fix(kanban): stop decompose siblings sharing one worktree checkout

[ahmadashfq]

What does this PR do?

Restores the documented one-worktree-per-task guarantee for decompose fan-outs. Today, decompose children inherit the root's literal workspace_path, and _resolve_worktree_workspace's existing-checkout shortcut reuses that directory on whatever branch is checked out — so siblings (which can be promoted and dispatched concurrently, max_in_progress unlimited by default) end up working in one directory on the first sibling's branch: cross-task commits land on the wrong wt/<id> branch, and concurrent siblings share one index/working tree with no lock. Observed in production 2026-07-10.

Related Issue

Fixes #61911

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/kanban_db.py — decompose_triage_task: worktree-kind children no longer inherit the root's literal path (each child materializes its own <repo>/.worktrees/<child-id> at dispatch); dir/scratch inheritance unchanged.
• hermes_cli/kanban_db.py — _resolve_worktree_workspace: when the requested path is an existing checkout of a different branch, fall back to a fresh <repo>/.worktrees/<task-id> (heals rows already carrying a shared inherited path). Same-branch reuse untouched; degenerate cases (no repo anchor / occupied path IS the task's own canonical worktree) keep the legacy reuse rather than failing dispatch.
• tests/hermes_cli/test_kanban_worktree_isolation.py — new, 5 cases.

How to Test

1. Bind a board to a git repo (hermes kanban boards set-default-workdir <slug> <repo>), create a triage card, decompose it into 2+ children with no dependency edges.
2. Without this patch: child A materializes the shared path on wt/<A>; child B resolves the same directory still on wt/<A> and works there. With it: each child gets .worktrees/<child-id> on its own branch.
3. python -m pytest tests/hermes_cli/test_kanban_worktree_isolation.py tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_decompose_db.py -q → 240 passed.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass — ran the targeted kanban suites above (240 passed, 0 failed); a full-tests/ local run did not complete in my environment
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15 (Darwin 25.5), Python 3.11.14

Documentation & Housekeeping

• I've updated relevant documentation — N/A: this restores the behavior kanban.md already documents (worktree → one per task id)
• I've updated cli-config.yaml.example if I added/changed config keys — N/A (no config changes)
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
• I've considered cross-platform impact (Windows, macOS) — pure pathlib + git -C subprocess calls, no shell strings, no platform-specific paths
• I've updated tool descriptions/schemas if I changed tool behavior — N/A (no tool surface changes)

🤖 Generated with Claude Code

[teknium1]

Thanks for tracing the existing-checkout shortcut and adding coverage for stale shared paths. The current-main premise is real: decompose_triage_task() copies the root path at hermes_cli/kanban_db.py:5107-5111, while _resolve_worktree_workspace() reuses an existing linked checkout at hermes_cli/kanban_db.py:5485-5487.

Problems

• The new workspace_path = None branch loses the repository anchor for roots configured with an explicit worktree path. A child without workspace_path must have board.default_workdir; otherwise current resolution raises at hermes_cli/kanban_db.py:5448-5459. This turns a valid explicit-worktree decomposition on a board without a default into a dispatch failure.

Suggested changes

• Preserve a repository anchor derived from the root path, rather than its concrete linked checkout, so each child resolves to its own .worktrees/<child-id> without depending on board configuration.
• Add an end-to-end decomposition plus dispatch test for that no-board-default case; the new test currently checks only the stored NULL path.

Automated hermes-sweeper review.

[teknium1]

Clearing the path also discards the only repo anchor for roots created with an explicit worktree:<path> on a board without default_workdir. _resolve_worktree_workspace() rejects that NULL child path at current-main hermes_cli/kanban_db.py:5454-5459; derive and persist the root repository anchor instead of the root's concrete checkout.

[teknium1]

Merged via #70177 — your commit was cherry-picked onto current main with your authorship preserved in git history (merge SHA 65d42e3). Thanks for both halves: the fan-out fix AND the resolution-time healing for rows already carrying a shared path — the wrong-branch fallback with the degenerate-case guards was exactly the right shape. Live E2E confirmed decomposed siblings now materialize their own worktrees on their own branches, and a legacy shared row heals to a fresh checkout.