+ jHj4a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIHtHt^RIHt^RIHt^RIHtHtHt^RIHt^RIHt] P<!]4t R R lt!ERR R llt"ERR Rllt#RRlt$R^/RRllt%R^/RRllt&RR0t'0ERmt(^t)0ERmt*RRlt+],!R]!444t-] P\R8Ht/ERt0ERRRllt1RR lt2R!R"lt3R#R$lt4R%R&lt5R'R/R(R)llt6R'R/R*R+llt7ERt8R'RR,R-/R.R/llt9ERt:ERt;^xt^Kt?^Nt@R2R3ltAR4R5ltBR6tC]!R7RR87tDR9]ER:&]!R;R-R87tFR<]ER=&]PR>4tH]PR?R@l4tI]P!RA4tKRBRCltLRDREltMRFRGltNRHRIltORJRKltPRLRMltQRNROltRRPRQltSRRRSltTERRTRUlltUERRVRWlltVRXRYltWRZR[ltXR\R]ltYERR^R_lltZERR`Rallt[ERRbRcllt\ERRdRellt]ERRfRgllt^]!RhRi44t_ERt`ERtaERtbERtc]!RR44td]!RR44te]!RR44tf]!RR44tgRthRRltiRRltjRRltkRRltlRRltmRRltnRRltoRRltpRkRRlRRoRRpRRqRRsRRuRRn^RERRR-RwRRxRRRR{RR~RRRRRRR-RRRRR|RR'RRtRRRRRR}R/RRlltqRRltrRRltsRRlttRRltuRrR/RRlltvRRltwRRRRRnRRRRmRRlRRjRRRRR/ txR]ER&RlRRmRRuRR|RRR-RRRRRyRRzR/ RRlltyRRltzERRRllt{RRlt|RRlt}RR/RRllt~RRltRRltRRltRRltRRltRRltRRltRRltRRltRRltRRltR^/RRllt!RR]4tRRltRRltRRRRR'RRR/RRlltRRR^RR/RRlltRRltRRltRRltRRltRERltERERR/ERERllltERRERRERRRmR/ERERlltER ER ltER ER ltER ERltERERltERERlt]!4tER]EER&ERRERRER]/ERERlltERRERRERRER]/ERERlltERERltERERERlltERERltERER ER!lltER"ER#ltER$ER%ltER&R/ER'ER(lltER)RER*R/ER+ER,lltER)RER*R/ER-ER.lltERER/ER0lltER1ER2ER3ER4ER5ER5RRER6R/tERER7ER8lltER)RER*R/ER9ER:lltER;ER<ltER=RER>R/ER?ER@lltERAERBltERCERDltERERER=R/ERFERGlltERHR-ERER/ERIERJlltERKERLlt]P!ERM4tERNEROlt!ERPERQ]4t!ERRERS]4t!ERTERU]4t!ERVERW]4tERXERYltRvRERRERRERZRER[RER\ER]ER^R-/ER_ER`lltERatERbERcltERdEReltERfERgltRERh/ERiERjlltERkERlltERmERnltERoERpltERqERrltERsERtltERuERvltERwERxltRERh/ERyERzlltER{ER|ltRjRRkRRnRRvRERRERRR'R/ER}ER~lltERERERRER[R/ERERlltERERltERERltERRERRERRER[RER^R-ERR-/ERERlltERERltERERltER[R/ERERlltERERR,R-/ERERlltERERltERERltERERltERERltERERltRjRRkRRlRERR/ERERlltER=R/ERERlltERERltERERltERERltERERER[R/ERERlltERERltERERltERERltERERltERERltERERltERER/ERERlltERERR'R/ERERlltR'R/ERERlltERRR'R/ERERlltERERltERERltERER]ERRERR/ERERlltERERltERERltERERltERERltERERlt^ERIHtHtHtHtHtHtHtHt^ERIHtHtHt^ERIEHEtEHEtEHEtEHEt^EREIEHEtEHEtEHEtEHEtEH Et EH Et EH Et EH Et EH Et EHEtEHEtR#(u'SQLite-backed Kanban board shared across profiles (the cross-profile coordination primitive). Lives under the shared Hermes root: ``default`` board DB at ``/kanban.db`` (pre-boards back-compat), other boards at ``/kanban/boards//``; a worker on one board never sees another. Board resolution: ``board=`` arg > ``HERMES_KANBAN_BOARD`` > ``HERMES_KANBAN_DB`` (pins the file path) > ``/kanban/current`` > ``default`` — but only for unfenced callers; the dispatcher injects these into workers, and dispatched workers (``HERMES_KANBAN_TASK``), delegated children and board-enumerating machine flows (gateway notifier/watcher/dispatcher, ``pin_first_board_resolution``) always resolve through the pin, so workers physically cannot see other boards. Concurrency: WAL + ``BEGIN IMMEDIATE`` + compare-and-swap on ``tasks.status``/``claim_lock`` — SQLite serializes writers so one claimer wins, losers see zero rows (no retries, no distributed locks). Schema: tasks, task_links, task_comments, task_events, task_runs, attachments, notify subs. ) annotationsN) ContextVarToken) dataclass)Path)AnyIterableOptional)DEFAULT_STATUSES)get_toolset_namesc V^8dQhRRRR/#valuerreturn)formats"9/home/ubuntu/.hermes/hermes-agent/hermes_cli/kanban_db.py __annotate__r(s  s s cX\V\4'dVPRRR7#V#)a``bytes`` -> ``str`` with U+FFFD for undecodable sequences; anything else passes through. Installed as every board connection's ``text_factory`` (a TEXT cell holding invalid UTF-8 otherwise aborts the whole ``fetchall`` with "Could not decode to UTF-8") and applied to BLOB-typed cells in the ``from_row`` constructors (task, comment, event, run), so one corrupt row degrades to replacement characters instead of taking the board listing down.utf-8replaceerrors) isinstancebytesdecoders&r _lossy_textr(s)%||GI|66 Lrc(V^8dQhRRRRRRRR/#)rrowrcolstrdefaultrr)rs"rrr6s(#C#rcFVeWP49dV#W,#)zJ``row[col]`` tolerant of the column being absent from the SELECT / schema.)keys)r!r"r$s&&&r_row_getr'6s {c+ 8Orc$V^8dQhRRRRRR/#)rrrr$rr)rs"rrr=s!C#rcjV'gV#\P!V4# \dTu#i;i)zPDecode a JSON text column; any decode failure or empty value yields ``default``.)jsonloads Exception)rr$s&&r_json_orr-=s2 zz%  s " 22c V^8dQhRRRR/#)rrrrdictr)rs"rrrGs66c6d6rcN\V/4p\V\4'dV#/#)zNDecode a JSON text column that must be an object; anything else yields ``{}``.)r-rr/)rparseds& r _json_dictr2Gs% eR F--6525rminimumc(V^8dQhRRRRRRRR/#)rnamer#r$intr3rr)rs"rrrMs(  3  # c rc\PPVR4P4pV'd\ V4pYB8dT#V# \ dTu#i;i)z[Integer env override: absent/empty/non-integer/below ``minimum`` falls back to ``default``.)osenvirongetstripr6 ValueError)r5r$r3rawr1s&&$ r_env_intr?MsX **..r " ( ( *C  XF  M N  N s A AAtimeoutc(V^8dQhRRRRRRRR/#) rcwdrargsr#r@r6r Optional[str]r)rs"rrrZs( 1 1$ 1s 1S 1- 1rc \P!RR\V4.VORRRRVRR7pTP^8wdR#TP ;'gR P 4;'gR# \dR#i;i) z^Run ``git -C cwd args`` and return stripped stdout, or ``None`` on any failure / empty output.gitz-CTrrF)capture_outputtextencodingrr@checkNr8) subprocessrunr#r, returncodestdoutr<)rBr@rCresults&$* r_git_outrPZs D#c( *T *dWY5 A MM  R & & ( 0 0D0 s+A.. A=<A=runningblockedc V^8dQhRRRR/#)reffortrDrr)rs"rrrvs S S} S Src^RIHp\T;'gR4P4P 4pV'gR#VR8XgW!9dV#RP R.VO54p\ RV RV: 24h)u``VALID_REASONING_EFFORTS`` or ``"none"`` (thinking off), case-insensitive; empty/None = inherit the profile's own effort (NULL). Anything else raises — a typo'd level must not quietly hand the task back to the profile default.)VALID_REASONING_EFFORTSr8Nnone, z reasoning_effort must be one of , got )hermes_constantsrVr#r<lowerjoinr=)rTrVralloweds& rnormalize_reasoning_effortr^vsp9  "  # # % + + -E  %: ii:"9:;G 7yvjQ RRrc#@"TFqP4xK R#5iN)casefold).0r5s& r rcsPA A>> B* B%%B*c ,V^8dQhRRRRRRRRR R /#) rrrrpr#changed_fields Iterable[str]rrDrrgr)rs"rrrs6?? ?'*? > ?ll Ez (*  $ $g5Q5Q>O>Q(+S_,/3'(T$~J^ ? 