+ jHjRt^RIHt^RIt^RIt^RIt^RIHt^RIH t ^RI H t H t H t ^RIHt^RIHt]P$!]4tRtRtR tR R ltR R ltRRlt!RR4tRRltRtRtRRltRRlt Rt!Rt"Rt#R#)a)Hot-serve for ``gateway.multiplex_profiles``: keep the served-profile set in step with ``profiles/`` while the multiplexer runs, instead of snapshotting it once at boot. Three things were start-time snapshots: the secondary adapter set (``_start_secondary_profile_adapters``), the ``served_profiles`` record in ``gateway_state.json`` (``_record_served_profiles``) and the cron ticker's ``profile_homes`` list. Everything else (``/p//`` prefixes, profile-route eligibility, handoff/kanban watchers, shared ingress) already reads ``profiles_to_serve()`` / ``_profile_adapters`` live, so reconciling those three is enough for a profile created after boot to be served. ``reconcile_served_profiles`` runs on the loop under one lock, triggered by the ``rescan-profiles`` control verb (``hermes_cli/profiles.py`` create/delete fire it through the control socket) and by the supervised ``_profile_reconcile_watcher`` every ``_PROFILE_RESCAN_INTERVAL_SECS`` as the safety net. A served profile whose ``config.yaml``/``.env`` changed since its adapters were last built is re-scanned too: creators make the profile first and add the bot token afterwards, and without this an adapter-less profile would stay adapter-less forever. The same watcher tick (on every gateway, multiplexed or not) re-syncs a home's shell hooks when its ``shell-hooks-allowlist.json`` (or ``config.yaml``) changed: a non-TTY gateway skips unconsented hooks, so consent recorded afterwards must register them without a restart (#132993). That re-runs hook registration only, never an adapter rebuild. ) annotationsN)partial)Path)AnyDictOptional)_log_suppressed)file_signatureg>@@c V^8dQhRRRR/#)pathrreturnzOptional[tuple])formats"B/home/ubuntu/.hermes/hermes-agent/gateway/run_profile_reconcile.py __annotate__r+s$?cf\\P!V44# \dR#i;iN)r osstatOSError)r s&r_stat_signaturer+s,bggdm,, s ! 00c V^8dQhRRRR/#)r homerrtupler)rs"rrr2s  $ 5 rc.p\FDp\P!\V4V, 4pVP \ V44KF \V4# \ dTP R4Kri;i)zYCheap change detector for a served profile's credentials/config: file signature per file.N)_PROFILE_SIGNATURE_FILESrrrappendr rr)rsignamests& rprofile_serve_signaturer#2sg C( dd*+B JJ~b) *) :  JJt  sAAA<;A<c V^8dQhRRRR/#)r launchrr Optional[str]r)rs"rrr>s((4(M(rcL^RIHp^RIHpHpV!V4'dV#V!4#)zWhy a single-profile boot must not start multiplexing now that a second profile exists: the ``gateway.auto_multiplex_migration: false`` opt-out on the default profile, else boot's preflight.)auto_migration_opted_out)AUTO_MIGRATION_OPTED_OUT_REASONimplicit_multiplex_blocker)!hermes_cli.gateway_migrate_guardsr(!hermes_cli.gateway_multiplex_moder)r*)r%r(r)r*s& r_added_profile_blockerr->s%Km''.. % ''rc:]tRt^Ht$RtRtR]R&RtR]R&RtR]R&Rt R ]R &Rt R ]R &Rt R ]R &Rt R]R&RRlt RRltRRlt]3RRlltRRltRRltRR/RRlltR RR!R/R"ltR#R$ltR%R&ltR'R(ltR)R*ltR+R,ltR-R.ltR/tR#)0GatewayProfileReconcileMixinzbRuntime reconciliation of the multiplexed served-profile set (hot add / unroute / credential-add).NzOptional[dict[str, Path]]_served_profile_homeszOptional[dict[str, tuple]]_served_profile_signatureszOptional[asyncio.Lock]_profile_reconcile_lockzOptional[set[str]]_profile_own_gateway_warned_profile_probe_timeout_warnedz$Optional[dict[str, Optional[tuple]]]_hook_consent_signaturesr&_single_profile_blocker_loggedcV^8dQhRR/#)r rz asyncio.Lockr)rs"rr)GatewayProfileReconcileMixin.__annotate__Us,,,rc jVPf\P!4VnVP#r)r2asyncioLock)selfs&r_reconcile_lock,GatewayProfileReconcileMixin._reconcile_lockUs(  ' ' /+2<<>D (+++rcV^8dQhRR/#r rlistr)rs"rrr8Zslldlrc aVP;'g/p\VRR4;'gRoSV9g V'gS.M.\V3RlV44,#)zUProfiles this multiplexer currently serves (active first), from the live bookkeeping._primary_profile_nameNdefaultc38<"TFqS8wgK VxK R#5irr).0nactives& r DGatewayProfileReconcileMixin.served_profile_names..^sJkV[QRdj_j11V[s )r0getattrsorted)r<homesrHs& @rserved_profile_names1GatewayProfileReconcileMixin.served_profile_namesZsP**00b6=JJ"eO5bFJkV[JkDkkkrcV^8dQhRR/#r rNoner)rs"rrr8`sLLdLrc lVUUu/uFwr#\V4\V4bK pppW@n\VP\ 4'd VPM/pVP 4UUu/uF)wr#Y%PV4;'g \V4bK+ uppVnR#uuppiuuppi)zYCalled by ``_record_served_profiles``: remember the served set and each home's signature.N) strrr0 isinstancer1dictitemsgetr#)r< profile_homesr!rrMsigss&& r_note_served_profiles2GatewayProfileReconcileMixin._note_served_profiles`s9FG:4TDJ&G%*"2.s0%QYY[[%sc3H<"TFp\SV, 4xK R#5ir)r)rFr!rs& rrIrseAdt 44Ads" config.yamlNz5shell-hook re-sync failed for %s; retrying next cycleTrdr)agent.shell_hooksr~r gateway.runrrgateway.run_turnrrrXrTrri_standalone_launch_scopermrnro) r<rMr|r~rrrrcurrentr loadscopers &&& @rrx9GatewayProfileReconcileMixin._resync_changed_hook_consents  KL50%0D%eBTVcAde%%eBTVcAdeeCxxD 2&#-%(D "/ 1EFD595G5G5I5I+D1*CCE  U$T* "%CI 1 U VX\gkl s0 D C; D; D D D#D65D6rcrequestc V^8dQhRRRR/#)r rcrTrzdict[str, Any]r)rs"rrr8s"F[F[F[^F[rc z"^RIHp^RIHpR.R.R.R.RV/pVP 4'g7VP 4GRjxL 'g/VCR R R VP 4/C#VP'dVPf/VCR R R VP 4/C#VP4;_uu_4GRjxL \VRR4;'gRpV!R R7UUu/uFwrg\V4\V4bK ppp\V4p \VP;'g/4p ^RIHp \4p \4p VP";'g \4pVP$;'g \4p\'V4FpWe8XgWj9dK\(P*!VP-WV,4\.R7GRjxL pTfKRT P3T4Yn9d\4P9RT4YK WnWnVP:;'g/p^RIHpVPA4Uu.uFpVV 9gK VNK upF pV!W4K VPA4pVR8HpVUu.uF(pVV 9gK VV8wgKV'g VV9gK&VNK* ppV Uu.uFpVV9gK VV8wgKVNK ppVUu.uFHpVV 9gK VV8wgKVV9gK\CVV,4VPEV48wgKFVNKJ ppVPG4UUu/uFwppVV 9g VV8XgKVVbK pppVPIVVVVWVR7GRjxL uuRRR4GRjxL #ELXELuuppiEL \0dHT P3T4Yo9d\4P6M\4P8pT!RT4YEKki;iuupiuupiuupiuupiuuppiLL +GRjxL 'giR#;i5i)a Diff ``profiles/`` (what exists now) against the served set (the process reservation): reserve + build the runtime and start adapters for new profiles, tear down, unroute and unreserve deleted ones, (re)build adapters for served profiles whose config/.env changed. Other profiles' adapters are never touched. A new profile whose home another gateway owns or whose store is unusable is parked (logged, not served) and left for an explicit rescan. Returns ``{"added", "removed", "rescanned", "parked", "served_profiles"}``.MultiplexConfigErrorprofiles_to_serveaddedremoved