fix: integrate issue 401 ownership repairs

[cermm]

Summary

Fresh current-main rebuild for the accepted cermm/wc-infrastructure NousResearch#401 child deltas:

• Replays Feature: OpenHands Coding Agent Skill — Model-Agnostic Sandboxed Code Agent Delegation NousResearch/hermes-agent#477 approval generation owner isolation on current main
• Replays Feature: Blackbox CLI Skill — Multi-Model Agent Delegation with Built-in Judge (inspired by Blackbox AI) NousResearch/hermes-agent#475 gateway auth/lifecycle replay authority invariants on current main
• Replays fix(config): route API keys and tokens to .env instead of config.yaml NousResearch/hermes-agent#469 goal policy, cancellation, generation ownership, and deferred-command authorization invariants on current main

This intentionally does not reuse stale conflicting PR #11. This PR supersedes #15, which used the same source tree but had automation-only commit attribution that failed the contributor check.

Exact candidate

• Base: d4b6ecf622c44a96eff2a79b2f0c904e678b2f38
• Head: 6702edb1d4971fc0e411096e7b5e82f7dd6a385e
• Tree: 6fc554824c18735804c82941bac25e1803bcde9a
• Source-equivalent reviewed tree: 4a9f21d50c9ad82295527bd17230c89238bdcf51 → identical tree/diff to this head

Verification

git diff --check HEAD^..HEAD
git diff --exit-code 4a9f21d50c9ad82295527bd17230c89238bdcf51 HEAD --stat
python -m pytest tests/acp/test_approval_isolation.py tests/gateway/test_goal_verdict_send.py tests/tools/test_command_guards.py tests/gateway/test_replay_entry_fields.py tests/agent/test_replay_cleanup.py tests/gateway/test_shutdown_cache_cleanup.py tests/gateway/test_issue401_lifecycle_replay_authority.py -q
python -m compileall gateway hermes_cli tools -q

Local result: no source drift vs 4a9f21d50c9ad82295527bd17230c89238bdcf51; 97 passed; compileall-ok; diff check clean.

Independent exact-head review: PASS/PASS on 6702edb1d4971fc0e411096e7b5e82f7dd6a385e.

Refs cermm/wc-infrastructure#469
Refs cermm/wc-infrastructure#475
Refs cermm/wc-infrastructure#477
Refs cermm/wc-infrastructure#401

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6702edb1d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Propagate explicit authorization to deferred goal commands

The new option is never enabled by production code: repo-wide search finds only the direct tests passing require_explicit_authorization=True, while tools/terminal_tool.py calls the guard without it. Consequently, a synthetic /goal continuation that issues a dangerous terminal command still accepts once or always, so the advertised session-only automatic-goal policy has no runtime effect. Mark goal-continuation execution in context and propagate that state through the terminal wrapper to this argument.

AGENTS.md reference: AGENTS.md:L122-L125

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Enforce explicit authorization before allowlist bypasses

This check runs only after a fresh prompt, but a previously permanent-approved pattern is filtered by is_approved() (and an exact/glob permanent allowlist returns even earlier at lines 2684-2685), leaving warnings empty and returning approved before reaching this branch. Thus, once the deferred path is wired, a prior always approval authorizes an automatic goal command even though this branch explicitly says permanent approval must not do so; distinguish session authorization before applying permanent allowlist shortcuts. The added mocked prompt tests do not exercise this security-boundary path.

AGENTS.md reference: AGENTS.md:L84-L87

Useful? React with 👍 / 👎.