8#>>?s)/BBB)B B1B,,B1dry_runFc(V^8dQhRRRRRRRR/#) rrODispatchResultrrDrrrrgr)rs"rrrs2 @ @  @&3 @EI @  @rc a\R4'gR#^RIHp\4pVf \ 4pRpSP 'dRpMJ\;QJd#V3Rl\4F 'gK RM RM!V3Rl\44'gR pV!RW\V4VSR 7R# \ dRpLi;i \ d"p\PR T4Rp?R#Rp?ii;i) u``on_kanban_dispatch_tick`` — strictly AFTER ``_dispatch_tick_lock`` is released so a slow subscriber cannot stall a sibling dispatcher. Re-port of PR #56066 per the #64231 batch disposition: renamed to the taxonomy form and called by ``dispatch_once`` strictly AFTER ``_dispatch_tick_lock`` has been released — the original fired inside the lock, so a slow subscriber could extend the single-writer critical section and stall a sibling dispatcher's tick. Observer-only and fully best-effort: any subscriber failure is swallowed. on_kanban_dispatch_tickNrsokskipped_lockedc3<<"TFp\SV4xK R#5ir`)getattr)rbfrOs& rrc+_fire_dispatch_tick_hook.. sG1FAWVQ''1FsTFidle)rruroutcomerOz$kanban dispatch tick hook failed: %s) rrvrtrwrr,rany_TICK_ACTIVITY_FIELDSrrxry)rOrrrtrurrzsf$$ r_fire_dispatch_tick_hookrs %%> ? ?@4)+ = )+  &GG1FGG1FGGGG %UM76    @ 93??@sQC B.C CC2!CC. B>;C=B>>C C- C((C-c V^8dQhRRRR/#)r ttl_secondsrrr6r)rs"rrr's]]M]S]rcXVe\^\V44#\R\^R7#)zIExplicit ``ttl_seconds`` > ``HERMES_KANBAN_CLAIM_TTL_SECONDS`` > default.HERMES_KANBAN_CLAIM_TTL_SECONDS)r3)maxr6r?DEFAULT_CLAIM_TTL_SECONDS)rs&r_resolve_claim_ttl_secondsr's,1c+&'' 57PZ[ \\rcV^8dQhRR/#rrr6r)rs"rrr=sVVcVrc"\R\4#)zN``HERMES_KANBAN_CRASH_GRACE_SECONDS`` (0 = immediate, for tests) else default.!HERMES_KANBAN_CRASH_GRACE_SECONDS)r?DEFAULT_CRASH_GRACE_SECONDSrrr_resolve_crash_grace_secondsr=s 79T UUrcV^8dQhRR/#rr)rs"rrrBsffcfrc"\R\4#)zV``HERMES_KANBAN_RATE_LIMIT_COOLDOWN_SECONDS`` (0 = next tick, for tests) else default.)HERMES_KANBAN_RATE_LIMIT_COOLDOWN_SECONDS)r?#DEFAULT_RATE_LIMIT_COOLDOWN_SECONDSrrr$_resolve_rate_limit_cooldown_secondsrBs ?Ad eerr$$hermes_kanban_current_board_override)r$zContextVar[str | None]_CURRENT_BOARD_OVERRIDE(hermes_kanban_pin_first_board_resolutionzContextVar[bool]_PIN_FIRST_BOARD_RESOLUTIONc#"\PR4pRx\PV4R# \PT4i;i5i)uResolve board paths env-pin-first for machine flows that enumerate boards. The gateway notifier, per-subscription cursor writes and the embedded dispatcher poll every board slug from ``list_boards()`` — the slug is not caller intent, it is an iteration variable. On a box whose environment pins ``HERMES_KANBAN_DB`` (the dispatcher default) every slug must map to that one pinned file: the notifier dedupes resolved DB paths, and per-slug paths read empty boards nobody writes, silently killing wake notifications. Explicit cross-board intent (CLI ``--board``, a model tool's ``board=``) is a USER property and must never run inside this context; with no pin set this context changes nothing. TN)rsetreset)tokens rpin_first_board_resolutionrTs< ( + +D 1E1 #))%0#))%0A4AA  AcV^8dQhRR/#)rslugr#r)rs"rrrjs--s-rc#"\PV4pRx\PV4R# \PT4i;i5i)z2Pin the active board for the current context only.N)rrr)rrs& rscoped_current_boardris< 7::4@E- %%e,%%e,rz^[a-z0-9][a-z0-9\-_]{0,63}$c V^8dQhRRRR/#)rrrDrr)rs"rrrxs    -  rcVe(\V4P4P4MRpV'gR#\P V4'g\ RV: R24hV#)z>Lowercase + strip a slug; validate; return ``None`` for empty.Nr8zinvalid board slug zc: must be 1-64 chars, lowercase alphanumerics / hyphens / underscores, not starting with '-' or '_')r#r<r[_BOARD_SLUG_REmatchr=)rss& r_normalize_board_slugrxs`%)%5D !2A     " "!$*R S   Hrc V^8dQhRRRR/#)rrrDrr#r)rs"rrrs99M9c9rc4\V4;'g\#r`)r DEFAULT_BOARDrs&r_slug_or_defaultrs  ' 8 8=8rc V^8dQhRRRR/#)rrr#rr)rs"rrrsrcB\V4pV'g \R4hV#)zboard slug is required)rr=)rnormeds& r _require_slugrs "4 (F 122 MrcV^8dQhRR/#rrrr)rs"rrrs%%T%rc\PPRR4P4pV'd\ V4P 4#^RIHpV!4#)z``HERMES_KANBAN_HOME`` else ``get_default_hermes_root()``. Shared across profiles BY DESIGN: resolving through the active profile's HERMES_HOME would fork the board per profile and break the dispatcher/worker handoff.HERMES_KANBAN_HOMEr8get_default_hermes_root)r9r:r;r<r expanduserrZr)overriders rrkrksDzz~~2B7==?HH~((**8 " $$rcV^8dQhRR/#rr)rs"rrrs//T/rc2\4R, R, #)u``/kanban/boards`` — parent of the *additional* named boards. ``default`` is deliberately not here (its DB stays at ``/kanban.db``).kanbanboardsrkrrr boards_rootrs =8 #h ..rcV^8dQhRR/#rr)rs"rrrs00D0rc2\4R, R, #)u_``/kanban/current`` — one-line slug written by ``boards switch``; absent = ``default``.rcurrentrrrrcurrent_board_pathrs =8 #i //rcV^8dQhRR/#rr)rs"rrrs))3)rcHRRlp\P4;'gRP4\PPRR4P43FpV!V4pV'gKVu# \ 4pVP 4'dVVPRR7P4pV'd.\V4pV'd\V4'dV#\#\# \d \#i;i \d \#i;i)uActive slug: context override -> ``HERMES_KANBAN_BOARD`` -> ``/kanban/current`` (only while that board exists) -> ``DEFAULT_BOARD``. A malformed/stale slug falls through — the dispatcher must never crash on a hand-edited file.c V^8dQhRRRR/#)r candidater#rrDr)rs"rr'get_current_board..__annotate__sS]rcV'gR#\V4pT'd\T4'gR#\T4P R4'dR#T# \dR#i;i)Narchived)rr= board_existsread_board_metadatar;)rrs& r _existing$get_current_board.._existings] *95F<// v & * *: 6 6   s A A%$A%r8HERMES_KANBAN_BOARD utf-8-sigrI) rr;r<r9r:rexists read_textrrr=OSErrorr)rrfoundrvalrs rrrs" ! $ $ & , ,"335 ,b1779 )$ 5L     88::++{+399;C237F,v"6"6% = "      s1=AD%C88 D D D  D D! D!c V^8dQhRRRR/#)rrr#rrr)rs"rrrsCDrc\4\V4p\4pVPP RRR7VP VR,RR7V#)uPersist ``slug`` as the active board; returns the file written. Does NOT check the board exists — callers do (so ``boards switch `` errors).Tparentsexist_ok rr)rmrrparentmkdir write_text)rrrfs& rset_current_boardrsL)* 4 F  DKKdT2OOFTMGO4 KrcV^8dQhRR/#rrrgr)rs"rrrs&&T&rc\4\P!