rescannedparkedrcN multiplexFserved_profilespendingTrCrDr)live_gateway_pid_for_hometimeoutzS[MULTIPLEX] Own-gateway probe for profile '%s' timed out; not serving it this cyclezc[MULTIPLEX] Profile '%s' still runs its own gateway; stop it before the host can serve this profile)unpark_profilecontrol-socket)rcliveresult)%rrhermes_cli.profilesrrirjrNrfr0r=rKrTrsetrVgateway.statusrr3r4rAr:wait_for_run_housekeeping_in_executor_OWN_GATEWAY_PROBE_TIMEOUT_SECS TimeoutErroraddrndebugror1gateway.run_runtimer_parked_profile_namesr#rXrW_apply_profile_changes)r<rcrrrrHr!rrlistedknownrblocked timed_outwarnedtimeout_warnedpidlogrZrrGr retry_parkedrrchangedryrs&$ rrk6GatewayProfileReconcileMixin.reconcile_served_profiless 59")2y"k2xY[]egm!n!!##$2S2S2U,U,Uafak52CTE^E^E`a a}}} : : B^f^i/@$B[B[B]^ ^'')))T#:DANNYF>F!??HH35NT >T]  ' 0 0::;T[_V`a ?!AAC?KK%)(XY]_ 9#:07 ,1: .2288bD :$($>$>$@T$@qAVO$@Tt*U//1F!%55L $m1Q1;QL\]ek\kQQEm"'I%Q1D=qQ&[qq%GI"&L$Q!u*qfqRWq247;txx{Jq$GL(, R 1U a6ktq!t GR44SY5[[m*)) -V *^&A$ MM$'*.*@&,,fnnC459;  (U nILR[m*)))s`AP;N P;)P;9AP;;N<P;?$P# N" APP;'P#5N+N( N+P#AP5P PP$+P PP&P.P7P=P P P P  P& P4P=P#P.P4P P !P (PPP P;PP;P;"P(N++A O= 8P<O= =PP;P8 $P'% P8 0P8 2 P;rrc p "^RIHp^RIHp Hp ^RIHp \VRR4;'gRp \T;'g R.R.R .R .R V/4pVPR .4VeTM \V4p\VP;'g/4p VP;'g/pV'g'V'gV'g/VCR VP4/C#VF;pVPWV,4GRjxL VR,PV4K= \V4FmpVP!WV,4GRjxL pVe5VP#V4V !WV4VR ,PV4K[V !W4Wo,W&Ko VP%V 4p\'4p\'4pW$,Fp\)W,4pVP+WV,V4GRjxL pVW&Y9d3\,P9RTTT4TR,PT4Kr\,P9RTT4TR ,PT4K V'dVUu.uF qV9gK VNK ppWn V !RR7UUu0uFwpp\3V4kK pppVUu.uFpVV9gK VV 8wgKVNK upF]pVPWP1V44GRjxL VR,PV4VUu.uFpVV8wgK VNK ppK_ VP;V \VP=444VFvp\?VP\4'dVPP1VR4\VRR4p\?V\4'gKdVP1VR4Kx V'dI^RIH pV!V4GRjxL TPCVUu.uFpVVV,3NK up4GRjxL VP4VR &V#ELKELELV Tdp\,P/R TT4TP1T4pTPTT4GRjxL T !Y\3T44TR ,PT4TP5T4Rp?EKRp?i\6d0\,P/RTRR7^pTP5T4ELi;iuupiuuppiuupiEL*uupiEL9uupiEL5i)zApply a selected diff under the reconcile lock, shared by the watcher and the serve/unserve control verbs. New profiles first get a runtime (reservation + store); one whose home another gateway owns or whose store is unusable is parked, not served.r) park_profilerrrCNrDrrrrrcr'[MULTIPLEX] Profile '%s' not served: %sz5[MULTIPLEX] Failed to start adapters for profile '%s'TrdzB[MULTIPLEX] Now serving profile '%s' (%s adapter(s) connected; %s)zV[MULTIPLEX] Re-scanned profile '%s' after config/.env change (%s adapter(s) connected)r_profile_configs)recover_served_native_rows)"rrrrrrrrKrV setdefaultr0r1rN_unserve_profilerrA_serve_profile_runtimeremove_live_resource_claimsrr#_start_one_profile_adaptersrnerrorpoprTrrminfo_record_served_profilesrWrUr_after_profiles_added)r<rrrrrcrrrrrrrHrrZr!reason_claimedtransient_failed config_parkedscan_signature connectedexcr_homelive_nowrGconfigsrs&&&&&$$$ rr3GatewayProfileReconcileMixin._apply_profile_changess 5D96=JJfmm"i["hXZ\dfl mn(B''tT']T//5526..44"GMfM/1J1J1LM MD''Dk: : : 9  $ $T *KD 774jIIG" T"T1x ''- 4 & JGM ,,V45 OOD5W]CN ,"&"B"B4QUX_"`` &, } `bfhqsyzw&&t, tvz}FG{#**40=$> &+Ied=/HTTeEI*.'2CT1RS1R+$CI1RS 'M11H+4A T6=Q>BT6Q.Q/Q3A6T6*T6.T;TT6T,T63 