fix(tools): bound recoverable context outputs

[jkobject]

Summary

Bound recoverable model-facing output from session_search and kanban_show so large recall/orientation results cannot immediately rebuild context after compression.

The implementation preserves canonical board/session data and complete instructional skill_view behavior. Model-facing views now provide bounded previews, original-size metadata, totals/omitted counts, and explicit canonical recovery instructions.

Changes

session_search

• Enforces a 90,000-character aggregate response ceiling across read, scroll, browse, discovery, and profile-resolution success paths.
• Compacts message content and verbose metadata structurally while preserving exact session_id, parent_session_id, and link recovery handles.
• Keeps result/message containers in the recovery-only fallback so emitted handles remain navigable.
• Fails closed instead of returning plausible-looking fragments when complete opaque handles cannot fit under the ceiling.

kanban_show

• Returns a bounded orientation view instead of duplicating the complete board history.
• Enforces a 30,000-character aggregate response ceiling while preserving exact task, parent/child, and attachment handles whenever a valid bounded representation exists.
• Fetches latest comments, events, runs, attachments, and graph IDs with SQL limits before materializing rows; reports canonical totals and omitted counts separately.
• Selects latest completed parent handoffs before applying graph-ID limits.
• Keeps the public task/run shape explicit and redacts internal claim ownership fields and historical claim-value aliases from events, run errors/metadata, and parent handoffs.
• Leaves attachment contents unloaded; the canonical manifest remains available through kanban_attachments.

Guidance and docs

• Updates injected Kanban lifecycle guidance and user docs to describe bounded orientation rather than a duplicated full worker_context.
• Documents recovery through exact handles, kanban_attachments, and the canonical CLI/dashboard history surfaces.

Regression coverage

Adversarial tests cover:

• 80k-character message/task/comment payloads;
• long valid session/task/parent/child identifiers;
• aggregate multi-record responses;
• recovery by feeding emitted identifiers back into the tools;
• recovery-only fallback container preservation;
• latest-N query ordering and pre-materialization limits;
• internal claim-field and historical claim-value redaction;
• latest completed parent handoff selection before graph limits.

Validation

scripts/run_tests.sh \
  tests/tools/test_session_search.py \
  tests/tools/test_kanban_tools.py \
  tests/hermes_cli/test_kanban_review_surfaces.py \
  tests/hermes_cli/test_kanban_db.py \
  tests/hermes_cli/test_kanban_core_functionality.py \
  tests/hermes_cli/test_kanban_comment_queries.py

Result: 140 passed, 2 skipped, 0 failed.

python -m ruff check \
  tools/session_search_tool.py tools/kanban_tools.py hermes_cli/kanban_db.py \
  agent/prompt_builder.py tests/tools/test_session_search.py \
  tests/tools/test_kanban_tools.py
python -m py_compile \
  tools/session_search_tool.py tools/kanban_tools.py hermes_cli/kanban_db.py \
  agent/prompt_builder.py
git diff --check

All pass. Independent pre-commit review reported no remaining security or logic blockers on revision 69c1f0ccbf24f4a8ef39746eec97fd15abd393da.

Scope

• No canonical board/session mutation.
• No attachment-content loading.
• No pagination or truncation of instructional skills.
• No new core tool.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[teknium1]

Thanks for the focused work on a real current-main context-growth path.

Problems

• Blocking: tools/session_search_tool.py:96-153 truncates every string in the aggregate fallback. That includes session_id and link; hermes_state.py:2458-2460 accepts arbitrary session IDs. A valid oversized stored ID can therefore exceed the aggregate threshold and be returned only as an unusable fragment, despite recovery guidance requiring the exact ID.
• The kanban_show contract changes from full worker_context/comment history to bounded orientation slices, but website/docs/user-guide/features/kanban.md:293,310-311,393-394 and tutorial references still document the removed behavior.

Suggested changes

• Add a valid oversized-session-ID regression and define a bounded recovery behavior that does not advertise a truncated identifier as reusable.
• Update the Kanban docs with the bounded orientation and recovery model.
• Integrate against current session-search behavior, including 9bb253d4fa and b93fd077c0; those paths changed after this branch's base.

This is an automated hermes-sweeper review.