fix(kanban): guard dependency block after successor creation

[JeffreyDavidson]

Summary

• guard dependency blocks after a successor child has already been created, forcing the parent to complete instead of parking itself in todo
• keep the parent running and successor todo when the invalid block is attempted, then verify parent completion promotes the child normally
• preserve existing no-successor dependency wait behavior

Scope

• hermes_cli/kanban_db.py
• tests/hermes_cli/test_kanban_block_kinds.py

Verification

• git verify-commit HEAD
• git diff --check origin/main...HEAD
• scripts/run_tests.sh tests/hermes_cli/test_kanban_block_kinds.py -k test_dependency_block_refuses_after_successor_creation

Upstream QA acceptance was recorded by Merlin for exact signed commit 81fa11a5c0fa434e0ec65f0990d697072154a5a9.

[tonydwb]

{
"event": "APPROVE",

Code Review Summary

Verdict: Approved

Prevents block_task(kind=\"dependency\") on a parent task that already has a created successor. Trying to park a parent with a dependency block after a successor exists would leave the successor orphaned. The fix checks for existing child links and raises a clear ValueError with the task IDs. Regression test covers the exact scenario.

Looks Good

• Check happens before any state mutation
• Error message includes both task IDs for easy debugging
• Test verifies parent remains running and child becomes ready after parent completes

---

Reviewed by Hermes Agent",
"comments": []
}

[tonydwb]

Code Review Summary

Verdict: Comment

+33/-0 kanban fix to guard dependency block after successor creation. Small, targeted fix. No concerns.

Reviewed by Hermes Agent

[teknium1]

Thanks for isolating a real lifecycle hole: current block_task routes a dependency-blocked task to todo without considering an already-created successor (hermes_cli/kanban_db.py:4936-4976).

Problems

• The new guard is too broad. link_tasks permits an unfinished parent to be linked to an already-running task (hermes_cli/kanban_db.py:2814-2837), so a valid graph can be P -> A -> C; A must still be allowed to dependency-wait for P. The dependency contract is based on incoming parents (hermes_cli/kanban_db.py:3441-3475), not whether A has descendants.
• The new ValueError would escape hermes kanban block: _cmd_block writes a BLOCKED comment and directly calls block_task without handling that exception (hermes_cli/kanban.py:2047-2057).

Suggested changes

• Reject only when there is no unsatisfied incoming parent dependency, rather than whenever a successor exists.
• Add the P -> A -> C regression and a CLI rejection-path test that confirms no misleading comment is written.

This is an automated hermes-sweeper review.

[teknium1]

Checking only for an outgoing child rejects a valid P -> A -> C graph when running A acquires or already has an unfinished incoming parent P. link_tasks permits adding that parent edge to a running task; gate this on unsatisfied incoming parents (or otherwise preserve that dependency-wait path), not descendant existence alone.

[GottZ]

This was generated by AI during triage.

Summary

Thirteen PRs address or reference #59333/#66909: #59367, #59536, and #59645 implement the requested global kanban.block_recurrence_limit, while #52848 is the merged hard-coded foundation and the other diffs concern distinct review, dependency, authorization, cron, PASS-loop, or repeated-failure paths. Contributor discussion identifies #66909 as a duplicate of #59333 and #59367 as the active implementation.

Related pull requests

• feat(kanban): typed block reasons + unblock-loop breaker #52848 [merged] related — (+551/-49) — n/a: Merged reference implementation that introduced typed block reasons, persistent recurrence counting, and the hard-coded BLOCK_RECURRENCE_LIMIT = 2, making it relevant as the source of the configuration gap.
• fix(kanban): enforce review change loop before completion #58695 related — (+84/-1) — n/a: Exempts review-required: reblocks and adds a comment-derived completion gate rather than configuring the general limit; its contributor keep_open review requires authorized reviewer identity and deterministic verdict ordering, so the focused reblock exemption is the concrete salvage path.
• feat(kanban): make block recurrence limit configurable #59367 best fix — (+86/-3) — n/a: The recorded best fix for [Feature]: Use config for BLOCK_RECURANCE_LIMIT #59333 and [Feature]: Please allow to modify BLOCK_RECURRENCE_LIMIT #66909 adds kanban.block_recurrence_limit to defaults, validates it with explicit boolean fallback, uses the effective value for routing and event telemetry, documents it, and tests the configured threshold.
• feat(kanban): make block recurrence limit configurable #59536 fixes — (+76/-7) — n/a: Implements the same global key and routing substitution as feat(kanban): make block recurrence limit configurable #59367, but despite its contributor keep_open review, the visible int(value) path accepts booleans and truncates non-integral floats, making it a weaker duplicate.
• feat(cron): make BLOCK_RECURANCE_LIMIT configurable (#59333) #59645 partial — (+415/-2) — n/a: Reimplements the global override with extensive tests and example configuration, but despite its contributor keep_open review, the diff omits DEFAULT_CONFIG registration and logs invalid configuration on every resolver call; contributor discussion names feat(kanban): make block recurrence limit configurable #59367 as canonical.
• fix(kanban): guard needs_input unblock from non-interactive sessions #59906 related — (+451/-2) — n/a: Adds a DB/process-ancestry guard plus an environment-scrubbed CLI E2E test against worker self-unblocking of needs_input; consistent with the maintainer-bot keep_open verdict, this is a separate authorization safeguard.
• feat(cron): add configurable max_repeat safeguard for cron job repeats (#59333) #60476 related — (+142/-0) — n/a: Adds cron.max_repeat clamping only during cron-job creation and does not alter Kanban’s recurrence threshold; its contributor keep_open review calls for re-scoping, centralized create/update validation, default registration, and documentation.
• fix: stop dependency-wait kanban promotion loops #61366 related — (+164/-38) — n/a: Prevents parentless dependency waits from immediate redispatch by routing them to triage while preserving parent-gated waits, and its amended interfaces, documentation, event reference, and tests address the maintainer-bot keep_open feedback.
• fix: keep review-required kanban reblocks out of triage #61372 [closed] related — (+67/-4) — n/a: Closed reference implementation that keeps canonical review-required: reblocks in blocked; it remains relevant because it overlaps fix(kanban): enforce review change loop before completion #58695’s focused exemption and was intentionally moved to the author’s fork with no upstream merge intended.
• fix(kanban): persist pass-loop state on task rows #63723 related — (+1636/-39) — n/a: Adds broad persistent PASS-loop and delivery state rather than recurrence-limit configuration; its contributor keep_open review finds the completion_blocked_% predicate overbroad and the routing change unsupported without a current-main reproduction.
• fix(kanban): fail closed invalid dependency waits #64585 related — (+124/-31) — n/a: Addresses the same parentless-dependency redispatch cause as fix: stop dependency-wait kanban promotion loops #61366 but fails closed in blocked; consistent with its maintainer-bot keep_open verdict, it needs CLI/tool-schema recovery guidance and interface coverage.
• fix(kanban): guard dependency block after successor creation #66632 related — (+33/-0) — n/a: Rejects dependency blocks whenever a successor exists, but the contributor keep_open review shows that this breaks valid P -> A -> C graphs and lets ValueError escape the CLI, outweighing the non-contributor approval.
• fix(kanban): freeze repeated identical failures #68027 related — (+1114/-86) — n/a: Replaces kind-only counting with a normalized failure fingerprint, third-identical-outcome freeze, audited rearm, and automatic-path guards; consistent with the maintainer-bot keep_open verdict finding no verified blocking defect, it is a broader failure-loop hardening lane rather than the requested configurable threshold.

Duplicates

#59536 and #59645 are later implementations of #59367; #61372 overlaps the review-reblock portion of #58695, while #61366 and #64585 address the same parentless-dependency cause with different terminal states.

Suggested consolidation

Author action: rebase #59367 onto current main, preserving its boolean-rejection tests and validated routing/event behavior; close #59536 and #59645 as duplicates of #59367 despite their keep_open reviews because their visible diffs retain the validation and default-registration defects above, and close #66909 as a duplicate of #59333. Keep #68027 open with its durable-fingerprint, audited-rearm, and automatic-path-guard salvage path; keep #59906, #61366/#64585, and #63723 in separately scoped salvage lanes addressing their recorded reviews, re-scope #60476 away from #59333, narrow #58695 to the review-reblock exemption unless an authorized ordered verdict source is added, and retain #61372 only as the closed reference.

Cross-PR triage: Reviewed 13 pull requests and 2 issues in this complex. Each diff was read against this issue; Assessment working set: 301 kB of PR diffs, 27 kB of issue/PR text, 17 kB of discussion (19 comments), 10 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.