TT T)T69T#: T6 T&(T&.BT6T6!T62T+3T6T. T6$T3%T6T6QT=S R AS T6 T ,T T6TT6&T6.T6cV^8dQhRR/#r@r)rs"rrr8Es..t.rc 0^RIHp\V!V44#)zProfiles that exist but could not be served (unusable store, home owned elsewhere); boot's ``initialize_gateway_runtime`` parks into the same published ``name -> reason`` map.)parked_profile_map)rrrA)r<rs& rr2GatewayProfileReconcileMixin._parked_profile_namesEs ;&t,--rcV^8dQhRR/#)r rboolr)rs"rrr8Ks??D?rc "^RIHpHpHpHpHpHp^RIHp^RI H pH p VP4;_uu_4GRjxL VP4'dRRR4GRjxL R#VP'd\VRR4'dRRR4GRjxL R#V!4W!39dRRR4GRjxL R#V !4P!4p W!4P!48wdRRR4GRjxL R#\#V!RRR74^8dRRR4GRjxL R#VP%\&V 4GRjxL p V eVWP(8wd\*P-R V 4WnW8XdV!V!RR V 44RRR4GRjxL R#VP'd\VRR4'dRRR4GRjxL R#^R I Hp ^R IHp ^R IHpV!4V !V !V 44RVP8nRV 33VP8n\VRR4pVeRVn\AVPBPE44F`pVPGVPI44VPKVPM44VPOVPQ44Kb VPSRRV 3.4V!V!RRR44\*PUR4RRR4GRjxL R#ELELELELcEL%ELELELELWL! +GRjxL 'giR#;i5i)aStart multiplexing in place when this gateway booted standalone ONLY because the host had one profile and a second now exists (#141623). Boot settles the mode once, so without this a profile created afterwards (Desktop's New Agent, ``hermes profile create``) was never served: every ticket, session and delete for it was refused until a manual restart. No restart and no drain: the launch env is frozen and unscoped secret reads fail closed (``activate_multi_profile_hosting``, the hosted-room precedent), the launch home becomes the first entry of the reservation, and the caller's ordinary hot-serve reconcile serves the new profile. Turns already running keep their bound scope; the launch profile's later work binds its own scope through ``_standalone_launch_scope`` and the re-wired primary handlers. Any other standalone verdict, or a preflight blocker now, leaves the gateway as it is; nothing is latched, so the next rescan or watcher tick retries once the blocker clears. The switch is an automatic migration, so ``gateway.auto_multiplex_migration: false`` holds it back the same way (re-read on every rescan: setting it back to true converges without a restart). True when armed.)r)SINGLE_PROFILE_REASONMultiplexDecisionlog_multiplex_decisionrecord_multiplex_decisionrecorded_standalone_reasonr)get_default_hermes_rootrtNT _drainingF)rinclude_parkedzF[MULTIPLEX] A new profile exists but this gateway stays standalone: %sguardhermes_home_key)rekey_unscoped_connections)activate_multi_profile_hostingrDsession_authoritiesza second profile was createdzY[MULTIPLEX] A second profile exists; serving every profile from this process (no restart))+r,r)rrrrrrrrurrtr=rirfrKrlenrr-r6rnrortools.mcp_tool_scoper!tui_gateway.launch_profile_policyrconfigmultiplex_profiles_runtime_profile_homes multiplexedrAadaptersrvset_message_handler_primary_message_handlerset_busy_session_handler_primary_busy_session_handlerset_platform_event_handler_primary_platform_event_handlerrr)r<r)rrrrrrrrtr%blockerrrrregistryadapters& rrj9GatewayProfileReconcileMixin._multiplex_for_added_profileKs C C :U'')))!!##*))===GD+u$E$E *)) *+4I3kk *))-.668F02::<<*))$tDIJQN*))!