\4;_uu_4\ 4P 4RRR4R# +'giR#;i)zLRemove ``/kanban/current`` so the active board reverts to ``default``.N)rm contextlibsuppressFileNotFoundErrorrunlinkrrrclear_current_boardrs8(*   . / /##% 0 / / /s A A! c V^8dQhRRRR/#rrrDrrr)rs"rrrs33]3d3rc6\4\V4, #)u``/kanban/boards//``. For ``default`` this holds metadata only (board.json, workspaces/, logs/) — its DB stays at ``/kanban.db`` for back-compat (:func:`kanban_db_path`). )rrrs&r board_dirr s =+E2 22rc V^8dQhRRRR/#)rrrDrrr)rs"rrrs-- --rcZ\V4pV\8XdR#\\V44#)z>Board has a ``board.json`` on disk; ``default`` always exists.T)rr_dir_holds_boardr )rrs& rrrs& E "D } IdO ,,rc V^8dQhRRRR/#)rrrDrr)rs"rrrs -rcVe \V4#\P4;'gRP4pV'd \V4#R# \dR#i;i)zExplicit caller intent: a direct ``board=`` argument, else the scoped ``--board`` context (CLI ``hermes kanban --board``, dashboard plugin_api); ``None`` when the caller expressed neither.Nr8)rrr;r<r=)rctxs& r_explicit_board_slugr'sb $U++ # & & ( . .B 5 5 7C  (- -   s A A! A!cV^8dQhRR/#rrrr)rs"rrr s--t-rcT\P4'dR#^RIHpV!4#)uWhether an explicit ``board=`` (or scoped ``--board``) must still resolve through the ``HERMES_KANBAN_DB``-style env pins instead of its own board dir. True for machine flows wrapped in :func:`pin_first_board_resolution` and for every execution the dispatcher fences: its own workers (they carry ``HERMES_KANBAN_TASK``) and delegated children / descendants (the ``HERMES_DELEGATED_CHILD_CONTEXT`` marker). The pins ARE the "workers physically cannot see other boards" isolation (5ec6baa), and ``agent.delegation_context.kanban_path_is_fenced`` checks the pinned path / fenced root — an explicit board that resolved elsewhere would also escape that fence.Texplicit_board_intent_is_pinned)rr;rjr,r+s r_explicit_board_intent_pinnedr- s"#&&((H * ,,rc ,V^8dQhRRRRRRRRRR /#) renv_varrDr default_partstuple[str, ...]leafr#rrr)rs"rrrs4"" "#0"AP"X[" "rcxV'd/\PPVR4P4MRp\ V4pV'd.Ve\ 4'd\ V4P4#Vf \4pV\8Xd\4P!V!#\V4V, #)utShared resolver. An explicit ``board=`` argument — or the scoped ``--board`` context (:func:`scoped_current_board`) — outranks the ``env_var`` pin ONLY where no fence applies (see :func:`_explicit_board_intent_pinned`): user-facing cross-board intent (CLI ``--board``, a model tool's ``board=``) is honored, but machine flows that enumerate boards (gateway notifier / watcher / dispatcher ticks) and dispatched or delegated workers keep resolving through the pin. Without explicit intent the ``env_var`` override pins the file, else legacy ``/`` for the ``default`` board, else ``board_dir(slug)/leaf``.r8) r9r:r;r<r'r-rrrrrkjoinpathr )r/rr0r2pinrs&&&& r _board_pathr6s29"**.." % + + -bC  &D  = ? ?Cy##%% | " }}%%}55 T?T !!rc V^8dQhRRRR/#rr)rs"rrr2sOO-O4Orc\RVRR4#)z``kanban.db`` path: ``HERMES_KANBAN_DB`` pins it (injected into workers); ``default`` -> ``/kanban.db`` (back-compat), else the board dir.HERMES_KANBAN_DB kanban.db)r:r6rs&rkanban_db_pathr<2s )5.+ NNrc V^8dQhRRRR/#rr)rs"rrr8sgg=gDgrc\RVRR4#)zPer-board scratch workspace root (``HERMES_KANBAN_WORKSPACES_ROOT`` wins); ``default`` keeps the legacy ``/kanban/workspaces/``.HERMES_KANBAN_WORKSPACES_ROOT workspaces)rr@r;rs&rworkspaces_rootrA8s 6?WYe ffrc V^8dQhRRRR/#rr)rs"rrr>sjjMjTjrc\RVRR4#)zPer-board attachments root (``HERMES_KANBAN_ATTACHMENTS_ROOT`` wins). Workers read attachments by absolute path, so remote terminal backends must mount it.HERMES_KANBAN_ATTACHMENTS_ROOT attachments)rrEr;rs&rattachments_rootrF>s 7@Y[h iirc$V^8dQhRRRRRR/#rrpr#rrDrrr)rs"rrrDs!33#3m3t3rc(\VR7V, #)z?Return the per-task attachment directory ``//``.r)rFrprs&&rtask_attachments_dirrKDs % (7 22rc V^8dQhRRRR/#rr)rs"rrrIs@@=@D@rc\RVRR4#)zyPer-board worker log dir (logs follow the board so ``hermes kanban log`` is unambiguous when two boards share a task id).Nlogs)rrNr;rs&rworker_logs_dirrOIs tU$6 ??rc ]tRtRt$RtR]R&R]R&R]R&R]R&R]R &R ]R &R]R &R ]R&R ]R&R ]R&R]R&R]R&R]R&R ]R&R]R&RtR]R&RtR]R&RtR]R&Rt R]R&^t R ]R&Rt R ]R&Rt R]R&Rt R ]R&RtR ]R&RtR ]R &RtR]R!&RtR]R"&RtR#]R$&RtR]R%&RtR]R&&RtR]R'&RtR ]R(&R)tR*]R+&RtR ]R,&RtR]R-&RtR]R.&^tR ]R/&RtR]R0&]R1R2l4tR3tR#)4riQz1In-memory view of a row from the ``tasks`` table.r#rtitlerDbodyrstatusr6priority created_byr created_at started_at completed_atworkspace_kindr claim_lock claim_expirestenantN branch_name project_idrOidempotency_keyconsecutive_failuresrlast_failure_errormax_runtime_secondslast_heartbeat_atrworkflow_template_idcurrent_step_keyzOptional[list]skillsmodel_overrideprovider_overridereasoning_effort max_retriesFr goal_modegoal_max_turns session_id block_kindblock_recurrencescompletion_contractc V^8dQhRRRR/#)rr! sqlite3.Rowrrr)rs"rrTask.__annotate__s  ; 4 rc aR V3Rllp\V!R44p\V\4'd%VUu.uFqD'gK \V4NK upMRpT!R /\Uu/uFqf\ SV,4bK upB\ Uu/uFqf\V!V44bK upB\Uu/uF qfV!V4bK upB\Uu/uFqfV!V4;'gRbK upBRV!RV!R^44RV!RV!R44RTR\V!R44R\V!R4;'g^4/B#uupiuupiuupiuupiuupi) Nc.<\\SW44#r`)rr')r"r$r!s&&rTask.from_row..sk(32M&Nrrfr`spawn_failuresralast_spawn_errorrkror`r) r-rrr#_TASK_REQUIRED_COLUMNSr_TASK_EPOCH_COLUMNS _to_epoch_TASK_OPTIONAL_COLUMNS_TASK_EMPTY_IS_NULL_COLUMNSrr6)clsr!gr1r skills_valuer"s&f rfrom_row Task.from_rows_ N!H+&8B648P8P41!A4VZ   5KL5KcKC))5KL  1DE1D#Iaf%%1DE  '==&*  "!$7"8"="=A>  5LE=Js) D9D9#D> E .E E E r) __name__ __module__ __qualname____firstlineno____doc____annotations__r]r^rOr_r`rrarbrcrrdrerfrgrhrirjrkrlrmrnrorp classmethodr__static_attributes__rrrrrQs_; G J  KM!!  !%K% $J $ FM %)O]) !#! $J $(, ,)--'+}+$(NM(*.-.&*m*!FN!$(NM('+}+&*m*!%K%It$(NM( $J $ $J $s)--  rrrQrRrrSrTrUrYrrVr]r^r\rOr_rbrdrerjrmrprgrhrirlc]tRtRt$RtR]R&R]R&R]R&R]R &R]R &R]R &R ]R &R ]R&R ]R&R ]R&R]R&R ]R&R]R&R]R&R]R&R]R&]RRl4tRtR#)RunizOne attempt at a task (``task_runs`` row): opened on claim, closed on complete/block/crash/timeout/reclaim; carries the handoff summary.r6rr#rprDprofilestep_keyrSrZrr[rrbrcrWended_atrsummaryOptional[dict]metadataerrorc V^8dQhRRRR/#)rr!rrrrr)rs"rrRun.__annotate__s   ;  3  rc <T!R/RUu/uFq"\W,4bK upBRUu/uFq"\W,4bK upBR\VR,4R\VR,4;'g^R\\VR,44/B#uupiuupi)rprrWrr) rprrrSrZrrbrrr)r[rcr)rr|r6r-)rr!r"s&& rr Run.from_rows  77s[**7  4ff3eCIch''3ef  3t9~  +4C 4E*F*K*K!  k#j/:;   gs B B rN rrrrrrrrrrrrrrsxJ G L  K  &&$$O       rrc`]tRtRt$R]R&R]R&R]R&R]R&R]R&]R R l4tR tR #) Commentir6rr#rpauthorrRrVc V^8dQhRRRR/#)rrrrrrr)rs"rrComment.