feat: evidence-gate Hermes delivery and attribution

[lightcloud00]

Adds opt-in request attribution for every Hermes completion path, GitHub action receipts with exact-head readback, receipt-pending Kanban completion and exact-once reconciliation, five-minute dispatch-admission receipts, legacy hold migration, and cross-board worker ceilings.

Also keeps upstream larger-runner behavior intact while using standard GitHub-hosted runners only in the personal evidence fork, where organization-level larger-runner groups are unavailable. The fallback covers every callable Python, OS, Nix, JS, Rust, and desktop lane; Docker publish/build remains restricted to the upstream repository by its existing gate.

Exact source:

• Head: bacc1e3496cfbe1e5f51bbfc5b859c8442b1350b
• Base: 3687f750c5a60b336091316499f47b63639552cf

Verification:

• Repository-native hermetic affected suite: 176 passed, 1 expected host-specific skip, 0 failed
• Workflow actionlint: passed for every modified workflow
• Ruff: passed for all changed Python files
• git diff --check: passed
• Hook doctor: 10 stress passes
• Standalone Alpha interop acceptance: passed

Safety:

• Embedded dispatch remains disabled
• Runtime services and rollback listener state remain unchanged
• Existing task rows and workspaces are preserved

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 31245c7d-6575-49b4-907a-747d6636fde1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

૮ >ﻌ< ა ci review

_{ran on bacc1e3 — ci: cover remaining evidence fork lanes}

⚠️ Warnings

OSV vulnerability scan · View job

7 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-71554 in uv.lock
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json
• CVE-2026-71554 in uv.lock

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

ℹ️ Info

CI-sensitive file review · View job

PR touches sensitive files, but the ci-reviewed label has been added, approving them.

Sensitive files changed:

• .github/workflows/e2e-desktop.yml
• .github/workflows/js-tests.yml
• .github/workflows/nix.yml
• .github/workflows/rust-tests.yml
• .github/workflows/tests-os.yml
• .github/workflows/tests.yml

---

debug info

CI timings

CI timings · View report · View job

Wall time 31m53s (no baseline yet).