From 6a87e2a03a62b24c1805dec978736c9579626d84 Mon Sep 17 00:00:00 2001 From: Casey West Date: Mon, 17 Aug 2026 13:48:13 -0400 Subject: [PATCH] =?UTF-8?q?=F0=9F=A7=AA=20test(kanban):=20isolate=20HERMES?= =?UTF-8?q?=5FKANBAN=5FORIGIN=20in=20the=20hermetic=20env=20fixture?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 8 report-back subscription tests in tests/tools/test_kanban_tools.py failed under bare pytest (126 passed, 8 failed) while passing under the CI wrapper. Root cause is a test-isolation gap, not a runtime bug. _maybe_auto_subscribe resolves the card origin from the HERMES_KANBAN_ORIGIN env mirror (gateway/session_context, added when the create path learned to inherit a card origin across the spawn boundary) BEFORE it consults the HERMES_SESSION_* vars. That precedence is intentional. The conftest _hermetic_environment fixture scrubs every other HERMES_KANBAN_* pin and the HERMES_SESSION_* vars, but never added HERMES_KANBAN_ORIGIN. When pytest runs inside a dispatched worker, that var is inherited from the parent with a foreign owner pid, so the origin channel leaks into every test: cards auto-subscribe even after a test clears the session vars, flipping subscribed to True. The CI wrapper spawns a clean env so the leak never appears there; bare pytest in an inherited env has only the conftest scrub as its defense, and the scrub was missing this var. Add HERMES_KANBAN_ORIGIN to _HERMES_BEHAVIORAL_VARS alongside the other kanban pins so subscription tests see a truly detached context. Witnessed RED (8 failed) against the pre-change fixture with the var set, GREEN (134 passed) after. --- tests/conftest.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/conftest.py b/tests/conftest.py index 159afd4c2b487..d062e63194f4e 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -214,6 +214,14 @@ def _looks_like_credential(name: str) -> bool: "HERMES_KANBAN_RUN_ID", "HERMES_KANBAN_CLAIM_LOCK", "HERMES_KANBAN_DISPATCH_IN_GATEWAY", + # The card-origin channel (gateway/session_context._KANBAN_ORIGIN_ENV). + # A dispatched worker inherits this across the spawn boundary; under bare + # pytest (no CI wrapper) it leaks into every test, so + # _maybe_auto_subscribe resolves a real origin and auto-subscribes even + # when a test has cleared the HERMES_SESSION_* vars. Scrub it alongside + # the other kanban pins so subscription tests see a truly detached + # context. + "HERMES_KANBAN_ORIGIN", "HERMES_TENANT", # Honcho host selection changes which nested config block wins. A local # shell override leaked "myhost" into the full suite and flipped 20