+ iHj2 a0t$Rt^RIHt^RIt^RIHt^RIHtH t ^RI H t H t H t Ht]!RRR7tR ]R &]!R RR7tR ]R &R tR.tR]R&]R/RRll4tRRltRRltRRlt]RRl4tRRltRRltRRltR R!ltR"R#ltR$R%ltR&R'lt]R(R)l4t ]R/R*R+ll4t R/R,R-llt R#)0aaContext-local state for delegate_task child execution. A Hermes process may itself be a Kanban dispatcher worker with HERMES_KANBAN_* in os.environ. In-process delegate_task children and cron jobs fired via ``cronjob(action="run")`` are NOT dispatcher-owned, so identity gates must fail closed for them without mutating the process-global environment. ) annotationsN)contextmanager) ContextVarToken)IteratorMappingMutableMappingoverloadhermes_delegated_child_contextF)defaultzContextVar[bool]_DELEGATED_CHILD_CONTEXT#hermes_non_dispatcher_owned_context_NON_DISPATCHER_OWNED_CONTEXTHERMES_DELEGATED_CHILD_CONTEXTztuple[str, ...]KANBAN_ENV_KEYSc V^8dQhRRRR/#) session_idz str | NonereturnIterator[None])formats"=/home/ubuntu/.hermes/hermes-agent/agent/delegation_context.py __annotate__rs . . .n .c#"\PR4p^RIHpV!V4;_uu_4RxRRR4\P V4R# +'giL';i \P T4i;i5i)zMark child execution and isolate its task-local session identity. Even a context entered without an id must restore the parent's session ContextVar (child construction calls ``set_current_session_id``).T)scoped_current_session_idN)r setgateway.session_contextrreset)rtokenrs& rdelegated_child_contextr!s[ % ( ( .E.E &z 2 2 3 !&&u-3 2 !&&u-s1BA&AA&B A# A&&A==BcV^8dQhRR/#rrboolr)rs"rrr+s00D0rc<\\P44#)zrrrr6r6ks2 (,,. / c c4 Ga8b3ccrcV^8dQhRR/#rBr)rs"rrrpsSrcT^RIHp\V!44# \dR#i;i)zThe board root this process's Kanban lineage lives under (``kanban_home()``); ``"1"`` when it cannot be resolved, which readers treat as "fence every board" (the pre-path marker). kanban_home1)hermes_cli.kanban_dbrKrC ExceptionrJs r_fenced_kanban_rootrOps)4;=!! s  ''c V^8dQhRRRR/#)renvz,Mapping[str, str] | MutableMapping[str, str]rdict[str, str]r)rs"rrrzsF>rcVP4UUu/uFwrV\9gKWbK ppp\VP\4;'gR4pV'd VR8wdTM \ 4V\&V#uuppi)aRemove worker identity, retaining board/location and an inherited write fence. TASK absence alone would promote a descendant to an orchestrator. The marker survives later execs, including scripts that remove TASK themselves. This is cooperative runtime scoping, not confinement of code with direct SQLite access. The marker's value is the fenced board ROOT, so the fence applies to the lineage's board and not to every Kanban DB the descendant touches: a child running a repro against a temp ``HERMES_HOME`` got a silently read-only board there. An inherited path-valued marker is kept (a grandchild that moved HERMES_HOME must not re-fence onto its scratch root and unfence the real one). r;rL)itemsrrCr&r>rO)rQkvcleaned inheriteds& rscrub_kanban_envrYzsm!$ H q/Gtqt GHCGG67==2>I7@YRUEU)[n[pG &' NIs A=A=c V^8dQhRRRR/#)rpathzos.PathLike[str] | strrr$r)rs"rrrs 64rcL\P4'dR#\PP\R4pV'gR#VR8XdR#^RIHpV!V4P4P4p\PPRR4P4pV'd+W2!V4P4P48XdR#VPV!V4P4P44R# \dR#i;i)aZWhether Kanban mutations at *path* (a board DB or board-metadata root) are denied for this process: always for an in-process delegate child (the parent's own board); for a spawned descendant only when *path* is the dispatcher-pinned ``HERMES_KANBAN_DB`` or lies under the fenced root the marker carries. A legacy ``"1"`` marker fences everything.Tr;FrL)PathHERMES_KANBAN_DB) r r&r<r=r>pathlibr] expanduserresolver? relative_to ValueError)r[markerr]targetpinneds& rkanban_path_is_fencedrgs  ##%% ZZ^^6 ;F  } $Z " " $ , , .F ZZ^^. 3 9 9 ;F &DL335==??4<224<<>?  s3D D#"D#c V^8dQhRRRR/#)rrQzMapping[str, str]rrRr)rs"rrrsQQ(9QnQrcR#NrrQs&rdelegated_child_subprocess_envrlsNQrc V^8dQhRRRR/#)rrQr-rdict[str, str] | Noner)rs"rrrsRRR8MRrcR#rjrrks&rrlrlsORrc V^8dQhRRRR/#)rrQz3Mapping[str, str] | MutableMapping[str, str] | Nonerrnr)rs"rrrs @ @ < @ @rcH\4'gq\PPR4'gLV'd3VPR4'g-VP\4'gVfR#\ V4#\ Vf\P4#T4#)zCarry worker/delegate descendant denial across a real process spawn. Location and credentials are untouched; callers retain their existing secret policy. Dispatcher workers and supervised tool transports grant their own explicit scope. r:N)r6r<r=r&r>dictrYrks&rrlrlso / 0 0BJJNNCW4X4X!566#''B\:]:]{t1S 1 #+BJJ ??3 ??r)r:HERMES_KANBAN_RUN_IDHERMES_KANBAN_CLAIM_LOCKHERMES_KANBAN_GOAL_MODEHERMES_KANBAN_GOAL_MAX_TURNSrj)!__conditional_annotations____doc__ __future__rr< contextlibr contextvarsrrtypingrrrr r __annotations__rr>rr!r'r+r0r3r7r@rEr6rOrYrgrl)rws@rr~s# %)>>-78Xbg-h*h3==blq2r/r=$  . .0 3 /  1 1] F(@d &0 Q Q R R @ @r