Skip to content

feat(kanban): cleanup-operator workflow gate + skill (Issue #139-B) - #72693

Closed
queeph wants to merge 1 commit into
NousResearch:mainfrom
queeph:codex/issue-139-b-cleanup-operator-stage
Closed

feat(kanban): cleanup-operator workflow gate + skill (Issue #139-B)#72693
queeph wants to merge 1 commit into
NousResearch:mainfrom
queeph:codex/issue-139-b-cleanup-operator-stage

Conversation

@queeph

@queeph queeph commented Jul 27, 2026

Copy link
Copy Markdown

Issue

Closes https://github.com/queeph/trading-bot/issues/139 (Acceptance Criterion B)

Summary

Adds a new Kanban worker role cleanup-operator between builder/tester and release-ci that owns destructive DB operations on the live trading database. The gate is enforced at TWO levels so a single bypass is impossible:

  1. Dispatcher-level gate (this PR) — hermes_cli/kanban_db.py::dispatch_once refuses to spawn a worker for any cleanup-operator task whose body lacks an apply_confirm_token_prefix: field (≥ 8 chars). The rejected task is auto-blocked with a dispatch_rejected event BEFORE any worker subprocess is launched.

  2. Worker-level gate (this PR) — skills/devops/kanban-cleanup-operator/SKILL.md enforces a 4-step dry-run → operator Telegram reply → --apply-confirm → verify (with rollback on verify-fail) sequence inside the worker.

Changed files

  • hermes_cli/kanban_db.py (+116 lines): gate constants + helpers + dispatch-loop integration
  • skills/devops/kanban-cleanup-operator/SKILL.md (new, 11.7k): worker-side 4-step sequence + 5 iron laws + failure-mode exit codes + profile setup recipe
  • tests/hermes_cli/test_kanban_cleanup_operator.py (new, 9 tests): 7 spec tests + 2 bonus
  • docs/kanban/cleanup-operator.md (new, 7.7k): workflow + Telegram pattern + task-body contract + operator recipe

Test results

scripts/run_tests.sh tests/hermes_cli/test_kanban_cleanup_operator.py -> 9/9 pass (1.4s)
scripts/run_tests.sh tests/hermes_cli/test_kanban_db.py -> 230/230 pass (38.6s, no regressions)
scripts/run_tests.sh tests/hermes_cli/test_kanban_dispatch_lock.py tests/hermes_cli/test_kanban_default_assignee.py -> 11/11 pass

Acceptance criteria

  • skills/devops/kanban-cleanup-operator/SKILL.md vollständig
  • hermes_cli/kanban_db.py Workflow-Constraint implementiert
  • tests/hermes_cli/test_kanban_cleanup_operator.py 9/9 grün
  • docs/kanban/cleanup-operator.md aktualisiert
  • Branch codex/issue-139-b-cleanup-operator-stage mit squashed commit (single commit on rebased origin/main)
  • Push + PR auf NousResearch/hermes-agent (via queeph fork — see note below)
  • KEIN Live-DB, KEIN main-Push

Note on PR source

The branch was pushed to the queeph/hermes-agent fork because the queeph account does not have direct write access to NousResearch/hermes-agent. The PR targets NousResearch/hermes-agent:main as specified.

Cross-references

Nami (OpenClaw)
feat(kanban): cleanup-operator workflow gate + skill (Issue #139-B)
e9e2468 
Issue: https://github.com/queeph/trading-bot/issues/139 (Akzeptanzkriterium B)
Pipeline position: builder -> tester -> cleanup-operator -> release-ci

Adds a new Kanban worker role between builder/tester and release-ci that
owns destructive DB operations (--apply, --apply-confirm, schema
rewrites, bulk UPDATE/DELETE) on the live trading database. The gate is
enforced at TWO levels so a single bypass is impossible:

1. Dispatcher-level gate (hermes_cli/kanban_db.py::dispatch_once):
   refuses to spawn a worker for any cleanup-operator task whose body
   lacks an apply_confirm_token_prefix: field (>= 8 chars). The rejected
   task is auto-blocked with a dispatch_rejected event BEFORE any
   worker subprocess is launched.

