fix(kanban): profile-correct notification ownership and routing (salvage #57995, #56589, #62380, #69181)

[teknium1]

Summary

Multi-profile kanban notifications now route to the profile that created them — never a wrong bot, never a silent rewind loop. Four composed contributor fixes (one commit each, authorship preserved) close the ownership gaps on the shared board: subscriptions always get an owner stamp, the notifier no longer silently loses secondary-profile events, gateway-per-profile deployments resolve their own adapter instead of failing closed forever, and dispatched workers can't inherit stale session routing.

Fixes #57993, #71340, #70179. Partially addresses #56802 (items 2–3; item 1 — decoupling the notifier from kanban.dispatch_in_gateway — stays open as a design decision).

Changes

• fix: scope kanban auto-subscriptions to active profile — @tymrtn (fix: scope kanban auto-subscriptions to active profile #57995): _maybe_auto_subscribe stamps notifier_profile via get_active_profile_name() fallback, so a sub is never ownerless
• fix(kanban): widen notifier pre-filter to secondary-profile platforms — @srojk34 (fix(kanban): widen notifier pre-filter to secondary-profile platforms #56589): _collect() no longer skips (and permanently loses — cursor claimed, no rewind) events for subs owned by profiles whose platform isn't in the primary adapter map
• fix(kanban): route active named profile through the active adapter map — @salimhamed (fix(kanban): deliver actionable active-profile notifications #62380, routing half): _authorization_adapter recognizes the gateway's own active named profile as primary — kills the Kanban notify: a subscription with notifier_profile set is never delivered when each profile runs its own gateway process (authorization chokepoint fails closed → silent rewind loop) #71340 rewind-forever loop on per-profile gateway deployments. (The PR's unrelated 160→3000-char reason-truncation change was deliberately not taken)
• fix(kanban): strip stale session routing from dispatched worker env — @trymhaak (fix(kanban): prevent worker session routing leaks #69181): dispatched workers no longer inherit HERMES_SESSION_*/cron routing keys, closing the cross-profile auto-subscribe leak (Kanban auto-subscribe can leak notifications across profiles #57993's mechanism). Original commits were authored as a placeholder identity; reapplied with the contributor's real handle

Not taken, for the record: #70091's dispatch_in_gateway gate removal (would resurrect the N-gateway SQLite contention the gate prevents; its other goals are covered here or already on main), #66703 and #69020 (separate design decisions, left open).

One noted edge for maintainer judgment: an explicit profile="default" stamp on a named-primary gateway still resolves via self.adapters — changing that would break every legacy default-stamped row, so it's left as-is.

Validation

Check	Result
8 targeted suites after rebase onto current main	185/185 pass
Builder's full run	397/397 pass
Sabotage checks — each of the 4 fixes reverted individually → its regression test fails → restored	all verified
ruff + git diff --check	clean

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 47597e9}

ℹ️ Info

Desktop E2E visual evidence · View test artifacts · View job

1 visual diff.

_{inline evidence upload failed.}

Failed to upload diff-665a0833239e-onboarding-overlay-diff.png with gh image (exit code 1): Error uploading /home/runner/work/_temp/e2e-evidence/diff-665a0833239e-onboarding-overlay-diff.png: step 0 (get upload token): uploadToken not found on repo page — do you have write access to NousResearch/hermes-agent? (or, if NousResearch enforces SAML SSO, authorize at https://github.com/orgs/NousResearch/sso)