Skip to main content

Assessor persistent controller

Use when managing Assessor's persistent four lanes.

Temporary owner build-fleet route override (2026-09-10)​

User temporarily replaces Fable with exact openai-codex/gpt-6-astra and Opus with exact openai-codex/gpt-5.6-sol in the build fleet until reversed. This supersedes older Fable-only roles and Opus escalation routing, not cumulative failure history, independent review, tests/security, or merge/deployment limits. Preserve work and verified ownership on transition; no new Fable/Opus assignments. Separate implementation and independent verification sessions even when both use SOL. Three active Assessor/recovery manager prompts and four canonical coordinating cards were updated/read back; this does not certify every runtime launcher migrated.

Latest owner override — SOL failure escalation and remediation plans​

For all builds, after SOL fails to resolve the same item more than two times, require first-party Opus review before another identical SOL resolution retry. Count distinct failed resolution attempts cumulatively across sessions/cards/candidates for the same unresolved item; deduplicate repeated reports and retain evidence rather than resetting counts on a new card. Opus reviews the current candidate, failed attempts, findings and root cause, and supplies an actionable remediation plan. SOL coordinates execution and final verification afterward; Terra remains skipped. This Opus review authority is an explicit exception to older restrictions on review/planning authorship, not automatic authority for unrestricted code mutation. Every review activity must include a remediation plan whenever remediation is needed: evidence-backed findings, concrete ordered fixes and affected scope/files, dependencies/owner or writer route, regression tests, acceptance gates and re-review criteria. If no remediation is needed, say so explicitly; unknown root cause requires bounded diagnostic steps, not invented fixes. Preserve all safety/acceptance/merge limits. This saved operating policy alone does not prove automated escalation is deployed.

Latest owner override — SOL-only review for ALL builds​

User explicitly directs: "From now on skip Terra review and go right to SOL. DO THIS FOR ALL BUILDS." All new review handoffs go directly to literal SOL for exact-candidate review/final verification, without Terra approval as a prerequisite. This supersedes every older Terra -> Sol requirement below, including product, operations, route deployment, CIS and remediation handoffs. Preserve existing findings as evidence for SOL; skipping the reviewer does not erase defects, waive tests/security/native-human acceptance, or expand merge authority or reactivate paused products. Do not report live automation migrated merely because this policy was saved; inspect and reconcile any hard-coded Terra gate through supported paths when operating it.

Scope only X-Centric-IT-Solutions/prj-xis-m365_azure_assesor. Source/runbook/config /root/Working/Operations/assessor-lane-controller/; read README.md and README-interface.md before operating. User authorized deterministic user-systemd supervision plus literal Sol planning, with existing Kanban authoritative. Other products remain paused.

Three-failure Astra escalation (owner correction)​

Owner requires literal Astra root-cause recovery after THREE distinct failures of the same canonical operation/work item, not thirty repeated retries. Stop identical retries, preserve cumulative lineage across cards/prompts/models, and deduplicate recovery. Distinguish execution failures from no-improvement. Astra repairs orchestration/planning blockers; controller-only product admission and native Opus after >2 failed implementation attempts remain, as do Terra/Sol gates. A written policy is not proof the deterministic supervisor trigger is deployed: require tested threshold=3, restart/lineage and dedup behavior with reviewed deployment evidence.

Plan progress and Fable recovery​

Owner requires supervisor comparison of every unfinished item's current plan milestone against its prior verified checkpoint. Missing progress triggers deduplicated literal Fable recovery review of plan, work/attempt history, worktrees, gates/reviews, ownership and dependencies. Fable may revise the stalled item's plan and return it to Sol for execution: explicit narrow exception to Astra-only revision authorship, no redundant Astra rewrite required. Read live FABLE-STALL-RECOVERY-POLICY.md. Preserve bounded live-worker checkpoints, product worktrees read-only for Fable, plan revision history/digest fencing, retry lineage and exact product approval roles. Repeated status comments/PIDs alone are not progress. Supervisor must consume the handoff and execute, not stop at audit. This is operating policy, not proof of deterministic stall-detection implementation.

Latest owner policy: Astra plan-first and Opus escalation​

User now requires a durable Astra-authored outcome-first plan for every new model assignment. Worker plans specify exact implementation/files/invariants/tests; review plans bind exact candidate and explicit success/progression criteria. Plans cover bounded assignments, not each tool call; planning itself has an outcome-first planning brief. Sol remains execution coordinator, not substitute planning author. More than two distinct failed worker attempts on the same implementation work item makes Opus the next writer, superseding older mandatory-Sonnet escalation below. Count once per failed attempt across continuation cards/models, not each finding/notification; preserve retry budgets and productive incumbents. Read /root/Working/Operations/assessor-lane-controller/ASTRA-PLAN-FIRST-POLICY.md. Rollout plan /root/Working/Operations/assessor-plan-first-rollout/tasks/plan.md. Native Opus routing was owner-authorized and deployed 2026-09-07: --route opus launches first-party claude-opus-5, eligible benchmark-sonnet/other-1/other-2, with credential scrub/census/capacity/board checks retained. Five route regressions and real firstParty Opus file-write/independent three-test probe passed; four pre-existing full-suite failures remain documented in /root/Working/Operations/assessor-scope-20260907/. No claim of full-suite green. Runtime plan admission and automatic failure-ledger escalation are still separate work. No Opus-as-Sonnet alias or ad-hoc bypass. Later S3/S4 cutover must preserve/reconcile controller.py and ready_reserve.py Opus changes. All Assessor units are USER systemd units: inspect/restart with systemctl --user, read journalctl --user; system-level show can misleadingly report MainPID=0 for a live user worker. Existing exact reviewer roles, four-product cap, no new DeepSeek, supported ownership and human/security gates remain.

Explicit parallel durable-delivery authorization​

Owner explicitly authorized more operations workers to accelerate durable delivery in the durable-recovery thread. On 2026-09-07 Astra dispatched two scoped first-party Sonnet lanes under /root/Working/Operations/durable-delivery-parallel-20260907/: S7 GitHub integration job and S11 soak collector. Separate independent clones at accepted b9045eb, disjoint module/test/docs allowlists, exact per-assignment locks, shared heavy-gate lock; no live/controller/integration/planner edits or product/remote mutation. Units durable-parallel-s7-20260907 and durable-parallel-s11-20260907 are supplemental to the existing repair owner. Existing Sol coordinator/program t_9e4f230f retain integration and literal Terra/Sol gates. This narrow user authorization supersedes the older single-operations-writer restriction for these lanes, not the four-product cap. Re-census launch.json/PIDs/units and consume reports before launching duplicate scopes. Assignment plan is ASTRA-ASSIGNMENT-PLAN.md in that directory; no new manager or cron.

Spark replacement policy​

2026-09-06 user replaces DeepSeek with GPT-5.3-Codex-Spark alongside Sonnet for Assessor; prior 3:1 ratio superseded. Max one Spark and four product slots; supplemental operations Sonnet remains separate. Preserve productive incumbents, no new DeepSeek or silent fallback, throttle with checkpoint/backoff. Literal Terra/Sol and >3-round Sonnet remediation unchanged. Exact Hermes openai-codex/gpt-5.3-codex-spark successfully wrote a disposable Python probe and tests (parent reran 3/3); standalone Codex ChatGPT route rejected same model. Controller native Spark route requires tested/reviewed deployment before product launch: do not disguise Spark as DeepSeek or bypass controller.

Live authority​

  • assessor-lane-controller.service: deterministic15s census, durable slot ownership, Restart=always.
  • assessor-lane-planner.service: bounded literal openai-codex/gpt-5.6-sol, no fallback; worker services are independent siblings.
  • Old cron a03d5e8a7517 is retired/paused. Do not run/resume. Code-level fence requires disabled AND unclaimed before new planner/launch.
  • Hourly brief 05aa83fc41b2 uses assessor-controller-report.py plus read-only Sol analysis.
  • No-agent incident watcher a808a7dd7126 uses assessor-controller-health.py every2m, dedup with15m reminders. Gateway needed for Slack delivery, not controller lifetime.

Cutover fence discovery before service recovery​

Before restoring an inactive/disabled/missing controller unit, inspect durable-delivery program card t_9e4f230f, newest /root/Working/Operations/durable-delivery-cutover-receipts/, cutover owner units/processes/lock and recovery cron. An intentional stop/disable can unlink an absolute-path linked systemd unit: missing installed file is not proof of accidental deletion. In 2026-09-05 cutover, BLOCKED_FENCED intentionally disabled/unlinked the controller while preserving an active planner; foreground restoration mistakenly crossed that fence. Reconcile cutover authority first, preserve later worker/journal/policy changes, and never blindly restore old runtime. Immutable staging docs can predate newer external receipts and board comments.

Operate safely​

Use python3 .../controller.py --config .../config.json status; inspect user-systemd and exact OS identities. Runtime JSON is observations/leases, NOT backlog authority. Controller CLI is sole new implementation launch path; no ad-hoc background/systemd writer starts. Four slots: benchmark-sonnet, benchmark-deepseek, other-1, other-2. Preserve productive incumbents. Reviews excluded only in configured review roots with exact Terra/Sol route.

adopt/launch require exact linked assessor worktree, correct route, board capability hold, no claim/current run, done parents. release requires verified exit; never clear JSON manually. Live CWD drift is unsafe ownership, not death. Unknown census/board/unit state fails closed. The currently deployed source still stores task/worktree/route/brief-hash launch counters; this is a known legacy gap and never authorizes bypass by cosmetic prompt edits. The isolated durable-delivery candidate binds retries to canonical board task/worktree/route and conservatively seeds upgrade counts from preserved handoffs. A material new shape requires a supported new/deduplicated board task, not a caller scope string. The candidate is not live until exact-head gates and authorized cutover. No reset/delete/stash of useful work.

Outcome-first delivery improvement​

The reusable durable-fleet-delivery skill holds the cross-fleet recovery and delivery contract; its implementation plan is /root/.hermes/plans/2026-09-04_210627-durable-fleet-delivery.md. Staged code in /root/Working/Operations/durable-fleet-delivery-build is not a deployed capability. Service lifetime and planner receipts do not prove accepted/integrated/released work. Completed/no-edit worker output needs acceptance classification, not blind respawn; broad handoff investigation must not starve unrelated dispatch. Four lanes remain safe capacity policy, not the primary delivery outcome.

Verification​

python3 -m unittest test_controller test_integration test_health_report test_public_snapshot -v. Opt-in real disposable systemd drill: ASSESSOR_SYSTEMD_DRILL=1 python3 -m unittest test_systemd_drill -v. Opt-in real first-party Sonnet fixture: ASSESSOR_LIVE_LAUNCH=1 python3 -m unittest test_live_launch -v (uses inference, not product task). Controller SIGKILL automatic restart, adopted worker survival and pending-request persistence exercised; evidence in operations directory. Tests do not prove perpetual4/4 progress or product approval. Running means fresh tracked content, not accepted completion.

User priorities and repeated-review escalation​

2026-09-05 user correction supersedes Terra-as-remediator: more than three distinct Terra/Sol change-request rounds on the same GitHub issue requires first-party Sonnet as NEXT remediation writer, not DeepSeek. Count cumulatively across cards/candidates/PRs, deduplicate verdicts, preserve productive incumbents until checkpoint/exit, and retain literal Terra review then literal Sol verification. Record count/evidence/next route on authoritative card. Priorities: complete CIS and WAF baselines, SQLCipher compatibility/adoption, and report updates. Inspect newly eligible GitHub successors, not just historical capability-held queue cards; merged predecessors can leave stale needs_input cards hiding useful work.

Work-conserving user priority​

2026-09-05 user explicitly requested lower-priority work when critical items are not ready: do not leave safe vacant workers waiting for the top-priority issues. Scan the whole current board/GitHub backlog, choose eligible disjoint implementation or concrete gate-remediation gaps, and retain benchmark/control route constraints, retry budgets, exact reviews, and human prerequisites. Named priority items are preferences, not an exhaustive dispatch allowlist.

Gate handoff and reviewer dispatch recovery​

A candidate_needing_gates phase requires an actual serialized gate job, not repeated planner comments. Foreground recovery for #171/#172/#201 ran typecheck/lint/full suite/build/diff under runtime/product-heavy-gates.lock, binding every result to before/after HEAD and tracked binary-diff hashes, then created unchanged-source stash snapshots and detached review worktrees. Gate-only work is not an implementation writer. Gateway Terra dispatch was observed still injecting unrelated GitHub/OpenRouter/Spark credentials plus GitHub MCP despite literal model overrides; exact route alone does not prove safe environment. Reclaim and capability-hold unsafe review attempts. The proven alternative is a minimal-env exact openai-codex/gpt-5.6-terra Hermes --safe-mode --toolsets terminal,file --oneshot wrapper with isolated CWD, locked immutable snapshot, report/usage/meta receipts and completion notification. Live parent and descendant credential/route verification remains mandatory. Do not modify another profile to repair this.

Benchmark review recovery​

Do not treat a repeated completed/no-edit handoff as new implementation work. Read actual board run scope/verdicts and review only changed candidates, not already approved narrow validator fixes. Before sealing residue, inspect BOTH tracked changes and meaningful untracked files: a baseline regression test may be untracked and therefore absent from git stash create. Use a disposable alternate index, explicit source/test paths, write-tree/commit-tree and a retained review ref; leave the source index/branch/worktree untouched. Assert no live owner and stable source diff across sealing; clone locally into detached review CWDs and verify exact HEAD/tree and clean status before/after. If symlinking trusted existing node_modules for gates, exclude only that known symlink locally, not arbitrary untracked changes. Focused green tests are not sufficient source truth: check every claimed identity, evaluator meaning, authorized severity, content-bound provenance, actual workbook text, reconciliation artifacts and customer coverage-count drift. Placeholder/manual availability is distinct from automated runtime support. Run source/reporting guards alongside the new focused test; self-attesting fixture tests can pass with a fabricated fixed provenance hash. Require real exact-route usage receipts plus preserved reviewed tree, not wrapper exit or role prose alone. Only an exact Terra APPROVE can advance to Sol final verification. Publish/read back current verdicts on the matching GitHub issue and hand the same durable artifacts to the existing Sol manager for supported board reconciliation/remediation; never bypass a delegated-child Kanban guard or launch a competing planner. Keep one-off review instructions separate from permanent worker route policy.

Opus whole-backlog review grounding​

For backlog audits, capture all open GitHub issue bodies/comments with count-verified pagination, full nonarchived board inventory plus actual capability queue, open PR file sets, and worktree status into an operations evidence directory. Board list omits comments: fetch exact candidate cards before accepting eligibility. Crucially the canonical repo CWD can be an old checked-out branch even while remote main has advanced: export source from the API-verified main SHA with git show (or use an immutable main checkout), never call root worktree files current main. A 2026-09-06 Opus audit otherwise proposed reimplementing already-merged #160 ownership protections and restarting completed #179/#188 work. Parent must verify recommendations, reject unsafe stat/hash/unlink regression plans, and distinguish completed handoffs from actual missing code. Parse exhaustive issue mappings to unique IDs in code and compare against the fetched index; prose count checks can contradict themselves. Execute real gates before assigning missing-code workers. Long Opus print-mode calls should run tracked background+completion notification; a foreground timeout can terminate a still-productive audit before its final JSON exists.

Planner incident recovery and reporting​

2026-09-07 stall recovery consolidated a 51k-character contradictory historical planner.md into a compact current-authority execution contract; original retained at runtime/plans/20260907-planner-pre-stall-recovery.md. Preserve new policy/handoffs when editing, do not re-expand every historical brief into every pass. A prompt edit applies to the next invocation, not a running Sol process; contract checks alone do not prove timeout recovery. Counter planner.failures includes ok_no_improvement, not only crashes. Retired cron a03d5e8a7517 is exactly "M365 Assessor 4-lane control program manager", disabled/unclaimed is expected safety, not an actionable stall. Hourly/unified reporting prompts now distinguish this and current Sonnet/Opus/Spark policy. Completed planning can coexist with failed wrapper metadata: #201 wrapper used global --oneshot incorrectly and targeted a missing filename, while genuine Astra session20260907_143904_dd0c0c produced runtime/plans/issue201-sol-25cd6a4-evidence-remediation-astra-r1.md. Verify actual file/hash and sessions/messages provenance before discarding or duplicating. hermes chat --oneshot --query-file FILE uses boolean chat flag; global hermes --oneshot requires PROMPT. Fable can expose false dependency holds and unconsumed gate evidence; consume verified recovery outputs instead of repeatedly calling completed audits active.

Planner input discipline​

CLI status and status.json are compact projections; never dump private state.json per-file baselines into model context. python3 integration.py --config config.json queue exposes actual capability holds and dependency states read-only; generic Kanban list JSON omits fields, so absent keys are not null database values. Completed candidates awaiting review do not reserve implementation slots: schedule their durable handoff and choose other eligible disjoint work. Continue from the previous result/report instead of repeating unchanged candidate archaeology.

Safe new-card capability hold​

create --initial-status blocked leaves block_kind unset; calling block on an already-blocked card does not establish it. Create the card UNASSIGNED with an idempotency key and exact linked worktree, then supported unblock TASK, block --kind capability TASK REASON, and only then assign TASK default|opencode. Verify exact status/block_kind/no claim via integration check before controller launch. Unassigned transition prevents a gateway dispatch race. Put --kind before task/reason because this argparse CLI rejects the interspersed form.

Post-bootstrap environment boundary​

Installed Hermes imports load_hermes_dotenv at hermes_cli/main.py:781-796 before cmd_chat applies --safe-mode. env_loader.py also hydrates .op.env, project fallback, external sources and managed environment. A filtered subprocess environment plus safe mode is NOT proof of final credential/backend exclusion. HOME/HERMES_HOME/executable/installation identity must be bound, and a disposable sentinel test must exercise actual bootstrap/reload paths without reading or copying real unrelated credentials. No global loader/profile patch or weakened safe mode is an acceptable shortcut. Deployment manifests must bind candidate_manifest AND every per-file source path to the exact accepted snapshot; identical bytes under an older path do not satisfy literal manifest identity.

Repair verification and fixture boundaries​

For auxiliary launch repairs, a setsid subprocess is still inside its caller's systemd cgroup; use a real sibling transient supervisor unit and verify it with a disposable executable, not merely mocked argv. Keep process-exit receipts explicitly separate from model approval. Use real disposable Kanban CLI tests with explicit HERMES_HOME, HERMES_KANBAN_HOME, HERMES_KANBAN_DB and workspace roots; verify DB resolution before creating the fixture board, and never start its gateway. An auxiliary Sol review card uses workspace_kind=dir, so a worktree-only admission helper does not cover the observed duplicate-review incident. Exact readonly SELECT fields are required because even show --json omits block_kind/claim/current_run metadata. Preserve unassigned -> typed capability hold -> assignment order. Installed Hermes accepts global --usage-file before chat but its chat handler may not emit that file; an actual safe-mode Sol probe confirmed missing file alongside genuine session_model_usage. Recover exact session/route/model usage read-only rather than synthesize a receipt or call it zero inference. Safe-mode completion alone does not establish the native cause of a non-safe-mode SIGSEGV. Legacy tests expecting embedded handoffs/private projection or cosmetic-prompt retry resets must be checked against canonical HandoffStore/privacy/canonical-attempt contracts; reproduce failures first and strengthen assertions, never weaken runtime fences for old tests.

Real auxiliary user-systemd drills must separate the systemd-run --user client's bus transport environment from the environment enumerated into the supervised child. Replacing the client environment with a child-only allowlist can omit XDG_RUNTIME_DIR/DBUS_SESSION_BUS_ADDRESS and fail with No medium found even when the caller's user manager is healthy; this is a failed transport gate, not an unavailable-manager skip. If the drill self-acquires the existing heavy-gate lock, do not hold that same lock in the outer launcher: doing so can turn all cases into skips with exit 0, which is not acceptance. The final child may legitimately carry a private assignment-local XDG_RUNTIME_DIR; non-leak assertions must forbid the host transport value and DBUS_SESSION_BUS_ADDRESS, not contradict the required private runtime key. Also, root can report os.access(path, os.W_OK) true for mode-0444 files. Verify sealed snapshot mode bits, create-once/overwrite refusal, and—where needed—an appropriately unprivileged write attempt rather than using root os.access as the read-only assertion.

Timeout diagnosis from quiet-session evidence​

Quiet planner logs can contain only a session ID despite extensive tool activity and real side effects. Query that exact session read-only in active Hermes state.db (sessions/messages; introspect schema first), summarize tool names/timestamps/errors rather than dumping entire transcripts, and correlate user-systemd journals. A 2026-09-07 timeout involved duplicate gateway/external review dispatch, zombie kill-0 confusion, and improvised recovery wrapper failures (Popen input keyword unsupported, then bare claude missing from systemd PATH). Use tested reusable launchers, explicit executable paths, stdin PIPE/communicate, unassigned capability-hold before assignment, and checkpointed bounded work. A planner timeout does not mean no mutations. The failures counter also includes successful ok_no_improvement vacancy outcomes; report these separately. Do not identify MemPalace warnings or prior SIGSEGV as a particular timeout cause without matching evidence.

Owner release decisions and deferred product scope (2026-09-07)​

GitHub #111 records Justin owning Apple Developer ID/Windows signing, deferred until production readiness. Signing is not an implementation, unsigned native-packaging, checklist-development or pre-production testing dependency; preserve final release signing and all other security/native gates. Live board had no outgoing #111 dependency to unlink. GitHub #238 records ACCEPTED selected-driver maintenance/support and independent-cryptographic-assurance risks; no repeated owner decision, no claim of independent certification or technical acceptance. #110 is Justin's live-tenant run after benchmark/package prerequisites. #109 developed checklist is /root/Working/Operations/assessor-owner-decisions/ISSUE-109-DESKTOP-ACCEPTANCE.md and issue comment5574610845; authored procedure is not native execution. Its engineering packet still needs exact candidate artifacts/harness. Old BUILD-AND-TEST.md has stale counts/driver ABI workarounds and unsafe sandbox-disable troubleshooting: do not repeat those as current acceptance instructions. #131 TCM wanted, #212 tenant-rooted 3D children plus item unmet controls/recommendations, and #213 M365/Azure/Both project-setup wizard with consultant/customer/logo, exact inline requirements and customer accounts/permissions setup guide remain explicitly DEFERRED. Clarified scope is not reactivation. Decisions are read-back verified on GitHub and coordinator t_467fc84a.

Dedicated CIS completion ownership (2026-09-07)​

Owner explicitly requested a dedicated durable CIS manager after general Sol passes did not advance sealing. Cron efeb7660f49c is pinned openai-codex/gpt-5.6-sol, every10m, origin delivery, continuity enabled; initial immediate fire dispatched. Plan /root/Working/Operations/assessor-special-204-243/CIS-DEDICATED-MANAGER.md. General planner.md now excludes complete-CIS t_8d7267cb / t_fa84ac14 / t_ed6c5b29 mutation/seal/review/integration scope; canonical cards bind scope transfer and plan digest. This narrow owner-authorized delegation supersedes blanket sole-general-coordinator wording only for CIS. General fleet retains other disjoint work/global capacity; controller-only product launches/four-cap unchanged. Dedicated owner checks any older in-flight general pass is quiescent before mutation, resumes actual phase, and owns delivery not audit reports. First obligation is stable eleven-path alternate-index seal then exact Terra -> foreground Astra, with native Opus remediation if needed. Do not dispatch duplicates or claim schedule activation is product progress. Read current checkpoint and live cron state before operating.

#233 clean-install recovery evidence​

Owner-reopened Astra recovery independently reproduced the JourneyApps generated scoped node-addon-api manifest defect after standard clean npm ci, not only in the old installed tree. Evidence runtime/evidence/issue233-astra-clean-r1 binds an eight-path overlay, successful install, failed unchanged policy, and four focused files/266 passing tests. Generated gyp Makefiles are not a declared scoped dependency: never fabricate a manifest, remove only that directory, weaken scanning, or assume clean reinstall fixes it. Cross-driver fixture construction must remain independent. The owner-required next Fable DO-work recovery is capability-blocked until native product controller routing is implemented/tested/reviewed: current argparse/slot/argv/env/census support only sonnet/deepseek/opus. Exact execution and admission plan runtime/plans/issue233-fable-recovery-admission-r1.md was handed/read back to existing operations t_30168e43/t_9e4f230f and product coordinator, not launched or accepted. Consult current checkpoint; do not repeat identical Astra diagnostics or conflate this product recovery with C7 transport Fable work.

Native route disposable admission evidence​

A native route can be gate-tested independently of the auxiliary C8 launcher: use the immutable route snapshot, explicit isolated HERMES_HOME/KANBAN_HOME/KANBAN_DB/workspace roots, assert installed kanban_db_path resolution before CLI init, and a disposable linked Git worktree. Create unassigned initially blocked, unblock, apply typed capability hold, then assign; a newly created ready card cannot be unblocked. Read exact claim/current_run fields from the isolated DB. A real sibling-systemd Python sleeper with explicit Claude/Fable argv can test census/adopt, duplicate rejection, reconstruction, content checkpoint, exit and canonical handoff preservation, but is NOT real model inference, Controller.launch acceptance or child confinement. Controller.status() is private state; public_status()/handoff_store expose canonical handoff count. Preserve failed harness receipts separately from product-attempt lineage. Working harness and PASS receipt: /root/Working/Operations/assessor-fable-route-immediate/receipts/cron-20260908T0313Z/. Direct native Controller.worker exec is not automatically dependent on auxiliary_launcher/install_binding; assess native security requirements specifically.

Exhaustive GitHub/Kanban status reconciliation​

For an inventory audit, fetch all GitHub issue pages with state=all, separate PRs in code, and compare open issues plus open PRs to repo.open_issues_count. Collect every comment page for all open issues plus closed issues carrying actionable labels, verifying each issue's declared comment count. The repo's in-progress label means verified live implementation ownership; ready means immediately claimable, so a completed/gated/reviewed handoff is not ready for another writer. Do not erase a closed issue's needs-verification label when a merged PR explicitly preserves unexecuted native acceptance. Use per-label DELETE/POST rather than replacing whole label sets, with exact fresh issue/card reads before and issue readback after; preserve body/state/type/priority and skip concurrent changes. Delegated Kanban CLI list can fail with the same mutation guard as writes. Respect it: read SQLite with explicit mode=ro and snapshot tasks/comments/events/runs/links in one read transaction; never bypass the guard. Supply exact supported parent-only mutations that preserve claims/assignment and cannot auto-dispatch; an obsolete unassigned ready duplicate can be proposed for block --kind capability, not complete/unblock. Historical done review cards may contain REQUEST CHANGES, and pending Terra prerequisites are superseded by current SOL policy, not new gates. Save individual issue/card audit rows plus raw batches, exact URLs/IDs, assertions and mutation receipts. Partial overlap, parent-child decomposition, local approval, and absent legacy data are not full supersession proof. If ordinary terminal returns empty stdout even for printf, a bounded direct execute_code Python/subprocess probe may provide real execution; do not manufacture output or alter runtime configuration. GitHub Checks API can return403 despite working issues/PR/Actions access: inspect exact-head Actions runs as an alternative and disclose unavailable check-suite/branch-protection evidence; an empty commit-status response showing pending is not failed CI. Canonical delivery records.json may be DDSJ1 framed journal, not plain JSON/JSONL; use supported controller status projection rather than declaring corruption.

Native boundary implementation diagnostics (not deployment approval)​

The isolated native-boundary r1 at /root/Working/Operations/assessor-native-fable-boundary-implementation-r1 demonstrated additional pitfalls with installed Claude 2.1.259: safe-mode alone still hydrated a dummy project settings env into the Bedrock provider; the documented --setting-sources '' retained firstParty/no-auth instead. Test actual bootstrap, not just incoming env. A bwrap PID-namespace guardian retains the registered host PID while the literal model is below a reaper; census must prove ancestry, cgroup, namespace separation and CWD before folding that family, while retaining strangers and drift as unsafe. Sharing the TCP/IP namespace also shares abstract Unix sockets: filesystem hiding alone cannot deny host buses. A mandatory inherited AF_UNIX/socketpair seccomp restriction needs io_uring denial and inherited-FD closure too; actual io_uring setup was initially allowed on this host. These are diagnostic facts, not independent acceptance of the new candidate. The candidate passed offline and dummy held-board/systemd gates, but a linked worktree's external Git common-dir was deliberately not mounted: actual git status exited128. Do not broaden mounts to shared credentials/config or claim product readiness; require a source-bound authorization/projection design, real model file/test/usage, and direct SOL review. Keep native test iterations separate from auxiliary K4D-01 and product attempt lineage.

Pitfalls​

Cron script paths must be relative under active ~/.hermes/scripts/; use wrapper hooks, not absolute operations paths. CLI cron edit can exit0 with failure text: read back target. --ignore-user-config still honors installation cli-config.yaml; adapter rejects that file pending fallback audit. Planner request must match durable pending ID/timestamp and lack existing result before spawning. Inherited env allowlists are not filesystem credential sandboxing. Other profiles remain untouched.

Source: jknash/hermes-shared-skills · branch hermes-jkdev001 @ 1d0d545c3970 · skills/assessor-lane-controller/ · view source · Imported 2026-10-04. Supporting files (references, scripts) remain in the source repository.

Label: Host operating record — this page documents the installed lane controller on host jkdev001. It is that host's operating record, not a general fleet skill; the reusable delivery contract is Durable Fleet Delivery.

Published by Muse · 2026-10-04.