Skip to content

fix(kanban): secure remediation handoff identity - #76986

Closed
solovision24 wants to merge 19 commits into
NousResearch:mainfrom
solovision24:fix/review-changes-required-hard-gate
Closed

fix(kanban): secure remediation handoff identity#76986
solovision24 wants to merge 19 commits into
NousResearch:mainfrom
solovision24:fix/review-changes-required-hard-gate

Conversation

@solovision24

Copy link
Copy Markdown

Summary

  • Reserve the internal review-remediation idempotency namespace from generic task creation.
  • Validate any pre-existing exact remediation key against the expected child contract before authorizing changes requested.
  • Persist and verify the remediation key alongside the exact child id at claim time.
  • Restore webhook/native convergence regressions and delegated-child guards, including the canonical ingest-pr handler behavior.

Verification

  • HERMES_PYTHON=/home/solo/.hermes/hermes-agent/venv/bin/python bash scripts/run_tests.sh tests/hermes_cli/test_kanban_review_lifecycle.py tests/hermes_cli/test_kanban_db.py tests/tools/test_kanban_tools.py -q — 94 passed
  • git diff --check — passed
  • npm run check — blocked by pre-existing missing workspace dependencies (@tauri-apps/api, @assistant-ui/*, @nous-research/ui, plist, and related type errors); no changed JS files.

Kanban Task

Deployment implications: no deployment or restart performed; this is a Kanban database/CLI behavior change and requires normal review before merge.

solovision24 and others added 19 commits July 31, 2026 08:14
…026.7.20 upgrade

- agent/conversation_loop.py: prioritise structured reasoning fields over
  inline-think content for tool_progress_callback relay
- ui-tui appLayout.tsx: drop stale inputHeight box sizing (auto-size from
  rendered content instead)
- ui-tui textInput.tsx: cancel pending fast-echo parent update on submit
Merged after independent verification: 54 focused lifecycle/tool/core tests passed, compileall and git diff --check passed, and the PR is limited to the upstream-compatible Hermes baseline.
* fix(kanban): allow requeued review workers past PR guard

* fix(kanban): preserve review routing after crash requeue

* fix(kanban): preserve native review lane on crash

* fix(kanban): apply retry guards to native reviews

* fix(kanban): guard native review respawns during cooldown

---------

Co-authored-by: SoLo <solo@SoLoBot>
Co-authored-by: SoLo <solo@SoLoBot>
* fix(kanban): restore native GitHub PR ingest

* fix(kanban): restore GitHub PR lifecycle safeguards

---------

Co-authored-by: SoLo <solo@SoLoBot>
* feat(kanban): enforce native review lifecycle

* fix(kanban): authorize review changes from active review runs

---------

Co-authored-by: SoLo <solo@SoLoBot>
* feat(kanban): enforce native review lifecycle

* fix(kanban): authorize review changes from active review runs

* ci: scope contributor checks to the PR base

---------

Co-authored-by: SoLo <solo@SoLoBot>
* fix(kanban): replay native review convergence on current base

* fix(kanban): restore same-card review remediation lifecycle

* fix(kanban): replay webhook review convergence on approved base

---------

Co-authored-by: SoLo <solo@SoLoBot>
* fix(kanban): finalize claimed webhook review runs

* fix(kanban): correct native review handoff comment

---------

Co-authored-by: SoLo <solo@SoLoBot>
@solovision24

Copy link
Copy Markdown
Author

Closing as an unintended wrong-base artifact created during an internal SoLo fork remediation. The canonical review remains on solovision24/hermes-agent PR #14; no upstream merge is requested.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant