docs: add CLAUDE.md with branch and auto-merge workflow rules by uaixo · Pull Request #2 · uaixo/HTAI-Personal-Assistant

uaixo · 2026-07-22T11:30:45Z

What does this PR do?

Adds a root CLAUDE.md so future Claude sessions automatically follow the user-approved workflow: base all work on NousAI-Assistant, land it via PR (the CI vehicle — ci.yml only triggers on pull_request), squash-merge automatically once green, never target main or upstream nousresearch/hermes-agent, and keep the branch conflict-free against upstream by adding files only. Also documents the check-attribution remediation procedure and the Phase 1 branding pack location.

Related Issue

Fixes # — no issue; follow-up to PR #1 per user request to stop manual PR handling.

Type of Change

📝 Documentation update

Changes Made

CLAUDE.md (new file) — branch roles, auto-merge workflow, upstream-sync safety rules, Phase 1 branding notes

How to Test

Confirm the file renders correctly on GitHub
Future Claude Code sessions in this repo load CLAUDE.md automatically and follow the recorded workflow

Checklist

Code

My commit messages follow Conventional Commits
My PR contains only changes related to this fix/feature (no unrelated commits)
N/A — documentation only, no code paths affected

Documentation & Housekeeping

I've updated relevant documentation — this PR is the documentation
N/A — no config keys, architecture, tooling, or cross-platform impact

🤖 Generated with Claude Code

https://claude.ai/code/session_01KFEJ7TzKwG4tQujNy3CWjT

Generated by Claude Code

Records the user-approved session workflow: base all work on NousAI-Assistant, land it via PR with CI, squash-merge automatically when green, and keep the branch conflict-free against upstream by adding files only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KFEJ7TzKwG4tQujNy3CWjT

…ch#67140) The background write guard decided ownership from `isinstance(usage_rec, dict)`, so a local skill with NO usage record passed. That successful write called bump_patch(), which created a `created_by: null` record — and the identical write was refused from then on. "Allowed exactly once, then never" is a race with our own bookkeeping, not a policy. Reproduced on main: patch #1 succeeds, patch #2 with the same arguments is refused. Option B from the issue. Option A (split `session_review` from `scheduled_curator` and let the session fork patch user-owned skills it consulted) would widen autonomous write permission onto skills the user owns with no user present to consent — wrong direction for a no-user-present actor. - skill_manager_tool: missing and explicit-null records now resolve IDENTICALLY, both fail closed. The refusal names the reason and points at `hermes curator adopt <name>`. - background_review: both review prompts told the reviewer to patch any skill consulted in the session and claimed pinned skills could be improved, while enforcement refused both. Prompts now list pinned, external, and user-owned skills as protected, and tell the reviewer to RECOMMEND adoption instead of attempting a write that will be refused. - skill_usage: document that `created_by` is a curator-management policy flag, not a provenance claim, and add `is_curator_managed()` so call sites read as the question they ask. Field name retained — it is on disk in every `.usage.json` and renaming would strand those records. - curator CLI: `hermes curator list-unmanaged` itemizes unmanaged skills with the reason each is unmanaged (completes the NousResearch#67139 spec). Foreground writes are untouched: a user-directed edit to a user-owned skill still works, including on pinned skills. Sibling tests: 9 failures in test_skill_manager_tool.py were fixtures that created record-less skills to exercise OTHER guards (consolidation-delete, read-before-write) and relied on ownership falling through. Fixed at the fixture, since the real curator only ever operates on managed sediment. One test asserted the old "manually authored" wording; rewritten to assert the behavior contract instead of the string. Validation: 274 targeted tests + all 7 background-review files (60 tests) pass. E2E on a temp HERMES_HOME (30 checks) covers the flip, foreground writes, adoption unblocking, pin semantics, prompt/enforcement parity, and the new verb. Each new test sabotage-verified: revert the fix, confirm it goes red. Fixes NousResearch#67140

… a broken chat A completely unconfigured install previously booted into a working-looking chat (banner showed model 'unknown'), accepted a message, spun ~30s, then failed with 'Set OPENROUTER_API_KEY' — a provider the user never chose — and never offered setup. - HermesCLI.run() now probes provider readiness at startup (TTY only) and offers the shared provider picker (hermes model flow, which fronts Quick Setup / Nous Portal OAuth) when nothing is configured. Decline is respected; picker state re-syncs into the live CLI so the next turn works without a restart. - New silent probe _runtime_credentials_ready(): no printing, no state mutation; handles keyless local endpoints and callable bearer providers. - The empty-api-key error is provider-aware: names the actual resolved provider and points at 'hermes model' / 'hermes setup' instead of hardcoding OPENROUTER_API_KEY. - Banner: unconfigured installs render 'no model configured — run /model' in red instead of the silent 'unknown' model slug. Consumer-onboarding audit finding #2 (sev 5), Aug 2026.

…on delegation callbacks (NousResearch#82592) * fix(gateway): stop frozen-preview finals and dropped idle-session delegation callbacks Two relay-plane delivery losses from the 2026-08-09 staging incident: 1. stream_consumer: the skip-redundant-finalize branch recorded _accumulated as the delivered turn-final payload even when the last ACKED edit was an earlier throttled preview snapshot, so delivered_final_matches reconciled True and the gateway suppressed the corrective final send — the user was left with a cut-off message ending in the streaming cursor. Extracted _mark_skip_redundant_finalize(): records the last acked wire payload (cursor-stripped), so a preview/final mismatch now returns False and the normal final send fires. 2. run.py: _classify_completion_target classified every ended parent session terminal unless it ended by compression. Idle/timeout session ends are the norm on scale-to-zero relay deployments and the chat route remains valid; completed async delegation results were terminally dropped. Ended parents now classify deliver unless the end was an explicit user boundary (session_reset / user_exit / session_switch). * fix(relay): drain in-flight outbound frames before transport teardown disconnect() failed every pending outbound future immediately with 'relay transport closed', so a trailing finalize edit racing turn teardown was lost even though the connector socket could still serve it. Bounded drain grace (5s) lets in-flight requests resolve; silent connectors still tear down promptly. asyncio.wait (not gather+wait_for) so a timeout doesn't cancel futures owned by the fail-remaining loop. * fix(gateway): route completion injection through the alias-aware transport resolver Third relay-plane delivery loss from the 2026-08-09 staging incidents: a delegation batch completed while the gateway was up, the watcher drained the event, and delivery vanished with no log line. _inject_watch_notification resolved its adapter with a literal p.value == platform_name scan of self.adapters — a relay-fronted gateway registers ONE adapter under Platform.RELAY fronting N logical platforms, so 'slack' never matched and the injection returned None ('no gateway route'), silently dropping the completion. The handoff path already documents this exact trap and uses resolve_delivery_transport; the injection path now does the same (native wins; relay eligible only when it fronts the logical platform), with the literal scan kept as fallback for stub runners and exotic platforms. * fix(relay): clamp disconnect drain grace to the runner's adapter-disconnect budget Review finding (JoaoMarcos44, NousResearch#82592): a fixed 5.0s drain in front of the three 1.0s sequential teardown awaits gives an 8.0s worst case inside the runner's 5.0s asyncio.wait_for(adapter.disconnect()) — tripping it cancels teardown mid-drain, skips the fail-pending loop, and leaves outbound callers blocked until _OUTBOUND_TIMEOUT_S (30s). The effective grace is now budget - 3*TEARDOWN - margin (env-aware via the same HERMES_GATEWAY_ADAPTER_DISCONNECT_TIMEOUT the runner reads), so the drain can never push teardown past its caller's budget; a budget too small for any drain disables it cleanly. * test(gateway): pin the final-send suppression contract across a behaviour matrix The gateway skips its own final send when the stream consumer claims the turn final already reached the user. Every incident in that family — NousResearch#71643 (stale finalize snapshot), NousResearch#78541 (payload-less multi-message split), NousResearch#82656 (frozen preview left with a visible cursor) — is the same failure: the consumer claimed delivery for text the platform never rendered, so the corrective send was suppressed and the answer was lost with no retry. Each was fixed with a scenario test pinned to one branch of GatewayStreamConsumer.run(). The got_done handler now has five sibling branches that each set the suppression flags and record a turn-final payload, and nothing checks them as a group: a new branch, or a new early `return True` in _send_or_edit, can reintroduce the class without failing a test. Pin the invariant instead of the branch — if the consumer offers the gateway any signal it would trust, the complete final text must have reached the wire — and assert it across {edit always / dies / never / lies} x {send always / never} x {fresh-final on / off} x {clean / interrupted stream}. The adapter records only frames that actually rendered, so an ACK the platform drops does not count as delivery. 24 honest-transport scenarios hold the invariant as a hard assertion. The 16 lying-transport scenarios are checked too; the single combination that still violates it is reported as an expected failure documenting the open exposure rather than asserting it away. Refs NousResearch#82656 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(gateway,relay): prime relay egress routing for synthetic injections + cap stale completion replay Defect #4 from the 2026-08-09 staging incidents (upgrade-robustness): after every gateway restart the durable async-delegation replay injected completions correctly (post-741663cf1) but their replies bounced at the connector — 'slack egress declined: target not routed to an onboarded tenant'. The relay adapter re-attaches tenant discriminators (metadata.scope_id / metadata.user_id) from per-chat caches warmed ONLY by inbound traffic; synthetic turns race those cold caches on every deploy, scale-to-zero wake, and crash recovery. - relay adapter: prime_routing_cache() — feeds a synthetic event's session-store origin through the same _capture_scope used for real inbound (never raises). - run.py injection path: prime the resolved adapter before handle_message (duck-typed; native adapters unaffected). - async_delegation: 48h staleness cap in restore_undelivered_completions — a pending completion older than the cap is terminally dropped (payload stays queryable) instead of re-run as a fresh full-context turn; the post-restart replay of a July session burned a 102K-token context. Also carried: JoaoMarcos44's suppression behaviour-matrix harness (cherry-picked from NousResearch#82676, authorship preserved) — 39 passed + 1 xfail (the documented ACK-then-drop transport-honesty residue). * test: use recent timestamps in restored-ownership fixtures test_restore_stamps_restored_flag persisted its completion with epoch-era toy timestamps (dispatched_at=1.0), which the new 48h replay staleness cap correctly classifies as stale — the fixture then exercised the cap instead of the restored-flag contract (CI slice 4 failure). Timestamps are now now-relative; the staleness behavior itself is pinned separately in test_relay_injection_egress_priming.py. * fix(gateway,relay): close four review findings on the relay delivery fixes Review follow-ups on this branch (NousResearch#82592): 1. HIGH — classifier/resolver mismatch (falsely-acknowledged loss). _classify_completion_target now returns "deliver" for idle-ended parents, but _resolve_async_delegation_session still dropped every non-compression-ended pin: the durable row was acked at adapter acceptance, then the injection died inside the pipeline with no retry — strictly worse than the honest terminal drop on main, and the delivery leg defect #2's fix depends on did not exist. The resolver now retargets non-user-boundary ends (idle/timeout/ lifecycle) to the chat's current session — session_entry already IS the routing key's current session for the same chat — while user boundaries (session_reset / new_session / user_exit / session_switch) stay fail-closed. Both sides share one module-level _USER_BOUNDARY_END_REASONS so the verdict and the routing decision cannot drift again; a coherence test asserts deliver-verdicts resolve non-None across representative end reasons. 2. HIGH — drain clamp missed adapter-level spend. The effective drain grace budgeted drain + 3x teardown, but RelayAdapter.disconnect spends revocation-monitor teardown + go_idle time BEFORE the transport drain inside the same runner wait_for; worst case still blew the budget and cancelled teardown mid-drain (skipping the fail-pending loop). The adapter now measures its own elapsed time and threads the REMAINING budget into transport.disconnect(budget_s=...); legacy/stub transports without the keyword fall back to the no-arg signature. 3. P1 — _request_response racing disconnect() could register a future after the fail-pending loop already ran, stranding the caller for the full _OUTBOUND_TIMEOUT_S (30s). Fail fast with the same "relay transport closed" error once _closing is set. 4. P1 — _build_process_event_source's last-resort reconstruction dropped scope_id, so a scoped relay completion whose session-store origin was unavailable primed no tenant discriminator and could still bounce off the connector's fail-closed egress guard. scope_id now threads through the reconstructed SessionSource, with a warning when a scoped chat reconstructs without one. All four: RED reproduced with the fix reverted, GREEN after; relay/ delegation delivery families pass (43 + 71 + 179 across the touched suites); full tests/gateway run shows only failures already failing identically on merge base 2446c8b (env/dep issues). * fix(gateway,relay): make pending-frame failure cancellation-safe; persist completion routing origin Two remaining review findings on this branch (NousResearch#82592): 1. Cancellation could strand outbound waiters past the fail-pending loop. transport.disconnect() failed pending futures only at the END of the drain + three teardown awaits; a cancellation landing mid-drain (the runner's wait_for budget, an outer cleanup deadline) skipped the loop entirely and left registered futures unresolved — their callers blocked until _OUTBOUND_TIMEOUT_S (30s). The budget threading added earlier shrinks the window but is not a hard guarantee. The fail-pending loop (and the going_idle ack failure) now run in a `finally`, so no exit path — normal, error, or cancelled — can leave a registered future unresolved. Idempotent: done futures are skipped, a second disconnect() pass is a no-op. 2. Durable completions did not persist their routing origin, so the scope_id threading in the fallback SessionSource reconstruction had nothing to carry on the exact path it exists for (restart replay with session store + source cache gone): the async-delegation event producers never populated scope_id and the durable rows never stored it. Dispatch now snapshots the originating turn's scope_id/user_id/user_name from the session context (_capture_routing_origin — a new HERMES_SESSION_SCOPE_ID contextvar bound by the gateway at session-bind time alongside the existing vars), stores them in the existing task_json payload (no schema migration), and re-attaches them to all three completion-event shapes (live single, live batch, crash-recovery rebuild). The gateway's fallback reconstruction then primes both discriminators after a restart. Tests: cancellation mid-drain -> every pending future resolves with "relay transport closed" (mutation: moving the loop out of the finally goes RED); second-pass disconnect idempotence; end-to-end dispatch -> owner-death recovery -> event carries scope_id -> fallback SessionSource primes it (mutations: dropping the dispatch capture or the task_json persistence both go RED); live completion event carries the origin. 94 passed + 1 xfailed across the delivery/delegation suites; tests/tools delegation family 73 passed (2 collection errors pre-existing on merge base 2446c8b). --------- Co-authored-by: joaomarcos <joaomarcosdias444@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Ben Barclay <ben@nousresearch.com>

Addresses both review findings on the remote-gateway download PR: 1. Unbounded buffering (finding #1). fetchBuffer / fetchBufferViaOauthSession accumulated the entire response (then copied it again via Buffer.concat) before saveGatewayFile even opened the save dialog, so a large gateway file could exhaust the native process. Both auth paths now stream: once response headers arrive the connect timeout is cleared, the filename is derived, the save dialog is shown, and the body is piped to the chosen destination with backpressure. A read/write error tears down the stream and unlinks the partial file. The byte-moving, data-URL decoding, and filename/path helpers are extracted into gateway-file-download.ts so they're unit-testable without Electron. 2. No fallback for older gateways (finding #2). saveGatewayFile required the new /api/fs/download route. Desktop and the remote gateway update independently, so a gateway predating this PR 404s. Added a 404-only compatibility fallback to the existing capped /api/fs/read-data-url route (bounded, so it only serves smaller files — enough to keep older backends working). Tests: gateway-file-download.test.ts covers streaming, backpressure, error-cleanup (unlink on write/response error), data-URL decoding, filename derivation (incl. traversal reduction), and 404 detection; gateway-file-download-transport.test.ts asserts both transports stream (no whole-body Buffer.concat) and that the 404 fallback is wired. Both registered in the desktop platform test list. Server-side /api/fs/download tests (streaming + sensitive-file reject) already pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Two independent bugs let a deleted profile reappear / leave orphaned resources on next launch: 1. hermes_cli/profiles.py's backend-process scanner required argv[0] to resolve to an executable literally named "hermes". Electron's pool-backend spawn resolves the hermes console-script shim's path and execs it via the interpreter directly (python3 /path/to/hermes ...), so argv[0] reports as "python3" and the scanner never matched the running backend -- delete removed the profile's files but left its live backend process running (still bound to a port via uvicorn), which accumulates across repeated delete/recreate cycles. 2. The desktop sidebar's ProfileRail only refreshed its cached profile list once, on mount, so a delete/create/rename from another surface (another window, or the CLI) left a stale ghost entry until something unrelated triggered a refetch. Note: a delete via this window's own Manage-Profiles view already refreshes the shared $profiles atom ProfileRail subscribes to (confirmed by reading refreshProfiles() and handleConfirmDelete()) -- this fix only covers the cross-window/cross- process staleness gap, not a duplicate of the already-merged NousResearch#57329's Manage-Profiles rail-refresh work. Fix 1: recognize a python-interpreter argv[0] exec'ing a hermes-named console-script shim via argv[1]. Fix 2: refresh the profile list on window focus/visibilitychange, matching the existing pattern used elsewhere in the sidebar (sidebar/index.tsx, use-background-sync.ts, star-map.tsx, use-gateway-boot.ts all use the same focus+visibilitychange pattern). ## Related work already on main PR NousResearch#57329 (merged) fixed the *headline* symptom from issue NousResearch#52279 (deleted profile respawns) via a different, non-overlapping mechanism: routing profile-delete through the primary backend instead of spawning a fresh pool backend, plus a separate recreation guard in ensure_hermes_home() (NousResearch#49435, merged) that makes a backend spawned into a deleted profile's directory raise FileNotFoundError instead of silently recreating it. This PR is NOT a duplicate of that fix. Verified: even with both of those merged, a backend process that survives because of gap #1 above still holds a bound port via uvicorn -- it just can no longer resurrect the profile directory. That's real resource-hygiene, not a symptom already covered. Gap #2 touches a different file/component (ProfileRail / profile-switcher.tsx) than NousResearch#57329's rail-refresh half (which touched the Manage-Profiles view's own $profiles.ts / index.tsx) and covers a distinct staleness path (cross-window/cross-process, not same-window delete-then-refresh). Tests: tests/hermes_cli/test_profiles.py -- 156 passed (existing + regression coverage for the argv[0] python-interpreter detection case). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… the relay (gateway half) (NousResearch#85796) * feat(relay): live-card ops — native draft streaming + task cards over the relay (gateway half) NS-658. Three additive ops within contract v1, emitted only when the connector's negotiated descriptor advertises them: {op: draft, chat_id, draft_id, content, final, metadata} {op: task_card, chat_id, card_id, chunks, metadata} {op: task_card_stop, chat_id, card_id, metadata} The gateway side is deliberately dumb: no platform API knowledge, no new config keys. Slack mechanics (chat.startStream/appendStream/stopStream, per-workspace feature-gate cache, send+edit fallback) live connector-side where the platform adapter lives in the relay model. Semantic bridge: base send_draft is Telegram-shaped (draft clears; final is a separate send). Slack native streaming makes the stream THE message. The adapter tracks the open draft per chat and converts the turn-final send() into draft(final=true) so the connector seals the stream instead of posting a duplicate; the stream ts returns as the message identity. A failed frame disarms interception so the edit-based fallback's real send goes through untouched. BEHAVIOR CHANGE (deliberate): relay supports_draft_streaming() now requires the descriptor flag AND the draft op. Flag-only was a latent lie — send_draft inherited NotImplementedError, so a connector setting the flag without the op would have crashed the stream consumer's draft path. supported_ops stays fail-open for legacy (pre-contract) ops; draft/task_card did not exist pre-contract and must not fail open. Task cards ride NousResearch#85476's adapter-agnostic TurnRunner seam (hasattr on send_native_task_card_progress); supports_native_task_cards() is the descriptor probe. Connector half + E2E harness pair follow in the gg repo. * fix(relay): expose native_task_cards_enabled() on the relay adapter Live-canary finding (Alice, staging): the TurnRunner's task-card lane probes adapter.native_task_cards_enabled() (the native Slack adapter's opt-in contract). The relay adapter only offered supports_native_task_cards(), so the hasattr gate failed silently and tool progress stayed on the text path — draft streaming worked, cards never rendered. Alias it to the descriptor probe. * fix(relay): match task-card methods to the TurnRunner's native keyword contract Live-canary finding #2 (Alice, staging): gateway/run.py's card lane calls send/stop_native_task_card_progress with the NATIVE Slack adapter's signature (tasks/title/reply_to/metadata/fallback_text, keyword-only) — PR 85796's relay methods took a positional card_id, so every call raised TypeError('unexpected keyword argument reply_to') in the progress task, repeatedly killing the card publisher (and the retry loop resent the final delivery 4-5x). Card id now derives per turn thread (turn:<reply_to>), thread_ts anchored like draft; title/fallback_text accepted for parity, not forwarded (plan-mode stream renders chunks). * fix(relay): one draft stream per turn for stream-is-the-message adapters Live-canary finding #4 (Alice, staging): the stream consumer bumps draft_id at every tool boundary so Telegram-shaped drafts animate each text segment as a fresh preview. On relay Slack NATIVE streaming a new draft_id opens a brand-new chat.startStream — the user saw one frozen message per segment (stuck streaming cursor ▉, never sealed: only the LAST stream gets the final=true seal) plus the real final; 5-6 cumulative snapshots per turn. Adapters that mark draft_stream_is_message keep ONE stream per turn: tool progress lives in the native task card, and the connector's suffix-delta falls back to whole-text append on prefix mismatch, so segments append cleanly. Telegram-shaped drafts keep the per-segment bump. * fix(relay): don't seal the native stream at tool boundaries — only the turn-final does Live-canary finding #5 (Alice; supersedes the incomplete #4 which was necessary but not sufficient). Root cause CONFIRMED by integration trace (test_live_cards_flow_trace.py, real consumer semantics + real adapter + stub transport): at every tool boundary the consumer calls _send_or_edit(finalize=True), which skips the draft path and issues a real send(); the relay adapter's seal-interception converts THAT into draft(final=true) — sealing the stream once per segment. Timeline showed 3 seals for a 3-segment turn: exactly the frozen cumulative ▉ snapshots seen live (the replaced stream never gets stopStream, keeping its cursor). Fix: for draft_stream_is_message adapters, a segment-break finalize (finalize=True, is_turn_final=False) stays ON the draft path as another cumulative frame; only got_done (is_turn_final=True) falls through to send() and seals. Telegram-shaped platforms unchanged. Trace test now pins the invariant: ONE user-visible message per turn. * fix(relay): strip the text cursor from native draft frames Live-canary finding #6 (Alice) — the ACTUAL duplicate-content mechanism, confirmed by full-flow scan of both sides' code + logs. The consumer appends its text cursor (▉) to every non-final display_text tick. The connector's stream sender diffs CUMULATIVE frames via prefix check: 'abc▉'.startsWith → 'abc def▉' is NEVER a prefix match (the cursor sits mid-string), so deltaFor falls back to whole-text append on EVERY tick — chat.appendStream stacks each full cumulative snapshot (cursor included) into the ONE stream message. Exactly the observed thread: repeated blocks, each ending in a frozen ▉, growing per tick. Fixes #4/#5 were real (one stream per turn now) but this was the last mechanism standing. Native streams render their own typing indicator, so the text cursor is pure noise on this path: strip it from draft frames. Prefix check now holds; every tick appends only its true suffix delta. * fix(relay): seal-interception covers EVERY egress door, not just send() Live-canary finding #7 (Alice): one duplication remained after #6 — the stream froze mid-word with the live indicator (never sealed) and the final posted as a separate message. Log receipt: 'Queued follow-up: final text delivery confirmed; delivering explicit media before continuing' — the turn's final went out via the DELIVERY RESOLVER lane (gateway/delivery.py), which calls send_for_platform() DIRECTLY, bypassing send() and its seal-interception. The open stream never absorbed the final; it arrived as a plain 'send' op → chat.postMessage. Fix: hoist the open-draft check to the top of send() (ahead of the explicit-platform branch) AND add it to send_for_platform() — an open native stream absorbs the turn-final regardless of which egress door it arrives through. The stream IS the message. * fix(relay): failed seal falls back to plain send (PR 85796 AI-review point 1) A turn-final seal that fails at the transport must never swallow the final answer: the stream consumer has already disabled the draft transport for the run, so a failed _seal_open_draft returning success=False meant the user got NOTHING. Both seal-interception sites (send + send_for_platform) now fall through to the regular plain-send path on seal failure, with a warning receipt. Also mitigates AI-review point 2 (sticky _open_draft_by_chat after an abandoned turn): a stale entry's failed seal no longer blocks the next turn's delivery. * fix(relay): arm seal-interception optimistically; never disarm on ambiguous failure (audit G-D1) Deep-audit defect G-D1 (HIGH): the outbound leg is at-most-once on the wire but its ack channel is lossy — send_outbound timeout (30s) and WS-drop 'failures' frequently mean the frame WAS delivered and the connector stream is open. send_draft popped _open_draft_by_chat on any failure, disarming seal-interception while the connector stream lived: the turn-final went out as a plain send → orphaned mid-word stream + complete duplicate final (intermittent; needs a drop/timeout inside the draft window). Fix: arm the entry BEFORE the transport call and keep it armed on failure/exception. Safe in every case: sealing a non-existent stream opens+seals a single complete message connector-side, and a truly failed seal already falls back to plain send at both interception sites. Stale-entry damage is self-healing (one warning + plain send). * fix(relay): gateway-side sealed-draft tombstone — G-D1 arming must not resurrect sealed streams Regression fix on G-D1 (live: 'worse than before' — escalating frozen prefixes). Optimistic arming had no seal-awareness: a straggler frame arriving AFTER the seal re-armed _open_draft_by_chat for the already- sealed draft_id; the next send was converted to draft(final=true) on the tombstoned connector key, which CLEARED the connector tombstone (final frame = new-turn signal), re-opened a stream with cumulative content, and left it frozen — repeating per straggler: 4-5 escalating frozen snapshots. Mirror the connector: _sealed_draft_by_chat records the sealed draft_id per chat (tombstoned BEFORE the seal's transport call); send_draft for a sealed draft_id is a success no-op (content already in the sealed message) and never arms. A new turn's fresh draft_id arms normally. * fix(relay): key stream/card state per (chat, turn anchor) — parallel turns must not collide (finding #10) Live finding #10 (Alice; three concurrent turns in one flat DM): all coordination state was keyed per CHAT on a one-active-turn assumption. Three parallel turns produced: turn B's task card merged into turn A's (both were card 'turn:root' — reply_to is None in flat DMs), B left cardless, and _open/_sealed_draft_by_chat clobbered across writers (3x duplicate finals on the last turn). Per-turn machinery was correct; the keys were not. Fix: _draft_key(chat, metadata) = chat + the turn's thread anchor (inbound stamps thread_ts = event.thread_ts or ts on every top-level message, so each turn has one even in flat DMs). draft arming, seal tombstones, both interception sites, and the task-card id all derive from the same anchor. New trace test pins two interleaved turns: distinct cards, own-stream seals, no leaked plain send, no cross-turn tombstone drops (289 tests green). * fix(gateway): preserve cumulative native stream across tools * fix(gateway): consumer-declared final — the seal carries the true final Three composed fixes for the Slack live-cards duplicate-final class: 1. finish(final_text): TurnRunner passes the completed final_response (verifier footer, completion explainer included) as the authoritative finalize payload. The native-stream seal delivers the TRUE final, so post-stream mutation no longer forks a corrective plain send (#11). 2. Interim-send contract: commentary and segment-tail sends carry a gateway-internal _interim_send marker; relay seal-interception skips them at both egress doors. A mid-turn interim send can no longer seal the live stream and orphan the real final into a duplicate. 3. Queued-follow-up lane reconciles an unconfirmed final by EDITING the consumer's delivered message in place (sealed stream = regular message, chat.update live-verified); plain send only as fallback. This was the actual duplicate lane in the parallel canaries — every duplicated turn logged 'final stream delivery not confirmed; sending first response' (subagent-completion queued inbound), not parallelism. Also: draft frames stay prefix-stable gateway-side (no fence-closing, no segment state reset, no commentary reset for stream-is-the-message adapters; MagicMock-safe 'is True' guards). * test+docs: streaming-contract coverage completeness + maintenance guidelines Coverage: two gaps closed on the consumer-declared-final contract — (1) send_for_platform (the delivery-resolver egress door) honors the _interim_send contract: no seal, marker stripped before the wire; (2) finish(final_text) on a turn that never streamed does not adopt the final (delivery ownership stays with the gateway's normal send path for non-streaming models / tool-only turns). Docs: AGENTS.md 'Known Pitfalls' gains the streaming delivery contract — the four invariants of stream-is-the-message adapters (prefix-stable frames, consumer-declared final, interim-send marker, reconcile-by-edit), each traced to its live incident, plus the live-probed Slack streaming API ground truth and the MagicMock 'is True' guard-style note. * fix(relay): seal transport failure must never silently lose the final (review B1) Two halves of one silent-loss path, live-probed on the review branch: 1. adapter: _seal_open_draft did not catch transport exceptions. A socket drop at seal time raised out of send(), skipping the fail-open plain send entirely. Now: retry the SAME idempotent final frame once (the connector's sealed-key tombstone returns the original stream ts for a repeated final — a retry can never open a second stream or duplicate), then report failure so the caller's fail-open path runs. 2. consumer: the turn-final retry (elif not _already_sent) called _send_or_edit with finalize=False, which re-entered the DRAFT-FRAME branch. Its no-op dedupe compared the adopted final against the last unsealed frame, matched, and returned True with ZERO transport calls — final_response_sent went green, delivered_final_matches reconciled, the gateway suppressed its fallback, and the user never received the answer. finalize=True keeps this retry out of the draft branch. Regression suite: tests/gateway/test_relay_seal_failure.py (3 tests). Mutation evidence in follow-up verification: reverting either half sends the suite red. * fix(relay): draft ids unique across gateway incarnations (review B3) The relay connector tombstones sealed streams by (channel, draft_id) and keeps up to 512 of them; they outlive the gateway process. Relay gateways are disposable BY DESIGN (scale-to-zero), and _draft_id_counter restarted at zero every incarnation — so the first turns after every scale-from-zero in a recently-active channel replayed already-sealed wire identities. The connector answered those frames straight out of the old tombstone: zero Slack API calls, the OLD message ts returned as the new turn's identity, the new answer silently dropped while gateway-side flags recorded success. Seed the counter from wall-clock milliseconds at process start. Ids stay plain ints within the existing contract op; incarnations cannot overlap for realistic turn counts and restart gaps. Regression: tests/gateway/test_draft_id_restart_uniqueness.py — the seed test fails on the old code (seed 0 is not epoch-scale). * fix(relay): stream/card state keyed per TURN, not per thread anchor (review B2) The thread anchor is the wrong coordination identity — simultaneously: - too coarse: two parallel turns replying INSIDE ONE Slack thread share thread_ts. Live-probed on the review branch: turn A's final sealed turn B's stream with A's content while A's own stream stayed open, and B's final degraded to a plain send. - too fragile: a flat DM with no thread metadata degraded to the bare chat id, re-creating the original finding-#10 collision the anchor was meant to fix. _draft_key now prefers the triggering inbound message id (message_id / reply_to_message_id — per-turn by construction; the gateway's Slack thread metadata and the consumer's send path both stamp it), falling back to the thread anchor, then the bare chat. The consumer stamps the same reply_to_message_id on draft frames so frames and the turn-final resolve to one key. Task-card ids share the derivation via _card_key (one helper for send AND stop, so the stop always hits the stream the send opened). Legacy resolver-lane callers with placement-only metadata still seal via _match_open_draft's fallback — but ONLY when exactly one stream is open. With several open, an identity-less send stays a plain send: a duplicate message is recoverable, sealing someone else's stream is not. Regression: tests/gateway/relay/test_relay_turn_keying.py (7 tests). * fix(relay): stream-is-the-message is a Slack semantic, gate it on the descriptor (review B4) draft_stream_is_message was hardcoded True on the relay adapter class, i.e. for EVERY relay platform. The base send_draft contract is Telegram-shaped — the draft clears client-side and the final arrives as a separate real send that becomes the history message. With the flag forced on, any non-Slack connector advertising the draft op had its turn-final intercepted into draft(final=true): probed on the review branch with a telegram descriptor, the op stream was [draft(final=false), draft(final=true)] and NO send — no history message would ever be posted. Gate the flag on the negotiated descriptor platform (slack), and skip arming seal-interception entirely when it is off. A future platform with genuine stream-is-the-message native streaming should advertise it via the descriptor rather than widening the platform check by guesswork. Regression: tests/gateway/relay/test_relay_stream_semantics_gating.py (4 tests: gating both ways, telegram final is a real send, slack final still seals). * fix(gateway): mark every mid-turn status lane interim — heartbeats must not seal the stream (review B5) Seal-interception treats the first unmarked send to an armed (chat, turn) key as the turn-final. The consumer's own interim lanes (commentary, tail flush) carry _interim_send, but four gateway-side lanes that fire DURING a streaming turn did not: - long-running heartbeat (default every 180s — probed live: at 3 minutes it sealed the live stream with '⏳ Working — 3 min', the real final posted as a duplicate, and later frames were silently swallowed by the seal tombstone) - inactivity warning - plain-text approval fallback (button lane failed) - background-review notice Add _interim_metadata() beside _non_conversational_metadata and wrap all four call sites. The marker is gateway-internal; the relay adapter strips it before the wire (existing behavior, pinned by test). Note for follow-up: the opt-out shape remains fragile — any FUTURE unmarked mid-turn send lane re-creates this bug. Inverting the contract (explicitly mark the one turn-final send) is the durable fix but touches every adapter's final-delivery path; deliberately kept out of this review-fix series. Regression: tests/gateway/test_interim_send_lanes.py (4 tests). * fix(gateway): interrupted/incomplete turns must not adopt the diagnostic as the stream final (review B6) The finish(final_text) adoption gate checked only 'not failed', but the interrupt/abort returns in agent/conversation_loop.py are {completed: False, interrupted: True, final_response: 'Operation interrupted during …'} with NO failed key. Adopting that diagnostic: 1. sealed the user's streamed partial answer over with the interrupt text (stream-is-the-message: the seal rewrites the whole message), and 2. recorded the diagnostic as the turn-final payload, so delivered_final_matches reconciled and the gateway suppressed its own error-delivery path — the diagnostic became the ONLY thing delivered. Enumerated all 27 final_response-bearing return shapes in conversation_loop.py: every non-happy-path shape carries completed: False (several with a diagnostic final_response and neither failed nor interrupted — retry exhaustion, truncation, codex-incomplete); the happy path routes through turn_finalizer.finalize_turn (completed=True). Gate is therefore: not failed AND not interrupted AND completed is not False. Results lacking the completed key entirely (older callers/test doubles) keep the previous behavior. Regression: tests/gateway/test_stream_final_adoption_gate.py (6 tests, incl. a source-level pin on the run.py call site). * fix(relay): task-card transport failures degrade to failed SendResults (review B7) send_native_task_card_progress and stop_native_task_card_progress let transport exceptions escape. The stop runs inside the progress loop's finally block on the turn-cleanup path, and the post-cancel awaits in gateway/run.py caught only CancelledError — a socket drop during a card publish/stop therefore aborted cleanup BEFORE the final-delivery bookkeeping ran. Three layers, outermost defends any adapter: - both adapter methods catch transport exceptions and return failed SendResults (progress is advisory; the TurnRunner's text fallback already handles failure results) - the progress loop's finally wraps the stop (best-effort; the connector seals orphaned card streams on its own via recycling/eviction) - the cleanup awaits log-and-continue on non-cancellation errors so final-delivery bookkeeping always runs Regression: tests/gateway/relay/test_relay_task_card_failures.py. * fix(relay): a dying turn seals its native stream instead of orphaning it (review B8) Stale-generation exits (/new, /stop mid-stream) and cancellations returned from the consumer's run() with the native stream still open: - the Slack message kept its live streaming indicator forever (the cancellation best-effort edit only runs when _message_id exists, and the native draft path deliberately keeps it None); - the adapter's armed interception state survived the turn, so the next turn on the same key could inherit it and seal a dead draft_id. New adapter op abandon_open_draft(chat, content): seals in place with the text already on screen (the consumer passes its last delivered frame) — the seal adds nothing and claims nothing; delivery flags are never set, so the gateway's normal paths still own whatever happens next. Best-effort by contract (failure reported, never raised); the connector reaps truly orphaned streams via recycling/eviction. The consumer calls it from both death paths: the stale-generation early return and the CancelledError handler. Regression: tests/gateway/test_stream_abandon_on_turn_death.py (4 tests, incl. the next-turn-inheritance hazard). * fix(relay): bound the draft/seal coordination dicts (review M1) _sealed_draft_by_chat's key embeds a per-turn identity, so every completed turn wrote a permanent entry — unbounded growth for the life of a long-running gateway process (the docstring said 'one entry per chat', which stopped being true when the key gained the turn anchor). _open_draft_by_chat could grow the same way via abandoned entries. FIFO-evict both at 512 entries — the same idiom as the sibling bounded cache (_auto_thread_by_chat, capped at 256) and the same size as the connector's own tombstone store. The straggler window the tombstone exists for is seconds long; FIFO is more than enough. Regression: tests/gateway/relay/test_relay_state_bounds.py. * fix(relay): explicit connector rejection disarms interception; exceptions stay armed (review P3) The G-D1 optimistic-arming change silently dropped disarm-on-failure entirely: after an EXPLICIT connector rejection (success=False result — not a transport ambiguity), interception stayed armed even though the stream consumer disables the draft transport on that failure and falls back to edit-based streaming. Its turn-final would then be converted into a seal on a stream the connector just told us is unusable. test_draft_failure_result_propagates claimed to cover this ('must NOT leave seal-interception armed') but passed for an unrelated reason: the stub's canned failure also failed the SEAL, whose fail-open path did the plain send. Split the two semantics and pin each honestly: - explicit rejection (result success=False): disarm — turn-final is a real send (test_draft_failure_result_propagates, now testing what its comment says) - transport exception: ambiguous, stay armed — turn-final still seals (test_draft_transport_exception_keeps_interception_armed, the G-D1 contract) Also corrects commit ba3a24a's claim ('a failed frame disarms interception so the edit-based fallback's real send goes through untouched') to hold again for the rejection case it described. * fix(relay): lost acks are ambiguous, not rejections — on the RESULT channel too (review r2, finding 1) The production ws transport does not raise on ack timeout — it returns {"success": False, "error": "relay outbound timed out"}. The round-1 ambiguity handling keyed entirely on the exception channel, so the shape production actually produces was misclassified as a definite connector rejection. Probed on the head: - lost SEAL ack: skipped the idempotent retry, fell straight to a plain send — duplicate final whenever the seal had actually applied; - lost FRAME ack: the round-1 disarm-on-rejection fired — interception disarmed, frozen native stream beside a plain final. This re-created the original G-D1 ambiguous-ack defect on the result channel. Contract now spans both channels: - transport: the ack-timeout branch tags ambiguous=True. The fail-fast branches (closing / not connected) never sent anything and stay unmarked — they are definite non-delivery. - adapter frame path: ambiguous results keep interception armed (same as exceptions); only definite rejections disarm. - adapter seal path: one shared _attempt() classifier — exception and ambiguous result both mean "unknown"; the SAME idempotent frame is retried once (connector tombstone returns the original stream ts for a repeated final). Only after both attempts stay ambiguous does the caller's fail-open plain send run: a possible duplicate after double ack loss beats a silent loss, and double ack loss on one socket almost always means the transport is down for the plain send too. Regression: tests/gateway/relay/test_relay_ack_ambiguity.py (6 tests, incl. a source-of-truth check that the transport tags the timeout branch and leaves fail-fast branches unmarked). * fix(relay): stream semantics + draft capability resolve per CHAT, not per primary (review r2, finding 2) One RelayAdapter fronts N platforms (Phase 1.5): descriptors accumulate per platform on the transport and egress is tagged per chat — but the round-1 gate keyed draft_stream_is_message and supports_draft_streaming() off the PRIMARY scalar descriptor. Probed on the head: - Slack primary + Telegram chat: the Telegram chat's turn-final was intercepted into draft(final=true) — no real Telegram history message; - Telegram primary + Slack chat: the Slack chat was denied native streaming entirely. Resolve both through _descriptor_for_chat — the same per-chat machinery max_message_length already uses (added for the identical class of bug: the primary's 39000-char cap over-sending into Discord 400s): - new stream_is_message_for_chat(chat_id) on the adapter; arming and NotImplementedError gating use it. The class attribute remains as the single-platform value and legacy-probe fallback. - supports_draft_streaming() gains an optional chat_id kwarg (base signature updated; single-platform adapters ignore it). The consumer passes chat_id with a TypeError fallback for out-of-tree adapters. - the consumer's four draft_stream_is_message reads collapse into one _stream_is_message() helper that prefers the per-chat probe (class-resolved, MagicMock-safe) over the attribute. Platform-name inference ("slack") stays deliberate: a descriptor-level semantic field is the right eventual contract but is a cross-repo wire change — noted for the gg follow-up so future platforms advertise the semantic explicitly. Regression: tests/gateway/relay/test_relay_multiplatform_semantics.py (5 tests: both starvation directions, scalar fallback, per-chat capability gate). * fix(gateway): split delivery + authoritative footer reconciles by suffix, not full resend (review r2, finding 3) The _FINAL_TEXT adoption guard refuses wholesale adoption on split turns — correct (NousResearch#78541: sealed heads would repeat inside the tail) but it was absolute: a post-split verifier footer never entered the ledger, delivered_final_matches() reported a mismatch, and the gateway resent the ENTIRE body+footer after the split chunks (the #11 duplicate class, one level up). When the authoritative final strictly prefix-extends the split ledger, the missing suffix is the only undelivered content: append it to the live tail and the ledger, so the finalize carries it and the recorded payload reconciles. Non-prefix rewrites keep the full-resend fallback — a rewrite cannot be patched onto sealed heads. Regression: tests/gateway/test_split_final_suffix_reconcile.py (3 tests: suffix rides the tail + reconciles, rewrite still mismatches, unsplit adoption unchanged). * fix(relay): cancellation mid-seal restores open state so abandon can close the stream (review r2, finding 4) _seal_open_draft pops the open entry and writes the local tombstone BEFORE awaiting transport I/O — correct ordering for the straggler race, but CancelledError is not an Exception: a cancel during the await bypassed all failure handling, leaving the remote stream live (visible streaming indicator until connector eviction) while the local state said 'nothing open'. The consumer's abandon pass — added for exactly this turn-death case — found nothing to close and no-oped. On CancelledError: restore the open entry, drop the premature tombstone (only if it is still ours), re-raise. The abandon path then seals the stream in place with the on-screen text. Regression: tests/gateway/relay/test_relay_seal_cancellation.py (2 tests: state restoration, and end-to-end cancel→abandon→remote seal). * fix(relay): thread anchors are placement, not turn identity — revive the placement-only fallback (review r2, finding 5) _match_open_draft's single-open-stream fallback was dead for its primary intended callers: metadata carrying thread_ts/thread_id (placement-only resolver lanes) was classified as having 'turn identity', so those sends never reached the fallback — probed: a plain final posted beside the still-open turn-keyed stream. Only per-turn MESSAGE ids are identity now. Thread-anchored and bare callers share the fallback: absorb into the chat's open stream when EXACTLY one is open; stay a plain send when several are (duplicate is recoverable, wrong-stream seal is not). Callers WITH a message id whose key misses never fall back — their identity is authoritative and a miss means the stream belongs to a different turn. Regression: 4 new tests in test_relay_turn_keying.py (thread-anchored seal, both ambiguous-stay-plain shapes, id-mismatch never steals). * fix(relay): random process nonce for draft-id seeding (review r2, follow-up 6) The epoch-millisecond seed (round-1 B3 fix) mitigates the restart-replay class but is not a uniqueness guarantee: two gateways starting in the same millisecond, a forked process inheriting the class state, or a clock step backwards can all mint colliding wire identities against the connector's per-(channel, draft_id) tombstone store. Seed from secrets.randbits(49) instead: collision probability negligible, no clock dependence, and ids + realistic per-process turn counts stay comfortably inside the connector's JS number range (draft_id?: number, 2^53). Regression test now spawns two real interpreters and asserts their seeds differ — the exact scale-to-zero restart shape, and both start within the same second so a clock-locked seed would fail it. * fix(relay): stamp per-turn Slack egress identity — cache is fallback only (R3-5) The connector (gateway-gateway#210) fills chat.startStream's recipient_user_id / recipient_team_id — required by Slack when streaming to a channel — from metadata.user_id / metadata.scope_id. The gateway stamped only slack_team_id per-turn and left user_id (and scope_id) to RelayAdapter._with_scope, whose per-chat caches are keyed on chat_id alone and overwritten by every inbound message: with users U1 and U2 running overlapping turns in one channel, U2's arrival overwrote the cache before U1's stream opened, and U1's stream carried U2 as recipient_user_id. _thread_metadata_for_source now stamps scope_id and user_id from the turn's OWN source (setdefault — explicit values win), so identity is turn-scoped data on the wire. _with_scope is unchanged and fill-only: the caches keep serving restart/synthetic sends that carry no per-turn identity, which is all they were ever safe for. Mutation evidence: reverting the run.py hunk sends test_thread_metadata_stamps_per_turn_user_and_scope and test_concurrent_turns_carry_their_own_identity red; restore returns green. The _with_scope fill-only tests pass on both trees (existing correct behavior, now pinned against regression). --------- Co-authored-by: Ben Barclay <ben@nousresearch.com>

…er-bot Sessions browser (NousResearch#90732) Symptom: switching between bots forked a brand-new "Bot Chat" for the returned-to bot on EVERY switch, burying the user's real forever-chat (one report: a 930-message chat displaced by 7 forks in one morning). Root cause is a self-perpetuating loop between three parties: - state.db enforces UNIQUE(title): the first fork permanently squats the "Bot Chat" title; every later mint's title request is silently dropped by set_session_title (returns 0, no error to the caller). - The post-turn LLM auto-titler then names the untitled fork from its kickoff content ("Assistant introduction request #2", ...). - openBotCanonicalChat's identity check is title-string matching, so the renamed fork reads as "not plumbing" -> corrupted metadata -> clear pin -> mint again. Grandfathered pre-convention chats (real history, derived titles) hit the same branch and are forked away from immediately. Fix, two invariants: 1. Adopt-before-mint: createCanonicalChat first scans the profile via session.list include_hidden:true for an existing "Bot Chat" row and re-pins it instead of creating. The UNIQUE index makes this an exact registry lookup (at most one match), not a heuristic. Older gateways without include_hidden find nothing and fall through to mint. 2. A pin that resolves to a NON-plumbing session carrying real history is the user's conversation - keep it and open it (title drift is metadata damage, not ownership loss). Only a pin resolving to an EMPTY stray draft is treated as corrupted and replaced (which now goes through adoption first). Also removes the right-click -> Sessions per-bot stored-session browser (ProfileSessionsWorkspace and its atoms/query/rows). Bot Mode's product contract is ONE forever-chat per bot; a browser listing every hidden plumbing session contradicts that and confused users into opening dead forks. The Sessions workspace test goes with it; the include_hidden source-shape test now pins the adoption scan instead, and a new suite (canonical-chat-adopt-before-mint.test.mjs) covers both invariants plus the older-gateway fallback.

