{"repo":"NousResearch/hermes-agent","public_id":"116239","display_label":"Unbound stale worker run-ownership safety fixes","summary":"These items address a vulnerability where an unbound or stale worker could incorrectly complete or mutate work owned by a live run, tightening run-ID ownership checks and failing closed when a run ID cannot be established.","subsystem":null,"counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":116743,"merged_at":"2026-09-20T17:08:03+00:00"},"resolution":{"state":"resolved","by":"pr-116743"},"freshness":{"state":"verified","last_verified_at":"2026-09-20T17:08:03+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":116239,"pr_number":116743,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-20T17:08:03+00:00"}],"members":[{"kind":"issue","number":116239,"title":"[kernel] expected_run_id=None silently disables the run-ownership CAS: an unbound stale worker can complete a task a live successor owns","url":null,"state":"closed"},{"kind":"pr","number":116257,"title":"fix(tools): refuse unbound worker run-lifecycle mutations","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"7c2b5b59815","number":0}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":116269,"title":"fix(kanban): fail closed when a worker cannot name its run id (#116239)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#116257","number":116257}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":116743,"title":"fix(kanban): an unbound stale worker can no longer complete a card a live run owns (#116239, salvage #116257)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/hermes_cli/test_kanban_notify.py","tests/tools/test_kanban_complete_parents_tool.py","tests/tools/test_kanban_tools.py","tools/kanban_tools.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}