sync(main): promote the PMOVES overlay line — upstream through 2026-09-20 + 48-commit overlay, AUDIT INSIDE

.github/workflows/docker.yml

@@ -76,7 +76,7 @@ jobs:
       matrix:
         include:
           - arch: amd64
-            runner: ubuntu-latest-32-core
+            runner: ubuntu-latest
             platform: linux/amd64
             cache-from: type=gha,scope=docker-amd64
             cache-to: type=gha,mode=max,scope=docker-amd64
@@ -193,7 +193,7 @@ jobs:
       matrix:
         include:
           - arch: amd64
-            runner: ubuntu-latest-32-core
+            runner: ubuntu-latest
             platform: linux/amd64
             cache-from: type=gha,scope=docker-amd64
             cache-to: type=gha,mode=max,scope=docker-amd64

.github/workflows/e2e-desktop.yml

@@ -20,7 +20,7 @@ jobs:
     # This job builds the renderer and the electron bundle, then drives a real
     # Electron app under xvfb. vite, tsc and the Playwright workers all scale
     # with the core count.
-    runs-on: ubuntu-latest-32-core
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     outputs:
       review_status: ${{ steps.review-status.outputs.review_status }}

.github/workflows/js-tests.yml

@@ -14,7 +14,7 @@ jobs:
     #
     # One larger runner installs one time. vitest, tsc and eslint each size
     # their own worker pool from the core count.
-    runs-on: ubuntu-latest-32-core
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/nix.yml

@@ -54,7 +54,7 @@ jobs:
     # takes minutes and not seconds when the cache misses. `nix flake check`
     # builds 21 checks, and --max-jobs defaults to the core count. It uses the
     # wider runner with no more configuration.
-    runs-on: ubuntu-latest-32-core
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
       - name: Checkout code

.github/workflows/rust-tests.yml

@@ -30,7 +30,7 @@ jobs:
     # cargo builds codegen units and test binaries in parallel across the
     # cores. This lane also builds the crate from the start when Cargo.toml
     # changes.
-    runs-on: ubuntu-latest-32-core
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     defaults:
       run:

.github/workflows/tests-os.yml

@@ -61,7 +61,7 @@ jobs:
             runner: macos-latest
             marker: macos_only
           - name: Windows-only tests
-            runner: windows-latest-32-core
+            runner: windows-latest
             marker: windows_only
     steps:
       - name: Checkout code

.github/workflows/tests.yml

@@ -21,7 +21,7 @@ jobs:
     # 96 cores clear the floor that the slowest single test file sets (about
     # 82s). A second slice divides work that is already at that floor, and
     # adds a second setup.
-    runs-on: ubuntu-latest-96-core
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Checkout code

pyproject.toml

@@ -604,7 +604,7 @@ youtube-transcript-api = false
 # and the drift broke installed wheels. Do not add the list back.
 
 [tool.setuptools.packages.find]
-include = ["agent", "agent.*", "tools", "tools.*", "hermes_cli", "hermes_cli.*", "gateway", "gateway.*", "tui_gateway", "tui_gateway.*", "cron", "cron.*", "acp_adapter", "plugins", "plugins.*", "providers", "providers.*"]
+include = ["agent", "agent.*", "tools", "tools.*", "hermes_cli", "hermes_cli.*", "gateway", "gateway.*", "tui_gateway", "tui_gateway.*", "cron", "cron.*", "acp_adapter", "plugins", "plugins.*", "providers", "providers.*", "pmoves_bootstrap", "pmoves_bootstrap.*"]
 
 [tool.setuptools.package-data]
 hermes_cli = ["observability/schemas/*.json", "data/*.json", "local_runtime/*.json"]

tests/agent/test_run_agent_codex_responses.py

@@ -2626,6 +2626,7 @@ def test_consume_codex_stream_leaves_unindexed_reasoning_untouched():
 
     assert "".join(reasoning_streamed) == "Need to inspect files."
 