__annotate__s    rc  T!VR,VR,\VR,4\VR,4\VR,4;'g^R7#)rrprrRrV)rrprrRrV)rr|rrs&&rrComment.from_rowsGw) [85MQvY'Ia o4N4S4SRS  rrN)rrrrrrrrrrrrrs- G L K IO  rrc]tRtRt$RtR]R&R]R&R]R&R]R&R ]R &R]R &R ]R &R]R &]RRl4tRtR#) Attachmentiz fallback. project_id TEXT, claim_lock TEXT, claim_expires INTEGER, tenant TEXT, result TEXT, idempotency_key TEXT, -- Unified consecutive-failure counter. Incremented on spawn -- failure, timeout, or crash; reset only on successful completion. -- The circuit breaker in _record_task_failure trips when this -- exceeds DEFAULT_FAILURE_LIMIT consecutive non-successes. consecutive_failures INTEGER NOT NULL DEFAULT 0, worker_pid INTEGER, -- Restart-stable fingerprint of worker_pid ("|", -- kanban_db_dispatch._process_fingerprint) recorded at spawn: liveness and kills require pid -- AND fingerprint to agree, so a PID recycled after a reboot is never read as our worker or -- signalled. NULL = legacy row (pre-fingerprint spawn); 'unverified' = capture failed at -- spawn (held while live, never signalled). Column keeps its INTEGER affinity for the -- start-time-only integer values older rows carry. worker_started_at INTEGER, -- Short excerpt of the most recent failure's error text. last_failure_error TEXT, max_runtime_seconds INTEGER, last_heartbeat_at INTEGER, -- Pointer into task_runs for the currently-active run (NULL if no -- run is in-flight). Denormalised for cheap reads. current_run_id INTEGER, -- Forward-compat for v2 workflow routing. In v1 the kernel writes -- these when the task is opted into a template but otherwise ignores -- them; the dispatcher doesn't consult them for routing yet. workflow_template_id TEXT, current_step_key TEXT, -- Force-loaded skills for the worker on this task, stored as JSON. -- Passed to the worker via `--skills`. NULL or empty array = no extras. skills TEXT, -- Per-task model override. When set, the dispatcher passes -m -- to the worker, overriding the profile's default model. NULL = use -- the profile default. model_override TEXT, -- Provider the model override belongs to. When set (alongside -- model_override), the dispatcher passes --provider so the -- worker resolves the model against the right backend instead of the -- profile's configured provider. NULL = profile provider. provider_override TEXT, -- Per-task reasoning effort for the worker (minimal|low|medium|high| -- xhigh|max|ultra, or 'none' for thinking off). When set, the dispatcher -- passes --reasoning so the worker runs at that depth regardless -- of the profile's agent.reasoning_effort. NULL = profile setting. reasoning_effort TEXT, -- Per-task override for the consecutive-failure circuit breaker. -- The value is the failure count at which the breaker trips — e.g. -- ``max_retries=1`` blocks on the first failure. NULL (the common -- case) falls through to the dispatcher-level ``kanban.failure_limit`` -- config and then ``DEFAULT_FAILURE_LIMIT``. max_retries INTEGER, -- When 1, the dispatched worker runs in a Ralph-style goal loop: an -- auxiliary judge re-evaluates the worker's response against the -- card title/body after each turn and feeds a continuation prompt -- back into the SAME session until the judge agrees the work is done -- or ``goal_max_turns`` is exhausted. NULL/0 = classic single-shot -- worker (the default). goal_mode INTEGER NOT NULL DEFAULT 0, -- Goal-loop turn budget for ``goal_mode`` workers. NULL = use the -- goals-engine default. goal_max_turns INTEGER, -- Originating chat/agent session id when the task was created from -- inside an agent loop that propagated ``HERMES_SESSION_ID``. NULL -- for tasks created from the CLI, dashboard, or any path that doesn't -- set the env var, and for an id with no ``sessions`` row in this -- profile's state.db (kanban_create verifies before stamping). Indexed -- so per-session list queries stay cheap on larger boards. session_id TEXT, -- Typed block reason set by ``block_task`` (one of VALID_BLOCK_KINDS, or -- NULL for legacy/un-typed blocks). Drives routing: ``dependency`` never -- sits in ``blocked`` (goes to ``todo`` for parent-gating); the others go -- to ``blocked`` for a human. Preserved across unblock so a re-block for -- the SAME kind can be recognised as a loop. block_kind TEXT, -- Unblock-loop counter. Incremented each time a task is re-blocked for the -- same truly-blocked reason after having been unblocked. When it reaches -- BLOCK_RECURRENCE_LIMIT the task is routed to ``triage`` instead of -- ``blocked`` so a cron can't spin it forever. Reset to 0 only on a -- successful completion — NOT on unblock (resetting on unblock is exactly -- the amnesia that let the loop run unbounded). block_recurrences INTEGER NOT NULL DEFAULT 0 ); CREATE TABLE IF NOT EXISTS task_links ( parent_id TEXT NOT NULL, child_id TEXT NOT NULL, PRIMARY KEY (parent_id, child_id) ); CREATE TABLE IF NOT EXISTS task_comments ( id INTEGER PRIMARY KEY AUTOINCREMENT, task_id TEXT NOT NULL, author TEXT NOT NULL, body TEXT NOT NULL, created_at INTEGER NOT NULL ); CREATE TABLE IF NOT EXISTS task_events ( id INTEGER PRIMARY KEY AUTOINCREMENT, task_id TEXT NOT NULL, run_id INTEGER, kind TEXT NOT NULL, payload TEXT, created_at INTEGER NOT NULL ); -- Historical attempt record. Each time the dispatcher claims a task, a -- new row is created here; claim state, PID, heartbeat, runtime cap, -- and structured summary all live on the run, not the task. Multiple -- rows per task id when the task was retried after crash/timeout/block. -- v2 of the kanban schema will use ``step_key`` to drive per-stage -- workflow routing; in v1 the column is nullable and unused (kernel -- ignores it). CREATE TABLE IF NOT EXISTS task_runs ( id INTEGER PRIMARY KEY AUTOINCREMENT, task_id TEXT NOT NULL, profile TEXT, step_key TEXT, status TEXT NOT NULL, -- status: running | done | blocked | crashed | timed_out | failed | released claim_lock TEXT, claim_expires INTEGER, worker_pid INTEGER, -- Spawn-time start fingerprint of worker_pid (see tasks.worker_started_at). Retained with -- worker_pid after the run ends so a worker that outlives its terminal transition can -- still be found and reaped; NULL = legacy row, never signalled. worker_started_at INTEGER, max_runtime_seconds INTEGER, last_heartbeat_at INTEGER, started_at INTEGER NOT NULL, ended_at INTEGER, outcome TEXT, -- outcome: completed | blocked | crashed | timed_out | spawn_failed | -- gave_up | reclaimed | (null while still running) summary TEXT, metadata TEXT, error TEXT ); -- Files attached to a task (PDFs, images, source documents). The blob -- lives on disk under ``attachments_root(board)//``; -- this row carries metadata + the absolute ``stored_path`` so the -- dashboard can list/download and ``build_worker_context`` can surface -- the absolute path to the worker (which has full file-tool access). See -- #35338. CREATE TABLE IF NOT EXISTS task_attachments ( id INTEGER PRIMARY KEY AUTOINCREMENT, task_id TEXT NOT NULL, filename TEXT NOT NULL, stored_path TEXT NOT NULL, content_type TEXT, size INTEGER NOT NULL DEFAULT 0, uploaded_by TEXT, created_at INTEGER NOT NULL ); -- Subscription from a gateway source (platform + chat + thread) to a -- task. The gateway's kanban-notifier watcher tails task_events and -- pushes ``completed`` / ``blocked`` / ``spawn_auto_blocked`` events to -- the original requester so human-in-the-loop workflows close the loop. CREATE TABLE IF NOT EXISTS kanban_notify_subs ( task_id TEXT NOT NULL, platform TEXT NOT NULL, chat_id TEXT NOT NULL, thread_id TEXT NOT NULL DEFAULT '', user_id TEXT, user_id_alt TEXT, chat_type TEXT, notifier_profile TEXT, delivery_mode TEXT NOT NULL DEFAULT 'notify', delivery_metadata TEXT, created_at INTEGER NOT NULL, last_event_id INTEGER NOT NULL DEFAULT 0, last_ping_event_id INTEGER NOT NULL DEFAULT 0, PRIMARY KEY (task_id, platform, chat_id, thread_id) ); CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(status); CREATE INDEX IF NOT EXISTS idx_links_child ON task_links(child_id); CREATE INDEX IF NOT EXISTS idx_links_parent ON task_links(parent_id); CREATE INDEX IF NOT EXISTS idx_comments_task ON task_comments(task_id, created_at); CREATE INDEX IF NOT EXISTS idx_events_task ON task_events(task_id, created_at); CREATE INDEX IF NOT EXISTS idx_runs_task ON task_runs(task_id, started_at); CREATE INDEX IF NOT EXISTS idx_runs_status ON task_runs(status); CREATE INDEX IF NOT EXISTS idx_attachments_task ON task_attachments(task_id, created_at); CREATE INDEX IF NOT EXISTS idx_notify_task ON kanban_notify_subs(task_id); cV^8dQhRR/#rr)rs"rrrs''c'rc<R\P!^4,#)z``t_`` + 4 hex bytes (collision ~1e-3 at 100k tasks; 2 bytes would hit 50% by 10k). Idempotency belongs to ``idempotency_key``, not id uniqueness.t_)secrets token_hexrrr _new_task_idrs '##A& &&rcV^8dQhRR/#rr)rs"rrrs##S#rc^RIpVP4;'gRpV R\P!4 2# \dRpL)i;i)z:Return a ``host:pid`` string that identifies this claimer.Nunknown:)socket gethostnamer,r9getpid)rhosts r _claimer_idrsO!!#00yV1RYY[M "" s:: A  A cV^8dQhRR/#rr)rs"rrrs00c0rcJ\4PR^4^, R2#)zF``":"`` prefix shared by every claim lock issued from this host.r)rsplitrrr _host_prefixrs$m!!#q)!, -Q //rc$V^8dQhRRRRRR/#)rmodelrDproviderrz#tuple[Optional[str], Optional[str]]r)rs"rrrs"M]OrrcT;'gRP4;'gRpT;'gRP4;'gRpV'dV'g \R4hW3#)uStrip both; a provider without a model is rejected (a bare ``--provider`` would re-resolve the profile's model against another backend — exactly the mismatch the override exists to kill).r8Nz+provider_override requires a model_override)r<r=)rrs&&r_validate_model_overridersU[[b   ! ) )TEB%%'//4HFGG ?rc V^8dQhRRRR/#)rrrDrr)rs"rrrs,,-,M,rc*VfR#^RIHpV!V4#)zHLowercase-assignee normalization for Kanban rows (dashboard/CLI parity).N)normalize_profile_name)rr)rrs& r_canonical_assigneers: !( ++rc 0V^8dQhRRRRRRRRRRR R /#) rrrr^rDproject_source_task_idrYr#rrz-tuple[Optional[str], Any, Optional[str], str]r)rs"rrrsF)E)E )E*7)EQ^)E)E)6)E3)Erc`Ve$\V4P4;'gRMRpV'gRRRV3#^RIHpRpVP 4;_uu_4pVP Wq4pRRR4Xf.T'd&\YT\T44wrTe TR8XdRpTfRRRT3#TR8XdTP'dRpTR8Xd,Tf(TP'd\TP4pTPYT3# +'giL;i \ dRpLi;i)a``(project_id, project_obj, project_repo, workspace_kind)`` for ``create_task``. A project-linked task is anchored to the project's primary repo as a worktree with a deterministic branch (slug + task id). Projects live in the creator's per-profile projects.db, but the stored repo path is absolute so the cross-profile dispatcher needs no projects.db access. ``project_repo`` is set when the worktree path must still be derived from the new task id. N projects_dbscratchworktree) r#r< hermes_clirconnect_closing get_projectr,_project_from_source_task primary_pathr) rr^rrYr_pdb project_repo_pconn project_objs &&&&& r_resolve_project_linkrs.7A6L#j/'')11TRVJ T4//."&L  ! ! # #v**6>K$5$=  C(>$?% !   "~'B'NT4//"{'?'?'?##(>;C[C[C[;334 >>;n DD-$ #  s0DD +D D DD D-,D-c ,V^8dQhRRRRRRRRRR /#) rrrrrr^r#source_task_idrztuple[Any, Optional[str]]r)rs"rrr2s4'%'% '%$''%58'%JM'%'%rc\W4pVe5VPV8Xd$VPR8XdVP'gR#\ VP4pVP 4'd7VP VP8XdVPP R8XgR#RpVP'dVPPR4wrxp V'dqWP8Xg%V PVP R24'd=\P!\4;_uu_4VPV4pRRR4Vf=\P!\4;_uu_4VPV4pRRR4V'gR#\!VPP4p VP#W&V^V R7p W3# +'giL;i +'giLd;i)aRecover a Project (and its repo) from a canonical project-linked worktree task on this board. Worker profiles have their own projects.db while the Kanban DB is shared, so this carries the repo + branch convention forward without opening the creator's store and without reusing the source task's literal worktree path. ``(None, None)`` when the source task is not a ``/.worktrees/`` project worktree.Nr .worktrees/-)rrr5rVr)NN)get_taskr^rYrr is_absoluter5rrr] partition startswithrrr=normalize_slugr#Project) rrr^r source_task source_path project_slugprefix separatorr2rrs &&&& rrr2s40K  " "j 0  & &* 4  & & &{112K!!     .    # #| 3L"-"9"9"C"CC"H4 $..0DOO{~~FVVWDX4Y4Y$$Z00#226: 1   , ,..z:L- {))001L,, |XdK  $$10- ,s9G9G' G$ ' G7 c V^8dQhRRRR/#)rrfOptional[Iterable[str]]rzOptional[list[str]]r)rs"rrr\s%%#:%?R%rcVfR#.p\4p.pVFpV'gK \V4P4pV'gK0RV9d\RV: R24hVP 4\ 9dVP V4KsWR9dK{VPV4VP V4K V'd>RPRV44p\V4^8XdRMRp\V R V R 24hV#) zStrip/dedupe a skills list. Commas are refused (a comma-joined string must not land in one argv slot); toolset names are rejected all at once because agents that confuse the two usually pass several.N,z!skill name cannot contain comma: zA (pass a list of separate names instead of a comma-joined string)rXc38"TFp\V4xK R#5ir`)repr)rbns& rrc)_normalize_task_skills..xs:Mq477Mzis a toolset namezare toolset names z, not skill name(s). Put toolsets in the assignee profile's `toolsets:` config instead of per-task skills. Skills are named skill bundles (e.g. `blogwatcher`, `github-code-review`); toolsets are runtime capabilities (e.g. `web`, `browser`, `terminal`).) rr#r<r=raKNOWN_TOOLSET_NAMESappendaddr\len)rfcleanedseen toolset_typosrr5quotednouns& r_normalize_task_skillsr\s~GUD!M  1v||~  $;3D8\V4PR4;'gRP4;'gRpVfRpV\9d \R \\4 R V: 24hVe$\!V4P4;'gRpV'dVR 8wd \R 4h\#VVVWV4wppp p\$;QJd.R V 4FNK 5M !R V 44p \'V4p!V 'd3VP)RV 34P+4p"V"'d V"R,#\-\.P.!44p#Vf9V f5VR-9d.\V4PR4p$V$'d \!V$4p\1^4EFp%\34p&\5VRR7;_uu_4V!W VW4wp'pVeNVR 8XdGV 'd*V'g"\6P8P;V RV&4pV'g\=VV&V4pTP)RT&VP4Y#T'T TT#YVTTY\?V 4V!e\@PB!V!4MR\?V4TTTV'd^M^\?V4VV34V Fp(\EVV(V&4K \GTT&RRTRT'R\IV 4RTRTRTRTRTRTRV!'d \IV!4MRR\KV4;'gRR VR!V/ 4V'R"8Xd\GTT&R"R#R$RR"R%T;'gR&/4V'R'8XdFV U)u.uFp)\MVV)4R.9gKV)NK p*p)V*'d\GVV&R(R#R)R*V*^,/4V!VV&VV#R+7\OVV&V V#R+7RRR4V&u# \UR,4h \dELqi;iuup)i +'giL8;i \PPRdT%^8XdhEKTi;i)/uCreate a task (optionally under ``parents``); returns its id. Status: ``ready`` unless a parent is not ``done`` (``todo``); ``triage=True`` forces ``triage``; ``initial_status="blocked"`` parks it for human ops. ``idempotency_key``: an existing non-archived task with the key is returned instead of a duplicate. ``max_runtime_seconds``: cap before the dispatcher SIGTERMs and re-queues. ``model_override``/``provider_override`` pin the worker model (provider requires model); ``reasoning_effort`` is independent. ``creator_task_id``: inherit durable session/subscriptions independently of dependency edges; an explicit ``session_id`` still wins. ``project_source_task_id``: cross-profile fallback when ``project_id`` is not in the active profile's projects.db — see ``_resolve_project_link``. ``workspace_kind=None`` (omitted) inherits a project-scoped board's project; an explicit ``"scratch"`` or ``project_id=""`` is a request for no project. )initial_task_stateinherit_creator_origin)validate_contractztitle is requiredzinitial_status must be one of Nrr^r8zworkspace_kind must be one of rYrz1branch_name is only valid for worktree workspacesc38"TFq'gK VxK R#5ir`rrbps& rrccreate_task..s,w!!AAw  zhSELECT id FROM tasks WHERE idempotency_key = ? AND status != 'archived' ORDER BY created_at DESC LIMIT 1rdefault_workdirT allow_nestedra| INSERT INTO tasks ( id, title, body, assignee, status, priority, created_by, created_at, workspace_kind, workspace_path, branch_name, project_id, tenant, idempotency_key, max_runtime_seconds, skills, max_retries, model_override, provider_override, reasoning_effort, goal_mode, goal_max_turns, session_id, completion_contract ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) createdrrSrr r\rYrr]rfrkrgrhrRreasonr actorusertododependency_waitparent_not_doner)rV unreachable>dirrdoner)+hermes_cli.kanban_db_graphrrhermes_cli.kanban_pr_acceptancerrr^rr<r=VALID_INITIAL_STATUSESsorted_board_meta_forr;r,VALID_WORKSPACE_KINDSr#rtuplerrrr6timeranger write_txnr9rfr\_project_branch_namerr*dumps_link _append_eventrr _task_status_inherit_notify_subssqlite3IntegrityError RuntimeError)+rrQrRrrUrYrr]r\rTrr r_rbrfrjrgrhrirkrlr rmrr^rr rprrrrr skills_listr!now board_defaultattemptrp task_statusrrgatings+&$$$$$$$$$$$$$$$$$$$$$$$$$$$ r create_taskr=s<VA+,?@(@Qb(c%N%12BC"8,H  ,--339&AW:X9YZ[[ n 9 )%044\BHHbOOQYYUYJ"22,V4I-J,KL!$ &  +&,,.66$ ~3LMMe,w,ee,w,,G(0Kll /1@0B  (* t9  diik C,"6>M`;`'.223DE  /N8.Q 4d33&8X^&g# V*~/K#N)+lLRY)Z&&:;QV&W     X"C#Z !453>3J ;/PT -~?PRb&Ax/GUh,#C$W-#"H +!4=)? &(.(.%{$j {${"3#T)_%<%<(.+-> ()+!!!#3Xy'S]SgSgagh  &(*1fALq4IQe4eaaFf% #-%'8(F1IN 'tWoRUV$T7GLU4VNah } %%{   \gA43X%% !| s P68P6P6<Q  Q 2Q :(Q #C!Q (Q .Q Q Q >Q  Q 6 QQQ  Q Q  RRc V^8dQhRRRR/#)rrrDrr/r)rs"rrr4sHH=HTHrcD\V'dV4#\44#r`)rrrs&rr(r(4s u GG3D3F GGrc(V^8dQhRRRRRRRR/#)rrrrpr#rQrDrr)rs"rrr8s)cC R_rcn^RIHpTPYT;'gRR7# \dR#i;i)rr8)rQN)rrbranch_name_forr,)rrprQrs&&& rr.r.8s8.##K #LL s%% 44c(V^8dQhRRRRRRRR/#)rrr parent_idr#child_idrrgr)rs"rrrAs)"scdrc,VPRW34R#)zDINSERT OR IGNORE INTO task_links (parent_id, child_id) VALUES (?, ?)Nr)rrErFs&&&rr0r0AsLLN rc$V^8dQhRRRRRR/#)rrridsrr list[str]r)rs"rrrHs"00.0]0y0rc,\V4pV'g.#RPR\V4,4pVPRV R2V4P 4pVUu0uF qDR,kK ppVUu.uF qfV9gK VNK up#uupiuupi)z5Subset of ``ids`` (order kept) with no ``tasks`` row.r?z"SELECT id FROM tasks WHERE id IN ()r)rr\rrfetchall)rrJ placeholdersrowsrpresentrs&& r_missing_task_idsrSHs s)C  88C#c(N+L <<<\N!Lc R [ [ ]D $%1wwG% /s!w.AAs //& /sB 6BBc ,V^8dQhRRRRRRRRR R /#) rrrrFr#rrrVrrrgr)rs"rrrSs6## #(+#6C## #rc\\PRV444pV'gR#VPRV34P 4p\ Ve VR,M^4pRP R\V4,4pTPRV R2T\ VeTM\P!44V.VO54R#) a4Copy parents' notify subscriptions to a child, cursor caught up to the child's current event so a late ``link_tasks`` never replays history. Single owner of inheritance (create_task, link_tasks, decompose). It must copy EVERY routing/delivery column: dropping ``chat_type`` made DM-originated completions wake a fresh group session instead of the originating DM. Omitting columns here silently degrades routing: a DM-originated child completion falls back to chat_type='group' and wakes a fresh group-scoped session instead of the originating DM (issue #73030). c38"TFq'gK VxK R#5ir`rrs& rrc'_inherit_notify_subs..as$=11QQrNzHSELECT COALESCE(MAX(id), 0) AS cursor FROM task_events WHERE task_id = ?cursorrrMa INSERT OR IGNORE INTO kanban_notify_subs (task_id, platform, chat_id, thread_id, user_id, user_id_alt, chat_type, notifier_profile, delivery_mode, delivery_metadata, created_at, last_event_id) SELECT ?, platform, chat_id, thread_id, user_id, user_id_alt, COALESCE(chat_type, 'dm'), notifier_profile, COALESCE(delivery_mode, 'notify'), delivery_metadata, ?, ? FROM kanban_notify_subs WHERE task_id IN (z ) ) r*r/fromkeysrrr6r\rr+)rrFrrV parent_idsr!rXrPs&&&$ rr3r3Sst}}$=$==>J  ,,RU]T_ hj#/Xq 9F88C#j/12LLL )>*   3Z%;zMvcXbc rc$V^8dQhRRRRRR/#)rrrrpr#rr~r)rs"rrrys"//%///rcVPRV34P4pV'd\PV4#R#)z SELECT * FROM tasks WHERE id = ?N)rrrrrrpr!s&& rrrys4 ,,9G: F O O QC!$4== .$.rrcreated_at ASC, id ASCz created-desczcreated_at DESC, id DESCzpriority DESC, created_at ASCz priority-desczpriority ASC, created_at ASCzstatus ASC, created_at ASCzassignee ASC, created_at ASCztitle ASC, id ASCupdatedz+started_at DESC NULLS LAST, created_at DESCzcompleted-descz%completed_at DESC NULLS LAST, id DESCdict[str, str]VALID_SORT_ORDERSinclude_archivedlimitorder_bycDV^8dQhRRRRRRRRRRRR R R R RR RRRRR/ #)rrrrrDrSr\rmrbrrcrrdrdrerz list[Task]r)rs"rrrsp,, ,+8,IV, ,.;,VZ, ,,9,( ,CP ,  ,rc Ve'V\9d\R\\4 24hRp .p R\V43RV3RV3RV3RV3RV 33F)wrV fK V R V R 2, p V P V 4K+ V'gVR 8wd V R , p VekVP 4P 4pV\9d*\R \\P44 24hV R\V, 2, p M V R, p V'dV R\V4 2, p VPW4P4pVUu.uFp\PV4NK up#uupi)Nzstatus must be one of zSELECT * FROM tasks WHERE 1=1rrSr\rmrdre AND  = ?rz AND status != 'archived'zorder_by must be one of z ORDER BY z' ORDER BY priority DESC, created_at ASCz LIMIT )VALID_STATUSESr=r'rrr<r[rar&r6rrOrr)rrrSr\rmrbrcrdrdrequeryparamsr"r rQrs&$$$$$$$$$ r list_tasksrlsp fN:1&2H1IJKK +EF (23h5G(TZI[ z"%;=Q$R -. ? uSE& &E MM#  * 4 ,,>>#))+ , ,7?P?U?U?W8X7YZ[ [ :/9:;; ::  73u:,'' << & / / 1D&* +dDMM! d ++ +sE)c(V^8dQhRRRRRRRR/#) rrrrpr#rrDrrr)rs"rrrs*(3SWrc \V4p\V4;_uu_4VPRV34P4pV'g RRR4R#VR,eVR,R8Xd\ RV R24hVR ,V8wdVPR W!34MVPR W!34\ WR R VR VR ,/4RRR4\ WR4R# +'giL;i)zMAssign/reassign; raises RuntimeError while the task is running under a claim.z;SELECT status, claim_lock, assignee FROM tasks WHERE id = ?NFrZrSrQzcannot reassign zS: currently running (claimed). Wait for completion or reclaim the stale lock first.rz_UPDATE tasks SET assignee = ?, consecutive_failures = 0, last_failure_error = NULL WHERE id = ?z*UPDATE tasks SET assignee = ? WHERE id = ?assignedfromT)r)rr-rrr6r1r)rrprr!s&&& r assign_taskrqs!'*G 4ll IG: (*   |  (S]i-G"7),GG  z?g % LL9;B:L  LLEGY Z  : GVS_'U + 2}5 5 s+CA5C C/ c ,V^8dQhRRRRRRRRRR /#) rrrrpr#rrDrrrr)rs"rrrs4    '* 3@ LY   rc J\W#4wr#\WRW#3RRVRV/RRR7#)zSet (empty ``model`` clears BOTH) the per-task model/provider override. Allowed while ``running``: it applies on the NEXT dispatch, which is the rate-limit-recovery flow (set, then reclaim/retry).zGUPDATE tasks SET model_override = ?, provider_override = ? WHERE id = ?model_override_setrrzcannot set model override archived_msg)rgrh)r_set_task_override)rrprrs&&&&rset_model_overriderxs= /u?OE  QTYSdwz8D/>Y  rc<V^8dQhRRRRRRRRRRR R R R R RRR/ #)rrrrpr#sqlrkr* event_kindrr/rr1rvrrr)rs"rrrsV '*14>CQT_c#69 rc$\V4;_uu_4\W4pVf RRR4R#VR8Xd\V RV 24hVPV.VOVN54\ WWE4RRR4\ WV4R# +'giL;i)zPer-task override write: refuse archived tasks, record ``event_kind``, then fire the task-updated observer AFTER commit (RFC #58548).NFrz on archived task T)r-r2r6rr1r) rrprzrkr{rrrvrSs &&&&&&&$ rrwrws 4d, >  Z ,/A'KL L S,F,G,-dZ9 ~6  sA?:A?? B c(V^8dQhRRRRRRRR/#) rrrrpr#rTrDrrr)rs"rrrs*  1 C  [_ rc B\V4p\WRV3RRV/RRR7#)zSet (empty clears; ``"none"`` pins thinking OFF) the per-task reasoning effort. Independent of the model override so clearing one never resets the other; applies on the NEXT dispatch, so settable while running.z2UPDATE tasks SET reasoning_effort = ? WHERE id = ?reasoning_effort_setrizcannot set reasoning effortru)ri)r^rw)rrprTs&&&rset_reasoning_effortrs6( /F  KfY!3V <,I rexpected_child_run_idc ,V^8dQhRRRRRRRRRR /#) rrrrEr#rFrrrrr)rs"rrrs:88 888 ) 8  8rc W8Xd \R4hRp\V4;_uu_4\WV.4pV'd\RRPV4 24hVP RV34P 4pVR,R8Xd%VeVR ,V8wd\R V R V R 24h\ WV4'd\R V R V R24h\WV4\W4R9d?VP RV34pVP^8HpV'd\VVRRRRRRV/4\VVRRVRV/4\WV34RRR4V# +'giT#;i)aLink ``parent_id -> child_id``. Returns True when the link gated a ``ready`` child back to ``todo`` (the new parent is not yet terminal), so callers can surface the demotion instead of a silent status flip. A running child cannot normally be gated retroactively, so reject the edge rather than record a dependency that did not constrain the active run. The owning worker may link its own active run for a subsequent dependency-block handoff by supplying its trusted ``expected_child_run_id``. za task cannot depend on itselfFzunknown task(s): rXz5SELECT status, current_run_id FROM tasks WHERE id = ?rSrQNrz cannot link z -> z: child is already runningzlinking z would create a cycleBUPDATE tasks SET status = 'todo' WHERE id = ? AND status = 'ready'rrrdemotedTrlinkedchildr") r=r-rSr\rr _would_cycler0r2rowcountr1r3)rrErFrgatedmissingrcurs&&&$ r link_tasksrs 9:: E 4#Dh*?@ 071C0DEF F Ch[ (*  ?i ' ! )%&*??