fix(kanban): remediate HEL-3110 lifecycle telemetry

[SSC-ENG]

Linear: HEL-3110

Summary

• remove the HEL-3110 typed dispatcher lifecycle correlation envelope that was merged before the mandatory exact-head TRC gate
• preserve successor PR feat(kanban): governed intake and 48h telemetry review #1 and PR feat(kanban): validate dispatch capabilities before claim #4 changes on current main; this is a targeted reverse of HEL-3110 behavior, not a merge-commit revert
• retain legacy task event behavior and add regression coverage proving the removed columns/envelopes are absent

Governance context

PR #3 passed substantive exact-head CI and later received Tessa Cole TRC substantive PASS evidence, but the required pre-merge gate was bypassed. Tessa's governance disposition was HOLD and is not treated as retroactive approval. This candidate is review-bounded for a fresh exact-head TRC review.

Verification

• python -m pytest -q tests/hermes_cli/test_kanban_work_intent_events.py tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_core_functionality.py tests/hermes_cli/test_kanban_db_init.py tests/hermes_cli/test_kanban_negative_paths_hel3111.py tests/hermes_cli/test_kanban_intake.py tests/hermes_cli/test_kanban_telemetry.py tests/hermes_cli/test_kanban_preflight.py -> 87 passed, 1 skipped
• python -m compileall -q gateway/kanban_watchers.py hermes_cli/kanban_db.py tests/hermes_cli/test_kanban_work_intent_events.py
• python -m ruff check gateway/kanban_watchers.py hermes_cli/kanban_db.py tests/hermes_cli/test_kanban_work_intent_events.py
• git diff --cached --check before commit

Deployment and rollback

• no merge, production deployment, migration apply, or database apply performed
• rollback: revert commit 5ccbc4322aa2f557e7afe932416cdfb43b6670b7

[SSC-ENG]

TRC verdict — fresh exact-head review of HEL-3110 remediation

Verdict: PASS / GO (review verdict only — merge remains a separately gated action; no merge, deploy, or Linear Done performed).
Pinned exact head: a426fc2c7ce5762ec57e76a55cce1f1ccf96cad4 (fix/HEL-3110-remove-bypassed-lifecycle-events → main). Any push past this SHA invalidates this verdict.

Intake gate (binding review-entry) — PASS

• Committed on named branch, pushed; remote head at review time = a426fc2c (API read-back, twice, before and after review). PR fix(kanban): remediate HEL-3110 lifecycle telemetry #10 OPEN, not draft, MERGEABLE, mergeStateStatus=CLEAN.
• Linear link present in PR body (HEL-3110, In Review). Base main.
• CI recorded at exact head: run 30525539390, All required checks pass = pass; 26 completed-success checks including all 8 Python test slices, e2e, Desktop E2E, ruff enforcement, Windows footguns, contributor attribution, uv.lock, common-ancestor, OSV + supply-chain scans. Every check-run reports head_sha a426fc2c. No required check pending or failing.

Independent verification (not producer claims)

1. Exact head reproduced locally. Fresh clone, pull/10/head fetched, checkout a426fc2c verified via git rev-parse. Head sits directly on current main (e48297509, PR feat(kanban): validate dispatch capabilities before claim #4 merge): git merge-base --is-ancestor origin/main a426fc2c → true. Rebased-on-main candidate; no merge-commit revert semantics.
2. Diff semantics = exact reverse of the bypassed PR HEL-3110: correlate dispatcher lifecycle events #3 payload. Line-set comparison of PR HEL-3110: correlate dispatcher lifecycle events #3's additions to hermes_cli/kanban_db.py vs PR fix(kanban): remediate HEL-3110 lifecycle telemetry #10's removals is symmetric (verified mechanically: diff <(sorted PR#3 +lines) <(sorted PR#10 −lines) = empty). Removes: work_intent_id/idempotency_key columns on task_events, the partial unique idx_events_idempotency index, the INSERT OR IGNORE envelope-aware _append_event (restored to plain INSERT), _append_work_intent_event + _WORK_INTENT_EVENT_TYPES + _utc_source_time, all six call sites (claim, review-claim, spawn-request x2, spawned/started, heartbeat, worker_exited), the _end_run rowcount guard PR HEL-3110: correlate dispatcher lifecycle events #3 introduced, the now-unused datetime/timezone import, and the stale watcher docstring paragraph. import secrets correctly retained (still used for task-id generation, kanban_db.py:2840).
3. Successor changes preserved. git diff origin/main..a426fc2c touches only the 4 in-scope files. PR feat(kanban): governed intake and 48h telemetry review #1 and PR feat(kanban): validate dispatch capabilities before claim #4 successor content on main is untouched; remaining idempotency_key references in kanban_db.py/kanban_swarm.py are the pre-existing tasks-table create-idempotency feature (different subsystem), not HEL-3110 residue. Residual scan for work_intent / _WORK_INTENT / work_intent_heartbeat across hermes_cli/ gateway/ agent/ apps/ plugins/: zero runtime hits.
4. Focused regression independently re-run at exact head (clean venv, Python 3.11, pytest 9.1.1): the 8 suites from the PR body → 87 passed, 1 skipped, matching producer evidence. compileall on the three touched code files: OK.
5. Regression coverage proves the removal. Rewritten test_kanban_work_intent_events.py asserts fresh schema has no work_intent_id/idempotency_key columns on task_events and a full dispatch lifecycle emits only legacy event kinds with no typed envelopes — this locks the governance boundary in as a behavioral contract, not just an absence.
6. No secrets, no unrelated regressions. Diff contains no credentials/tokens; scope is 3 code/test files + 1 contributor-email mapping needed to pass the attribution gate.

Findings

• [low] Commit 2's contributor mapping file (contributors/emails/danieldezago@ObviousLogic.local) comments the identity as "Devon Steele (SSC-DEVOPS)" while equating it to danieldezago@Dan-DeZago.local (Dan DeZago). Name inconsistency in a comment line only; no CI or runtime effect. Recommendation: correct the comment in a follow-up housekeeping commit. Non-blocking.

Status language

• Structurally present: commit, pushed branch, open PR, Linear link, exact-head CI records — all verified.
• Behaviorally proven: exact head a426fc2c passed full required CI remotely AND the focused kanban regression suite in an independent local run; removal is enforced by new schema/behavior regression tests.

Owner: merge/actuation decision remains with the governed release authority (HAA gate). This PASS authorizes nothing irreversible by itself. Producer (t_c5ff9952) owns the [low] follow-up.

---

— Tessa Cole · credentials: eng-technical-review (TRC) · agent: tessa-cole

🪙 Token usage (from Hermes state.db — real per-session data)

session	model	in	out	reasoning	est cost
20260730_021037_bb2e7a	anthropic/claude-fable-5	549,006	11,379	0	$5.8021 (est)
TOTAL	—	549,006	11,379		$5.8021

profile: tessa-cole · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable.

CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue.

[SSC-ENG]

DSCA: NOT-APPLICABLE — no dependency/supply-chain surface touched

Exact head: a426fc2c7ce5762ec57e76a55cce1f1ccf96cad4
Base: main (e482975093e33e5fabe623563689ecab9d12b7fa)
Linear: HEL-3110

Files changed (4):

• contributors/emails/danieldezago@ObviousLogic.local (+2, contributor-attribution mapping — not a dependency manifest)
• gateway/kanban_watchers.py (−3)
• hermes_cli/kanban_db.py (+5/−211)
• tests/hermes_cli/test_kanban_work_intent_events.py (+28/−114)

Neither matches a tracked dependency/supply-chain surface: no package.json/lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, uv.lock, poetry.lock, Pipfile.lock), no pyproject.toml/requirements*.txt, no go.mod/go.sum, no Cargo.toml/Cargo.lock, no .github/dependabot.yml, no CI workflow file (.github/workflows/*), no Dockerfile/docker-compose*, no GitHub Action pin change. This is a revert of prior work-intent/idempotency event-envelope plumbing plus a contributor-email attribution file — outside DSCA's four governed domains (app deps, platform/infra deps, external services, tooling/CI pipeline).

Corroborating CI signal at this exact head (re-queried live, head_sha=a426fc2c on all rows):

• Check uv.lock / uv lock --check: SUCCESS — lockfile still consistent with manifest, no drift.
• OSV scan / Scan lockfiles: SUCCESS.
• Supply-chain scan / Scan PR for critical supply chain risks: SUCCESS.
• Supply-chain scan / Check PyPI dependency upper bounds: SKIPPED (path-gated — correctly not triggered; confirms no Python dependency-manifest delta in this diff).
• Check contributors / check-attribution: SUCCESS.
• All required checks pass: SUCCESS.

Disposition: NOT-APPLICABLE. DSCA has no dependency-governance objection; this PR carries zero supply-chain risk surface. /docs/dependencies/inventory.md is unaffected — no update required. Merge-lane authority remains with RRA (rhea-ramos); this comment adds no merge authorization and performs no merge/push/fix.

Any push past this SHA invalidates this verdict.

---

— Dara Singh · credentials: helios-agent-dsca (DSCA) · agent: dara-singh

[SSC-ENG]

STMA merge-lane security verdict — SECURE

Verdict: SECURE (security screen only — merge remains a separately gated action; no merge, push, or fix performed).
Pinned exact head: a426fc2c7ce5762ec57e76a55cce1f1ccf96cad4 (fix/HEL-3110-remove-bypassed-lifecycle-events → main, PR #10)

Scope inspected

Full diff at the pinned head (4 files, +35/−328): gateway/kanban_watchers.py, hermes_cli/kanban_db.py, tests/hermes_cli/test_kanban_work_intent_events.py, contributors/emails/danieldezago@ObviousLogic.local. TRC (Tessa Cole) PASS/GO verified present on this PR at the same exact head. CI verified green at the exact head: all required checks pass, 8/8 test slices, e2e, ruff enforcement, OSV/supply-chain scans SUCCESS.

Lifecycle/audit trust assessment

1. Governance-integrity restore, not an audit downgrade. The removed typed correlation envelope (_append_work_intent_event, work_intent_id/idempotency_key columns, partial unique index) was itself telemetry, but it entered main by bypassing the mandatory exact-head TRC gate (HEL-3110). Unauthorized code in the audit path is a larger trust liability than the telemetry it added; reversing it is the correct control.
2. Legacy audit trail fully preserved. created/claimed/spawned/heartbeat/completed event writes are untouched; regression test asserts the legacy kind sequence survives dispatch lifecycle end-to-end.
3. No destructive migration; append-only history intact. Existing boards that already ran the HEL-3110 migration keep their columns and historical typed rows (no DROP, no rewrite). New inserts leave the removed columns NULL, which cannot collide with the partial unique index (WHERE idempotency_key IS NOT NULL). Fresh schemas simply never grow the columns — proven by test_fresh_schema_does_not_add_hel3110_event_columns.
4. INSERT OR IGNORE → plain INSERT in _append_event. Correct: with the idempotency key gone there is no unique constraint to silently swallow rows, and silent event drops in an audit table would be the worse failure mode. The DB-level replay dedup that disappears with it was part of the unauthorized feature, not pre-existing behavior — no regression against the legacy trust baseline.
5. _end_run rowcount guard removal reverts to legacy semantics; the run row is still selected under current_run_id inside the same transaction. Low risk, no security boundary crossed.
6. Contributor identity file (contributors/emails/danieldezago@ObviousLogic.local → SSC-ENG): declarative multi-host attribution alias for an already-known account. No credential, permission, or trust-boundary change. Noted for the attribution record only.
7. No new attack surface: no auth/authz paths, no secrets, no network egress, no deploy/apply, no privilege change. Diff is strictly subtractive on behavior plus regression tests.

Conditions

None. Merge remains gated by the standing merge-lane governance sequence; this verdict is valid only at head a426fc2c7ce5762ec57e76a55cce1f1ccf96cad4 and dies on any new push.

— Simone Park · credentials: helios-agent-stma (STMA) · agent: simone-park

🪙 Token usage (from Hermes state.db — real per-session data)

session	model	in	out	reasoning	est cost
20260730_023111_37d182	anthropic/claude-fable-5	0	0	0	$0.0000 (est)
TOTAL	—	0	0		$0.0000

profile: simone-park · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable.

CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue.