…urface

Clean CSS polish, no conflicts.

…arg mismatch' (NousResearch#12) from fix/delegate-workspace-kwarg into main

Address adversarial review findings:

1. Race condition (#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (#12): git push origin HEAD:main instead of
   bare git push.

* ci(nix): auto-fix stale npm hashes on push to main

When a PR merges to main with updated package-lock.json or package.json
in ui-tui/ or web/, the new auto-fix-main job detects stale npmDepsHash
values and pushes a fix commit directly to main.

This eliminates the recurring manual hash-bump PRs (#15420, #15314,
#15272, #15244) by reusing the existing fix-lockfiles --apply pipeline.

The fix commit only touches nix/*.nix files, which are outside the push
path filter (package-lock.json / package.json), so it cannot re-trigger
itself.

Closes #15314

* fix(ci): use GitHub App token for auto-fix-main push

GITHUB_TOKEN commits are invisible to workflow triggers (GitHub's
infinite-loop prevention). The auto-fix-main job pushes directly to
main, so the fix commit never triggered downstream nix.yml verification.

Mint a short-lived token via the repo's GitHub App (daimon-nous, APP_ID
+ APP_PRIVATE_KEY secrets) so the push is treated as a real event and
nix.yml fires to verify the corrected hashes.

Tested via workflow_dispatch dry-run: app token minted successfully,
checkout with app token succeeded, fix job correctly gated.

Resolves review feedback from Bugbot (r3144569551).

* ci(nix): rename lockfile check job for required status check

Rename 'check' → 'nix-lockfile-check' so the status check name is
unambiguous when added as a required check on main.

* fix(ci): harden auto-fix-main against races, loops, and silent failures

Address adversarial review findings:

1. Race condition (#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (#12): git push origin HEAD:main instead of
   bare git push.

---------

Co-authored-by: alt-glitch <alt-glitch@users.noreply.github.com>

* ci(nix): auto-fix stale npm hashes on push to main

When a PR merges to main with updated package-lock.json or package.json
in ui-tui/ or web/, the new auto-fix-main job detects stale npmDepsHash
values and pushes a fix commit directly to main.

This eliminates the recurring manual hash-bump PRs (NousResearch#15420, NousResearch#15314,
NousResearch#15272, NousResearch#15244) by reusing the existing fix-lockfiles --apply pipeline.

The fix commit only touches nix/*.nix files, which are outside the push
path filter (package-lock.json / package.json), so it cannot re-trigger
itself.

Closes NousResearch#15314

* fix(ci): use GitHub App token for auto-fix-main push

GITHUB_TOKEN commits are invisible to workflow triggers (GitHub's
infinite-loop prevention). The auto-fix-main job pushes directly to
main, so the fix commit never triggered downstream nix.yml verification.

Mint a short-lived token via the repo's GitHub App (daimon-nous, APP_ID
+ APP_PRIVATE_KEY secrets) so the push is treated as a real event and
nix.yml fires to verify the corrected hashes.

Tested via workflow_dispatch dry-run: app token minted successfully,
checkout with app token succeeded, fix job correctly gated.

Resolves review feedback from Bugbot (r3144569551).

* ci(nix): rename lockfile check job for required status check

Rename 'check' → 'nix-lockfile-check' so the status check name is
unambiguous when added as a required check on main.

* fix(ci): harden auto-fix-main against races, loops, and silent failures

Address adversarial review findings:

1. Race condition (NousResearch#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (NousResearch#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (NousResearch#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (NousResearch#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (NousResearch#12): git push origin HEAD:main instead of
   bare git push.

---------

Co-authored-by: alt-glitch <alt-glitch@users.noreply.github.com>

* ci(nix): auto-fix stale npm hashes on push to main

When a PR merges to main with updated package-lock.json or package.json
in ui-tui/ or web/, the new auto-fix-main job detects stale npmDepsHash
values and pushes a fix commit directly to main.

This eliminates the recurring manual hash-bump PRs (NousResearch#15420, NousResearch#15314,
NousResearch#15272, NousResearch#15244) by reusing the existing fix-lockfiles --apply pipeline.

The fix commit only touches nix/*.nix files, which are outside the push
path filter (package-lock.json / package.json), so it cannot re-trigger
itself.

Closes NousResearch#15314

* fix(ci): use GitHub App token for auto-fix-main push

GITHUB_TOKEN commits are invisible to workflow triggers (GitHub's
infinite-loop prevention). The auto-fix-main job pushes directly to
main, so the fix commit never triggered downstream nix.yml verification.

Mint a short-lived token via the repo's GitHub App (daimon-nous, APP_ID
+ APP_PRIVATE_KEY secrets) so the push is treated as a real event and
nix.yml fires to verify the corrected hashes.

Tested via workflow_dispatch dry-run: app token minted successfully,
checkout with app token succeeded, fix job correctly gated.

Resolves review feedback from Bugbot (r3144569551).

* ci(nix): rename lockfile check job for required status check

Rename 'check' → 'nix-lockfile-check' so the status check name is
unambiguous when added as a required check on main.

* fix(ci): harden auto-fix-main against races, loops, and silent failures

Address adversarial review findings:

1. Race condition (NousResearch#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (NousResearch#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (NousResearch#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (NousResearch#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (NousResearch#12): git push origin HEAD:main instead of
   bare git push.

---------

Co-authored-by: alt-glitch <alt-glitch@users.noreply.github.com>

12 輪 iteration 累積核心可交付物：

1. skill-helper-template/ — Missive helper（已 pilot 部署到 runtime ✅）
   - query.py：純 stdlib，繞 hermes 7 道閘
   - install.sh / adopt.sh：runtime 部署 + 業務 repo 採納自動化
   - missive-skill-patch.md：CK_Missive SKILL.md 直接複製貼上
   - README.md：5/5 採納就緒度表 + 4 步完整解阻塞最小路徑

2. ck-{lvrland,pile,showcase}-bridge-stub/scripts/query.py + skill-patch.md
   3 skill 預製，等 CF Tunnel NousResearch#12-13 上線後 5–10 min 採納

3. ck-observability-bridge-skeleton/scripts/query.py + skill-patch.md
   multi-backend 設計（Loki/Prom/Grafana/Alertmanager），9 actions

4. hermes-integration-final-report.md：12 輪 wrap-up 一頁總覽
5. hermes-acceptance-sop.md：採納後 e2e 驗收（hermes-web :9119 為主入口）
6. commit-organization.md：33 untracked → 6 batches commit 指引

驗證：missive 端到端通過 hermes runtime 75s 取真實業務 query (rag_search 5 公文)。

採納路徑：
  業務 repo session: bash docs/plans/skill-helper-template/adopt.sh <skill> .

Refs: hermes-runtime-blockers-postmortem.md (7 層真因 — 下一 commit)
      hermes-integration-final-report.md (整體狀態)

per ADR-0024 (proposed)：
- 3 tools functional: lvrland_health / lvrland_query_sync / lvrland_price_trends
- ACTION_HANDLERS 對應 LvrLand /api/v1/ai/query / /api/v1/analytics/price-volume-trends
- tests: 12/12 ✅ (含 stub_http fixture / fallback / error paths / register_all)
- + scripts/query.py helper (Phase 1.5 採納用，待 CF Tunnel NousResearch#12)
- + skill-patch.md：CK_lvrland session 採納步驟

接續 ck-missive-bridge / ck-observability-bridge / ck-showcase-bridge / ck-pilemgmt-bridge
完成 ADR-0020 Phase 1 4 bridge skill 矩陣。

Refs: hermes-agent docs/plans/ck-lvrland-bridge-stub/SKILL.md

When agent.background_review_cache_aware=true in config, the skill/memory
review fork inherits ALL tool schemas from the parent session instead of
filtering to just memory+skills. This preserves KV cache hits on the full
system prompt + tool schemas + conversation history prefix.

Tool usage is constrained via the review prompt instead of enabled_toolsets
filtering, so the API request prefix remains identical to the main session.

* ci(nix): auto-fix stale npm hashes on push to main

When a PR merges to main with updated package-lock.json or package.json
in ui-tui/ or web/, the new auto-fix-main job detects stale npmDepsHash
values and pushes a fix commit directly to main.

This eliminates the recurring manual hash-bump PRs (NousResearch#15420, NousResearch#15314,
NousResearch#15272, NousResearch#15244) by reusing the existing fix-lockfiles --apply pipeline.

The fix commit only touches nix/*.nix files, which are outside the push
path filter (package-lock.json / package.json), so it cannot re-trigger
itself.

Closes NousResearch#15314

* fix(ci): use GitHub App token for auto-fix-main push

GITHUB_TOKEN commits are invisible to workflow triggers (GitHub's
infinite-loop prevention). The auto-fix-main job pushes directly to
main, so the fix commit never triggered downstream nix.yml verification.

Mint a short-lived token via the repo's GitHub App (daimon-nous, APP_ID
+ APP_PRIVATE_KEY secrets) so the push is treated as a real event and
nix.yml fires to verify the corrected hashes.

Tested via workflow_dispatch dry-run: app token minted successfully,
checkout with app token succeeded, fix job correctly gated.

Resolves review feedback from Bugbot (r3144569551).

* ci(nix): rename lockfile check job for required status check

Rename 'check' → 'nix-lockfile-check' so the status check name is
unambiguous when added as a required check on main.

* fix(ci): harden auto-fix-main against races, loops, and silent failures

Address adversarial review findings:

1. Race condition (NousResearch#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (NousResearch#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (NousResearch#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (NousResearch#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (NousResearch#12): git push origin HEAD:main instead of
   bare git push.

---------

Co-authored-by: alt-glitch <alt-glitch@users.noreply.github.com>

- #1: Semantic repair log now records each transformation step, not just final rule
- #2: Eliminated double-repair in concurrent execution path
- #3: log_tool_input_repaired now called from production code paths
- #4: _repair_check_path_traversal replaced pass with logger.warning
- #5: _repair_fix_double_escape corrected: 2 backslashes → 1 (was 4→2)
- #6: Fixed malformed backtick in coerce_tool_args docstring
- #7: Registered _repair_strip_shell_prompt in _SEMANTIC_REPAIR_MAP
- #8: Removed dead code in tests (empty patch.dict, unused MagicMock)
- #9: Tightened ambiguous test assertion for required null fields
- NousResearch#10: Added logger.warning for silent exception swallowing
- NousResearch#11: Added EVENT_TOOL_INPUT_REPAIRED to REQUIRED_PAYLOAD_KEYS
- NousResearch#12: Added 7 new edge case tests (multi-rule log, unicode, idempotency)
Total: 39 tests passing

…ring

Paket B wiring (from sync-20260526), Discord end-state only:
- runtime_health() reports status/latency/heartbeat-age/lag_class,
  reading op=11 freshness from discord.py 2.x KeepAliveHandler
  (_last_ack) — on_socket_response was removed in 2.0 and never fired.
- connect/disconnect go through _mark_connected/_mark_disconnected and
  a periodic _health_refresh_loop so heartbeat-age stays fresh.
- Zombie-WS detection via seconds-scale heartbeat-age thresholds
  (Review-Finding NousResearch#11/NousResearch#12). NOT the intermediate on_socket_response
  variant.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Finding NousResearch#12: ensure dashboard HTML and plugin asset responses carry frame-ancestor/X-Frame-Options protection via a shared middleware.

Also fixes a Windows profile wrapper newline issue exposed while expanding dashboard test coverage on Windows.

* ci(nix): auto-fix stale npm hashes on push to main

When a PR merges to main with updated package-lock.json or package.json
in ui-tui/ or web/, the new auto-fix-main job detects stale npmDepsHash
values and pushes a fix commit directly to main.

This eliminates the recurring manual hash-bump PRs (NousResearch#15420, NousResearch#15314,
NousResearch#15272, NousResearch#15244) by reusing the existing fix-lockfiles --apply pipeline.

The fix commit only touches nix/*.nix files, which are outside the push
path filter (package-lock.json / package.json), so it cannot re-trigger
itself.

Closes NousResearch#15314

* fix(ci): use GitHub App token for auto-fix-main push

GITHUB_TOKEN commits are invisible to workflow triggers (GitHub's
infinite-loop prevention). The auto-fix-main job pushes directly to
main, so the fix commit never triggered downstream nix.yml verification.

Mint a short-lived token via the repo's GitHub App (daimon-nous, APP_ID
+ APP_PRIVATE_KEY secrets) so the push is treated as a real event and
nix.yml fires to verify the corrected hashes.

Tested via workflow_dispatch dry-run: app token minted successfully,
checkout with app token succeeded, fix job correctly gated.

Resolves review feedback from Bugbot (r3144569551).

* ci(nix): rename lockfile check job for required status check

Rename 'check' → 'nix-lockfile-check' so the status check name is
unambiguous when added as a required check on main.

* fix(ci): harden auto-fix-main against races, loops, and silent failures

Address adversarial review findings:

1. Race condition (NousResearch#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (NousResearch#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (NousResearch#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (NousResearch#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (NousResearch#12): git push origin HEAD:main instead of
   bare git push.

---------

Co-authored-by: alt-glitch <alt-glitch@users.noreply.github.com>

Add an optional sha input to the publish workflow so any hermes-agent-dorvis commit can be built and tagged sha-<commit> on demand, not just the HEAD of main. Checkout uses the sha input when provided; the published tag and revision label derive from it; and latest only advances on a real push to main, so a manual backfill cannot move it onto an old commit.

This unblocks pinning idearoom-agents to commits that live on dorvis/runtime (e.g. the current fc126c2 pin) without merging them to main, and makes the fork-pin to publish-matching-SHA flow self-serviceable. See idearoom Linear AE-43 and idearoom-agents PR NousResearch#12.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…e removal, LOOP target warnings

NousResearch#8: Card ID parsing uses regex 'Created\s+card\s+(\S+)' with fallback
NousResearch#9: validate checks gate→revision pairs (referenced gates must have dependents)
NousResearch#10: _find_revision_node documented single-revision assumption
NousResearch#11: LOOP target mismatch warns before fallback
NousResearch#12: Removed unused _find_dependents
NousResearch#7: 32 unit tests — DAG, cycles, LOOP regex, failure propagation, state persistence, validation, card parsing

NousResearch#15

Three remaining findings from the code review.

NousResearch#12 — hermes_cli/superagent.py: _strip_fences only handled a SINGLE
      leading-and-trailing ``` envelope.  Common model failure mode
      is 'Here is the plan you asked for:\\n```yaml\\nfanout: 2\\n
      ...\\n```\\nLet me know.' — the leading prose means
      stripped.startswith('```') is False so the function returned
      the whole text unchanged, then yaml.safe_load choked → exit 2.

      Fix: regex-based extraction with _FENCE_BLOCK_RE that pulls
      the YAML body out of fenced blocks even when there's prose on
      either side.  Falls back to the simple-strip path for fence-
      only output (preserves existing behaviour).

NousResearch#13 — hermes_cli/web_server.py: /ready was BOTH side-effecting AND
      racy.  (a) Called path.parent.mkdir(parents=True, exist_ok=
      True) on every probe — k8s polls every few seconds, so a
      read-only mount surfaced PermissionError every hit and a
      writeable mount got directories repeatedly recreated.  (b)
      The .readiness_probe storage check used a shared filename;
      two concurrent k8s probes (liveness + readiness simultaneous)
      could race, one's unlink raising FileNotFoundError → false
      'not_ready' on a healthy node.

      Fix: (a) audit_log probe just reports parent.exists(); never
      mutates.  (b) storage probe uses a per-PID + per-call unique
      filename and tolerates FileNotFoundError on cleanup.

NousResearch#15 — hermes_cli/superagent.py + hermes_cli/orchestrate.py: parent
      AIAgent was constructed bare with model=... provider=...
      quiet_mode=True only — no api_key, no base_url, no api_mode,
      no credential_pool.  delegate_task then pulled effective_
      api_key=None from the parent, so child subagents failed to
      authenticate whenever credentials lived in config.yaml
      rather than env vars (the production case for serious users).

      Fix: mirror hermes_cli/oneshot.py's resolve_runtime_provider
      pattern in both _build_parent_agent and superagent.py's
      parent construction.  Threads api_key / base_url / provider /
      api_mode / credential_pool from the resolved runtime, exactly
      like oneshot does.

274 tests pass — no regressions.

All 15 code-review findings are now fixed across three commits
(f25ae81 showstoppers, 06e71bc critical correctness, this commit
lower-severity polish).

https://claude.ai/code/session_01PNyEMgrzVHtXnPGwUfotWw

* ci(nix): auto-fix stale npm hashes on push to main

When a PR merges to main with updated package-lock.json or package.json
in ui-tui/ or web/, the new auto-fix-main job detects stale npmDepsHash
values and pushes a fix commit directly to main.

This eliminates the recurring manual hash-bump PRs (NousResearch#15420, NousResearch#15314,
NousResearch#15272, NousResearch#15244) by reusing the existing fix-lockfiles --apply pipeline.

The fix commit only touches nix/*.nix files, which are outside the push
path filter (package-lock.json / package.json), so it cannot re-trigger
itself.

Closes NousResearch#15314

* fix(ci): use GitHub App token for auto-fix-main push

GITHUB_TOKEN commits are invisible to workflow triggers (GitHub's
infinite-loop prevention). The auto-fix-main job pushes directly to
main, so the fix commit never triggered downstream nix.yml verification.

Mint a short-lived token via the repo's GitHub App (daimon-nous, APP_ID
+ APP_PRIVATE_KEY secrets) so the push is treated as a real event and
nix.yml fires to verify the corrected hashes.

Tested via workflow_dispatch dry-run: app token minted successfully,
checkout with app token succeeded, fix job correctly gated.

Resolves review feedback from Bugbot (r3144569551).

* ci(nix): rename lockfile check job for required status check

Rename 'check' → 'nix-lockfile-check' so the status check name is
unambiguous when added as a required check on main.

* fix(ci): harden auto-fix-main against races, loops, and silent failures

Address adversarial review findings:

1. Race condition (NousResearch#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (NousResearch#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (NousResearch#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (NousResearch#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (NousResearch#12): git push origin HEAD:main instead of
   bare git push.

---------

Co-authored-by: alt-glitch <alt-glitch@users.noreply.github.com>