>>?UW]^^G"AAANN#kmtu:A7=..?wPW.XY+*)),===GD+u$E$E/*))0 9 G X * , &v'> ?-1DKK *3ML3 M(L%)M/L3L( A L3 ML+ M&L38L3 ML.MD&L3 ML1MMMM"M%M(L3+M.M1M3M 9L<: M M  Mc$V^8dQhRRRRRR/#)r r!rTrrrr&r)rs"rrr8s!D]rc "^RIHpHpHp^RIHpV!WV4\TRR4fR#T!YT4GRjxL R# T\ 3d&p\PRY4RT 2uRp?#Rp?ii;iL; \dppTPPT4e#\PRYRR 7R T 2uRp?#\PR YTRR 7T!Y4R T 2uRp?#Rp?ii;i5i) uOGrow the reservation by *home* and build its session authority (boot's per-secondary steps). Returns the park reason — reservation released — when another gateway owns the home (a stray per-profile daemon) or its store cannot be opened; None when served. An adapters-only runner (no authority registry) grows the reservation alone.)release_profile_homereserve_profile_homeserve_profile_runtime)OwnershipConflictrzhome owned by another gateway: NrzV[MULTIPLEX] Profile '%s' not served (%s); a turn outlived its Stop, ownership retainedTrdz3stopping after a failed serve; ownership retained: zK[MULTIPLEX] Profile '%s' not served: its session store is unusable (%s): %szsession store unusable: ) rrrrgateway.runtime_ownershiprrrnrrKrmrfor_home)r<r!rrrrrrs&&& rr3GatewayProfileReconcileMixin._serve_profile_runtimes ji? ; T 2 4. 5 = 4'D9 9 9'"7+ ; LLBD N4SE: : ; : 4''006B 237tMLSERR LLfS4  9  ,-cU3 3 4sC6 AC6 A9A7A9C6 A4A/)A4*C6/A44C67A99 C39C.=C3>C6%C.(C3)C6.C33C6c V^8dQhRRRR/#)r rHrTrzdict[tuple, str]r)rs"rrr8s  C 4D rc .VPV4p\VRR4;'g/P4FZwr4\VP44F8wrVVP WV4VP WV43F pVfK W2V&K K: K\ V#)zStartup's ``claimed`` map rebuilt from what is live now: primary claims plus every connected secondary's credential/listener, so a hot-added profile reusing a token is parked, never a second poller._profile_adaptersN)_primary_resource_claimsrKrWrA_adapter_credential_claim_adapter_listener_claim)r<rHr profile_namerplatformrclaims&& rr2GatewayProfileReconcileMixin._live_resource_claimss//7'.t5H$'O'U'USU&\&\&^ "L%)(..*:%;!"<'')*7 &L jG+D,>??A[A]A]..t\^5G5GI[\\\B^??+8 Y X]B^A]??? jK\dhi js3E C#*E 3DD "&C8 C6 C8 D DE # C3 .E 6C8 8 DD  D DE D#EE EE c$V^8dQhRRRRRR/#)r r!rTrrrrRr)rs"rrr8s+OyOy3OydOytOyrc "^RIHpHp^RIHpHp\ VRR4RJ;'gV!W4GRjxL p\ VRR4;'g/PVR4;'g/pVP4U u.uF?p \V \P4'gK%V P4'dK=V NKA p p V Fp V P4K V 'd.\P!WP4R7GRjxL V!\!V4RR7;_uu_4\ VR R4;'g/PVR4;'g/p \#V P%44F wrVP'WVR 7GRjxL K" V!VR 7R F9p\ WR4p\V\(4'gK'VPVR4K; \VP*\(4'dVP*PVR4\VP,\(4'dVP,PVR4^R IHpV!V4R ,p\ VRR4p\#T;'g/4Uu.uF'p\3V4P5V4'gK%VNK) upFBp\7\8P:RVRR7;_uu_4VP=V4RRR4KD V'g"\>PARV4RRR4R#\7\8P:RRR7;_uu_4^RI!H"pV!V4RRR4\7\8P:RRR7;_uu_4^RI#H$pV!RR4PJPMV4RRR4\7\8P:RRR7;_uu_4^RI'H(p^RI)H*p\PV!VV!V4R7GRjxL RRR4\7\8P:RRR7;_uu_4^RI,H-p\PV!VV4GRjxL RRR4V!W4\>P]RV\_V 44RRR4R#ELsuup iELEL uupi +'giEK;i +'giELq;i +'giEL0;iL +'giL;iL +'giL;i T!Y4i;i +'giR#;i5i)!uStop and unroute one profile: cancel its reconnects, tear down its adapters, drop its bookkeeping and release this process's handles into its home so the deleter's rmtree succeeds. The releasing process is not always the deleter (#130244): under multiplexing THIS gateway process routes the profile's logs and owns its scoped MCP servers, so both must be released here too or the deleter's rmtree still fails on ``logs/.__agent.lock`` / ``mcp-stderr.log``. The whole teardown runs inside the removed profile's own runtime scope: adapter disconnect hooks, the agent-cache eviction (provider/memory shutdown) and the state/memory handle release all read config and credentials at call time, and this coroutine runs on the reconcile task with no profile bound — unscoped they resolved against the LAUNCH home, so a teardown hook needing this profile's credential failed closed (or, worse, borrowed the launch profile's). Secrets are not re-hydrated: teardown must not block the loop on a source fetch. )r_write_runtime_status_quiet)runserve_profile_runtimerN_profile_failed_platformsrF)hydrate_secretsr )profile)drop_profile_platforms)_session_key_namespace: _agent_cachezagent eviction failed for %sTrdzS[MULTIPLEX] Profile '%s' unrouted, but a turn outlived its Stop; ownership retainedzprofile handle release failed)close_all_underzmemory-store release failed)import_provider_module holographicstorezscoped MCP shutdown failedr)shutdown_mcp_servers)rz"profile log handler release failed)release_profile_log_handlersuH[MULTIPLEX] Profile '%s' unserved — %d adapter(s) stopped and unrouted)pairing_stores_busy_text_modes_by_profile_busy_input_modes_by_profile_busy_text_timing_by_profile_human_delay_by_profiler)0rrr'rrr(rKrrvrUr:Taskdonecancelwait _adapter_disconnect_timeout_secsrrArW_bounded_adapter_teardownrVr0r1gateway.sessionr-rT startswithrrr_evict_cached_agentrnrhermes_state_registryr0plugins.memoryr1 MemoryStorerelease_all_underrurtools.mcp_tool_lifecycler4rwhermes_loggingr5rr)r<r!rrr'rr(retiredrttaskstaskrrrattrr3r-prefixcachekkeyr0r1rr4r5s&&& rr-GatewayProfileReconcileMixin._unserve_profiles TU$ 5t<DqqNefjNqHq4!+D1C7FD.$7E#' #4R#4aA8I8I&8Q#4R$W]]4RTWbfgg,,S1hgS rtxy5G F: 1$W]]4S^bccE#D)d%W]]4Q\`aaE*='BNN``aefb%W]]4P[_``@M!++,@X\H]^^^a%W]]4XcghhK!++,H$OOOi%T0 KKbdhjmnvjw xoG FIr] WVSgggdccbaa _a` Pih%T0mG F Fs`3UR(UU(U="R+$R+<R+"U%(U R0U-.T/7T/R3 5T/B=T/ T/"R6<R6+T/-R; ?T/T/* U5$T"S (,T")S$ =,T").S: S8 S: ,T"!T )T *T .T"6(T/ U+U3T/6T/; S  T/ S!  T"$ S5 / T"8S: : T T" T  T T"" T,,T// U : U)r5r3r4r2r0r1r6)__name__ __module__ __qualname____firstlineno____doc__r0__annotations__r1r2r3r4r5r6r=rNr[_PROFILE_RESCAN_INTERVAL_SECSrprhrxrkrrrjrrrr__static_attributes__rrrr/r/Hsl7;4;=A :A6:3:6:!3:8<!#5.applys?L##%%V___@\@\@d<= =))+++V%O7PQ-,+++E,+&i',+++sO0J.J"I"#J&5I= I=% J2I%3J8*I=" J/I(0J5#I=I+AI= J&I.'J, I= JI1J"I= JI3J I=! J.I5/J4#I=I7I=0 J=I9>J I= JI;J%J(J+I=.J1J3J5J7I=9J;J=J J J J  JcX<\P!S!VPR44S4pVPRR7# \dRRRSP 4/u#\ d>p\PRRR7R\T4P R T 2/uR p?