|I;d8*D^_` `  2 2x {$xj@UVW W dx(  (0D D,,T CLLA%E%0)T8YW      y'8 4  Ti\:I J LK J LsC/E3E E% c(V^8dQhRRRRRRRR/#rrrrEr#rFrrr)rs"rrr8s))cSTrc\4pV.pV'dmVP4pWQ8XdR#WS9dK(VPV4VPRV34P 4pVP RV44KtR#)z?True iff ``parent_id`` is already a descendant of ``child_id``.Tz3SELECT child_id FROM task_links WHERE parent_id = ?c32"TF qR,xK R#5i)rFNr)rbrs& rrc_would_cycle..Fs1Dqz]]DsF)rpoprrrOextend)rrErFrstacknoderQs&&& rrr8sp 5D JE yy{   <  || AD7 (*   1D11 rc(V^8dQhRRRRRRRR/#rr)rs"rrrJs)  ) c S T rc \V4;_uu_4VPRW34pVP^8pV'd\WRRVRV/4RRR4X'd \ V4V# +'giL%;i)z;DELETE FROM task_links WHERE parent_id = ? AND child_id = ?unlinkedrrN)r-rrr1recompute_ready)rrErFrremoveds&&& r unlink_tasksrJsk 4ll IIK` ,,"  $*xGU]6^ _   N s >rc$V^8dQhRRRRRR/#rr)rs"rrrgs"??&???rc\VRRV4#)rFrErrs&&r child_idsrgs tZg >>rc$V^8dQhRRRRRR/#)rrrtask_idsrrzdict[str, dict]r)rs"rrrks"0Morc\\PRV444pVUu/uF q3R.R./bK ppV'gV#RPRV44pRFwrgpVP RV RV RV R V R V R 2 \ V44P 4FCp WIR ,,V,PR V R ,RV R,RV R,/4KE K V#uupi)zABulk-load compact direct graph state for graph-aware diagnostics.c3J"TFq'gK \V4xK R#5ir`)r#)rbrps& rrc&task_graph_contexts..ms$UgW\S\\s ##rchildrenrc3&"TFpRxK R#5irMNrrb_s& rrcrrs5ACz SELECT l.zQ AS owner_id, t.id, t.title, t.status FROM task_links l JOIN tasks t ON t.id = l.z WHERE l.z IN (z ) ORDER BY l.z, t.idowner_idrrQrS))rrFrE)rrErF)rr/rYr\rr*rOr) rr ordered_idsrpcontextsrPbucketownotherr!s && rtask_graph_contextsrkst}}$U$UUVKHST W)RR88 HT 88555LkU<<u::?Ae5mC5 HIN{I[  (* C _ %f - 4 4s4y'3w<3x=Q  l OUsC+c$V^8dQhRRRRRR/#)rrrrpr#rr/r)rs"rrrs"99/9#9$9rc(\W.4V,#)z6Return compact direct parent/child state for one task.)rrs&&rtask_graph_contextrs tY / 88rc ,V^8dQhRRRRRRRRRR/#) rrrrpr#rrRrr6r)rs"rrrs1''('3''3'SV'rc 4V'dVP4'g \R4hV'dVP4'g \R4h\\P!44p\ VRR7;_uu_4\ W4VP RWP4VP4V34p\WRRVR\V4/4\VP;'g^4uuRRR4# +'giR#;i) zcomment body is requiredzcomment author is requiredTrQINSERT INTO task_comments (task_id, author, body, created_at) VALUES (?, ?, ?, ?) commentedrrN) r<r=r6r+r- _require_taskrr1r lastrowid)rrprrRr8rs&&&& r add_commentrs tzz||344 566 diik C 4d + +d$ll "$+\\^TZZ\3#O  d[8VUCPTI2VW3==%%A& , + + +s A5D D c$V^8dQhRRRRRR/#rrrrpr#rrgr)rs"rrrs"44*4S4T4rcpVPRV34P4'g\RV 24hR#)z SELECT 1 FROM tasks WHERE id = ? unknown task N)rrr=rs&&rrrs7 <<:WJ G P P R R= 233 Src ,V^8dQhRRRRRRRRRR/#) rrrtabler#rporderrzlist[sqlite3.Row]r)rs"rrrs1'c#RcrcPVPRV RV 2V34P4#)zSELECT * FROM z WHERE task_id = ? ORDER BY r)rrrprs&&&&r _task_rowsrs/ << ;E7CgZ hjrc$V^8dQhRRRRRR/#)rrrrpr#r list[Comment]r)rs"rrrs'gg*gSg]grcn\VRVR4Uu.uFp\PV4NK up#uupi) task_commentszcreated_at ASC)rrrrrprs&& r list_commentsrs3)3D/7Td)e f)eAG  Q )e ff f2after_idc(V^8dQhRRRRRRRR/#) rrrrpr#rr6rrr)rs"rrrs, / /  /'* /9< / /rcVPRV\V434P4pVUu.uFp\P V4NK up#uupi)uComments with ``id > after_id`` — keyed on rowid, not ``created_at``, so a same-second burst is never skipped (live worker comment bridge).zlSELECT id, task_id, author, body, created_at FROM task_comments WHERE task_id = ? AND id > ? ORDER BY id ASC)rr6rOrr)rrprrQrs&&$ rlist_comments_afterrsT << 79@#h-8P hj *. .AG  Q  .. .sAc]tRtRtRtRtR#)AttachmentTooLargeizAttachment over the size cap. A ``ValueError`` so generic 400 handlers still catch it while the tool/CLI can give a 413-style message.rNrrrrrrrrrrrsGrrc V^8dQhRRRR/#)rr>r#rr)rs"rrrs  s s rcDT;'gRPRR4PR4R,P4pRPRV44P4pVP R4P4pV'g \ R4hVR,#) zClient filename -> safe basename: strip directories (both separators), control chars and leading dots (no dotfiles, no traversal); ValueError when nothing usable remains. Only ever joined under the per-task attachments dir.r8\rc3f"TF'qP4'gKVR9gK#VxK) R#5i)N) isprintable)rbchs& rrc(_safe_attachment_name..s"N"(82Rv=M22s 11 1.zinvalid attachment filename:NN)rrr<r\lstripr=)r>r5s& r_safe_attachment_namers II2  tS ) / / 4R 8 > > @D 77NN N T T VD ;;s  ! ! #D 677 :rc$V^8dQhRRRRRR/#)rdest_dirr safe_namer#rr)rs"rrrs!  4 C D rcVPR4wr#pTp^pW, P4'dV RV RV V 2pV^, pK3W, #)zN``foo.pdf`` -> ``foo.pdf``, ``foo (1).pdf``, ... first one that doesn't exist.rz (rN)rr)rrstemdotextrrs&& r_collision_free_pathrs^((-NDsI A   ' ' ) )fBqc3%u-  Q  rrr max_bytesc<V^8dQhRRRRRRRRRR R R R R R R RR/ #)rrrrpr#rdatarrrDrrrrrr6r)rs"rrrsZ '*69AF5B -: rc &Vf\p\V4V8d\RVR , R24h\V4p\ WR7p V P RRR7\ W4p V PV4\WV P\V P44V\V4VR7# \dS\P!\4;_uu_4T P!RR7RRR4h +'gih;ii;i) a"Single attachment write path (dashboard, tools, CLI): size cap, safe basename, collision-free blob under :func:`task_attachments_dir`, then the metadata row. Raises :class:`AttachmentTooLarge` / ``ValueError``; a blob whose row insert fails is removed before re-raising. Returns the new id.Nzattachment exceeds z MB limitrTr )rrrrr missing_ok)KANBAN_ATTACHMENT_MAX_BYTESrrrrKrr write_bytesadd_attachmentr5r#resolver,rrrr) rrprrrrrrrr dest_paths &&&&$$$$ rstore_attachment_bytesrs/  4y9 #6y[7Q6RR[!\]]%h/I#G9H NN4$N/$X9I $  INNIDUDUDW@X%CI;     ) )     -* * ) s$8:B33-D C<3 D< D  Drc8V^8dQhRRRRRRRRRRR R R RR R /#) rrrrpr#rrrrDrr6rrr)rs"rrrsN'' ''*'9<'KN''.1'DQ' 'rc HV'dVP4'g \R4hV'dVP4'g \R4h\\P!44p\ V4;_uu_4\ W4VP RWP4W4\V4Wg34p\WRRVP4R\V4RV/4\VP;'g^4uuRRR4# +'giR#;i) zSRecord the metadata row (+ ``attached`` event) for a blob the caller already wrote.zattachment filename is requiredz"attachment stored_path is requiredzINSERT INTO task_attachments (task_id, filename, stored_path, content_type, size, uploaded_by, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)attachedrrbyN) r<r=r6r+r-rrr1r) rrprrrrrr8rs &&$$$$$ rrrs 8>>++:;; k//11=>> diik C 4d$ll +nn& 3t9k _    : )63t9dK P 3==%%A& s BD D! c$V^8dQhRRRRRR/#)rrrrpr#rzlist[Attachment]r)rs"rrr s(uu-uu@Purcn\VRVR4Uu.uFp\PV4NK up#uupi)task_attachmentsr^)rrrrs&& rlist_attachmentsr s5,6t=OQXZr,s t,sqJ   ",s tt trc$V^8dQhRRRRRR/#rrr attachment_idr6rzOptional[Attachment]r)rs"rrr s#99+9C9DX9rczVPRV34P4pVfR#\PV4#)z+SELECT * FROM task_attachments WHERE id = ?N)rrrr)rr rs&& rget_attachmentr  s9 B]DTU^^`A948*"5"5a"88rc$V^8dQhRRRRRR/#r r)rs"rrrs#.sG[rc f\V4;_uu_4\W4pVf RRR4R#VPRV34VPRVP34P 4RJp\ WP RRVP/4RRR4X'gi\P!\4;_uu_4\XP4pVP4'dVP4RRR4V#X# +'giL;i +'giX#;i)zTDelete the row (source of truth) and best-effort its blob; None when no row matched.Nz)DELETE FROM task_attachments WHERE id = ?z