+ jHjOa0t$Rt^RIHt^RIt^RIt^RIt^RIHt^RI H t ^RI H t ]P!]4tRtRtRtR tR tR tR R ltRRlt]!RR7!RR44tRRltRRltRRltRRltRRltRtRsR] R &R!R"lt!R#R$lt"R%R&/R'R(llt#R%R&/R)R*llt$R+R,R-R/R.R/llt%]!RR7!R0R144t&R2R3lt'R4R5lt(R6R7lt)R8R9lt*R:R;lt+R<R=lt,R>R?/R@RAllt-R#)Buv Is there ONE live host gateway, and does it already serve this profile? Multiplex-only (Teknium ruling): exactly one MULTIPLEXING ``hermes gateway run`` per host, serving every profile; standalone per-profile gateways coexist until that migration is forced (#109417). The lifecycle verbs therefore answer a different question than they used to — not "does THIS home hold a ``gateway.pid``?" but "is the host process live, and is this profile in its served set?" — and when it is not, they ask that process to serve the profile instead of starting a second one. Five outcomes, in order: * ``ATTACH`` — a live host gateway already serves this profile. Nothing to start; exit 0. * ``RESCAN``→ATTACH — it does not serve it yet: ask it to reconcile ``profiles/`` now (control socket ``rescan-profiles``) and attach once the answer includes us. * ``REPLACE_HOST`` — ``--replace`` targets the host process when it serves this profile, whichever home launched it. An owner that has not published its served set yet is targeted too, but the ownership guard (``run._replace_target_belongs_to_other_profile``) can then only prove it from THIS home's pid record, so from another home the replace is refused (exit 1). * ``REFUSE`` — a live MULTIPLEXING gateway exists and cannot be made to serve this profile. Never start a second one silently. * ``START`` — no live owner, or the owner answers ``multiplex: False``: it is another profile's standalone gateway (the documented one-process-per-profile topology), not a multiplexer that excluded us, so this profile runs its own gateway beside it as it always did. **The attach channel is the OWNER's control socket, never ours.** Ordering matters: the owner publishes its rendezvous record when it claims its PID file and binds its control socket a moment later (``gateway/run.py``: claim → socket), so for a short window the record exists and the channel does not. A reader that took "no socket" for "no owner" would start exactly the second gateway this module prevents — but a reader that took the RECORD's word for the served set is worse: the claim-time record is published before the process knows what it will serve, so a supervised unit for a profile nobody serves would stand down forever. Hence the split: * the record proves an OWNER exists (PID + createTime), and that alone never yields ATTACH; * the served set comes ONLY from a live ``identify`` answer, waited for a bounded :data:`ATTACH_CHANNEL_WAIT_S`; * owner present + served set unknown is a TRANSIENT verdict — do not start, do not park. Nothing here depends on the *calling* process having started anything. ) annotationsN) dataclass)Path)Optionalg@g?startattachrefusez replace-hostc V^8dQhRRRR/#)namestrreturn)formats"8/home/ubuntu/.hermes/hermes-agent/gateway/host_attach.py __annotate__r<s33S3S3c^RIHpT!T;'gR4# \d,T;'gRP4P 4u#i;i))normalize_profile_namedefault)hermes_cli.profilesr Exceptionstriplower)r rs& r _normalizer<sL3>%d&7&7i88 3!! ((*00223sAAAc V^8dQhRRRR/#)r home Path | strr r r)rs"rrrEs;; ;s;rcD^RIHpV!