#R p?ii;i) r!r rrTrz Profile lifecycle request failedrdr: N) r:run_coroutine_threadsaferXrrrNrmrnrotyperT)paramsfuturerrgr"rfs& rhandler(_profile_lifecycle_verb..handler9s11% 68J2KTR ====- - Wt%68S8S8UV V = NN=N MS 2 232cU;< < =s)AB)"B)+B),2B$B)$B))r:r)rfr]rorgr"sfd @@r_profile_lifecycle_verbrqs#  # # %DR8 = Nrc\VRR7#)Fr]rqrfs&runserve_profile_verbrvGs "6 77rc\VRR7#)Trsrtrus&rserve_profile_verbrxKs "6 66rc<aaa\4oRV3RlloVV3Rl#)uHousekeeping chore keeping live MCP servers in step with ``mcp_servers`` on disk, every tick after the first (startup discovery owns that one). Reconciling on DRIFT rather than only on a config EDIT is what brings back a server whose FIRST connect failed (#112445): it never reached ``_servers``, so the parked self-probe — a property of a task that connected once — cannot revive it, and its config never changes. The reconcile is a cached config read plus set compares when nothing moved; a server dropped from config is torn down (a parked one otherwise self-probes every ``_PARKED_RETRY_INTERVAL`` for the life of the process) and a missing one is reconnected only once its per-server connect cooldown (30s→600s backoff) has lapsed, so a chronically failing server is retried on that schedule, not every tick. Interactive OAuth is suppressed — this runs on a housekeeping thread nobody is watching.c V^8dQhRRRR/#)r labelrTrrRr)rs"rr,_mcp_config_reconciler..__annotate__\s C C# C$ CrcB<^RIHp^RIHpVS9dSP V4R#V!4;_uu_4V!4pRRR4XR,'gVR,'d(\ P RWR,VR,4R#R# +'giLW;i)r`r)!reconcile_mcp_servers_with_configNrrz._reconcile_current\su>N   JJu   ' ) )68F* )  w KKVi0&/ C!0* )s B B c<\SS4#r_for_each_served_profile)rrfsr(_mcp_config_reconciler..hs+F4FGr)r)rfrrsf@@r_mcp_config_reconcilerrOs!%F C C HGrcV^8dQhRR/#rQr)rs"rrrksWWdWrc^RIHpHp\VRR4p\VRR4'g2^RIHpVP 4;_uu_4V!R4RRR4R#V!V4F9wrgV!\V44;_uu_4V!\V44RRR4K; R# +'giR#;i +'giKd;i \d"p\PRYh4Rp?KRp?ii;i) uRun ``body(profile_label)`` once per served profile, inside that profile's runtime scope. Housekeeping runs on a bare thread with no turn on the stack, so nothing binds a profile for it: ``get_hermes_home()`` and ``get_secret()`` see the LAUNCH profile's values, and under ``gateway.multiplex_profiles`` a fail-closed credential read logs ``no profile secret scope on a multiplexed call`` on every tick (the skills-sync pulls resolved Nous credentials this way, four WARNINGs per hourly tick per chore). A single-profile gateway runs ``body`` once, unscoped: there the process env IS the profile's own value — unless a hosted room already flipped the process-wide guard (#112878), in which case the launch profile's OWN scope is bound, as ``run_turn.py::_standalone_launch_scope`` does for turns.)_multiplex_profile_homesrrNrFrrDz'Housekeeping for profile %s skipped: %s) rrrrKrrrrrTrmrnr) rfbodyrrrrrr#rs && rrrksM VXt ,F 6/ 7 75  6 6 8 8 O9&>v&F"  W'\(:;;S&'<; 'G9 8<;; W LLBL V V WsB B!(C B5C ! B2 5 C C C  C5C00C5caaVV3Rl#)zWrap a zero-arg housekeeping chore that reads the profile's home, config or credentials so it runs once per served profile under that profile's scope (see ``_for_each_served_profile``).c$<\SV3Rl4#)c<S!4#rr)_labelchores&rr8profile_scoped_chore....s57rr)rrfsrr&profile_scoped_chore..s+F4JKrr)rfrsffrprofile_scoped_chorers  LKrcaRV3RllpV#)aBuild the ``migrate-profile-identity`` control-verb handler for ``hermes profile rename`` (#111926). The live multiplexer owns the routing index in memory and writes it back periodically, so a CLI-side rewrite of ``agent::*`` would be clobbered on the next save; the CLI therefore asks this process to rekey both durable stores AND ``SessionStore._entries``. Runs on the control-socket executor thread; ``rekey_profile_routing`` takes the store lock.c V^8dQhRRRR/#r rmrVrr)rs"rr3migrate_profile_identity_verb..