HEL-3110: correlate dispatcher lifecycle events - #3
Merged
Conversation
SSC-ENG
force-pushed
the
feat/t-e662bbe9-work-intent-events
branch
from
July 30, 2026 06:01
5b51c6e to
25fbbaa
Compare
Collaborator
Author
|
TRC: HOLD Exact-head technical review for HEL-3110 at Disposition: HOLD due to governance race, not a substantive defect in the reviewed change. PR #3 was merged at Substantive evidence at the submitted exact head:
[high] Required pre-merge TRC gate was bypassed → Rhea Ramos / merge-lane owner must record the governance exception or remediate under the governed post-merge process. Do not represent this HOLD as a pre-merge approval. Any further candidate requires a fresh exact-head review. — Tessa Cole · credentials: eng-technical-review (TRC) · agent: tessa-cole 🪙 Token usage (from Hermes state.db — real per-session data)
profile: tessa-cole · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable. CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue. |
This was referenced Jul 30, 2026
SSC-ENG
added a commit
that referenced
this pull request
Jul 30, 2026
Re-lands the governed HEL-3110 implementation (originally PR #3, merged as ad29d8d, reverted by remediation PR #10 / 8684c5b because the merge bypassed the mandatory pre-merge TRC gate) on post-removal main. - work_intent_id correlation key on task_events (additive column + fresh-schema DDL), work_intent_id = task_id. - Typed lifecycle events emitted at existing dispatcher mutation boundaries in hermes_cli/kanban_db.py: task_claimed, worker_spawn_requested, worker_spawned, worker_started, heartbeat, worker_exited. gateway/kanban_watchers.py remains caller-only. - Append-only envelope per HELIOS-THROUGHPUT-TRC-FINAL-SCOPE \u00a73.1; idempotency_key dedupe so replaying a source event yields exactly one logical transition; no second telemetry DB; current_step_key untouched. - Payload safety: no secrets, raw HAA text, or local filesystem paths. Content is the symmetric reverse of PR #10's removal (mechanically the same lines PR #3 added), rebased over #4/#6 dispatcher changes. Linear: HEL-3110 (parent HEL-3103)
SSC-ENG
added a commit
that referenced
this pull request
Jul 30, 2026
…ion, and backfill gaps AGA rejection issuecomment-5128947822 reproduced five durable-contract bypasses at head 3e14c97d4. This commit closes all five behaviorally: P1 #1 replay safety: persist_review no longer uses INSERT OR REPLACE (delete+reinsert re-fired the ledger-promotion trigger and nulled disposition/verification on replay). Both telemetry tables now use true ON CONFLICT ... DO UPDATE upserts; the findings upsert preserves MIN(first_observed_at)/MAX(last_observed_at). The promotion trigger gains a NOT EXISTS replay guard. Regression test replays a dispositioned+verified telemetry source and proves the full ledger row, finding-event cardinality, and orphan set are unchanged. P1 #2 governed attestation: verify_finding only accepts a typed VerifiedEvidence produced by a governed adapter. fetch_linear_issue_evidence performs a real Linear GraphQL existence/state lookup (hermetic transport injection for tests) and binds canonical UUID, observed state, and verification time; fetch_decision_record_evidence refuses decision refs never recorded via record_finding_decision. Unknown sources, free-form strings, mismatched issues, and syntactically-valid-but-nonexistent ids are rejected with negative tests. The CLI verify path routes through the same adapters; no free-form evidence flags remain. P1 #3 bound-field immutability: trg_finding_disposition_bound_immutable freezes disposition, linear_issue_id, decision_record_ref, and dispositioned_at once disposition is set; trg_finding_verification_immutable freezes verified_at, verification_evidence_ref, verification_source, and verification_observed_state once verified. Direct-SQL tests cover every bound field; governed FROM-NULL updates still pass. P1 #4 purge retention: delete_archived_task and delete_task rehome findings whose telemetry source is retained to the durable rescue work-intent (finding_rehomed event) instead of orphaning the source; the rescue container itself cannot be deleted. Tests cover archive-purge and hard-delete paths with and without retained sources. P1 #5 migration: init_db DROP+recreates the finding triggers (legacy boards kept stale narrow bodies under CREATE TRIGGER IF NOT EXISTS), ALTERs verification_observed_state onto legacy findings tables before trigger recreation, and idempotently backfills retained telemetry_review_findings into the ledger - valid tasks promote in place, absent tasks rehome to the rescue work-intent with a finding_rehomed event. Linear: HEL-3112 (parent HEL-3104).
SSC-ENG
added a commit
that referenced
this pull request
Jul 30, 2026
* feat(HEL-3112): gate accepted findings into owned queue * fix(HEL-3112): close finding gate bypasses * fix(HEL-3112): close AGA P1 replay, attestation, immutability, retention, and backfill gaps AGA rejection issuecomment-5128947822 reproduced five durable-contract bypasses at head 3e14c97d4. This commit closes all five behaviorally: P1 #1 replay safety: persist_review no longer uses INSERT OR REPLACE (delete+reinsert re-fired the ledger-promotion trigger and nulled disposition/verification on replay). Both telemetry tables now use true ON CONFLICT ... DO UPDATE upserts; the findings upsert preserves MIN(first_observed_at)/MAX(last_observed_at). The promotion trigger gains a NOT EXISTS replay guard. Regression test replays a dispositioned+verified telemetry source and proves the full ledger row, finding-event cardinality, and orphan set are unchanged. P1 #2 governed attestation: verify_finding only accepts a typed VerifiedEvidence produced by a governed adapter. fetch_linear_issue_evidence performs a real Linear GraphQL existence/state lookup (hermetic transport injection for tests) and binds canonical UUID, observed state, and verification time; fetch_decision_record_evidence refuses decision refs never recorded via record_finding_decision. Unknown sources, free-form strings, mismatched issues, and syntactically-valid-but-nonexistent ids are rejected with negative tests. The CLI verify path routes through the same adapters; no free-form evidence flags remain. P1 #3 bound-field immutability: trg_finding_disposition_bound_immutable freezes disposition, linear_issue_id, decision_record_ref, and dispositioned_at once disposition is set; trg_finding_verification_immutable freezes verified_at, verification_evidence_ref, verification_source, and verification_observed_state once verified. Direct-SQL tests cover every bound field; governed FROM-NULL updates still pass. P1 #4 purge retention: delete_archived_task and delete_task rehome findings whose telemetry source is retained to the durable rescue work-intent (finding_rehomed event) instead of orphaning the source; the rescue container itself cannot be deleted. Tests cover archive-purge and hard-delete paths with and without retained sources. P1 #5 migration: init_db DROP+recreates the finding triggers (legacy boards kept stale narrow bodies under CREATE TRIGGER IF NOT EXISTS), ALTERs verification_observed_state onto legacy findings tables before trigger recreation, and idempotently backfills retained telemetry_review_findings into the ledger - valid tasks promote in place, absent tasks rehome to the rescue work-intent with a finding_rehomed event. Linear: HEL-3112 (parent HEL-3104). --------- Co-authored-by: SSC-ENG <225143396+SSC-ENG@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear: HEL-3110
Parent: HEL-3103
Summary
task_eventsstreamwork_intent_idcurrent_step_keyuntouchedBehavioral evidence
task_claimed→worker_spawn_requested→worker_spawned→worker_started→heartbeat→worker_exited(completed)worker_exited(spawn_failed)Tests
python -m pytest tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_core_functionality.py tests/hermes_cli/test_kanban_db_init.py tests/hermes_cli/test_kanban_work_intent_events.py -qpython -m compileall -q hermes_cli/kanban_db.py gateway/kanban_watchers.py tests/hermes_cli/test_kanban_work_intent_events.pygit diff --checkDeployment and rollback