\V44;'gR#)zQProfile a home belongs to; the root/default home is ``'default'`` (not ``None``).)_profile_name_for_homer)gateway.statusr r)rr s& rprofile_name_for_homer"Es5 !$t* - : ::rT)frozenc]tRt^Lt$RtR]R&R]R&R]R&RtR ]R &R tR ]R &R Rlt] RRl4t RRlt Rt R#) HostGatewayzQThe one live host gateway: who it is, where it was launched from, what it serves.intpidrrtuple[str, ...]profilesTbool served_knownF standalonec V^8dQhRRRR/#)r profiler r r*r)rs"rrHostGateway.__annotate__ZsCCcCdCrc aVP'gR#\V4o\;QJd)V3RlVP4F 'gK R# R#!V3RlVP44#)Fc3@<"TFp\V4S8HxK R#5iN)r).0pwanteds& r %HostGateway.serves..^sBMq:a=F*MsT)r+ranyr))selfr.r5s&&@rservesHostGateway.servesZsM   G$sBDMMBssBsBsBDMMBBBrcV^8dQhRR/#r r r r)rs"rrr/as00s0rc ,\VP4#r2)r"r)r9s&r profile_labelHostGateway.profile_label`s$TYY//rcV^8dQhRR/#r=r)rs"rrr/ds``#`rc VP'gRpM/VP'dRPVP4MRpRVP RVP RV R2#)z7not published yet (its control socket has not answered)z, nothingzPID z (launched by profile 'z '; serves: ))r+r)joinr'r?)r9serveds& rdescribeHostGateway.describedsY   NF15TYYt}}-IFdhhZ6t7I7I6J+V\U]]^__rrN) __name__ __module__ __qualname____firstlineno____doc____annotations__r+r,r:propertyr?rG__static_attributes__rrrr%r%LsS[ H JL$JC 00``rr%cV^8dQhRR/#)r r rr)rs"rrrlsaa4arc~^RIHp\VRR4'd\VP4#\V!44#)uHome the owner was launched from. Records written before the field existed fall back to the default root — the home every pre-record multiplexer ran under.get_default_hermes_rootr)hermes_constantsrTgetattrrr)recordrTs& r record_homerYls29 ' ; ;4 `F]F_A``rc$V^8dQhRRRRRR/#)r owner_homerour_homer r*r)rs"rrrts&IIIzIdIrc\T;'gR4'gR#^RIHp^RIHpV!V!VR7V!VR74'*#)aWas the owner launched from ANOTHER Hermes root (a second tenant on this host)? The host record and lock are per OS user, and two tenants (separate ``HERMES_HOME`` roots) each expose a profile named ``default``: tenant A's multiplexer "serving default" is a name collision for tenant B, never coverage, so it is not this tenant's host gateway (#121352). A legacy record with no ``home`` proves nothing and counts as ours. rUF_same_hermes_homerS)r)r r!r_rVrT)r[r\r_rTs&& rlaunched_by_other_tenantr`tsE zR 08 !8j!I!8h!GI IIrc V^8dQhRRRR/#)r rrr zOptional[dict]r)rs"rrrsD^rct^RIHpV!V4# \d\P RTRR7R#i;i)r)identify_gatewayz#host gateway identify failed for %sTexc_infoN)gateway.control_socketrcrloggerdebug)rrcs& r _identifyris:;%%  :D4 Ps #77c V^8dQhRRRR/#)r identitydictr r(r)rs"rrrs88D8_8rcVPR4p\V\4'dV'd.pVFp\V\4'dZVPR4;'gVPR4pTP V'd\ \ V44MR4KrVP \ V44K \V4#\ VPR4;'gR43#)aServed set from a live ``identify``. A STANDALONE gateway publishes no ``served_profiles``; it serves its own profile and nothing else, which is not the same as "unknown". The unified runtime publishes each served profile as ``{"profile_id", "home"}`` (what ``hermes_cli.gateway_runtime`` matches homes against); older gateways published bare names. Both spell the same roster, so a dict entry is reduced to its profile name here.served_profilesr profile_idrr.)get isinstancelistrlappendr"r tuple)rkrFnamesentryrs& r_served_from_identityrws\\+ ,F&$FE%&&yy(CCEIIl,C 23t9=9U SZ(  U|  Y'449 5 77rc V^8dQhRRRR/#)r rrr r*r)rs"rrrs**d*t*rc N\V\4'd!VPR4VP8wdR#VPR4pV'gR#^RIHp\ V!\\V44V44# \d\T4\T48Hu#i;i)zIs this ``identify`` answer really the record's owner? PID alone is not enough: a record naming an arbitrary home makes us dial whatever listens there, so the answer must also agree about the home it was launched from. r'F hermes_homeTr^) rqrlrpr'r!r_r*rr r)rkrXrreportedr_s&&& r_identity_matchesr|s h % %e)< )J||M*H *4%d3x=&94@AA *8}D ))*s)A??"B$#B$g@z-Optional[tuple[float, Optional[HostGateway]]] _cached_probecV^8dQhRR/#)r r Noner)rs"rrrstrc RsR#)zPForget the memoized probe (called by ``host_rendezvous`` on every record write).N)r}rrrinvalidate_host_gateway_cachers Mrc V^8dQhRRRR/#r wait_for_channelfloatr Optional[HostGateway]r)rs"rrrsAA%A4IArc^RIHpVPVP4pVfR#VP V4'gR#\ V4p\ P!4\RV4,p\V4p\WRV4'd!\VPV\V44#\ P!4V8dM\ P!\4Ku\VPVRRR7#)r)host_rendezvousNFr+r)gatewayr read_record ROLE_GATEWAYrecord_names_live_ownerrYtime monotonicmaxrir|r%r'rwsleep_CHANNEL_POLL_S)rhrrXrdeadlinerks& r_probe_host_gatewayrs- ^^BOO ,F ~  % %f - - v D~~#c+;"<> x '  ?# vzz4% @@rrrc V^8dQhRRRR/#rr)rs"rrrs  e 6K rc\P!4pV^8:d3\e+V\^,, \8d\^,#\ V4p\P!4V3sV#)uThe one live host gateway, or ``None``. The served set comes from the owner's control socket and nowhere else; a record with no live answer behind it yields ``served_known=False`` — an owner whose served set nobody knows yet. )rrr}HOST_GATEWAY_CACHE_TTL_Sr)rnowresults$ r host_gatewayrs\ .. C1!:s]STEU?UXp?pQ !1 2F^^%v.M Mrc$V^8dQhRRRRRR/#)r r.r rrr rr)rs"rrrs'PP#PEPLaPrcX\VR7pVeVPV4'dV#R#)uUThe host gateway when it is live AND serves ``profile`` — true for ``default`` too.rN)rr:)r.rrs&$ rhost_gateway_servingrs+,<=G)gnnW.E.E7O4Ortimeoutg @ownerc(V^8dQhRRRRRRRR/#)r r.r rrrrr r)rs"rrrs0TT3TET!6TBWTrcVeTM\\R7pVeVPV4'dV#^RIHpV!VP VR7p\T\4'gR#TPR4p\TPTP \T\4'd-\;QJd.R T4FNK 5M!R T44MR TPR 4R JR 7pTP 'gTPT4'dT#R# \ d\PRRR7R#i;i)upAsk the live host gateway to reconcile ``profiles/`` now; return it once it serves ``profile``. ``None`` when nobody answered or a multiplexer's roster still excludes the profile. An owner that answers ``multiplex: False`` comes back flagged ``standalone``: it cannot take the profile, and it is not a multiplexer that refused — the caller runs beside it, as before.Nr)rescan_gateway_profiles)rzhost gateway rescan failedTrdrnc38"TFp\V4xK R#5ir2)r )r3r4s& rr6(request_serve_profile..s %fc!fffs multiplexFr,r)rATTACH_CHANNEL_WAIT_Sr:rfrrrrgrhrqrlrpr%r'rrrtr,)r.rrrranswerrF rescanneds&$$ rrequest_serve_profilers (elLa.bG'..11B(wG fd # # ZZ) *F W\\)3FD)A)A %f % %f %%r::k*e35I",,, 0@0@0I0I9StS  1D AsD"EEcH]tRtRt$R]R&R]R&RtR]R&RtR ]R &R tR#) HostAttachDecisioni r outcomemessageNrrFr* transientr)rIrJrKrLrNrrrPrrrrr s# L L#'E 'Itrrc$V^8dQhRRRRRR/#r rr%r.r r r)rs"rrrs&AAKA#A#ArcJRV RVP4 RVP R2#)u-✓ The host gateway already serves profile 'u' — nothing to start. zH One gateway per host serves every profile; manage it with `hermes -p z gateway restart`.)rGr?rr.s&&rattach_messagers> 7yA     !++,,> @Arc$V^8dQhRRRRRR/#rr)rs"rrrs!99[93939rc0RVP4 RV R2#)uR⏳ A gateway already owns this host and has not published its served set yet. z# Whether it will serve profile 'a<' is unknown, so starting a second gateway now could double-bind this profile's platforms. Nothing was started; this is a transient state and a service supervisor will retry. Take the host over (only from the home that launched it): hermes gateway run --replace Start anyway: hermes gateway run --force)rGrs&&r_unknown_served_messagers/  !"--4I67 89rc$V^8dQhRRRRRR/#rr)rs"rrr)s& p p[ p3 p3 prcB^RIHpRV RVP4 RV R2#)rMIGRATE_COMMANDuA❌ A gateway already owns this host and will not serve profile 'z'. z Exactly one gateway per host serves every profile, so starting a second one would double-bind this profile's platforms. Fold this profile into it: z Or start one anyway: hermes gateway run --force (--replace only replaces an owner that serves this profile, so it would not take this one over.))hermes_cli.gateway_migraterrG)rr.rs&& r_refuse_messager)sC: LG9U !"+,;*;R>RT>Rt>R8J>Rrc\V4p\4pTeATP\P!48Xg\TPT4'd%\TR4;'g\ \ R4#T'd;TPT4'gTP'g\ \RT4#TP'd\Y4pTeT#TPT4'd\ \ \#Y24TRR7#TP'gk\\$R7pTf\ \ R4#Tp\Y4pTeT#TPT4'd\ \ \#Y24TRR7#\'Y#R7pTe4TPT4'd\ \ \#Yb4TRR7#TeNTP('d<^R IHp\P/R TP14Y'4\ \ R4#TP'g\ \2\5Y24TRR7#\ \2\7Y24T4# \d+\P RRR7\ \ R4u#i;i \d\P R RR7RpEL/i;i) zAttach, rescan-then-attach, replace or refuse; configured standalone profiles may coexist. Never raises: a broken probe degrades to ``START``, i.e. exactly the pre-rendezvous behaviour. z-host gateway probe failed; starting as beforeTrdrUNrr)rz"host gateway rescan request failedrzAnother profile's standalone gateway owns this host (%s); starting profile '%s' beside it. Fold every profile onto one gateway with: %s)r"rrrgrhrrr'rrr`rrr:r+ REPLACE_HOSTATTACHrrrr,rrrrGrrr)r\rr.rr,waitedattachedrs&$ rdeciderjs_ $H-G-.'++48PQXQ]Q]_g8h8h)(D9ZZ=OPUWY=ZZGNN7++73G3G3G ",G<</B  ! ~~g!&.*JG_cdd    /DE >%eR0 0/B  !  >>' " "%fnW.NPWcgh h(@ 8 8!&.*KXaeff 3 3 3 ?  ;     ;"%,,    " +G=wRVX X fog&G QQm - Dt T!%,,->  9D Is# I0 J(02J%$J%($KK).__conditional_annotations__rM __future__rloggingrr dataclassesrpathlibrtypingr getLoggerrIrgrrrrrrrr"r%rYr`rirwr|rr}rNrrrrrrrrrrrrr)rs@rrs<$L# !   8 $   3; $```>aI"8(*,?C <C A2 c PCP TCT9=T4 $A9 pG40&>Re>R>Rr