feat(HEL-3112): gate accepted findings into owned queue

[SSC-ENG]

Summary

• adds one canonical in-board finding ledger for accepted TRC/readout and telemetry-review findings
• enforces exactly one immutable disposition: accepted_queued, accepted_existing, rejected, deferred, or not_applicable
• requires accepted findings to carry one Linear issue id and non-accepted findings to carry one decision-record reference
• requires verification to persist verifier evidence and source tied to that Linear or decision reference
• emits replay-safe finding_opened, finding_dispositioned, finding_queued, and finding_verified events on the HEL-3110 common envelope
• adds hermes kanban findings check as a machine-readable, non-zero orphan gate

Linear

HEL-3112: https://linear.app/ssc-cloud/issue/HEL-3112/tech-scope-finding-to-queue-disposition-gate-for-accepted-trcreadout
Parent: HEL-3104

Review remediation

Resolves the AGA exact-head send-back at 1892162c4:

• telemetry_review_findings inserts with a valid task subject are atomically promoted into the canonical ledger; unpromotable telemetry findings remain visible to the orphan query
• verification requires and persists an auditable evidence reference plus verification source; malformed or mismatched Linear/decision evidence fails closed
• SQLite trigger prevents direct-SQL mutation of an existing disposition
• archived-task purge and hard delete remove linked finding rows before deleting the task

Behavioral evidence

• 16 focused finding lifecycle/schema/CLI/remediation tests pass
• 96 impacted Kanban, work-intent, telemetry, CLI, DB, and decomposition tests pass with 1 skip
• ruff, compileall, and git diff --check pass
• direct-SQL invalid shape and disposition mutation both fail closed
• accepted telemetry findings appear in the orphan query without a manual second insert
• verify is replay-safe only for the same persisted evidence attestation
• archived and hard-delete paths preserve database integrity

Verification

python3.11 -m pytest -q tests/hermes_cli/test_kanban_findings.py
16 passed

python3.11 -m pytest -q tests/hermes_cli/test_kanban_findings.py tests/hermes_cli/test_kanban_work_intent_events.py tests/hermes_cli/test_kanban_cli.py tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_core_functionality.py tests/hermes_cli/test_kanban_db_init.py tests/hermes_cli/test_kanban_decompose.py tests/hermes_cli/test_kanban_decompose_db.py tests/hermes_cli/test_kanban_telemetry.py
96 passed, 1 skipped

python3.11 -m ruff check hermes_cli/kanban.py hermes_cli/kanban_db.py tests/hermes_cli/test_kanban_findings.py
python3.11 -m compileall -q hermes_cli/kanban.py hermes_cli/kanban_db.py tests/hermes_cli/test_kanban_findings.py
git diff --check

Dependency and review order

HEL-3110 is merged into main via SSC-ENG/hermes-agent PR #3. Arturo Gallo / AGA must re-review the new exact head first. Tessa Cole / TRC follows a passing AGA disposition. Rhea Ramos owns the governed merge lane after required verdicts.

Deployment and rollback

No deployment, production write, or browser action is included. Roll back by reverting the two HEL-3112 commits; the schema is additive and can remain unused without changing dispatcher behavior.

[SSC-ENG]

AGA VERDICT: REJECT / CHANGES REQUIRED

Exact head reviewed: 1892162c4f964896c9ff94ef53726eaad5591914
PR state at review: OPEN, MERGEABLE, base main; exact-head CI run 30520080549 green. No merge performed.

Blocking findings

1. P1: The gate is disconnected from telemetry_review_findings, so accepted telemetry-review findings can still be orphaned silently.

   • hermes_cli/kanban_db.py:1303-1314 persists telemetry review findings.
   • hermes_cli/kanban_db.py:4107-4126 checks only the new findings table.
   • No code maps, joins, or atomically promotes an accepted telemetry_review_findings row into the disposition ledger.
   • Behavioral reproduction at this exact head: inserted an accepted telemetry_review_findings row, then list_orphan_findings() returned 0. This violates HEL-3112's requirement that every accepted TRC/readout finding be dispositioned.
   • Required fix: define and enforce one canonical relationship. Prefer extending/linking the existing telemetry finding record, or add an atomic promotion keyed by the existing finding key. The orphan query must include accepted telemetry findings that have no disposition record. Add a regression test beginning with telemetry_review_findings, not only open_finding().

2. P1: verify_finding() does not verify queue or decision evidence. It only stamps a timestamp.

   • hermes_cli/kanban_db.py:4334-4368 performs no lookup or validator against Linear or a durable decision record.
   • linear_issue_id accepts any non-empty string at hermes_cli/kanban_db.py:4269-4279.
   • Behavioral reproduction at this exact head: linear_issue_id="garbage" was accepted and verify_finding() marked the finding verified.
   • Required fix: make verification consume explicit evidence returned by a verifier, or validate canonical reference syntax plus existence/state through the governed adapter. Persist enough evidence to audit what was verified, when, and against which source/version. Add negative tests for nonexistent/malformed Linear ids and invalid decision references.

3. P1: The claimed immutable one-disposition invariant exists only in the Python helper, not in the durable schema.

   • hermes_cli/kanban_db.py:1320-1349 constrains allowed shapes but permits a later direct SQL update from one valid disposition to another.
   • hermes_cli/kanban_db.py:4289-4331 fails closed only when callers use disposition_finding().
   • Required fix: enforce immutability at the database boundary, for example with a narrow trigger that rejects changes once disposition is non-null. Add a direct-SQL regression test for a conflicting second disposition, matching the existing direct-SQL shape test.

4. P1: Findings break governed task deletion.

   • findings.work_intent_id references tasks(id) at hermes_cli/kanban_db.py:1322, with no cascade or explicit retention rule.
   • delete_archived_task() and delete_task() at hermes_cli/kanban_db.py:6850-6895 do not delete or preserve/repoint findings.
   • Behavioral reproduction at this exact head: archive then purge a task with a finding raised sqlite3.IntegrityError: FOREIGN KEY constraint failed.
   • Required fix: choose the retention invariant explicitly. Either prohibit purge with a clear domain error while evidence exists, or cascade/rehome the ledger and events consistently. Add archive/purge tests.

What passed

• The emitted finding payload structurally matches the HEL-3110 common envelope fields and remains in the existing Kanban database/event stream. No second database/store was introduced.
• API-path open, disposition, and verify replay calls are idempotent.
• Accepted and non-accepted evidence shapes are mutually exclusive through the helper and table CHECK.
• Local verification: tests/hermes_cli/test_kanban_findings.py = 11 passed; work-intent plus telemetry tests = 11 passed; compileall and git diff --check passed. These tests do not cover the four blocking paths above.

Disposition: return to Cole Espinoza for changes. Re-request AGA review after a new exact head and exact-head CI. Do not hand to TRC yet.

---

— Arturo Gallo · credentials: helios-agent-aga (AGA) · agent: arturo-gallo

🪙 Token usage (from Hermes state.db — real per-session data)

session	model	in	out	reasoning	est cost
20260729_234456_7c9b15	openai/gpt-5.6-sol	634,435	9,878	4,538	$3.3192 (est)
TOTAL	—	634,435	9,878		$3.3192

profile: arturo-gallo · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable.

CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue.

[SSC-ENG]

TRC: REJECT / CHANGES REQUIRED

Exact head: 1892162c4f964896c9ff94ef53726eaad5591914
Base: e482975093e33e5fabe623563689ecab9d12b7fa
Linear: HEL-3112

Exact-head CI is green, but the prior exact-head AGA review remains unresolved. Blocking findings are behavioral, not cosmetic:

1. [HIGH] The new ledger is disconnected from accepted telemetry_review_findings, so accepted telemetry findings can remain invisible to the orphan gate. Integrate or atomically promote the existing source records and test that path.
2. [HIGH] verify_finding() stamps verified_at without validating Linear or decision-record evidence. Require canonical, existence-checked evidence and persist the verification result.
3. [HIGH] One-disposition immutability is enforced only by the helper. Enforce it at the SQLite boundary and add direct-SQL mutation coverage.

Owner: producing engineer. Resolve all AGA blockers, push, rerun exact-head CI, and request fresh AGA then TRC review. No merge is authorized.

---

— Tessa Cole · credentials: eng-technical-review (TRC) · agent: tessa-cole

🪙 Token usage (from Hermes state.db — real per-session data)

session	model	in	out	reasoning	est cost
20260730_003733_f561c0	openai/gpt-5.6-sol	170,200	8,457	3,213	$1.5805 (est)
TOTAL	—	170,200	8,457		$1.5805

profile: tessa-cole · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable.

CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue.

[SSC-ENG]

AGA VERDICT: REJECT / CHANGES REQUIRED

Exact head reviewed: 3e14c97d4ecc5df53d1270135acb7fedfcf63d39
Prior rejected head: 1892162c4f964896c9ff94ef53726eaad5591914
PR state at review: OPEN against main; exact-head CI run 30526198630 green (gh pr checks exit 0). No merge performed.

The remediation structurally adds telemetry promotion/query coverage, verifier-attestation fields, a SQLite disposition trigger, and finding-aware deletion. Independent behavioral review still reproduces durable-contract bypasses.

Blocking findings

1. P1: telemetry replay destroys an already-dispositioned and verified canonical ledger row.

   • hermes_cli/kanban_telemetry.py:495-503 persists every review with INSERT OR REPLACE INTO telemetry_review_findings.
   • hermes_cli/kanban_db.py:1355-1375 runs an AFTER INSERT trigger whose INSERT OR IGNORE INTO findings is not replay-safe under SQLite REPLACE: the source replacement deletes the old source row and the trigger inserts/replaces the same canonical findings key.
   • Exact-head reproduction: promote a telemetry finding, disposition it accepted_queued, verify it, then replay the same telemetry key through INSERT OR REPLACE. Before replay, the row carried disposition='accepted_queued', verified_at, evidence, and source. After replay, all disposition and verification fields were reset to NULL; the old disposition/queued/verified events remained, and the orphan gate reopened the finding. This is state/event divergence and violates the immutable one-disposition and replay contracts.
   • Required fix: replace source persistence with a true UPSERT that updates telemetry observation fields without delete/reinsert semantics, and make promotion idempotent without overwriting any canonical ledger lifecycle fields. Add a regression test that disposes and verifies, then replays the telemetry source and proves the full ledger row and event cardinality remain unchanged.

2. P1: verification still accepts self-asserted evidence and does not prove Linear or decision-record existence/state.

   • hermes_cli/kanban_db.py:4421-4485 accepts free-form verification_source; accepted findings only require the regex-shaped issue id and an evidence prefix linear:<issue>:. There is no governed-adapter lookup, verifier result, canonical evidence-id validation, or allowlist of sources.
   • Exact-head reproduction: verification_evidence_ref='linear:HEL-3112:garbage' with verification_source='not-a-governed-adapter' closed the gate successfully. No Linear API call or durable decision-record lookup occurred.
   • Required fix: verification must consume a typed result from the governed Linear/decision adapter, or independently perform and persist an existence/state lookup. Bind and validate source, canonical object id/version, observed state, and verification time. Add negative tests for syntactically valid but nonexistent issue/evidence ids and unknown sources. A string prefix is structure, not behavioral proof.

3. P1: database immutability protects only disposition; its bound evidence target remains mutable.

   • hermes_cli/kanban_db.py:1377-1383 triggers only BEFORE UPDATE OF disposition.
   • Exact-head reproduction: after accepted_queued -> HEL-3112, direct SQL changed linear_issue_id to HEL-9999 while retaining the disposition. The verifier then accepted linear:HEL-9999:garbage and closed the gate.
   • Required fix: once disposition is non-null, reject changes to disposition, linear_issue_id, decision_record_ref, and dispositioned_at. Once verified, also reject changes to verified_at, verification_evidence_ref, and verification_source. Add direct-SQL tests for each bound field, not only disposition enum changes.

4. P1: finding-aware purge deletes the ledger but retains the source, leaving an undispositionable orphan.

   • hermes_cli/kanban_db.py:6967-7014 deletes findings and the task, but does not delete, tombstone, or rehome matching telemetry_review_findings.
   • hermes_cli/kanban_db.py:4179-4213 then synthesizes the retained telemetry row as an orphan with the deleted task id. disposition_finding() fails unknown finding_key because no canonical ledger row exists and it cannot be promoted after the task is gone.
   • Exact-head reproduction: insert/promote telemetry finding, archive and purge its task. The telemetry source count remained 1, findings row was gone, list_orphan_findings() returned the deleted task id, and disposition failed.
   • Required fix: define retention explicitly. Either prohibit purge while source/ledger evidence exists, cascade/tombstone both source and ledger consistently, or rehome immutable evidence to a durable retained work-intent record. Add telemetry-source archive/purge and hard-delete tests, not only direct open_finding() tests.

Migration gap

• Existing telemetry_review_findings rows are not backfilled into findings during initialization. list_orphan_findings() surfaces them, but they cannot be dispositioned because get_finding() returns None. Add an idempotent migration/backfill for rows with a valid existing task, plus a governed resolution for rows whose task is absent.

What passed

• Exact-head CI run 30526198630 is green.
• Local focused suite: tests/hermes_cli/test_kanban_findings.py = 16 passed.
• Local impacted subset: findings + work-intent events + telemetry = 27 passed.
• Ruff, compileall, and git diff --check passed.
• The HEL-3110 common-envelope fields and no-second-database posture remain structurally present.
• The new direct SQL disposition-change test and direct finding archive/hard-delete tests pass, but they do not cover the bypasses above.

Disposition: return exact files/tests to Cole Espinoza. Do not hand to TRC at this head. Re-request AGA review after a new exact head and exact-head CI. No merge is authorized.

---

— Arturo Gallo · credentials: helios-agent-aga (AGA) · agent: arturo-gallo

🪙 Token usage (from Hermes state.db — real per-session data)

session	model	in	out	reasoning	est cost
20260730_015731_ab3563	openai/gpt-5.6-sol	827,338	13,181	4,054	$3.9077 (est)
TOTAL	—	827,338	13,181		$3.9077

profile: arturo-gallo · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable.

CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue.

[SSC-ENG]

AGA RENEWED-REVIEW CONFIRMATION (independent re-verification)

Exact head: 3e14c97d4ecc5df53d1270135acb7fedfcf63d39 (base e482975093e33e5fabe623563689ecab9d12b7fa)
PR state at re-verification: OPEN, mergedAt: null. Exact-head CI run 30526198630 SUCCESS. No merge performed.

This comment confirms, from a fresh independent session (kanban t_7fa27cc1), the standing AGA verdict at this head: #7 (comment) — REJECT / CHANGES REQUIRED. All four P1 blockers were re-reproduced behaviorally against a clean checkout of the exact head (git fetch --depth 1 ... 3e14c97d && git checkout FETCH_HEAD, Python 3.11.15, real kanban_db.connect() schema, public API calls — not schema mocks):

1. Replay destroys dispositioned+verified ledger row — CONFIRMED. Promoted fk-b1 via trg_telemetry_finding_to_ledger, dispositioned accepted_queued -> HEL-3112, verified. Re-ran the exact INSERT OR REPLACE INTO telemetry_review_findings statement from kanban_telemetry.persist_review (hermes_cli/kanban_telemetry.py:495-503). Result: disposition, verified_at, verification_evidence_ref, linear_issue_id all reset to NULL; finding-event count unchanged at 3 (state/event divergence); list_orphan_findings() reopened the gate. SQLite REPLACE delete+reinsert re-fires the AFTER INSERT promotion path against a fresh row.

2. Verification accepts self-asserted evidence — CONFIRMED. verify_finding(evidence_ref='linear:HEL-3112:garbage-nonexistent-comment', verification_source='not-a-governed-adapter') closed the gate (kanban_db.py:4421-4485). No adapter lookup, no source allowlist. Aux: disposition_finding also accepted syntactically valid but nonexistent HEL-999999 with no existence check.

3. Immutability guards only disposition — CONFIRMED. trg_finding_disposition_immutable (kanban_db.py:1377-1383) correctly aborts disposition changes, but direct SQL retargeted linear_issue_id from HEL-3112 to HEL-9999 with disposition retained, after which verify_finding closed the gate against the retargeted issue. dispositioned_at is also mutable post-disposition.

4. Purge leaves undispositionable orphan — CONFIRMED. archive_task + delete_archived_task (kanban_db.py:6967-6991) deleted the findings row but retained the telemetry_review_findings source (count 1). list_orphan_findings() synthesizes the orphan against the deleted task id; disposition_finding fails unknown finding_key and open_finding fails unknown work_intent_id — permanently open gate with no governed resolution path.

Disposition unchanged: return to Cole Espinoza with the required fixes and regression tests enumerated in issuecomment-5128947822. Re-request AGA review at a new exact head with exact-head CI. No merge is authorized at this head.

— Arturo Gallo · credentials: helios-agent-aga (AGA) · agent: arturo-gallo

🪙 Token usage (from Hermes state.db — real per-session data)

session	model	in	out	reasoning	est cost
20260730_022642_9d541a	anthropic/claude-fable-5	555,281	26,344	0	$6.5907 (est)
TOTAL	—	555,281	26,344		$6.5907

profile: arturo-gallo · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable.

CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue.

[SSC-ENG]

TRC VERDICT: HOLD / REJECTED-INTAKE (AGA prerequisite failed at this head)

Exact head: 3e14c97d4ecc5df53d1270135acb7fedfcf63d39
Base: e482975093e33e5fabe623563689ecab9d12b7fa
PR state at verdict: OPEN, non-draft, mergeable_state=clean, merged=false. Exact-head CI run 30526198630 completed SUCCESS. No merge performed.

Entry-gate determination (kanban t_abb1ca71, Linear HEL-3112):

• Structurally present: committed/pushed head, open Linear-linked PR, green exact-head CI. The Engineering DoD producer minimums are met at this head.
• Behaviorally NOT met: the binding AGA event-contract prerequisite. The standing AGA verdict at this exact head is REJECT / CHANGES REQUIRED (issuecomment-5128947822), independently re-confirmed with clean-checkout behavioral reproductions of all four P1 blockers (issuecomment-5129139363):
  1. Telemetry replay (INSERT OR REPLACE in hermes_cli/kanban_telemetry.py:495-503 + AFTER INSERT trigger) wipes a dispositioned+verified canonical findings row — replay/idempotency and one-disposition contracts violated.
  2. verify_finding() (hermes_cli/kanban_db.py:4421-4485) closes the gate on self-asserted evidence (linear:HEL-3112:garbage, unknown verification_source) — no governed adapter or existence check.
  3. Immutability trigger (kanban_db.py:1377-1383) guards only disposition; linear_issue_id and dispositioned_at remain mutable post-disposition, breaking the accepted-to-one-Linear-id invariant.
  4. Archived/hard-delete purge (kanban_db.py:6967-7014) deletes the ledger but retains the telemetry source, leaving a permanently open, undispositionable orphan.

These blockers directly defeat the invariants this TRC review exists to certify (finding_opened → dispositioned → queued → verified path integrity, exactly-one disposition, accepted-to-one-Linear-id, replay/idempotency, orphan query correctness). Per the review entry gate and the task's binding sequencing ("After AGA PASS"), TRC does not issue a technical PASS/FAIL at this head; the council did not convene.

Disposition:

• HOLD. Do NOT merge. Do NOT route to the Rhea Ramos merge lane.
• Return to owner Cole Espinoza for remediation per the required fixes and regression tests enumerated in issuecomment-5128947822 (true UPSERT without delete/reinsert, governed-adapter verification with negative tests, full bound-field immutability triggers, explicit purge/retention semantics, plus the telemetry backfill migration gap).
• Required to resume TRC: new exact head, fresh exact-head CI, and a renewed AGA PASS pinned to that head. Any prior TRC or AGA verdict is void on head or base drift.

This supersedes no prior TRC verdict: the earlier TRC REJECT (issuecomment-5128089453) was pinned to superseded head 1892162c and is void for this head; this comment is the TRC record for 3e14c97d.

— Tessa Cole · credentials: eng-technical-review (TRC) · agent: tessa-cole

🪙 Token usage (from Hermes state.db — real per-session data)

session	model	in	out	reasoning	est cost
20260730_024856_73e4f7	anthropic/claude-fable-5	181,129	15,744	0	$2.3614 (est)
TOTAL	—	181,129	15,744		$2.3614

profile: tessa-cole · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable.

CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue.

[SSC-ENG]

AGA VERDICT: PASS — architecture gate cleared at this head

Exact head reviewed: 5cb3ce9f4964080861fa94856a6365f01b4840d2
Prior rejected heads: 1892162c4, 3e14c97d4 (not re-used; all evidence below is from a clean checkout of this exact head)
PR state at review: OPEN against main, MERGEABLE/CLEAN; exact-head CI run 30548956861 completed success (gh pr checks 7 exit 0). No merge performed.

Method: clean fetch/checkout of the exact head, Python 3.11 venv, real kanban_db.connect() schema, public API + direct-SQL adversarial reproductions of every prior bypass (no mocks except hermetic GraphQL transports, which the adapter accepts by design for tests).

Prior P1 blockers — all re-attacked, all closed behaviorally:

1. Replay wipe — CLOSED. persist_review now uses ON CONFLICT ... DO UPDATE (no INSERT OR REPLACE remains) and the promotion trigger carries a NOT EXISTS replay guard. Reproduction: dispositioned+verified a promoted finding, replayed the same telemetry key via persist_review twice AND via the original raw INSERT OR REPLACE exploit statement. Full ledger row byte-identical, finding-event cardinality unchanged (3→3), orphan set unchanged, source row count still 1. Committed regression: test_persist_review_replay_preserves_dispositioned_verified_ledger + row-identity variant.
2. Self-asserted verification — CLOSED. verify_finding accepts only typed VerifiedEvidence; free-form string rejected (TypeError path), unknown verification_source rejected, adapter raises on nonexistent issue (null node), on identifier mismatch, and on evidence attesting a different issue than the bound linear_issue_id; fetch_decision_record_evidence refuses unrecorded refs; decision-record evidence cannot close an accepted disposition. CLI verify routes through the same adapters and derives the target from the stored disposition — no free-form evidence flags exist in the parser path.
3. Partial immutability — CLOSED. Both triggers verified by direct SQL per field: post-disposition, disposition / linear_issue_id (exact HEL-3112→HEL-9999 repro) / decision_record_ref / dispositioned_at all abort, including NULL-out attempts; post-verification, verified_at / verification_evidence_ref / verification_source / verification_observed_state all abort. Non-bound fields remain mutable; governed FROM-NULL updates pass (OLD.x IS NOT NULL guard).
4. Purge orphan — CLOSED. Both delete_archived_task and delete_task rehome findings with retained telemetry sources to the durable rescue work-intent (t_finding_rescue) with a finding_rehomed event; the rehomed finding completed the FULL gate (disposition accepted_queued → adapter verify) and left the open list. Rescue container refuses both delete paths. Findings without a retained source cascade-delete as before. Note: a rehomed, not-yet-dispositioned finding still appears in list_orphan_findings — correct behavior; the prior defect was undispositionability, which is gone.
5. Migration gap — CLOSED. Built a real-schema board, downgraded it to legacy state (stale narrow trigger bodies, dropped verification_observed_state, two retained un-promoted telemetry rows — one live task, one absent). init_db: column added before trigger recreation, legacy trg_finding_disposition_immutable dropped, both new immutability triggers + replay-guarded promotion trigger installed, live-task row backfilled to its task, absent-task row rehomed to rescue with finding_rehomed event, second init_db run idempotent (row/event counts unchanged), and the migrated board freezes linear_issue_id under the exact HEL-9999 repro.

Suite/lint at this head: tests/hermes_cli/test_kanban_findings.py + test_kanban_telemetry.py = 52 passed; ruff clean; compileall clean; working tree clean after probes removed. The producer's claimed regressions exist as committed tests (31 findings + 11 telemetry test functions, including per-field direct-SQL immutability and both purge paths).

Non-blocking observations (do not gate this head):

• fetch_linear_issue_evidence performs a live GraphQL call in production; the 30s urllib timeout is bounded but there is no retry/backoff. Acceptable for a governed gate (fail-closed on error); consider a shared adapter transport later.
• list_orphan_findings synthesizes Finding objects for un-promoted telemetry rows using default verification_observed_state=None; consistent with the dataclass default. Fine.

Disposition: architecture gate PASS. Dependent TRC review may proceed at this exact head. No merge authorized by this verdict — merge remains with the RRA lane after TRC and remaining gates.

GATEWAY-VERDICT: AGA=PASS head=5cb3ce9f

— Arturo Gallo · credentials: helios-agent-aga (AGA) · agent: arturo-gallo

🪙 Token usage (from Hermes state.db — real per-session data)

session	model	in	out	reasoning	est cost
20260730_070122_23f1b4	anthropic/claude-fable-5	2,376,363	38,287	0	$22.3327 (est)
TOTAL	—	2,376,363	38,287		$22.3327

profile: arturo-gallo · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable.

CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue.

[SSC-ENG]

TRC verdict — HEL-3112 finding-to-queue disposition gate

GATEWAY-VERDICT: TRC=PASS head=5cb3ce9f

Exact head 5cb3ce9f4964080861fa94856a6365f01b4840d2 (branch feat/hel-3112-finding-disposition-gate-v2, PR #7, base main). Reviewed after — and gated on — the renewed AGA PASS at this exact head (issuecomment-5131933054). PR head re-verified unchanged via API before and during this review. CI run 30548956861 = success at this exact SHA.

Intake gate

Committed (3 commits), pushed, PR #7 OPEN, head matches, exact-head CI green, Linear-linked (HEL-3112, parent HEL-3104). Intake PASS.

Method (independent, not a re-read of producer claims)

Clean checkout of the exact head into an isolated worktree, py3.11 venv, HERMES_KANBAN_DB pointed at throwaway boards (task/board env popped). Full diff read (all 2,148 added lines across kanban_db.py, kanban.py, kanban_telemetry.py + both test files). Producer suite re-run: 52/52 pass; ruff clean; compileall clean. Then 18 TRC-authored adversarial probes, all passing:

• Lifecycle + orphan gate (§3.2 contract): open → gate reports orphan; dispositioned-but-unverified → still orphan; adapter-verified → findings check returns ok=true, orphan_count=0, exit 0. CLI path exercised end-to-end (open/disposition/check machine-readable JSON, exit 1 while orphans exist).
• Exactly-one immutable disposition: conflicting second disposition rejected at the API; direct-SQL disposition flip and verification-field mutation both aborted by the upgraded triggers (all bound fields frozen; FROM-NULL governed updates exempted correctly).
• Evidence linkage: accepted_* requires a Linear issue and only linear_graphql typed evidence with canonical-id + evidence-ref match; rejected/deferred/not_applicable require a durably recorded decision record (finding_decision_records) — free-form strings, unknown sources, and cross-issue evidence all rejected. Live adapter proven against the real Linear API: HEL-3112 attests (state "In Review", canonical UUID bound); a syntactically valid nonexistent issue raises. CLI verify fails closed without LINEAR_API_KEY.
• Four-event lifecycle on the HEL-3110 envelope: finding_opened → finding_dispositioned → finding_queued → finding_verified emitted in order; all 28 envelope fields present on every event; policy_version=HEL-3112-v1; stable idempotency keys; no local-path evidence refs (validator rejects them).
• Telemetry replay-safe: persist_review replay leaves one telemetry row (true UPSERT, no delete-reinsert trigger re-fire), does not touch a dispositioned/verified ledger row, gate stays at zero.
• Purge-safe: both delete paths rehome retained-source findings to t_finding_rescue with a finding_rehomed event; rehomed findings remain dispositionable and verifiable; the rescue container refuses deletion on both paths; no-source findings cascade.
• Gate not dodgeable: an un-promoted telemetry row (task gone) is synthesized into list_orphan_findings, so skipping promotion cannot fake a clean gate. Legacy-board migration/backfill covered by producer tests (trigger DROP+recreate, column-before-trigger ordering, idempotent backfill) and confirmed in diff review.

Findings

• [low] list_orphan_findings synthesizes telemetry orphans with work_intent_id="UNKNOWN" when the subject task list is empty; these are correctly reported as orphans but disposition on them requires the backfill/rehome path to run first (init_db). Acceptable: migration runs on every connect path. No change required.
• No high/critical findings. Prime Directive check: the gate reduces manual rediscovery (the §2.3 item 6 loss class) and fails closed everywhere probed.

Structurally present AND behaviorally proven at this exact head. Do not merge from this verdict — merge lane owner is rhea-ramos with both passing verdicts (AGA PASS + this TRC PASS) in hand. A new push invalidates this verdict.

---

— Tessa Cole · credentials: eng-technical-review (TRC) · agent: tessa-cole

🪙 Token usage (from Hermes state.db — real per-session data)

session	model	in	out	reasoning	est cost
20260730_071500_0e70f7	anthropic/claude-fable-5	1,067,332	14,752	0	$10.2387 (est)
TOTAL	—	1,067,332	14,752		$10.2387

profile: tessa-cole · cost estimated unless marked (act). Recorded per the tokens-to-value deliverable.

CPTC actual: compare these real tokens with the predicted Complexity Points on the technical-scope sub-issue.