…teway route Fixes NousResearch#92265 (proposed fix #2; #1 and #4 are separate follow-ups, see below). ensureGatewayForAgent() and ensureGatewayForProfile() both decided whether a secondary activation "succeeded" by checking Boolean(entry.connection) alone. entry.connection is set in openSecondary() BEFORE the WebSocket dial completes (`entry.connection = conn` happens ahead of `await entry.gateway.connect(wsUrl)`), so a transient first-dial failure -- caught by the surrounding try/catch and left for scheduleReconnect's backoff retry -- still left entry.connection truthy. Both functions then treated this as a successful activation: applyActive() switched g.activeKey and published $gateway to the closed socket, and publishActiveConnection() pushed the connection descriptor to the UI. The next chat RPC then failed with "Hermes gateway is not connected" against a route the user/desktop believed was live. Added an isOpen(entry.gateway) check alongside the existing Boolean(entry.connection) check in both functions' activation/publish conditions, gating BOTH applyActive() (which switches g.activeKey and publishes $gateway) and publishActiveConnection() (which pushes the connection descriptor) on the socket having actually reached 'open'. A failed first dial now correctly returns false / leaves the previous active route untouched, matching option 3 from the issue's own proposed fix ("if both bounded attempts fail, keep the existing active route") -- the existing scheduleReconnect backoff still owns recovery for that entry going forward. Not implemented in this PR (separate, lower-priority follow-ups): - Proposed fix #1 (one immediate bounded reconnect attempt before returning activation status) -- a larger behavioral change with its own retry/timing tradeoffs; left to a separate PR. - Proposed fix #4 (Bot Mode's own connection-ID-only guard in plugins/hermes-bots/plugin.js) -- host.ensureAgent() calls into the now-fixed gateway.ts functions, so this class of bug is already closed at the root; Bot Mode's own additional profile/state verification may still be worth adding but is a separate, narrower hardening pass on top of this fix. Found and fixed a genuine test-suite inconsistency while verifying: the existing "refreshes the active connection after a pooled profile reconnect succeeds" test in gateway-shared-remote.test.ts asserted setConnection was called once after a SINGLE ensureGatewayForProfile() call whose first dial failed -- i.e. it encoded the exact bug this issue reports as the EXPECTED, correct behavior. Rewrote it to assert the corrected contract: the failed first attempt does not call setConnection at all, and a realistic retry (calling ensureGatewayForProfile() again, since g.activeKey correctly never left the primary after the failed attempt -- ensureActiveGatewayOpen() is for reconnecting an already-active gateway that went stale, not retrying an activation that never succeeded) succeeds and publishes once the second dial goes through. Added a new test file (gateway-secondary-open-check.test.ts) following the established mocking pattern from gateway-agent-scope.test.ts, covering both ensureGatewayForAgent and ensureGatewayForProfile: a transient first-dial failure does not activate/publish (the exact reported symptom), and a successful dial still activates/publishes normally (sanity, no regression to the happy path). Verified as genuine regressions by reverting both isOpen() checks and confirming 2 of 4 new tests fail with exactly the reported symptom (activated resolves true / the primary gets replaced despite the failed dial). 44/44 pass across all 9 gateway-related test files (no regression). Dupe-swarm winner for issue NousResearch#92265; Biotrioo (PR NousResearch#92307) was the earliest submitter of the swarm and deserves first-report credit.

Review P1 #2. _append_to_transcript_serialized() writes the compression continuation to child_id BEFORE publishing either _transcript_reroutes or the _entries update — that ordering is load-bearing for backlog order, so it must not move. At that moment nothing in the routing index points at the child, so _db_for_session_id(child_id) missed its scan and fell through to _db_for_key(None), i.e. the ambient store. The fail-closed guard did not fire because root is a live handle. The row therefore targeted root rather than the already-proven parent owner. With no child row there the append is rejected by the FOREIGN KEY constraint, the pending queue never drains and the reroute cannot advance; against a split-brain root the message would instead be written cross-profile. Record ownership before the mutation instead of moving the publication: a private _session_owner_hints map carries session_id -> owning key for ids whose owner is proven but not yet published, consulted by the new _owner_key_for_session_id() after the index scan misses, and dropped as soon as routing publishes. Signatures are unchanged, so the existing suites that stub _append_transcript_message keep working untouched; the map is read through getattr for stores built via object.__new__. The regression is physical rather than mocked: an ended compression parent and a live child that exist only in profiles/fitness/state.db, no active profile scope, append to the parent, then assert all four effects — the row lands on the child in the profile store, the pending queue drains, the reroute and the routing entry advance, and root state.db stays untouched. Without the hint it fails exactly as the review predicted, on "FOREIGN KEY constraint failed" against root. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…s (P5) (NousResearch#99220) * fix(relay): authorize send_message targets and surface egress declines P5 of the relay egress-authorization workstream. The relay path authenticated the SENDER but never authorized the DESTINATION, and the gateway compounded it from both ends. (a) send_message could silently name an arbitrary relay target. Its `target` parameter is free-form ('platform:chat_id'), so a model could name ANY chat id and the gateway would emit an outbound frame for it. gateway/relay/egress.py adds an attestation floor: a relay-routed destination must have a provenance this gateway can show -- the operator's home channel, the channel directory, or its own gateway session origins. Anything else is refused HERE, with a visible tool error naming the target, before a frame is written. Non-relay platforms and platforms served by a live native adapter in this process are untouched (same precedence resolve_delivery_transport applies). (b) Connector declines were swallowed into apparent successes. The connector's egress floor answers an unauthorized destination with a DEFINITE failure whose text is deliberately uniform (F-005). Several relay lanes degrade a *transport drop* by design and were degrading an *authorization refusal* the same way: - _send_media returned None, sending the caller into BasePlatformAdapter's text fallback -- a DIFFERENT op re-addressed at the very chat the connector had just refused. - _send_prompt returned None, so exec-approval / slash-confirm / clarify reported "relay prompt op unavailable" (a wrong reason) and ran their numbered-text fallbacks into the refused chat. - task_card_stop discarded the error entirely. - typing / delete / react / thread ops degraded silently at debug. is_egress_decline() classifies THAT a decline happened (never why -- the uniform text is not parsed for reasons) and requires a definite, non-ambiguous failure, so a lost-ack retry is still a transport outcome. Lanes with an error-carrying contract now report the decline verbatim; cosmetic bool/None lanes still degrade but log it at WARNING. Advisory progress drops that legitimately degrade are unchanged: the task_card send lane, the draft ambiguous/except branches, and every transport-exception path keep their existing fail-open behaviour. Tests: 21 mutations of the production source, all KILLED. * fix(relay): authorize the RESOLVED target; declines must not fall back Review round 1 (independently confirmed by a second reviewer) found three blockers. Two are fixed here; the third (B-2, Telegram @username) is a policy decision left open deliberately. B-1 — THE FIX CAUSED THE OUTAGE IT PREVENTED (tools/send_message_tool.py) The P5(a) guard ran ABOVE Slack user->DM resolution, so it authorized the internal pseudo-id `_parse_target_ref` emits (`user_name:ben`, `user:U...`). Provenances only ever hold RESOLVED conversation ids, so a fully attested DM was compared as a handle against a set of `D...` ids and refused: base slack:@ben SENT head(before) slack:@ben REFUSED Every Slack DM by handle was broken. Moved the guard below resolution; it now authorizes the destination that is actually sent to, and the refusal names the resolved id. Position is load-bearing, so it is commented as such and pinned: reverting the move turns exactly the four new cases red. B-3 — A DECLINE IS NOT A LANE FAILURE (gateway/run.py) `_approval_send_outcome` had only sent/failed/ambiguous, so a connector decline collapsed into `failed` — which is the cue to run the plain-text fallback into the chat the connector had just refused. The adapter fix in the previous commit improved the error STRING while user-visible behaviour stayed identical to base; the commit message overstated it. Fixed properly: - new `declined` verdict, recognised via the shared `is_egress_decline` contract (not string sniffing at the call site) - exec-approval returns without the text fallback - slash-confirm suppresses the text reply AND clears the registration, so a card that never rendered cannot capture the user's next message `send_clarify` was already correct (returns early inside the adapter). MUTATIONS (production source; both directions) classifier never returns 'declined' -> KILLED (4 cases) ALL failures classified as 'declined' -> KILLED (2 cases) guard moved back above Slack resolution -> KILLED (4 cases) decline CODE changed (review M05) -> KILLED marker match made case-sensitive (M10) -> KILLED M05 was a tautology: the test asserted the imported constant against itself, so changing the constant could not fail it. The wire contract is now pinned as a literal, because the connector stamps that exact string and a one-sided change is a silent cross-repo break. REGRESSION CHECK: the 12 failures + 1 collection error in this test selection are PRE-EXISTING cross-test contamination — the identical set fails at 7cf86188ac. Verified by diffing the failing sets: no new failures, 363 -> 374 passed. NOT FIXED (deliberate): B-2, Telegram `@username`. The Bot API resolves handles at send time, so there is no id to compare and no canonicalization exists yet. That is a policy decision, not a code move. * fix(relay): fail CLOSED on guard faults; classify the structured decline Third independent review. Two more blockers, both reproduced before fixing. 1. THE GUARD ITSELF FAILED OPEN (tools/send_message_tool.py:158) `_authorize_relay_target` wrapped BOTH the import and the call in one `except Exception: return None` — and None means AUTHORIZED at every call site. So any runtime bug inside the guard silently switched the entire P5(a) boundary off. Reproduced: with the guard raising, an unattested target sent. The docstring already stated the correct intent ("must not fail closed on its own IMPORT error") and the code did something broader. The two failures are not the same: a missing gateway package means there is no relay egress to authorize; a fault inside the guard means authorization did not happen. The import is tolerated, the call is not — a guard that cannot answer refuses. 2. THE STRUCTURED DECLINE WAS THROWN AWAY (gateway/run.py) The adapter preserves the connector's dict in `SendResult.raw_response`. My previous commit rebuilt a dict from the error STRING, which loses two contracts: * a decline carrying `code: egress_declined` and NO text renders as "relay egress declined" — no marker colon — so it classified as `failed`, which is exactly the cue to run the fallback into the refused chat; * `ambiguous: True` (lost ack) was flattened into a DEFINITE failure, re-sending a card that may already be on the user's screen. That is the duplicate-card bug the ambiguous verdict exists to prevent, reintroduced by the fix meant to harden the same path. Both call sites now classify `raw_response` when present, ambiguity first, and fall back to the wire sentence only for connectors that send no structured response. I had fixed the text-marker path and tested only the text-marker path. Worth naming: the review's probe was a shape my tests never produced. MUTATIONS (production source) guard fault returns None (fail open again) -> KILLED classifier ignores raw_response -> KILLED (3 cases) ambiguous treated as a definite failure -> KILLED (2 cases) 40 focused tests pass. Regression check vs be321faf27: identical 13-item failing set (pre-existing cross-test contamination), no new failures. STILL OPEN: B-2 / finding 3, Telegram `@username`. The reviewer is right that this is a REGRESSION of an existing contract (#53573 added Bot API username support), not merely an unspecified input, since relay provenance stores the numeric chat id. Fixing it means resolving the handle before authorization, or explicitly revoking the contract. That is a policy decision, not a code move, and it is Ben's call. * test(relay): pin M21 and M25, the survivors whose comments called them load-bearing Round-2 review reported six unpinned survivors from round 1. Two guard real behaviour and are now covered; the other four are cosmetic-lane warnings and fail-open branches I am leaving documented rather than pretending to close. M25 — thread-qualified session ids. `_session_ids` adds BOTH "chat:thread" and the bare chat, because the connector authorizes the CHAT. Without the split a gateway whose session origin is `-100999:77` cannot send to `-100999`, the chat it is demonstrably already talking in. KILLED. M21 — the generic `relay` plane must union every fronted platform, since a relay session is filed under its LOGICAL platform. KILLED. MY FIRST M21 TEST WAS THE DEFECT IT WAS TESTING FOR. I patched `_relay_fronted` — the very function the mutation empties — so emptying it changed nothing the test could see, and the mutation SURVIVED against a green test. Rewritten to drive the real `relay_fronted_platforms()` through its env source (`GATEWAY_RELAY_PLATFORMS`), which is how production learns it. That is the same "the test verifies my stand-in" failure I have spent this workstream removing from the connector harnesses, reproduced here in three lines of Python. The tell was identical: a mutation that survives a test written specifically to kill it. 334 tests pass. NOT PINNED, deliberately: M03 (success-guard on a malformed dict), M24 (empty-target allowance — the one fail-open branch, reachable only when the bare-platform path already resolved a home channel), M35/M36 (decline WARNINGs on cosmetic lanes). All four are observability or defence-in-depth rather than authorization, and the review agrees they are non-blocking. * fix(relay): defer Telegram @username authorization to the connector (B-2) Closes the last blocker. Two reviewers independently called this a REGRESSION of the public-channel username support added in #53573, not an unspecified input, and they were right: provenance stores RESOLVED numeric chat ids, so comparing `@channel` against them could only ever refuse. WHY THE GATEWAY CANNOT ANSWER IT. The guard fires only when there is no live native adapter — i.e. relay-fronted deployments — and on exactly those the CONNECTOR holds the bot token, not this process. There is no local way to turn a handle into the numeric id. Refusing here is not "fail closed", it is "fail always". WHY DEFERRING IS SAFE. The destination is still authorized one layer out: the connector's Telegram egress floor (gg#238, merged 743a7c2) classifies and refuses unauthorized destinations after ITS resolution — the layer that closed the reported vulnerability in the first place. Handles go from two guards to one, the authoritative one, not to zero. The carve-out is deliberately narrow and its EDGES are pinned, because the failure mode of an exemption is silent widening: telegram `@handle` -> deferred (the regression case) telegram numeric id -> still guarded matrix `@user:server` -> still guarded (telegram-only) bare name, no `@` -> still guarded attested handle -> normal path, attestation still consulted MUTATIONS carve-out widened to all platforms -> KILLED carve-out widened to every target -> KILLED carve-out removed (regression back) -> KILLED carve-out checked BEFORE attestation -> KILLED THE ORDERING MUTANT SURVIVED MY FIRST TEST. Both orderings return None, so asserting the verdict could not tell them apart — the test asserted the claim instead of the mechanism. Rewritten to observe that attestation is actually consulted. Same defect class as the M21 test earlier in this branch: a mutation surviving a test written specifically to kill it means the test is measuring the wrong thing. 341 tests pass. FOLLOW-UP (option 2, Ben's call, deliberately NOT done here): resolve the handle before authorizing so BOTH layers apply. That needs a resolution round-trip through the connector — new wire surface — so it belongs in its own phase rather than bolted onto this one. Recorded in the code comment at the carve-out, not just here. * fix(relay): close two fail-open boundaries; test the code-only decline for real Both blockers from review, each REPRODUCED before fixing. 1. STRUCTURED DECLINE HAD NO GUARD. Deleting `raw_response=result` from both `_send_prompt` return branches left all 34 tests green — a surviving, non-equivalent security mutant. The `code` field is the documented PREFERRED signal precisely because a connector may send no prose, and a caller rebuilding `{"success": False, "error": ...}` cannot see it. Cause: every existing case declines with marker TEXT. The evidence for the code-only path was a hand-built SimpleNamespace in a different file — a stand-in for the adapter, so it verified my fixture instead of production. Fixed with a CodeOnlyDecliningConnector driving the real `send_exec_approval` -> `_send_prompt`, feeding the REAL SendResult to the REAL `_approval_send_outcome`, plus the same shape on the media lane. drop raw_response SURVIVED (34 passed) -> KILLED 2. TWO FAIL-OPEN BOUNDARIES, both "absence" and "fault" sharing a return. `_relay_fronted` swallowed EVERY exception and returned an empty set, which `relay_routed_platform` reads as "not relay-routed" — skipping the guard. Probe, with a positive control in the same run: positive_control_denied = True discovery_fault_denied = False <- unattested target AUTHORIZED `_authorize_relay_target` caught every exception during IMPORT as "no gateway package". A module that exists and fails to initialize is a fault, not an absence, and returning None there means authorized. Now: ImportError alone is absence; anything else raises RelayRouteUnknown and `authorize_relay_target` converts it to a REFUSAL STRING (not a raised exception — every caller treats the return value as the verdict, so raising would trade a fail-open for a crash). Kept the converse under test so "fail closed" does not silently become "refuse everything in CLI/cron", which is the outage the broad except existed to prevent. discovery fault -> empty set KILLED RelayRouteUnknown -> authorized KILLED import fault -> authorized KILLED 397 passed (was 392, +5 new cases), zero failures. * fix(relay): close all seven review-round-3 blockers Every finding reproduced before fixing; every fix mutation-checked after. CONTENT LEAKS (the decline was laundered into a different op, same chat) #1 A declined DRAFT SEAL replayed as a plain send. On stream-is-the-message platforms the turn-final becomes draft(final=True); `_seal_open_draft` dropped the structured body, so `_absorb_into_open_draft` read a REFUSAL as a lane failure and fell through. Probe, Slack descriptor: before: draft(partial) -> draft(final,SECRET) -> send(SECRET) after: draft(partial) -> draft(final,SECRET) My first probe of this used a discord descriptor and showed no seal at all — the leak is real, my probe was wrong (streams only arm for Slack). #6 Task-card PROGRESS had the same defect one lane over: a bare failed SendResult reads as "card lane unavailable", and TurnRunner then sends the task text to the same chat. Both card methods now carry raw_response and the caller suppresses the fallback on a decline. AUTHORIZATION BYPASSES #2 `except ImportError` was NOT the fix I claimed last round. ImportError also covers a broken dependency inside an INSTALLED gateway; review probed `ImportError.name = "gateway.relay.dependency"` and got an authorized verdict. Now only a name identifying the gateway relay module itself is absence. An ImportError with NO name stays absence — refusing on a fault we cannot attribute would trade an unidentifiable bug for a real CLI/cron outage, and an existing test caught exactly that when I first got it wrong. #3 `relay_routed_platform` lowercases the requested platform; `_relay_fronted` returned configured names verbatim. A platform configured as "Discord" missed the membership test, looked native, and skipped the guard: 'discord' => refused 'Discord' => ALLOWED 'DISCORD' => ALLOWED An attestation bypass on a string comparison. UNDELIVERABLE PROMPTS THAT HUNG #4 `_clarify_send_disposition` handled `failed` and `ambiguous` but not `declined`, so a REFUSED clarify card fell through to wait_for_response and blocked until clarify_timeout — indefinitely when configured non-positive. A decline is more definitive than a failure, not less. #5 The exec-approval decline branch returned quietly, which suppressed the text fallback (right) but left the CENTRAL approval entry pending (wrong) — the dangerous command stayed blocked until the approval timeout. My comment claimed the registration was torn down; only RelayAdapter's private map was. It now raises `_ExecApprovalDeclined`, which propagates to `_await_gateway_decision`'s existing notify-failure path (drops the entry, unblocks the tool). A dedicated type, re-raised past the local `except Exception` that would otherwise have restored the leak. #7 THE GAP THAT LET ALL OF THIS SHIP. Both caller-level suppressions were unfalsifiable: deleting either branch left 36/38 tests green. The suites drove `_approval_send_outcome` and `RelayAdapter` but never the real TurnRunner / busy-session callers, so nothing observed whether a text send FOLLOWED a decline — which is the whole property. tests/gateway/test_decline_fallback_suppression.py drives both real callers and records every send. Each decline case is paired with an ordinary-FAILURE control, because without one a caller that never falls back would also pass. MUTATIONS (all on production source, anchors count-checked, restored after) #1 seal decline -> plain send KILLED #1b seal drops raw_response KILLED #2 nested ImportError -> authorized KILLED #3 fronted set not normalized KILLED #4 clarify declined branch removed KILLED #5 approval decline returns not raises KILLED #6 task_card drops raw_response KILLED #7 slash-confirm suppression removed KILLED #7's two were the reviewer's SURVIVORS (36/38 passing); both now die. 425 passed, zero failures. * fix(relay): close the three round-4 blockers Round 4 confirmed six of seven round-3 fixes and found three more. Each reproduced before fixing, each mutation-checked after. 1. A NAMELESS ImportError still authorized. Last round I admitted it as "absence" to protect the CLI/cron path. That reasoning was WRONG and the interpreter says so: import gateway.relay.nope -> ModuleNotFoundError, name="gateway.relay.nope" import totally_absent_pkg -> ModuleNotFoundError, name="totally_absent_pkg" Genuine absence is ALWAYS ModuleNotFoundError with `.name` set, so the CLI/cron path never produces a bare ImportError and nothing legitimate was being protected. A plain or nameless ImportError comes from an import hook or a module that failed while initializing — an unattributable FAULT. Now: absence is ModuleNotFoundError naming gateway / gateway.relay / gateway.relay.egress; everything else refuses. Two existing tests raised a bare ImportError to simulate absence and were corrected to the real shape. 2. SESSION ATTESTATION INVENTED IDS. `_session_ids` split every id on the first colon to recover "chat" from "chat:thread". Matrix ids contain a colon natively, so `!room:server.org` attested a bare `!room` — the guard vouching for a destination on its own fabrication. The split now applies only to platforms whose ids genuinely carry a `:thread` suffix (allow-list; unknown platforms are treated as un-splittable, which can only refuse more). Kept a Slack control: dropping the split entirely would refuse legitimate thread replies, which is the outage the split exists to prevent. 3. THE TASK-CARD FIX WAS UNFALSIFIABLE — my own round-3 mistake, and the same one round 3 caught me making. I added the production branch AND a test, but the test stopped at RelayAdapter: it proved `raw_response` is carried and never called `TurnRunner._task_card_publish`, which owns the property. Deleting the real branch left 30 tests green. Now driven through the real caller, with an ordinary-failure control. The lesson generalises: proving the DATA reaches the boundary is not proving the CALLER acts on it. Every one of these decline fixes has two halves and the second half is where the security lives. Also closed the round-4 non-blocking finding: `gateway/relay/egress.py` has its OWN import boundary, and the existing test intercepted the earlier import in tools/send_message_tool.py, so it was never exercised. Mutating that classifier to treat every ImportError as absence now dies. MUTATIONS (production source, anchors count-checked, restored after) R4-1 nameless ImportError -> authorized KILLED R4-2 session split unconditional KILLED R4-3 task-card caller branch removed KILLED (was SURVIVED) egress classifier: any ImportError = absence KILLED Also probed and found NOT a leak: a refused OPENING draft frame disarms the stream and the turn-final goes out via `send`. That send is itself guarded and the connector refuses it too, so no content is delivered — unlike the seal case (round 3, #1) where the seal was the only check on that path. 452 passed, zero failures. * fix(relay): recover the thread parent from thread_id, not a colon split Round 4 blocker 2 was closed with an allow-list of platforms whose ids have no native colon. Reviewing my own fix while round 5 ran, the allow-list is the wrong mechanism: it NARROWS a guess instead of removing it, and it still gets Matrix wrong the moment a Matrix session is thread-qualified (`!room:server.org:$thr` -> split yields `!room`). The structured field was there all along. `_session_entry_id` composes the id as f"{chat_id}:{thread_id}" and the entry still carries `thread_id` separately, so the parent is knowable EXACTLY: strip the known suffix, or add nothing. No platform list, no guessing, correct for ids that contain colons. Mutations: back to splitting on the first colon KILLED thread parent never recovered (over-refuse) KILLED Both directions matter: the first invents attestations, the second refuses legitimate thread replies. One existing test (M25) asserted the right PROPERTY with a fixture that omitted `thread_id` — a shape real entries never have. Fixture corrected, assertions untouched. 453 passed. * fix(relay): close the four round-5 blockers Each reproduced before fixing, each mutation-checked after. R5-1 A DISABLED NATIVE ADAPTER BYPASSED AUTHORIZATION. `_has_live_native_adapter` treated any entry in the adapter map as native; `resolve_delivery_transport` ignores a native adapter whose config is disabled and routes over Relay. Two independent routing classifiers, disagreeing: guard says native: True delivery routes relay: True So the guard skipped authorization for a send that went over the relay. The guard now applies the router's enabled-state rule; probed both configurations and they agree. R5-2 THREAD IDS WERE NEVER AUTHORIZED. The parser splits chat_id and thread_id; only chat_id reached the guard. On Discord the thread IS the destination — `POST /channels/{thread_id}/messages` — so an attested parent channel authorized an arbitrary caller-supplied thread. `authorize_relay_target` now takes thread_id and requires its own attestation (bare id or the `chat:thread` form a session origin produces); both call sites forward it. R5-3 A DECLINED **INITIAL** DRAFT WAS RETRIED AS A PLAIN SEND. Round 3 fixed the declined SEAL; the declined OPEN was a different path. `send_draft` returned a bare failure, so the stream consumer read "draft transport unusable", disabled drafts and fell through to `_first_send`. Measured through the real adapter and real StreamTransportMixin: before: ops ['draft', 'send'] after: ops ['draft'] send_draft now carries raw_response; a decline is terminal for the run and the guard sits in `_first_send`, where every fallback path converges. R5-4 MY ROUND-4 TASK-CARD FIX SUPPRESSED EXACTLY ONE UPDATE. It set `native_failed`, which the entry gate already uses for an ordinary broken lane, so the next progress event skipped the decline branch and went straight to the text fallback: after first publish: [] after second: ['send'] Terminal declines are now a separate `egress_declined` state checked at the entry gate. A refusal does not expire after one tick. MUTATIONS R5-1 disabled native counts as native KILLED R5-2 thread_id not authorized KILLED R5-2b tool does not forward thread_id KILLED (was SURVIVED) R5-3 initial-draft decline not terminal KILLED R5-3b _first_send guard removed KILLED R5-4 declined state not persistent KILLED R5-2b is the same gap that produced findings 3 and 4 of the last two rounds, a third time: every test called `authorize_relay_target` directly, so dropping the argument from the TOOL WRAPPER changed nothing. Testing the callee never proves the caller uses it — now pinned explicitly. Each fix ships with an ordinary-failure control, because every one of these makes the guard refuse MORE, and over-refusal is now the larger risk. 474 passed, zero failures. * refactor(relay): declare the terminal-decline state where it lives Both terminal-decline flags were set dynamically. They worked (neither class is frozen or slotted) but an undeclared attribute hides the state from anyone reading the class, and this one is security-relevant. _TaskCardState.egress_declined — declared dataclass field StreamConsumer._egress_declined — initialised in __init__ Lifetime verified while checking whether a refusal can leak ACROSS turns and mute a healthy destination: it cannot. _TaskCardState is constructed per progress-drain (run_turn_runner.py:420) and the consumer's flags per run (stream_consumer.py:163), so both are fresh each turn. Also verified the guard's blast radius after adding thread authorization: the ONLY callers of authorize_relay_target are the two model-facing send_message call sites. Gateway-internal sends — notably the handoff path, which creates a thread and immediately posts to it with no session provenance yet — go through transport.adapter directly and are unaffected. That was the most plausible over-refusal, and it does not reach this guard. 461 passed. * fix(relay): close the four round-6 blockers — the edit lane R6-1 MY OWN R5-1 FIX REINTRODUCED THE BYPASS IT CLOSED. I wrote `except Exception: return True` around the config lookup, so a config read fault declared the platform native while the ROUTER, reading the real config, sends over the relay: guard_has_live_native True guard_verdict None router relay Routing we cannot determine is UNKNOWN. It now raises RelayRouteUnknown, which the outer handler must re-raise rather than flatten to False, and `authorize_relay_target` turns into a refusal. This is the second time a convenience `except` in this function created a bypass; there is now no permissive return left in it. R6-2/3/4 THE NINTH LANE: `edit`. ONE dropped field, THREE leaks. `RelayAdapter.edit_message` discarded the connector response, and three independent callers read a bare edit failure as "editing is unavailable" and re-send the content as a NEW message to the same chat: stream edit fallback ['edit', 'edit', 'send'] the unseen tail queued reconciliation ['edit', 'send'] the WHOLE response task-card fallback ['edit', 'send'] the task text again Fixed at the source (edit_message carries raw_response) plus each caller: `_on_edit_failure` — the single funnel for stream edit failures — makes a decline terminal for the run, `_send_fallback_final` refuses to deliver a continuation after one, the queued reconciler returns instead of sending, and the task-card fallback sets the same terminal state R5-4 introduced. R5-4 fixed the native task-card op and I did not check its sibling fallback path. The pattern across rounds 3-6 is consistent: the fix goes where the decline is OBSERVED, and the leak lives wherever someone else later decides to retry. MUTATIONS R6-1 config fault -> assume native KILLED R6-1b RelayRouteUnknown swallowed as False KILLED R6-2 edit drops raw_response KILLED R6-2b edit-failure decline not terminal KILLED R6-3 queued reconcile falls back on decline KILLED R6-4 task-card fallback edit decline KILLED Each with an ordinary-failure control: a genuinely un-editable message must still be delivered, and a broken card lane must still reach the user. 481 passed, zero failures. * fix(relay): add a terminal-decline latch at the adapter choke point THE STRUCTURAL FIX, not a twelfth local check. Rounds 3-6 of review found ONE defect in eleven lanes: the connector refuses an op, and some caller downstream reads that as 'this lane is unavailable' and retries the same content through a DIFFERENT op against the SAME chat. Media, prompt, draft-open, draft-seal, native task card, task-card fallback edit, slash-confirm, exec-approval, clarify, stream edit, queued reconciliation. Each was closed by adding a check at one more call site. That approach cannot converge: gateway/ has ~60 outbound call sites, every one of them a place a future change can reintroduce this, and four consecutive review rounds each found another. The reviewer's own count of lanes is the argument against the per-site design. Every relay frame from every one of those callers passes through _transport.send_outbound. One latch there covers them all: once the connector refuses a chat, this adapter stops emitting CONTENT frames for that chat. Proven to subsume the local checks: with the stream-edit per-site check DISABLED, the leak probe still reports blocked=true — the frame never reaches the wire. The local checks stay as defence in depth and for their better error messages, but they are no longer the only thing standing between a decline and a re-addressed send. Scope is deliberately narrow, and each limit is mutation-pinned: per CHAT - a refusal must not mute other conversations CONTENT ops - typing/delete carry nothing; latching them would leave a stuck typing indicator for no security gain self-healing - cleared when the connector accepts that chat again, so a transient policy change does not need a restart Mutations: latch never set KILLED latch never consulted KILLED latch is global, not per-chat KILLED latch never clears KILLED 485 passed. * fix(relay): one route source; the latch already covered round 7's lanes Round 7 reviewed 573e41e294 — one commit BEFORE the terminal-decline latch — and independently reached the same conclusion I had: 'The per-call-site approach is structurally wrong. Use one turn-scoped choke point.' That is the latch in 6dbc004594. Its four 'still broken' lanes (tool-progress edit, progress-overflow edit, long-running heartbeat edit, stale streamed-final reconciliation) all share the shape edit_message->declined->adapter.send(same chat, same content), and NONE has a local check. Probed all four against the latch: tool_progress ops ['edit'] blocked progress_overflow ops ['edit'] blocked heartbeat ops ['edit'] blocked stale_final ops ['edit'] blocked That is the argument for the choke point, measured: lanes nobody patched are safe anyway. Pinned by a parametrized test named for those four lanes. R7-1 IS A REAL BYPASS THE LATCH DOES NOT COVER, and it is fixed here. The guard rebuilt routing from GATEWAY_RELAY_PLATFORMS while resolve_delivery_transport asks the CONNECTED adapter (fronts_platform, from the handshake identity set). Different snapshots: with env discovery stale or momentarily empty, the guard said 'native' and the router sent over the relay, skipping authorization. before: guard_relay_routed False / delivery relay after: guard_relay_routed True / delivery relay / unattested target refused The guard now asks the live adapter first and falls back to config only when there is no runner (CLI/cron) — pinned in both directions. R7-5 (non-blocking, and a fair hit): my stream-fallback test asserted _egress_declined and never drove _send_fallback_final, so removing that early return SURVIVED. The test now calls the real fallback and asserts the wire is untouched; the mutation dies. Mutations: R7-1 guard ignores the live adapter KILLED (was SURVIVED) R7-5 fallback early return removed KILLED (was SURVIVED) latch not consulted KILLED 491 passed. * fix(relay): close three holes found by attacking my own latch Round 8's brief told the reviewer to attack the latch. I did the same in parallel and found three real holes in it before the review returned. 1. send_for_platform BYPASSED THE LATCH ENTIRELY. It builds and posts its frame directly rather than through _outbound — and it is the delivery resolver's OWN entry point, so it is the single most important caller. before: ops ['edit', 'send'] after: ops ['edit'] gateway/AGENTS.md states the rule I had just broken: 'Seal-interception exists at BOTH egress doors (send() and send_for_platform()); a new egress door needs the same two checks.' The latch is a third such check and I had wired it to one door. 2. A COSMETIC SUCCESS CLEARED THE LATCH. Clearing on ANY success meant a typing indicator — routinely allowed for a chat whose content is refused — re-opened the door for the very next send: ops ['edit', 'typing', 'send'] Only a CONTENT op the connector accepted may clear it now. 3. A THREAD INSIDE A REFUSED CHAT WAS NOT COVERED. A thread lives inside its parent, so the same content reached the same conversation one level down: ops ['edit', 'send'] The latch key now strips the thread suffix. Also normalised int/str chat ids (callers pass both; a type mismatch would silently unlatch). MUTATIONS send_for_platform not latched KILLED cosmetic success clears the latch KILLED thread suffix not stripped KILLED draft-seal retry not latched SURVIVED — EQUIVALENT, proven: is unreachable while latched (a declined edit before the seal produces ZERO seal frames, measured). Kept as defence in depth because it posts directly, and documented at the site rather than covered by a test that could not fail. One self-inflicted bug on the way: a blanket replace put 1Password CLI brings 1Password to your terminal. Turn on the 1Password app integration and sign in to get started. Run 'op signin --help' to learn more. For more help, read our documentation: https://www.1password.dev/cli 1Password CLI is built using open-source software. View our credits and licenses: https://downloads.1password.com/op/credits/stable/credits.html Usage: op [command] [flags] Management Commands: account Manage your locally configured 1Password accounts connect Manage Connect server instances and tokens in your 1Password account document Perform CRUD operations on Document items in your vaults events-api Manage Events API integrations in your 1Password account group Manage the groups in your 1Password account item Perform CRUD operations on the 1Password items in your vaults plugin Manage the shell plugins you use to authenticate third-party CLIs service-account Manage service accounts user Manage users within this 1Password account vault Manage permissions and perform CRUD operations on your 1Password vaults Commands: completion Generate shell completion information inject Inject secrets into a config file read Read a secret reference run Pass secrets as environment variables to a process signin Sign in to a 1Password account signout Sign out of a 1Password account update Check for and download updates. whoami Get information about a signed-in account Global Flags: --account account Select the account to execute the command by account shorthand, sign-in address, account ID, or user ID. For a list of available accounts, run 'op account list'. Can be set as the OP_ACCOUNT environment variable. --cache Store and use cached information. Caching is enabled by default on UNIX-like systems. Caching is not available on Windows. Options: true, false. Can also be set with the OP_CACHE environment variable. (default true) --config directory Use this configuration directory. --debug Enable debug mode. Can also be enabled by setting the OP_DEBUG environment variable to true. --encoding type Use this character encoding type. Default: UTF-8. Supported: SHIFT_JIS, gbk. --format string Use this output format. Can be 'human-readable' or 'json'. Can be set as the OP_FORMAT environment variable. (default "human-readable") -h, --help Get help for op. --iso-timestamps Format timestamps according to ISO 8601 / RFC 3339. Can be set as the OP_ISO_TIMESTAMPS environment variable. --no-color Print output without color. --session token Authenticate with this session token. 1Password CLI outputs session tokens for successful 'op signin' commands when 1Password app integration is not enabled. -v, --version version for op Run 'op [command] --help' for more information on the command. into send_for_platform, which has no such variable. Two existing unfurl tests caught it — NameError at adapter.py:1407. 504 passed. * fix(relay): Telegram handle exemption + a turn boundary for the latch Round 8 blockers. Two of its four were already closed by 93750e351a (it reviewed the commit before it); these two are real and both are mine. B1 — THE TELEGRAM @HANDLE EXEMPTION COVERED A NATIVE SEND. _is_unresolved_handle exempts telegram @handles from attestation because "the connector resolves and authorizes it". That justification is FALSE whenever the gateway holds its own token: _send_to_platform calls _send_telegram(pconfig.token, ...) directly and no connector is involved. So an unattested @handle went out under the gateway's own credential while the numeric control was correctly refused. The exemption now requires that no native credential exists. A probe fault WITHDRAWS the exemption (falls back to the ordinary attestation check) rather than granting it. Shipped with the converse control: relay-only config still exempts @handles, and numeric targets stay guarded in both modes. B4 — THE LATCH HAD NO BOUNDARY, SO IT WAS AN OUTAGE MECHANISM. My own regression, and worse than reported. Removing "clear on cosmetic success" (correctly) removed the ONLY way the latch could ever clear: a content op can never reach the connector to succeed, because the latch blocks it locally first. A refusal at 09:00 muted that chat forever. A new inbound message for a chat is the generation marker — the natural teardown point. Suppression still holds for the whole turn. same_turn_blocked: true next_turn_delivered: true MUTATIONS (all killed) handle exemption ignores native credential native-credential fault GRANTS the exemption no turn boundary (latch never clears) teardown clears ALL chats not just this one teardown ignores the chat The last two SURVIVED first: I tested _clear_declined_for_turn directly and never proved _on_inbound calls it — the caller-level gap that has now produced four blockers on this branch. Added a test driving the real inbound entry point. One self-inflicted bug, caught by my own fault test: the probe imported load_config, which does not exist (it is load_gateway_config), so it always threw and returned the fault default. The test that pinned fault behaviour is what exposed it. 510 passed. * fix(relay): correct latch identity and boundary; one config snapshot Round 9, four blockers, all reproduced. B1+B4 — THE TEARDOWN WAS AT THE WRONG PLACE, twice over. It sat on the adapter's raw _on_inbound, which runs BEFORE profile routing, the ignored-channel guard, plugin hooks and user authorization. An unauthorized or dropped event could therefore clear a refusal belonging to an active turn, and stale content then went out as a different op. The same placement missed Discord interaction passthrough, which builds its own MessageEvent and calls handle_message directly, so slash commands and modal submits stayed muted after an earlier decline. Both are one mistake: I picked a lane instead of a boundary. Teardown now runs immediately after _hm_admit_event, the single admission gate every entry path shares. dropped event -> latch survives, stale send blocked admitted event -> latch clears B2 — THE LATCH KEY SPLIT ON ':', WHICH IS A MISTAKE I ALREADY FIXED ONCE. _latch_key did str(chat_id).split(":", 1)[0], so !room:tenant-a and !room:tenant-b both keyed !room: a decline in one Matrix room muted another, and inbound from one cleared the other's refusal. egress.py ::_session_ids stopped doing exactly this in round 4 and I reintroduced it three rounds later. Parent identity is never recoverable from identifier TEXT. Thread coverage is now structural: _thread_parent looks the relationship up in the recorded auto-thread map. B3 — AUTHORIZATION AND DISPATCH USED DIFFERENT CONFIG SNAPSHOTS. _handle_send retains one pconfig; the guard independently reloaded config. Across a transition the authorization snapshot could see a connector-only setup (exemption granted) while dispatch still held the native token and sent the unattested @handle itself. The guard now takes native_token from the SAME snapshot dispatch will use. A caller that omits it does not silently look like "no token". NB-1/2/3 also closed: real-object snapshot tests, an exception shield that faces a real exception, and send_follow_up no longer discards the connector's verdict (that discard is exactly how the edit lane laundered declines). MUTATIONS (all killed) latch key splits on colon again thread parent lookup disabled dispatch token ignored by guard tool drops the snapshot token admission teardown removed teardown moved BEFORE admission exception shield removed follow_up drops raw_response "admission teardown removed" SURVIVED first: I had tested the helper, not _handle_message. Added a test driving production _handle_message with admission stubbed both ways. Fifth caller-level gap on this branch. One self-inflicted bug caught before commit: I passed pconfig.token in _handle_react, which has no pconfig — a NameError on every reaction. 516 passed. * docs(relay): pin the latch's thread coverage limit as a deliberate trade _thread_parent only sees connector auto-threads, and that map is capped at 256 entries, so a user-created or evicted thread does not inherit its parent's latch. Documented at the site and asserted by a test, because the alternative - deriving parents from identifier text - is exactly what muted unrelated Matrix rooms in round 9. The primary control is unaffected: authorize_relay_target takes thread_id as part of the destination and attests it on every send (6 thread tests). * refactor(relay): one SendResult decline classifier for all 8 gateway lanes The extraction found a DEFECT, not just repetition. Eight gateway lanes each hand-rolled the unwrapping of a decline from a SendResult, and they did not agree. Six checked only raw_response. Two also checked the error text. A connector that answers with the uniform decline SENTENCE and no structured code - the documented contract for older connectors, per _approval_send_outcome - was therefore classified as an ordinary failure by those six lanes, so each treated a refusal as "editing unavailable" and retried through another op. Measured: text-only decline six-site check False two-site check True structured decline six-site check True two-site check True No content leaked, because the adapter latch classifies the transport dict directly and catches both shapes (verified: text-only decline still latches C1 and keeps SECRET off the wire). The cost was wrong verdicts and futile retries, not disclosure. declined_send(result) in gateway/relay/egress.py now owns this. It checks raw_response when structured, else the error text, and preserves the ambiguous exclusion - an ambiguous result is a transport outcome, so it must never read as a refusal. run.py keeps its own shape deliberately: that lane has three verdicts (ambiguous / declined / failed), so it checks ambiguous first and then delegates the boolean. MUTATIONS (all killed) helper drops the text-only branch helper drops the structured branch ambiguous no longer excluded draft lane decline check removed edit-failure lane decline check removed prompt verdict lane check removed slash-confirm lane check removed draft lane goes terminal on ANY failure (over-refusal direction) "draft lane decline check removed" SURVIVED first: _send_draft_frame had no test driving an unsuccessful send_draft at all. Added one, with an ordinary-failure control so the fix cannot silently become "one flaky frame mutes the chat". A non-unique anchor also masked the edit-failure lane on the first pass - the trap my own skill warns about. This closes the duplication that caused four of nine rounds of blockers: a new lane now calls one classifier instead of copying three lines. 519 passed. * fix(relay): latch identity, new-turn boundary, seal arming, ambiguity Round 10, four blockers, each reproduced before fixing. Two are my own regressions from the previous two rounds. B1 - ADMISSION IS NOT A NEW-TURN BOUNDARY. Round 9 moved teardown to just after _hm_admit_event. That is only an ADMISSION gate: an authorized message can be steered into a running session, answer a pending prompt, run a busy slash command, or be refused by the pause/drain gates - all without starting a turn. Each of those cleared the ACTIVE turn's refusal, and a later fallback from that turn reached the wire (probe: latch emptied, wire ops ['edit', 'send']). Teardown now runs after _claim_active_session_slot, the first point the runner OWNS a new turn. The new test drives production _handle_message through all four non-turn lanes plus the real new-turn path. B2 - LATCH IDENTITY OMITTED THE LOGICAL PLATFORM. One relay adapter fronts several platforms, so native ids collide. A Discord refusal for chat 42 was cleared by clear_egress_latch("telegram", "42") - the method took a platform and ignored it - and the Discord fallback then reached the connector. Keyed by normalized platform plus exact chat id; thread-parent expansion keeps the platform component. B3 - THE DIRECT DRAFT-SEAL PATH DID NOT ARM THE LATCH. _seal_open_draft posts through _attempt directly rather than _outbound, so a definite decline logged and returned but never latched. The immediate plain-send fallback was suppressed by the caller's own check; later same-turn sends were not (wire ['draft', 'draft', 'send'], the third frame carrying refused content). B4 - MY OWN REFACTOR MADE AMBIGUOUS RESULTS TERMINAL. send_draft's ambiguous projection discarded raw_response, so declined_send fell through to the error-text branch - and an ambiguous result whose text carries the decline marker ("... egress declined: ack lost") read as a DEFINITE refusal and terminated the run. Ambiguous means the frame may well have been delivered: a transport outcome, never an authorization one. Fixed on both layers: the projection carries the body (and the seal's ambiguous return is now explicit too), and declined_send's text-only branch - which cannot see the ambiguous flag - treats ack-lost text as transport ambiguity. Audited every SendResult projection in adapter.py for the same shape. MUTATIONS (all killed) latch key drops the platform clear_egress_latch ignores platform draft seal does not arm the latch ambiguous projection drops raw body declined_send infers decline from ack-lost text teardown back at admission 523 passed. * refactor(relay): split the terminal-decline latch out of the guard PR The latch moves to feat/p5-egress-decline-latch (pushed at 3cf45736d7, which retains the full history) for redesign. This PR keeps the authorization guard and the per-site decline checks. WHY. Across eleven review rounds the two halves behaved very differently. The guard is a PURE FUNCTION of the destination - its blockers were all "you asked the wrong question" (case sensitivity, nested ImportError, missing thread_id, config snapshot skew), each a one-line correction that then stayed fixed. Rounds 7-10 found nothing new in it. The latch is MUTABLE STATE WITH A LIFETIME living on RelayAdapter - an object registered once per process that holds the WebSocket and has no concept of a turn. Nine of its blockers reduce to three questions the adapter cannot answer: when does it end, who arms it, what is it keyed on. Every answer so far has been a proxy (a successful op, an inbound message, an admitted event, a claimed session slot) and every proxy was wrong in a lane found later. The per-site checks hold identical information on `st` - a PER-TURN object - and have produced zero blockers, because the state dies with the turn and nobody has to decide when it ends. The no-relaunder property does NOT depend on the latch. Measured on the real consumer path with the latch absent: a declined draft frame sets _egress_declined and puts nothing on the wire. Removal verified structurally rather than by eye: an AST diff of every symbol between HEAD and this tree reports only latch symbols gone, nothing added. That check caught two over-deletions my strip made - _on_inbound (consumed by a "next def" boundary) and _SEEN_INBOUND_MAX (a class constant inside the removed span). Both restored; 19 failures went to 0. ALSO: RESTORED A TEST I WRONGLY REPORTED AS PASSING. test_tool_guard_forwards_thread_id never made it into the repo - `git log -S` finds it in no commit - though round 5 recorded its mutant as killed. Dropping thread_id from the guard call therefore survived the entire tests/tools suite (146 passed). Written properly this time, driving the real _handle_send far enough to reach the guard. It now KILLS that mutant. MUTATIONS on this tree guard fault authorizes instead of refusing KILLED thread_id dropped from the guard call KILLED (was SURVIVED) handle exemption ignores native credential KILLED draft lane decline check removed KILLED prompt verdict lane check removed KILLED slash-confirm lane check removed KILLED 503 passed. * test(relay): close the phantom-coverage gaps the guard audit found The thread_id test that was reported as killing a round-5 mutant turned out never to have been committed. That is a reason to distrust the other claimed kills, so I re-ran every guard mutation against the COMMITTED tree instead of trusting the earlier reports. Result: 9 of 11 killed, and the two "SKIPPED" ones had non-unique anchors hiding SIX separate sites. Mutating those individually found three real survivors. CASE NORMALISATION (round 3, finding 3) WAS HALF-COVERED. test_relay_fronted_matching_is_case_insensitive varies the CONFIGURED name but always requests lowercase "discord", so it pins _relay_fronted's normalisation and nothing else. The REQUESTED name's `.lower()` was covered by nothing at all. Probe with it removed: relay_routed("Discord") -> False authorize("Discord", unattested) -> AUTHORIZED which is exactly the bypass round 3 reported, alive again and untested. Two further sites were untested in the OVER-REFUSAL direction: the attested store is keyed lowercase, so a mixed-case request missed its own attested set and refused legitimate traffic. attested_relay_targets' own normalisation was invisible to every existing test because they all monkeypatch that function away; it is now asserted against the real function with only its leaf sources stubbed. Three tests added. All six case sites now die when mutated. I also re-did the three fail-closed RelayRouteUnknown mutations properly. The first pass swapped whole lines and produced IndentationErrors, so "KILLED" there proved nothing but a syntax error. Neutralising each raise at correct indentation: all three genuinely KILLED. FINAL AUDIT ON THIS TREE — 17 mutations, zero survivors guard: thread_id dropped at the call site guard: react path unguarded guard: handle exemption ignores native credential guard: 3x fail-closed raise neutralised guard: 6x case-normalisation site classifier: ambiguous treated as a decline classifier: text-only decline branch removed lane: draft / stream-edit / prompt / slash-confirm checks removed 511 passed. * test(relay): make the stream-edit test fail for the right reason Review of 45835a282d raised one blocking issue and three non-blocking ones. All four are addressed; none was a production defect. BLOCKING — the stream-edit test failed on the double, not on a leak. test_declined_stream_edit_does_not_send_the_unseen_tail implemented only the GUARDED path in its consumer double. Removing either guard therefore raised AttributeError inside the fake before any send could be observed: guard 1 removed -> AttributeError: no attribute '_is_flood_error' guard 2 removed -> AttributeError: no attribute '_clean_for_display' Red, but for the wrong reason — the test could not have caught the leak it is named for. My own docstring claimed it drove the fallback and checked the wire; it did neither. The double now implements everything the UNGUARDED path reaches (_is_flood_error, _flood_strikes, _current_edit_interval, _last_edit_time, _notify_new_message, _try_strip_cursor, _clean_for_display, _fallback_prefix, _metadata_for_send). Both mutations now fail on real assertions: guard 1 removed -> assert consumer._egress_declined is True guard 2 removed -> AssertionError: the unseen tail reached the wire: ['send'] NON-BLOCKING 1 — a docstring claimed more than the test exercises. test_requested_platform_name_is_also_normalised described a mixed-case send_message(target="Discord:999") bypass. That entry point cannot reach it: _resolve_tool_target lowercases the platform at tools/send_message_tool.py:47 before the guard runs. The test still pins a real contract — the helpers must not assume a lowercased argument, for the gateway lanes and any future non-normalising caller — so the claim is narrowed to that rather than the test removed. NON-BLOCKING 2 — the module docstring said "every lane drives the REAL RelayAdapter". The stream tests drive mixin doubles by design, because the behaviour under test belongs to the adapter's CALLER. Docstring now distinguishes the two kinds. NON-BLOCKING 3 — latch-deletion residue in gateway/relay/adapter.py:418: return None return latched if surface_declines else None The second line was unreachable and referenced a name deleted with the latch. Removed, along with the 20-line comment block describing the latch as "the structural fix" — that mechanism now lives on feat/p5-egress-decline-latch, not here. The reviewer independently confirmed the large deletion: an AST census between 3cf45736d7 and f57a2298fa reports only latch symbols removed and nothing added. 511 passed. * docs(relay): correct three claims that outran the code Review of 41ce3cc765 found no new production defect but three overstated claims, one of them in my own commit message. 1. THE LATCH COMMENTARY WAS STILL THERE. My previous commit message said it removed "the 20-line comment block describing the latch as the structural fix". It removed only the unreachable statement. Twenty lines at adapter.py:361-380 still described a per-chat latch, a choke point and its scope rules - none of which exist on this branch. In a refusal-sensitive module that reads as coverage this branch does not have. Now removed for real. This is the same defect class as the tests: a claim that outran what the code does. I made it while fixing that class. 2. THE STREAM-TEST DOCSTRING OVERSTATED BOTH MUTANTS. It said the mutation "now fails on the assertion that a send reached the wire" - true of one guard, not both. Verified separately: remove the _on_edit_failure check -> dies on _egress_declined, never reaches the fallback remove the fallback early return -> dies on the wire: ['send'] Both are valid behavioural failures, which is what the blocker asked for; they are different observables and the docstring now says so. 3. Duplicate `from types import SimpleNamespace` from an earlier scripted insert; imports reordered. 112 tests pass in the four focused files. * fix(relay): close two authorization defects found in review Both were reproduced before fixing and both mutants are pinned. 1. A LIVE relay adapter whose fronts_platform() raised degraded into the config fallback. `_live_relay_fronted` returned None for every failure, and None means "no live adapter, use the config snapshot" — so a faulting adapter plus an empty/stale snapshot made the guard conclude "not relay-routed" and authorize an unattested destination, while resolve_delivery_transport asks that same adapter and still routes over the relay. Measured: relay_routed=False, verdict None for chat 999. Absence and fault now have separate return values: None only when there is no runner or no relay adapter; a live adapter that cannot answer raises RelayRouteUnknown. This is the third instance of this bug class in this file, and the first two were also mine. 2. An attested chat whose id equalled the requested THREAD id vouched for that thread. The `thread in attested` arm proved nothing about parentage. Measured: attested {"-100A", "7"} authorized (-100A, thread 7). Only the bound `parent:thread` form is accepted now. Nothing legitimate needed the bare arm — _session_entry_id records a threaded origin as f"{chat_id}:{thread_id}", and a thread addressed as its own channel arrives as chat_id and passes the parent check. The existing test blessed the bare form via parametrize, so it PINNED the defect. Corrected, plus negative controls for the sibling-chat and other-parent cases and a positive control proving genuine absence still takes the config path (otherwise fix 1 would break native-only deploys). Merged origin/main (was 22 behind). 428 passed via scripts/run_tests.sh; full 10-row mutation ledger re-killed on the merged tree, none dying on an exception rather than an assertion. * fix(relay): only a missing adapter is absence; everything else is a fault Reviewer BLOCKER, reproduced before fixing. Two more paths where a PRESENT relay adapter still degraded into the config snapshot: 1. `fronts_platform` may be a property or descriptor, so the ATTRIBUTE LOOKUP can raise — and the lookup sat inside the absence handler. Probed with a raising property plus an empty snapshot: live=None, routed=False, verdict=None, i.e. an unattested target authorized. The previous test made an already-retrieved METHOD raise, so it could not reach this. 2. A present adapter with no usable `fronts_platform` returned None for the same reason. An adapter that cannot say what it fronts is broken, not absent, so it now raises too. Also found by my own spot-check while the review ran: the nested imports of `gateway.config` / `gateway.run` inside the live probe shared the broad handler, so a broken installation degraded to the snapshot as well. Probed with a healthy-adapter positive control in the same run — healthy refused the unattested target, faulted authorized it. `_relay_fronted` one function below already drew this exact distinction for its own import. The boundary is now: `relay is None` is the ONLY absence. Everything about a present adapter — attribute access, callability, the call itself, and the imports needed to reach it — is a fault and raises RelayRouteUnknown. This is the fourth variant of absence-vs-fault in this file and all four were mine. The lesson is in the code as a comment rather than in a commit message nobody re-reads. Four controls keep genuine absence benign: no runner, no relay adapter in the runner, a real ModuleNotFoundError naming the gateway package, and the configured-attested-target-still-sends case. 434 passed via scripts/run_tests.sh; 9-row mutation ledger re-killed including both new guards, none dying on an exception. * fix(relay): invert the live probe to fail closed by default Reviewer BLOCKER round 2, reproduced: reading the adapter registry can also raise. A runner whose `adapters.get()` raised gave relay_present=True, live=None, routed=False, verdict=None — unattested discord:999 authorized. That was the FIFTH boundary in one function with the same defect: the call, the attribute lookup, a non-callable attribute, the nested imports, and now the registry lookup. Each round I patched the reported boundary and the defect moved one statement up. The cause was the shape, not the statements: the function asked "did something go wrong?" and answered None, and None MEANS "no live adapter, use the config snapshot" — so every statement was a new chance to fail open, and every new statement would have been too. Inverted rather than patched a sixth time. Each `return None` now sits behind an explicit narrow check that cannot itself be the fault (no runner, no adapters, no relay key, gateway package genuinely absent), and one outer handler turns anything else into RelayRouteUnknown. A statement added inside this function is now fail-CLOSED by default. Verified all six fault shapes raise (call, attribute, missing method, registry .get, .adapters property, runner ref) and all five absence shapes stay benign, plus a liveness control where the config snapshot disagrees with a healthy adapter and the adapter still wins. Four new tests, including the two absence controls that keep native-only and CLI deployments working. 438 passed via scripts/run_tests.sh. Mutation ledger: 8 killed. One survivor recorded as a proven equivalent mutant — widening `if not registry` to `or {}` is behaviourally identical because `{}.get()` returns None, i.e. the same absence; it is a readability guard.

…xes) Picks up the plugin's merged fixes: empty-input tool calls no longer fail the request (#2), Haiku 4.5 requests no longer send adaptive thinking, top-level schema combinators are stripped before the native validator, the claude CLI is resolved on the env PATH, and relay/native failures now name their real cause instead of only the admission denial. Plugin version unchanged (0.3.0); the card art URL follows the pin.

gc_blobs carried two byte-identical `warning("malformed ledger line; blob GC skipped"); return 0, 0` blocks — one under `except json.JSONDecodeError`, one under `if not isinstance(row, dict)` (tools/skill_ledger.py:350-357; simplify reuse #2, efficiency note, re-gate G2 S2). Funnel the decode failure into the type guard (`row = None`) so the abort exists once. Behaviour is unchanged for both the [malformed-json] and [non-dict-row] parametrizations: any line that is not a JSON object still aborts the sweep with the same warning.

argparse's _get_value always calls a `type=` callable with the raw str token, and int(<str>) can only raise ValueError, so the TypeError arm in `except (TypeError, ValueError)` is unreachable. The try itself stays: without it argparse would print "invalid _nonnegative_int value: 'thirty'", leaking the private helper name into the usage error. Invariant: `_nonnegative_int` is only referenced as an argparse `type=` (hermes_cli/kanban_parser.py) and by the unit test, which passes str. Finding: simplify/D.quality.md #2 (hermes_cli/kanban_parser.py:50). Dead-branch deletion; existing test_gc_parser_rejects_negative_retention_days still covers the "thirty" -> "must be an integer" path (green).

uaixo marked this pull request as ready for review July 22, 2026 11:39

uaixo merged commit 407a845 into NousAI-Assistant Jul 22, 2026
20 checks passed

Navigation Menu

docs: add CLAUDE.md with branch and auto-merge workflow rules - #2

docs: add CLAUDE.md with branch and auto-merge workflow rules#2
uaixo merged 1 commit into
NousAI-Assistantfrom
claude/branch-connection-status-8yq06y

uaixo commented Jul 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

uaixo commented Jul 22, 2026

What does this PR do?

Related Issue

Type of Change

Changes Made

How to Test

Checklist

Code

Documentation & Housekeeping

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants