feat(kanban): govern raw intake decomposition - #5
Closed
SSC-ENG wants to merge 3 commits into
Closed
Conversation
…ner, and WSL browser paths Salvaged from NousResearch#57016 by @lEWFkRAD: - cli.py: handle file:///C:/... drive-letter URIs on nt (strip the leading slash urlparse leaves); join Termux example paths with literal forward slashes so hints stay POSIX on Windows. - gateway/status.py + hermes_cli/gateway.py: normalize backslashes to forward slashes before the HERMES_HOME substring match so separator style cannot defeat profile ownership detection. - hermes_cli/banner.py: cprint degrades to plain print when prompt_toolkit has no console (NoConsoleScreenBufferError on redirected/absent Windows stdout). - hermes_cli/browser_connect.py: posixpath.join for WSL /mnt/c/... bases (os.path.join would emit backslashes on nt). - Test hardening: symlink skip-guards, USERPROFILE alongside HOME for ntpath.expanduser, SIGKILL absence skipif fixed via monkeypatch, drive-letter URI / separator-normalization / banner-fallback coverage. Dropped from the original PR: tests/cli/conftest.py fixture and the AppSession _output monkeypatch — main's merged tests/cli/conftest.py already handles that prompt_toolkit pollution.
…repo-wide The test runner moved to per-file subprocess isolation via scripts/run_tests_parallel.py (hermetic `env -i`, worker count auto-scaled from CPU count, FLAKY-retry policy) — no pytest-xdist, no SIGALRM per-test timeout fixture. Docs still described the old runner in many places: - AGENTS.md: "-n auto xdist workers, in-tree subprocess-isolation plugin" clause replaced with the current per-file-subprocess description; the `::test_x` single-test example now shows file + -k (runner is file-granular). - CONTRIBUTING.md: "hermetic env, 4 xdist workers" comment corrected; `tests/conftest.py::_enforce_test_timeout` reference redirected to the win32 timeout-method shim in `tests/conftest.py::pytest_configure`. - skills/autonomous-ai-agents/hermes-agent/references/contributor-guide.md and windows-quirks.md: same corrections (the bundled skill mirrors the contributor docs); Windows workaround no longer installs pytest-xdist or passes -n 0. - website/docs + zh-Hans i18n mirrors: same fixes in adding-providers.md and the bundled-skill doc pages. - skills/software-development/python-debugpy/SKILL.md (+ zh-Hans mirror): "-p no:xdist"/"-n 0" pdb advice rewritten for the captured per-file subprocess runner. - skills/creative/comfyui/tests/README.md: parent-repo "-n auto by default" rationale updated to past tense. Combined salvage of PR NousResearch#38295 (konsisumer), PR NousResearch#51354 (TutkuEroglu, redirected to the current conftest truth and the relocated references/contributor-guide.md), and PR NousResearch#54956 (waroffchange). Co-authored-by: TutkuEroglu <rrandqua@gmail.com> Co-authored-by: waroffchange <116298975+waroffchange@users.noreply.github.com>
SSC-ENG
force-pushed
the
feat/HEL-3115-governed-intake
branch
from
July 30, 2026 06:36
578558e to
f874ff9
Compare
Collaborator
Author
|
RRA terminal disposition at exact head f874ff9: CLOSED as superseded. PR #8 carries the same HEL-3115 governed-intake scope on a clean branch and adds the content-digest deduplication fix; this branch also contains unrelated upstream commits and a 30-file diff. Continue review and merge processing on #8 only. |
Collaborator
Author
|
Closing the superseded delivery path. Canonical candidate: #8. |
SSC-ENG
added a commit
that referenced
this pull request
Jul 30, 2026
…ion, and backfill gaps AGA rejection issuecomment-5128947822 reproduced five durable-contract bypasses at head 3e14c97d4. This commit closes all five behaviorally: P1 #1 replay safety: persist_review no longer uses INSERT OR REPLACE (delete+reinsert re-fired the ledger-promotion trigger and nulled disposition/verification on replay). Both telemetry tables now use true ON CONFLICT ... DO UPDATE upserts; the findings upsert preserves MIN(first_observed_at)/MAX(last_observed_at). The promotion trigger gains a NOT EXISTS replay guard. Regression test replays a dispositioned+verified telemetry source and proves the full ledger row, finding-event cardinality, and orphan set are unchanged. P1 #2 governed attestation: verify_finding only accepts a typed VerifiedEvidence produced by a governed adapter. fetch_linear_issue_evidence performs a real Linear GraphQL existence/state lookup (hermetic transport injection for tests) and binds canonical UUID, observed state, and verification time; fetch_decision_record_evidence refuses decision refs never recorded via record_finding_decision. Unknown sources, free-form strings, mismatched issues, and syntactically-valid-but-nonexistent ids are rejected with negative tests. The CLI verify path routes through the same adapters; no free-form evidence flags remain. P1 #3 bound-field immutability: trg_finding_disposition_bound_immutable freezes disposition, linear_issue_id, decision_record_ref, and dispositioned_at once disposition is set; trg_finding_verification_immutable freezes verified_at, verification_evidence_ref, verification_source, and verification_observed_state once verified. Direct-SQL tests cover every bound field; governed FROM-NULL updates still pass. P1 #4 purge retention: delete_archived_task and delete_task rehome findings whose telemetry source is retained to the durable rescue work-intent (finding_rehomed event) instead of orphaning the source; the rescue container itself cannot be deleted. Tests cover archive-purge and hard-delete paths with and without retained sources. P1 #5 migration: init_db DROP+recreates the finding triggers (legacy boards kept stale narrow bodies under CREATE TRIGGER IF NOT EXISTS), ALTERs verification_observed_state onto legacy findings tables before trigger recreation, and idempotently backfills retained telemetry_review_findings into the ledger - valid tasks promote in place, absent tasks rehome to the rescue work-intent with a finding_rehomed event. Linear: HEL-3112 (parent HEL-3104).
SSC-ENG
added a commit
that referenced
this pull request
Jul 30, 2026
* feat(HEL-3112): gate accepted findings into owned queue * fix(HEL-3112): close finding gate bypasses * fix(HEL-3112): close AGA P1 replay, attestation, immutability, retention, and backfill gaps AGA rejection issuecomment-5128947822 reproduced five durable-contract bypasses at head 3e14c97d4. This commit closes all five behaviorally: P1 #1 replay safety: persist_review no longer uses INSERT OR REPLACE (delete+reinsert re-fired the ledger-promotion trigger and nulled disposition/verification on replay). Both telemetry tables now use true ON CONFLICT ... DO UPDATE upserts; the findings upsert preserves MIN(first_observed_at)/MAX(last_observed_at). The promotion trigger gains a NOT EXISTS replay guard. Regression test replays a dispositioned+verified telemetry source and proves the full ledger row, finding-event cardinality, and orphan set are unchanged. P1 #2 governed attestation: verify_finding only accepts a typed VerifiedEvidence produced by a governed adapter. fetch_linear_issue_evidence performs a real Linear GraphQL existence/state lookup (hermetic transport injection for tests) and binds canonical UUID, observed state, and verification time; fetch_decision_record_evidence refuses decision refs never recorded via record_finding_decision. Unknown sources, free-form strings, mismatched issues, and syntactically-valid-but-nonexistent ids are rejected with negative tests. The CLI verify path routes through the same adapters; no free-form evidence flags remain. P1 #3 bound-field immutability: trg_finding_disposition_bound_immutable freezes disposition, linear_issue_id, decision_record_ref, and dispositioned_at once disposition is set; trg_finding_verification_immutable freezes verified_at, verification_evidence_ref, verification_source, and verification_observed_state once verified. Direct-SQL tests cover every bound field; governed FROM-NULL updates still pass. P1 #4 purge retention: delete_archived_task and delete_task rehome findings whose telemetry source is retained to the durable rescue work-intent (finding_rehomed event) instead of orphaning the source; the rescue container itself cannot be deleted. Tests cover archive-purge and hard-delete paths with and without retained sources. P1 #5 migration: init_db DROP+recreates the finding triggers (legacy boards kept stale narrow bodies under CREATE TRIGGER IF NOT EXISTS), ALTERs verification_observed_state onto legacy findings tables before trigger recreation, and idempotently backfills retained telemetry_review_findings into the ledger - valid tasks promote in place, absent tasks rehome to the rescue work-intent with a finding_rehomed event. Linear: HEL-3112 (parent HEL-3104). --------- Co-authored-by: SSC-ENG <225143396+SSC-ENG@users.noreply.github.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear: HEL-3115\nParent: HEL-3107\n\nSummary:\n- add a canonical raw-intake envelope with content-digest idempotency on the existing triage/decomposer path\n- deterministically validate tenant/domain, profile/certification, allowed assignee, parent graph, fan-out cap, and PPMA task-0 gating after the LLM returns\n- emit typed scope_recorded/handoff_emitted events and parse PPMA LINEAR_SCOPE handoffs\n\nTests:\n- 15 passed across governed intake, decomposer, DB, CLI, and live auto-decompose suites\n- compileall and git diff --check passed\n\nDeployment impact: none. No automatic Linear/GitHub admin action or production apply.\nRollback: revert the single feature commit.