2. Worker-level gate (skills/devops/kanban-cleanup-operator/SKILL.md):
   enforces a 4-step dry-run -> operator Telegram reply ->
   --apply-confirm -> verify (with rollback on verify-fail) sequence
   inside the worker.

Changed files
- hermes_cli/kanban_db.py (+116 lines):
  - constants: CLEANUP_OPERATOR_ASSIGNEE, _TOKEN_PREFIX_FIELD,
    _TOKEN_PREFIX_MIN_LEN=8
  - helpers: _extract_cleanup_operator_token(body),
    _validate_cleanup_operator_task(task_id, body)
  - dispatch gate in _dispatch_once_locked BEFORE the spawn loop, with
    write_txn + status='blocked' + dispatch_rejected event emission
- skills/devops/kanban-cleanup-operator/SKILL.md (new, 11.7k):
  - YAML frontmatter (description with trigger phrase)
  - architecture context (issues #139-A / #139-B / #139-C split)
  - 5 iron laws (never run --apply without operator reply, never echo
    full token, fresh recon-snapshot within 60s, verify-then-rollback,
    no gateway auto-dispatch for destructive steps)
  - 4-step workflow (dry-run, operator Telegram confirm, --apply-confirm,
    verify with rollback)
  - failure-mode exit codes (1/70/71/77/78/130) with recovery paths
  - profile setup (live config, not a repo change)
- tests/hermes_cli/test_kanban_cleanup_operator.py (new, 9 tests):
  - test_dispatch_refuses_missing_token_prefix
  - test_dispatch_accepts_with_token_prefix
  - test_worker_dry_run_emits_token
  - test_worker_confirms_via_telegram (mocked)
  - test_worker_aborts_on_token_mismatch (exit 77)
  - test_worker_aborts_on_operator_cancel (exit 130)
  - test_token_format_validation (8 hex chars prefix)
  - test_gate_does_not_affect_other_assignees (bonus, scope check)
  - test_dispatch_dry_run_reports_gate_without_mutating (bonus, dry-run)
- docs/kanban/cleanup-operator.md (new, 7.7k): workflow + Telegram
  pattern + task-body contract + operator recipe + 7-path test
  coverage table + references

Acceptance criteria
- [x] skills/devops/kanban-cleanup-operator/SKILL.md vollstaendig
- [x] hermes_cli/kanban_db.py Workflow-Constraint implementiert
- [x] tests/hermes_cli/test_kanban_cleanup_operator.py 9/9 gruen
      (7 spec + 2 bonus; 9/9 pass in 1.4s)
- [x] docs/kanban/cleanup-operator.md aktualisiert
- [x] KEIN Live-DB, KEIN main-Push
- [ ] PR (deferred to commit+push step)

Test results
- scripts/run_tests.sh tests/hermes_cli/test_kanban_cleanup_operator.py
  -> 9/9 pass (1.4s)
- scripts/run_tests.sh tests/hermes_cli/test_kanban_db.py
  -> 230/230 pass (38.6s) -- no regressions in the dispatcher core
- scripts/run_tests.sh tests/hermes_cli/test_kanban_dispatch_lock.py
  tests/hermes_cli/test_kanban_default_assignee.py -> 11/11 pass

NO Live-DB. NO main-push. NO push to unknown-origin/vision-tools-provider-param.
@alt-glitch alt-glitch added invalid This doesn't seem right comp/cron Cron scheduler and job management tool/skills Skills system (list, view, manage) P3 Low — cosmetic, nice to have labels Jul 27, 2026
@queeph queeph closed this by deleting the head repository Jul 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

comp/cron Cron scheduler and job management invalid This doesn't seem right P3 Low — cosmetic, nice to have tool/skills Skills system (list, view, manage)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@queeph @alt-glitch