKILL_SYNC_* configuration and runs a local script. This conflicts with the project config policy (AGENTS.md:102-107); the test-created script does not validate a maintained runtime path.

Suggested changes

• Share a target-profile-aware resolver with the CLI preload path and add a subprocess test proving preflight-approved skills actually load.
• Put any supported sync policy in config.yaml and use a maintained sync interface.

Automated hermes-sweeper review.