feat(kanban): route notifications via owning profile + wake creator agent

[zmlgit]

Problem

In a multiplex_profiles gateway, kanban task notifications were always delivered via the default profile's adapter — even when the task was created by a different profile (e.g. CEO). This caused two failures:

1. Bot not in chat: The default bot may not be in the group where the task was created, so adapter.send() fails with [230002] Bot/User can NOT be out of the chat.
2. No agent follow-up: The creating agent has no way to know the task finished — the notification is fire-and-forget text, not a conversation turn trigger.

Root Cause

1. _maybe_auto_subscribe read os.environ.get("HERMES_PROFILE") to stamp notifier_profile — but in the gateway main process this env var is unset (multiplex profiles use ContextVars, not env vars).
2. Notifier profile filter skipped any subscription whose notifier_profile differs from the gateway's active profile.
3. Notifier adapter selection always used self.adapters[plat] (default profile only).

Changes

1. Session profile propagation (session_context.py, run.py, kanban_tools.py)

• Add HERMES_SESSION_PROFILE ContextVar
• Gateway stamps source.profile at dispatch time
• _maybe_auto_subscribe reads from ContextVar first, falls back to os.environ

2. Notifier profile-aware routing (kanban_watchers.py)

• Profile filter: skip only when the gateway has no adapter for the owning profile
• Adapter selection: prefer _profile_adapters[sub.notifier_profile]
• TERMINAL_KINDS: extend with status, archived, unblocked

3. Creator agent wakeup on terminal events (kanban_watchers.py)

After delivering completed/blocked/gave_up/crashed/timed_out notifications, inject a synthetic MessageEvent into the creator's session via adapter.handle_message() to trigger their agent loop.

Verification

End-to-end tested in a 10-profile multiplex gateway:

User @Jensen in feishu group -> Jensen creates kanban task
-> Task completed by worker
-> Notifier delivers via CEO adapter (not default)
-> Synthetic message injected into CEO session
-> Jensen agent loop fires, calls kanban_show, replies in group

Backward Compatibility

• os.environ fallback preserved for kanban workers
• Single-profile gateways unaffected (falls through to self.adapters)
• archived/unblocked notify but do not wake (no creator action needed)

[tonydwb]

Comment: The profile-based notification routing and wake-creator-agent feature is well-designed, but the hardcoded Chinese text in the wake messages (lines 118-128 of the diff) should be replaced with English or internationalized. The rest of the codebase uses English for user-facing messages, and hardcoded Chinese will confuse non-Chinese users. Consider using a constants dict or the existing i18n infrastructure.

[tonydwb]

Code Review Summary

Verdict: LGTM — clean kanban profile routing.

Well-structured implementation for profile-based notification routing and agent wake on task completion.

---

Reviewed by Hermes Agent

[zmlgit]

@tonydwb Thanks for the review — good catch on the hardcoded Chinese.

Pushed 0d60a1ae to address it. Used the existing i18n infrastructure you suggested (agent/i18n.py::t(), the same surface gateway/run.py and slash_commands.py already use) rather than a one-off constants dict:

• New gateway.kanban.wake.* keys in locales/en.yaml (baseline) + locales/zh.yaml (preserves the original Chinese phrasing, so existing zh users see no visible change).
• The other 14 catalogs got the same key set with English fallback values — required by the i18n invariant test (tests/agent/test_i18n.py::test_catalog_keys_match_english) and lets native translations land incrementally.
• gateway/kanban_watchers.py imports t and replaces the hardcoded strings; behavior unchanged for zh users.

Full test suite passes: i18n parity (47) + kanban notifier (13) = 60 tests, 0 failures.

[kshitijk4poor]

Thanks for this, @zmlgit (张满良) — landed on main via #56531. 🎉

Your two commits were rebase-merged with authorship preserved, so this ships as your work:

• feat(kanban): route notifications via owning profile + wake creator agent
• fix(kanban): i18n wake messages (addressing @tonydwb's review)

I added one follow-up review commit on top (correctness hardening surfaced during review):

• Adapter selection now routes through the shared _authorization_adapter chokepoint (gateway/authz_mixin.py) instead of the inline lookup, so a secondary profile's notification can't fall back to the default profile's bot when the owning profile has a registry entry but no adapter for that platform — closing the exact cross-profile mis-delivery ([230002] Bot can NOT be out of the chat) this change targets. Added a mutation-verified regression test.
• Wake-injection failures now log at WARNING with exc_info (the notifier cursor has already advanced, so a broken wake mustn't be a silent no-op), plus a clarifying comment on the intentionally-silent archived/unblocked kinds.

One known limitation tracked as a follow-up (not a regression): the creator-wake SessionSource hardcodes chat_type="group", because the subscription row doesn't persist the creator's chat_type and it isn't carried on the session-context bridge — so DM/thread-originated creators can be woken in a fresh session rather than their original one. Fixing that properly needs stamping + persisting chat_type end-to-end (a small schema + bridge change), which I've kept out of this PR to preserve its scope.

Closing this in favor of #56531. Thanks again for the fix and for iterating on the i18n feedback!