fix: make kanban patch and Docker build fully failure-safe

- Wrap entire kanban patch in try/except so any error (encoding, permissions,
changed upstream file structure) skips silently instead of exiting 1
- Use errors='replace' when reading kanban_db.py to handle non-UTF-8 bytes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -8,6 +8,7 @@
 - **Unpinned jupyterlab breaks venv** — `uv pip install jupyterlab` without a version constraint could pull a release incompatible with existing Hermes venv packages. Pinned to `>=4.0,<5` range to bound resolution.
 - **`uv` not in PATH during Docker build** — switched from bare `uv` to explicit `/opt/hermes/.venv/bin/uv` so the install works regardless of base image PATH configuration.
 - **`visudo` not in PATH during Docker build** — switched to explicit `/usr/sbin/visudo` path.
+- **Kanban patch exits with code 1** — entire kanban migration patch now wrapped in `try/except`; any unexpected error (file encoding, permission, changed upstream structure) skips silently instead of failing the Docker build.
 
 ## 0.2.0 - 2026-05-19
 

Dockerfile

@@ -59,41 +59,48 @@ RUN chmod +x \
 
 # Patch kanban migration: wrap ALTER TABLE ADD COLUMN in try/except so a
 # persisted DB with the column already present doesn't crash the gateway.
+# Entire block wrapped in try/except — skips silently if Hermes fixes this
+# upstream or the file structure changes.
 RUN python3 - <<'PY'
-from pathlib import Path
 import sys
-
-p = Path("/opt/hermes/hermes_cli/kanban_db.py")
-if not p.exists():
-    sys.exit(0)
-
-src = p.read_text(encoding="utf-8")
-sentinel = "# huggingmes: idempotent-alter"
-if sentinel in src:
-    sys.exit(0)
-
-old = (
-    '    conn.execute(\n'
-    '        "ALTER TABLE tasks ADD COLUMN consecutive_failures "\n'
-    '        "INTEGER NOT NULL DEFAULT 0"\n'
-    '    )'
-)
-new = (
-    f'    try:  {sentinel}\n'
-    '        conn.execute(\n'
-    '            "ALTER TABLE tasks ADD COLUMN consecutive_failures "\n'
-    '            "INTEGER NOT NULL DEFAULT 0"\n'
-    '        )\n'
-    '    except Exception:\n'
-    '        pass'
-)
-
-if old not in src:
-    print("kanban patch: pattern not found — may be fixed upstream, skipping")
-    sys.exit(0)
-
-p.write_text(src.replace(old, new), encoding="utf-8")
-print("kanban patch: applied")
+try:
+    from pathlib import Path
+
+    p = Path("/opt/hermes/hermes_cli/kanban_db.py")
+    if not p.exists():
+        print("kanban patch: file not found, skipping")
+        sys.exit(0)
+
+    src = p.read_text(encoding="utf-8", errors="replace")
+    sentinel = "# huggingmes: idempotent-alter"
+    if sentinel in src:
+        print("kanban patch: already applied, skipping")
+        sys.exit(0)
+
+    old = (
+        '    conn.execute(\n'
+        '        "ALTER TABLE tasks ADD COLUMN consecutive_failures "\n'
+        '        "INTEGER NOT NULL DEFAULT 0"\n'
+        '    )'
+    )
+    new = (
+        f'    try:  {sentinel}\n'
+        '        conn.execute(\n'
+        '            "ALTER TABLE tasks ADD COLUMN consecutive_failures "\n'
+        '            "INTEGER NOT NULL DEFAULT 0"\n'
+        '        )\n'
+        '    except Exception:\n'
+        '        pass'
+    )
+
+    if old not in src:
+        print("kanban patch: pattern not found, may be fixed upstream, skipping")
+        sys.exit(0)
+
+    p.write_text(src.replace(old, new), encoding="utf-8")
+    print("kanban patch: applied")
+except Exception as e:
+    print(f"kanban patch: error ({e}), skipping", file=sys.stderr)
 PY
 
 # Ensure hermes CLI is discoverable in ALL shell types (login, interactive,