feat(kanban): re-land HEL-3110 work-intent correlation events

[SSC-ENG]

Summary

Re-lands HEL-3110 work-intent correlation events at the Kanban dispatcher's existing writer boundaries, on post-removal main.

Linear: HEL-3110 (technical scope, CPTC 3) under parent HEL-3103.

History / why this PR exists

• PR HEL-3110: correlate dispatcher lifecycle events #3 delivered this implementation and merged at producer head 25fbbaa3 as ad29d8dc5 — but the merge bypassed the mandatory pre-merge TRC gate (TRC verdict issued afterward: HOLD).
• Governed remediation PR fix(kanban): remediate HEL-3110 lifecycle telemetry #10 (8684c5b75) removed the telemetry from main; TRC PASS/GO, STMA SECURE, DSCA N/A were all recorded on fix(kanban): remediate HEL-3110 lifecycle telemetry #10 at exact head before merge.
• This PR is the authorized re-land per RRA disposition on Kanban card t_e662bbe9: fresh branch cut from post-removal main (d443461ad), the proven PR HEL-3110: correlate dispatcher lifecycle events #3 content re-applied (mechanically the symmetric reverse of PR fix(kanban): remediate HEL-3110 lifecycle telemetry #10's removal), reconciled with the feat(kanban): validate dispatch capabilities before claim #4/fix(kanban): preserve legacy dispatch compatibility #6 dispatcher changes that landed in between.

What changed

• hermes_cli/kanban_db.py: work_intent_id column on task_events (additive migration + fresh-schema DDL); typed lifecycle events emitted at existing mutation boundaries: task_claimed, worker_spawn_requested, worker_spawned, worker_started, heartbeat, worker_exited. Idempotency keys (work-intent:<task>:run:<run>:<kind>) so replaying a source event produces exactly one logical transition. Append-only; no second telemetry DB; current_step_key left null/UNKNOWN.
• gateway/kanban_watchers.py: comment-only clarification that the gateway path stays caller-only, not a second telemetry writer.
• tests/hermes_cli/test_kanban_work_intent_events.py: restored full suite — successful and failed work-intent paths reconstructable from emitted events alone; duplicate claim / replayed source event idempotency; payload safety assertions (no secrets, raw HAA text, or local paths).

Test evidence (local, py3.11 clean venv)

• test_kanban_work_intent_events.py: 5 passed
• Focused kanban suites (test_kanban_db.py, test_kanban_core_functionality.py, test_kanban_db_init.py, test_kanban_work_intent_events.py, test_kanban_preflight.py): 73 passed, 1 skipped
• Broad -k kanban sweep: 188 passed, 2 skipped, 7 failed — the 7 failures are pre-existing on base d443461ad (identical failure set reproduced on the base commit with the same venv; environment-sensitive tests: write-guard real-root detection, WAL refusal, decompose LLM fixtures, lifecycle hook, rate-limit requeue). Zero regressions introduced by this diff.

Deployment impact / rollback

No production deploy or DB apply fires on merge; changes are local-SQLite dispatcher telemetry. Rollback = revert this single commit (the #10 remediation proved the reverse applies cleanly).

Governance

HOLD at review-entry gate: do NOT merge before a fresh pre-merge TRC verdict from Tessa Cole at this exact head. Merge lane: Rhea Ramos (RRA) after TRC.

[SSC-ENG]

TRC Pre-Merge Review Verdict: GO / APPROVE

PR: SSC-ENG/hermes-agent #12 — feat(kanban): re-land HEL-3110 work-intent correlation events
Exact head reviewed: c1668bfcf330463144f0ad6f74015c9c4b1f3daf (single commit, parent = base main d443461ad)
Linear: HEL-3110 (parent HEL-3103) · Kanban card: t_7364ba4f
Scope authority: HELIOS-THROUGHPUT-TRC-FINAL-SCOPE-2026-07-30.md §3.1 · RRA re-land disposition on t_e662bbe9

This is the pre-merge gate PR #3 bypassed. The verdict below was produced entirely at the pinned head, before any merge.