__annotate__s^^^$^rc <\VPR4;'gR4P4\VPR4;'gR4P4r!V'dV'dW8XdRRRR/#\SRR4pVfRRRR /#.p^R IHpHp/p\VR R4pVe'\VR 4'dVPW4VR &\VRR4p V 'd!\V 4R, V, R, MRp V eDV P4'd.V!V 4p VPV 4V PW4VR&VPW4p RRRV RV/VF p V!V 4K # \d\PRRR7K6i;i \d{p\P!RYT4RRR\#T4P$ RT 2/uRp?TF5p X!T 4K \d\PRRR7K3i;i #Rp?ii;i TF5p X!T 4K \d\PRRR7K3i;i i;i)oldnewokFrz old/new required and must differ session_storeN!live gateway has no session store)acquirerelease_or_close _routing_dbrekey_profile_staterouting _routing_homeprofileszstate.dbr+Trekeyeddbz*Failed to release renamed profile state DBrdz0Profile identity migration failed for %r->%r: %srj)rTrXstriprKrDrrhasattrrrexistsrrekey_profile_routingrmrnrrorlrT)rmrrr3acquiredrr db_counts routing_db routing_home profile_path profile_dbrrrrfs& r_handler/migrate_profile_identity_verb.._handlers[vzz%(..B/557VZZ=N=T=TRT9U9[9[9]S#%*LM M6 =%*MN N ^ G35I  tS*T*T'1'E'Ec'O )$"5/4@LQ]4 - :S@:McgL'L,?,?,A,A$\2  +'1'E'Ec'O )$11#;G$ 7D)D ^$R(!^LL!MX\L]^ J NNMsY\ ]%T#Y-?-?,@3%*HI I^$R( ^LL!MX\L]^  J^$R( ^LL!MX\L]^sBF.-AF.8F"F+*F+. H394H.-H3.H68H"H('H(.H33H66I3=II3"I- )I3,I- -I3rrfrsf rmigrate_profile_identity_verbrs^^@ OrcaRV3RllpV#)u4Build the ``purge-profile-identity`` control-verb handler for ``hermes profile delete`` (#111926, delete side). The live multiplexer owns the routing index in memory and writes it back periodically, so a CLI-side DELETE of ``agent::*`` rows would be undone by its next save; the CLI therefore asks this process to drop the durable rows AND ``SessionStore._entries``. Deliberately NOT part of ``_unserve_profile()``: that path also unserves names that are still alive elsewhere in the identity story — a rename's old name leaves the served set exactly like a delete does (its directory is gone either way) — and purging there would race the rekey it is supposed to leave intact. Only the delete path invokes this verb. Runs on the control-socket executor thread; ``purge_profile_routing`` takes the store lock.c V^8dQhRRRR/#rr)rs"rr1purge_profile_identity_verb..__annotate__sJJJ$Jrc<\VPR4;'gR4P4pV'gRRRR/#\SRR4pVfRRRR/#/p\VR R4pVe'\ VR 4'dVP V4VR &VP V4pRR R VRV/# \d?p\PRY4RRR\T4P RT 2/uRp?#Rp?ii;i)r!rrFrz name requiredrNrrpurge_profile_staterTdroppedrz(Profile identity purge failed for %r: %srj) rTrXrrKrrpurge_profile_routingrmrnrorlrT)rmr!r3rrrrrfs& rr-purge_profile_identity_verb.._handlers6::f%++,224%/: :6 =%*MN N J35I  tS*T*T'1'E'Ed'K )$11$7G$ 7D)D D J NNEt Q%T#Y-?-?,@3%*HI I JsAB,, C573C0*C50C5rrsf rpurge_profile_identity_verbrsJJ$ Or)rz.envr)$rX __future__rr:rr functoolsrpathlibrtypingrrrgateway.run_shutdownrutilsr getLoggerrTrnrZrrrr#r-r/rqrvrxrrrrrrrrrs(# &&0   8 $ $2#& (NyNyb+\87H8W<L 'Tr