fix(kanban): add fail-closed embedded dispatcher quiesce

[dagyrox]

Summary

Adds the provider-side, fail-closed quiescence boundary required by dagyrox/or7-platform#221 to unblock consumer dagyrox/or7-platform#223.

• adds hermes kanban dispatcher-quiesce --pid <MainPID> --timeout <seconds> --json
• identifies the exact gateway-embedded owner with per-acquisition generation metadata
• prevents new dispatcher ticks after the quiesce boundary
• drains active asyncio.to_thread(...) work before acknowledging, including under repeated watcher cancellation
• keeps the old gateway watcher quiesced while retaining the singleton lock until gateway shutdown
• returns fixed machine-readable states and nonzero failure exits through installed, module, and repository-local launchers
• keeps control independent of SQLite initialization, so it remains available with a corrupt/inaccessible board DB
• stores protocol files in a private owner-only POSIX control directory; Windows fails closed as unavailable rather than trusting forgeable mode bits
• does not signal, terminate, pause, resume, or mutate child workers/tasks

Athena exact-head repairs

This successor preserves the malformed-request repair against predecessor 6882b314c0d79e94a6efe085dfbd44c4a33dc612 and repairs Athena's strict-typing finding against rejected head b2cf303f9216e99368b06d2b4b3d69578d29d034:

• validates complete request structure before generation classification
• quiesces on empty, malformed, wrongly typed, or unclassifiable present requests
• treats an exact current owner_id with missing or contradictory owner_pid as invalid
• ignores/replaces only a complete valid request that positively identifies another owner generation
• refuses to overwrite malformed existing control state from the requester path
• requires exact Python int values for protocol and PID fields across owner, request, and ACK trust-boundary validators, excluding booleans, floats, and integer subclasses
• makes read_dispatcher_owner() reject malformed owner records and makes the requester return indeterminate without writing request/ACK files
• adds deterministic red-green coverage for owner protocol true, false, 1.0, strings, missing/unsupported values; owner/request/ACK PID booleans/floats; malformed request/ACK variants; and valid different-generation preservation

Safety contract

A successful result:

{"ok": true, "state": "quiesced", "owner_pid": 1234, "owner_mode": "embedded"}

means the targeted embedded owner acknowledged quiescence only after its active dispatcher tick drained. Repeated requests are idempotent. not_running, not_owner, timeout, indeterminate, and invalid_request return nonzero and must stop the caller's cutover.

Verification at successor head

Successor head: 3ae01d0910d027eb9dca3a73aa52c6551a901ab6

Successor tree: 6526ec36a155d8df9da4e4476e8940303a7090eb

• strict-typing regression on rejected-head behavior: 4 expected failures before the repair; 28 focused cases passed after the repair, including valid different-generation preservation
• canonical scripts/run_tests.sh wrapper under the installed Hermes venv (the ignored worktree .venv was temporarily moved aside and restored without installation or dependency mutation), focused four-file Issue fix(security): block path traversal in skill_view file_path parameter NousResearch/hermes-agent#221 matrix: 88 passed, 0 failed
• canonical scripts/run_tests.sh wrapper over all 47 *kanban*.py files: 1205 passed, 2 failed; log SHA-256 c53cc6107e1b73f3970b2bf6d5c1c81117c2f15d7ab427f2468c9f139d5e91e6; the two failures are unchanged provider-[Talos] Isolate Kanban workers from gateway lifecycle (or7-platform#221) #9 environment/baseline cases:
  • tests/hermes_cli/test_kanban_db.py::test_connect_falls_back_to_delete_on_locking_protocol
  • tests/hermes_cli/test_kanban_db_repair.py::test_wal_checkpoint_truncates_wal_file
• provider-[Talos] Isolate Kanban workers from gateway lifecycle (or7-platform#221) #9 baseline artifact sidecar verified: SHA-256 93b549ad9c8ab58e43210b6a898bab918c212695e743375a1e0268c6ab21fa7a
• Ruff on all changed Python runtime/test files: passed
• compileall on all changed Python runtime/test files: passed
• git diff --check: passed
• independent pre-commit review after repair: passed with no security or logic findings
• hosted status/check runs at publication: absent (0 statuses, 0 check runs), reported honestly under the fork waiver established by the predecessor review

Exact-head review binding

• predecessor Athena artifact: /tmp/athena-hermes-pr10-exact-head-6882b314.md
• predecessor artifact SHA-256: 3cbf369b32f23b5f6ef5149e48904fbea32314895de06afa91b1a4ce0bf996af
• predecessor sidecar verification: OK before edits
• Athena rejected-head artifact: /tmp/athena-hermes-pr10-rereview-b2cf303f.md
• Athena rejected-head artifact SHA-256: 5044b20a2c14212a77175da8f29e628571e3cad938849ee18bc11fcefaf5fa3b (sidecar verified before edits)
• rejected predecessor head/tree: b2cf303f9216e99368b06d2b4b3d69578d29d034 / dc284c345618dbd5da591210eb826cf1bc76a2ba
• successor head/tree submitted for fresh Athena review: 3ae01d0910d027eb9dca3a73aa52c6551a901ab6 / 6526ec36a155d8df9da4e4476e8940303a7090eb
• Talos strict-typing handoff artifact: /tmp/talos-hermes-pr10-strict-typing-3ae01d0910.md
• Talos strict-typing handoff SHA-256: 9cd4b943883591aecd6917cdeef0a28ca8f6e6f5cbb5d5318a2e119ed583b8f0 (sidecar verified)

Provenance

• Acting lane: Talos builder
• Authority: Athena architecture/release review
• Control: Hermes
• Issue: dagyrox/or7-platform#221
• Consumer PR: dagyrox/or7-platform#223 (still frozen pending its separate repair/review)
• Hermes Kanban: t_832c4f2d / run 178
• Parent builder card/run: t_c349e5f1 / 173
• Athena rejected-head rereview card/run: t_2c5cf8e5 / 177
• Work packet: docs/agentic-operations/work-packets/2026-08-21-hermes-kanban-lifecycle-isolation.md
• Provider base: 83d466e443f8c4e6d1526cebd90c9b0cfceb22cb

No merge, deployment, installation, activation, configuration/service mutation, gateway restart, or live witness is authorized or performed by this repair.