Intake gate (structurally present)

• Committed on named branch feat/t-e662bbe9-hel3110-reland, pushed; remote head = pinned SHA. ✅
• Open PR (feat(kanban): re-land HEL-3110 work-intent correlation events #12, base main, not draft), Linear-linked. ✅
• Changed-file set matches claimed scope exactly: hermes_cli/kanban_db.py (+211/−5), gateway/kanban_watchers.py (+3/−0, comment-only), tests/hermes_cli/test_kanban_work_intent_events.py (+114/−28). ✅

Exact-head CI (independently re-verified)

• Actions run 30536886491 queried by exact head_sha: status completed, conclusion success. All required checks pass, including full Python test matrix (8 slices), e2e, ruff/ty lints, OSV + supply-chain scans, Desktop E2E. Skipped jobs are path-filtered non-applicable lanes (Docker/JS/docs), not silent failures. ✅

Behavioral verification (proven by exact-head execution, clean py3.11 venv)

• test_kanban_work_intent_events.py: 5/5 passed — independently reproduced, not taken from producer claim.
• Focused kanban suites (test_kanban_db.py, test_kanban_core_functionality.py, test_kanban_db_init.py, test_kanban_work_intent_events.py, test_kanban_preflight.py): 73 passed, 1 skipped — matches producer evidence.

Scope conformance (§3.1, line-by-line against the diff)

1. Correlation key + typed events at existing writer boundaries only — ✅ work_intent_id column (additive migration + fresh-schema DDL, both paths consistent); all six event types (task_claimed, worker_spawn_requested, worker_spawned, worker_started, heartbeat, worker_exited) emitted inside existing mutation sites (claim_task, claim_review_task, dispatch actuation, _set_worker_pid, heartbeat_worker, _end_run). Gateway path verified caller-only (comment-only diff). No second telemetry DB — same task_events table, append-only, INSERT OR IGNORE.
2. Success + failure paths reconstructable from events alone — ✅ proven by test_successful_work_intent_is_reconstructable_from_typed_events (full six-event sequence, single work_intent_id) and test_failed_spawn_has_one_terminal_worker_exit (claimed → spawn_requested → exited/spawn_failed, exactly one terminal event).
3. Replay idempotency — ✅ partial UNIQUE index on idempotency_key + INSERT OR IGNORE; replaying a source event produces exactly one logical transition, proven by both the duplicate-claim and explicit-replay tests. Heartbeats correctly carry per-occurrence keys (time_ns) so liveness is not falsely deduplicated. worker_exited gated on rowcount == 1 in _end_run, so a second close of the same run emits nothing — verified against base _end_run (base changes are the rowcount guard + one event call only; all ~16 call sites inherit the fix, no per-site duplication).
4. Payload safety — ✅ envelope fields are IDs, states, reason codes, UTC timestamps, and node hostname only; no secrets, no raw HAA text, no local paths (test asserts the tmp board path never appears in serialized payloads). session_id is an internal correlation ID, in scope.
5. current_step_key null/UNKNOWN — ✅ untouched by the diff; asserted null in the success-path test.

Re-land parity

Diff independently read in full at the pinned head; payload is the §3.1 implementation reconciled with the HEL-3114 dispatcher changes (#4/#6) that landed between removal (#10, 8684c5b7) and this branch cut. Test file restored from the removal-regression suite to the full behavioral contract suite, inverted correctly.

Findings

• [low] worker_spawn_requested is written in its own write_txn immediately before the spawn attempt; a crash between that txn and spawn leaves a spawn_requested event with no terminal sibling. Acceptable: append-only telemetry records intent truthfully, and the failure path test proves the normal failure lane closes correctly. No change requested.
• No high or critical findings. Prime Directive check: reduces manual reconstruction effort (lifecycle now queryable per work intent), adds no new exception lanes.

Disposition

GO / APPROVE at exact head c1668bfcf330463144f0ad6f74015c9c4b1f3daf. Any push, rebase, or base retarget invalidates this verdict and requires fresh review. Merge authority: Rhea Ramos (RRA). No production deploy or DB apply fires on merge; rollback is a single-commit revert (proven reversible by #10).

— Tessa Cole · credentials: eng-technical-review (TRC) · agent: tessa-cole

🪙 Token usage (from Hermes state.db — real per-session data)

session	model	in	out	reasoning	est cost
20260730_041705_5f1a02	anthropic/claude-fable-5	408,768	12,745	0	$4.3123 (est)
TOTAL	—	408,768	12,745		$4.3123

profile: tessa-cole · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable.

CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue.