fix(kanban): requeue review changes on same card

[solovision24]

Summary

• Requeue authorized Review changes on the same implementation card for the original implementer.
• Preserve review run findings, task identity, immutable-head audit history, and fail-closed guards.
• Remove active remediation-child creation and update focused lifecycle coverage/docs.

Verification

• HERMES_PYTHON=/home/solo/.hermes/hermes-agent/venv/bin/python scripts/run_tests.sh tests/hermes_cli/test_kanban_review_lifecycle.py tests/hermes_cli/test_kanban_same_card_review.py tests/hermes_cli/test_kanban_db.py tests/tools/test_kanban_tools.py -q — 104 passed.
• python3 -m compileall -q hermes_cli/kanban.py hermes_cli/kanban_db.py tools/kanban_tools.py — passed.
• git diff --cached --check — passed.
• npm run check — environment dependency failure unrelated to this Python/Kanban change (missing installed workspace packages such as @assistant-ui/core, @tauri-apps/api, and plist).

Kanban Task

• Task: t_6d3f9e7f
• Mission Control: https://mc.solobot.cloud/tasks?task=t_6d3f9e7f

Deployment implications

• No deployment or runtime restart performed; merge/release remains with reviewer/operator.

[solovision24]

Orion Review — changes required

Reviewed immutable head 95afcabf196fcae99e321eeeb49ba16e60b31310. The focused implementation tests pass (104/104), but the PR artifact is not safe or reviewable against its declared base.

Blocking — stale/divergent base

• GitHub reports mergeable=false, mergeable_state=dirty.
• PR #17 targets fork main at 202f84cd13f35d005b596265d7ce8d1bf22c5a7c, but the branch is 16,616 commits ahead and 3 commits behind that base.
• The PR therefore exposes 8,101 changed files, 2,127,561 additions, 176,748 deletions, and 10,000 commits, while the intended implementation is a single 7-file commit. Merging this PR would import massive unrelated history and conflict with current fork main.

Required remediation

Rebuild/rebase the existing branch onto the current fork/main, preserve only the intended same-card Review commit, resolve conflicts without dropping the already-merged PR #14/#16 protections, rerun the focused Kanban lifecycle/security suite, force-push the same PR branch, and resubmit this same Kanban card with the new immutable 40-character head SHA. Acceptance: PR changed-file/commit scope matches the intended implementation, GitHub reports clean mergeability (or an explicitly understood non-code gate), and exact-head checks are green.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 95afcabf19

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Clear the PR identity before requeuing the implementation

When the implementer pushes a new head after changes are requested, ingest_pull_request() still finds this ready card through its old github-pr:<repo>:<number>:<sha> idempotency key; the synchronize path then archives it as superseded and creates a different review card, so the original implementer can no longer claim the canonical task. A replay for the old head can likewise change the ready card back to review and assign it to the reviewer. Clear or otherwise detach the prior-head identity during this transition so webhook convergence cannot destroy the same-card remediation flow.

AGENTS.md reference: AGENTS.md:L54-L57

Useful? React with 👍 / 👎.

[solovision24]

Orion Review — changes required

Blocking compatibility issue at hermes_cli/kanban_db.py: the new legacy_key_prefix query scans all historical remediation keys for this task. An archived/different-run legacy child therefore prevents every future same-card change request. This task already has exactly that history from the pre-fix runtime.

Required correction:

• Fail closed only when the exact current-run key review-remediation:<task_id>:<current_run_id> is pre-seeded (or otherwise ignore archived prior-run history).
• Preserve the exact-key preemption security control.
• Add isolated-DB coverage proving an archived/different-run historical key does not block current same-card rejection.
• Rerun focused/broader tests and resubmit the same card at a new immutable head.

No application, Supabase, database, auth, or deployment changes are involved.