kevin
224b344445
CI / build (push) Successful in 2m54s
A primary running INSIDE a herdr pane was resolved as a worker by the pane-match rule and refused every orchestration tool — the exact lockout bridge_whoami surfaced on this deployment. The CB-307 primary.terminal pin always claimed to replace connection-derived identity but only fed the push loop; it now short-circuits CallerResolver ahead of the pane→worker rule (the pane mapping is as unforgeable as a worker's, so no credential needed, even in token mode). bridged.example.yaml documents the block. Also guard the presence bridge against the primary's null terminal: the MCP context extractor marks presence on every request, and the first genuine primary contact NPEd into the SPAWNING→READY transition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SUTLvxtRPr2iT5u5g45BEs