+    reasoning_streamed = []
 
 def _codex_compaction_checkpoint_response(blob: str = "compaction_blob_1"):
     """A turn that returns ONLY a server-side native-compaction checkpoint.

tests/conftest.py

@@ -888,6 +888,22 @@ def _state_db_write_guard(request, monkeypatch):
     yield
 
 
+# ── Live state.db write guard ───────────────────────────────────────────────
+# Companion to the kanban guard above, for the MAIN state database.
+# ``hermes_state._ensure_test_isolation`` (the single choke point every
+# ``SessionDB()`` construction goes through) refuses, under pytest, any DB
+# path that resolves inside the REAL Hermes root. This fixture wires the
+# test-side knobs:
+#   • honors ``@pytest.mark.live_system_guard_bypass`` (the established
+#     escape-hatch marker) by disabling the state-db guard for that test;
+#   • injects the pre-sandbox CUSTOM production root (Docker/portable
+#     installs where HERMES_HOME is not ~/.hermes) into the guard's
+#     deny-list, mirroring the kanban deny-list capture above.
+# The guard itself is env-activated (PYTEST_CURRENT_TEST / PYTEST_VERSION),
+# so subprocess children that import hermes_state directly are covered even
+# without this fixture.
+
+
 # ── Module-level state reset — replaced by per-file process isolation ──────
 #
 # Each test FILE runs in a freshly-spawned ``python -m pytest <file>``

tests/plugins/model_providers/test_fireworks_profile.py

@@ -57,6 +57,10 @@ def test_user_agent_identifies_hermes(self, fireworks_profile):
         # Prefix, not the full string — the version moves every release.
         assert fireworks_profile.default_headers["User-Agent"].startswith("HermesAgent/")
 
+    def test_user_agent_identifies_hermes(self, fireworks_profile):
+        # Prefix, not the full string — the version moves every release.
+        assert fireworks_profile.default_headers["User-Agent"].startswith("HermesAgent/")
+
 
 class TestFireworksAliases:
     @pytest.mark.parametrize("alias", ["fireworks-ai", "fw"])

tests/test_schema_read_probe.py

@@ -0,0 +1,100 @@
+"""Contract tests for schema_read_probe_statements().
+
+Read-only SessionDB opens skip _reconcile_columns() by design, so dashboard
+read paths heal stale stores via a probe-then-writable-reopen dance in
+``hermes_cli.web_server._open_session_db_at_path``. These tests pin the
+probe's contract: it is DERIVED from SCHEMA_SQL (any column added there is
+covered automatically — the previous hand-written probe went stale within
+days) and it must fail at prepare time on a store missing any declared
+column or table.
+"""
+
+import sqlite3
+
+import pytest
+
+from hermes_state_common import DEFERRED_INDEX_SQL, SCHEMA_SQL
+from hermes_state_schema import SessionSchemaMixin, schema_read_probe_statements
+
+
+def _fresh_schema_conn() -> sqlite3.Connection:
+    conn = sqlite3.connect(":memory:")
+    conn.executescript(SCHEMA_SQL)
+    conn.executescript(DEFERRED_INDEX_SQL)
+    return conn
+
+
+class TestSchemaReadProbeStatements:
+    def test_probes_cover_every_declared_column(self):
+        """Invariant: every column SCHEMA_SQL declares appears in a probe.
+
+        This is the anti-staleness contract — a column added to SCHEMA_SQL
+        must be probed without anyone remembering to update a list.
+        """
+        expected = SessionSchemaMixin._parse_schema_columns(SCHEMA_SQL)
+        statements = schema_read_probe_statements()
+        by_table = {}
+        for statement in statements:
+            for table in expected:
+                if f'FROM "{table}"' in statement:
+                    by_table[table] = statement
+        for table, cols in expected.items():
+            assert table in by_table, f"no probe statement for table {table}"
+            for col in cols:
+                assert f'"{table}"."{col}"' in by_table[table], (
+                    f"column {table}.{col} declared in SCHEMA_SQL but not probed"
+                )
+
+    def test_probes_pass_on_fresh_schema(self):
+        conn = _fresh_schema_conn()
+        try:
+            for statement in schema_read_probe_statements():
+                conn.execute(statement).fetchone()
+        finally:
+            conn.close()
+
+    def test_probes_fail_on_missing_column(self):
+        """The shipped regression: a store predating sessions.last_activity_at
+
+        (#72424) passed the old hand-written probe, then 500'd inside
+        list_sessions_rich on every sidebar poll until the user's first
+        message forced a writable open.
+        """
+        conn = _fresh_schema_conn()
+        try:
+            conn.execute("ALTER TABLE sessions DROP COLUMN last_activity_at")
+            # The failure must come from the sessions probe naming the exact
+            # column — not incidentally from some other statement — so a
+            # probe-generation bug that misassigns columns to tables can't
+            # sneak through.
+            sessions_probe = next(
+                s
+                for s in schema_read_probe_statements()
+                if 'FROM "sessions"' in s
+            )
+            with pytest.raises(sqlite3.OperationalError) as excinfo:
+                conn.execute(sessions_probe)
+            assert "no such column: sessions.last_activity_at" in str(
+                excinfo.value
+            )
+        finally:
+            conn.close()
+
+    def test_probes_fail_on_missing_table(self):
+        conn = sqlite3.connect(":memory:")
+        try:
+            conn.executescript(SCHEMA_SQL)
+            conn.executescript("DROP TABLE gateway_routing")
+            gateway_probe = next(
+                s
+                for s in schema_read_probe_statements()
+                if 'FROM "gateway_routing"' in s
+            )
+            with pytest.raises(sqlite3.OperationalError) as excinfo:
+                conn.execute(gateway_probe)
+            assert "no such table" in str(excinfo.value).lower()
+        finally:
+            conn.close()
+
+    def test_probe_statements_are_cached(self):
+        assert schema_read_probe_statements() is schema_read_probe_statements()

tests/test_tui_gateway_server_crash_history.py

@@ -0,0 +1,37 @@
+"""Regression coverage for crashed TUI gateway turns."""
+
+import threading
+import types
+
+from tui_gateway import server
+
+
+def test_turn_error_restores_agent_transcript_to_gateway_history():
+    agent = types.SimpleNamespace(
+        _session_messages=[
+            {"role": "user", "content": "first"},
+            {"role": "assistant", "content": "completed work"},
+        ]
+    )
+    session = {
+        "history": [{"role": "user", "content": "first"}],
+        "history_lock": threading.Lock(),
+        "history_version": 0,
+    }
+
+    assert server._restore_agent_history_after_turn_error(session, agent) is True
+    assert session["history"] == agent._session_messages
+    assert session["history_version"] == 1
+
+
+def test_turn_error_with_no_agent_transcript_does_not_overwrite_history():
+    agent = types.SimpleNamespace(_session_messages=None)
+    session = {
+        "history": [{"role": "user", "content": "first"}],
+        "history_lock": threading.Lock(),
+        "history_version": 4,
+    }
+
+    assert server._restore_agent_history_after_turn_error(session, agent) is False
+    assert session["history"] == [{"role": "user", "content": "first"}]
+    assert session["history_version"] == 4

tui_gateway/methods_session.py

@@ -2180,6 +2180,52 @@ def _(rid, params: dict) -> dict:
     return _ok(rid, {"status": "queued" if queued else "rejected", "subagent_id": subagent_id, "text": text})
 
 
+@method("subagent.steer")
+def _(rid, params: dict) -> dict:
+    """Queue steering text into a live delegated child without stopping it.
+
+    The redirection-side mirror of subagent.interrupt: resolves the child in
+    the delegation registry and calls AIAgent.steer(), which appends the text
+    to the child's last tool result at its next iteration boundary — the
+    in-flight tool call is never cut. "queued" is not "delivered": a child
+    already past its final tool batch has no boundary left to drain into,
+    and that race surfaces as ``missed_steer`` on the parent's completion
+    entry instead of being silently dropped.
+    """
+    from tools.delegate_tool import steer_subagent
+
+    subagent_id = str(params.get("subagent_id") or "").strip()
+    if not subagent_id:
+        return _err(rid, 4000, "subagent_id required")
+    text = (params.get("text") or "").strip()
+    if not text:
+        return _err(rid, 4002, "text is required")
+    _invoking_session, err = _sess_nowait(params, rid)
+    if err:
+        return err
+    invoking_session_id = str(params.get("session_id") or "").strip()
+    invoking_transport, invoking_session = _current_session_steer_authority(
+        invoking_session_id
+    )
+    queued = False
+    if invoking_transport is not None and invoking_session is not None:
+        queued = steer_subagent(
+            subagent_id,
+            text,
+            owner_session_id=invoking_session_id,
+            owner_transport=invoking_transport,
+            owner_session_record=invoking_session,
+        )
+    return _ok(
+        rid,
+        {
+            "status": "queued" if queued else "rejected",
+            "subagent_id": subagent_id,
+            "text": text,
+        },
+    )
+
+
 @method("spawn_tree.save")
 def _(rid, params: dict) -> dict:
     session_id = _str_param(params, "session_id")