@staix/agent-hub 0.12.15 → 0.12.17

package/docs/smoke.md

@@ -2,6 +2,99 @@
 
 `scripts/check.sh` covers everything against fakes. The legs below need real accounts and an interactive terminal, so they are run by hand and recorded here.
 
+## Operator console and conductor candidate (#190, #191, #193-#195)
+
+Candidate 0.12.17, protocol 15, observed on 2026-10-09 KST. The final Claude
+observer runs used immutable source `20ad5e6`; their native completion receipts
+and actual console effects were checked independently. The Kimi new-tool leg
+remains quota-blocked, as recorded below.
+
+- Actual Codex 0.146.0 (`gpt-5.5`) and Claude 2.1.295 (Opus 5.5) TUIs started
+  real local and headless Pi peers, proposed exactly two tasks owned initially
+  by local, reassigned Beta to Pi, and placed and released their own holds.
+  The real owners checked their outputs and called `hub_task_done`; the native
+  conductor independently read the exact files before approving both tasks.
+  Real CLI calls retained the agent actor, and human-only queue/permission
+  actions were refused from an agent shell.
+- The person authorized `alpha.txt = ALPHA` (5 bytes) and `beta.txt = BETA`
+  (4 bytes), both without a newline. Separate selection and confirmation keys
+  reached the actual console PTY and produced allow-once console audit records.
+  Out-of-scope directory-list commands were cancelled. The final Claude own
+  run used three allow-once answers because Pi combined its exact write and
+  bounded byte checks in one approved command; it also recorded two cancelled
+  local directory-list requests. No permission or task completion was fabricated.
+- The final Claude own run recorded nine completed native turns and nine
+  matching daemon Stop records, 27 unique native usage records, and
+  1,888,242 tokens including cached input. Eight completed native turns contained
+  supervision, with 1,292,922 recorded tokens. Its final message UUID/id,
+  `end_turn`, `turn_duration`, instance/session/launcher and opaque Stop receipt
+  matched; native idle and an empty pending delivery queue were verified before
+  owned-process cleanup. Local recorded three turns and 72,046 gateway tokens;
+  Pi recorded two turns and 47,177 native tokens.
+- A read-only Claude feed-off continuation on the final observer preserved the
+  existing approved tasks and exact files. It verified one completed native turn,
+  four usage records and 263,413 cached-inclusive tokens, with matching daemon
+  Stop, native idle and delivery settlement. An obsolete review hold was first
+  discarded through the authenticated public operator API after fresh approved
+  task/history and exact BETA readback. That discard is not native execution.
+- A real console with two pending cards and no operator input consumed 0.07 CPU
+  seconds over 40.018 wall seconds in stream mode (0.175% of one CPU). A separate
+  actual Peers panel, 120x40, with two pending cards and no operator input used
+  0.07 CPU seconds over 40.012 wall seconds (0.175%). These are cumulative `ps`
+  process CPU samples in distinct modes/runs, not whole-host idle measurements.
+- In a plain Claude TUI without the development-channel flag, one actual
+  `hub_status` MCP call succeeded and the daemon audited the Claude status
+  action. A unique directed operator push was accepted by the bridge, but no
+  pushed native user row or answer appeared in the observed 20.075-second window.
+  This proves tool access separately from the bounded negative push observation.
+  The real channel-enabled runs above received actual review and supervision
+  pushes. The plain probe and cleanup completed in 56.724 seconds, with no model
+  file, shell, task or settings actions.
+- Real Kimi Code CLI 2.1.1 completed ACP initialization and `session/new`, then
+  rejected the single prompt with HTTP 403 for its weekly account usage limit.
+  No requested native tool event or role-refusal result occurred. The reset time
+  was not supplied. The owning CLI listed only the managed OAuth Kimi provider
+  (four models, default `kimi-code/k3`), so no configured alternative provider was
+  found. This is an incomplete external prerequisite, not a new-tool pass. No
+  purchase, provider/configuration change or model retry was performed; owned
+  processes were stopped after 3.142 seconds.
+
+The user explicitly approved release 0.12.17 with only the Kimi native new-tool
+and ordinary-role refusal T0 evidence deferred on 2026-10-09. That native
+prerequisite remains unverified; the quota rejection is not a tool pass. This
+decision does not defer the other native/source gates or authorize a purchase,
+credentials, provider/configuration change or account retry. The same isolated
+read-only Kimi probe remains required before its native coverage is marked verified.
+
+Earlier captures remain part of the evidence:
+
+- Codex feed-off included an interrupted original and read-only continuation:
+  six logical native turns, 49 increments and 1,979,016 tokens. Codex feed-own
+  recorded nine turns, 34 increments and 1,399,470 tokens. Their journals were
+  independently checked after cleanup. The first baseline interruption and
+  operator reconciliation are preserved; neither native task completion nor
+  board approval was substituted by the harness.
+- The original Claude runs approved the actual files but an early idle-based
+  harness stopped their final review answers. Subsequent `da2ebbc` feed-off
+  completed five native turns and 1,451,782 tokens but certified only one daemon
+  Stop. A `6034dd9` read-only continuation completed another native turn and
+  261,483 tokens, while its Stop remained unavailable during the native hook.
+  Both incomplete observer captures are preserved alongside raw and audited
+  summaries. The final post-ACK observer above closes the fresh completion proof;
+  it does not retroactively certify the earlier missed Stop records.
+
+All token totals describe whole native/model turns, including cached input and
+other work. Operator waiting, cancelled requests, marker probes, interrupted
+continuations and differing source revisions make these observations unsuitable
+for a causal feed-overhead or model-efficiency comparison. Unknown measurements
+and the Kimi prerequisite remain explicit.
+
+The harness uses real Python PTYs. Operator-file-input forwards only
+chat-authorized keys, removes inherited Orca terminal ownership from fixture
+children, and generates no approval automatically. Private original and
+continuation captures remain separate. The shell-marker probes and vendor
+limits are recorded in [the identity T0 ledger](verification/2026-10-09-agent-shell-t0.md).
+
 ## Approval race live reproduction and candidate verification (#98)
 
 Measured on 2026-10-02 KST with installed 0.12.1 and the correction candidate,

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1242,3 +1242,226 @@ Relay native-session counters and per-dispatch transport usage are separate
 measurements. Request usage and provider availability are optional metadata,
 bound to their own dispatch IDs; provider absence does not change model
 qualification. Primary and fallback dispatches have independent outcomes.
+
+
+## Task idle sweep (#186, 2026-10-09)
+
+`Tasks.sweep(now)` owns a deterministic, default-off between-turn sweep. It
+classifies proposed tasks with an owner as unaccepted assignments, in-progress
+tasks with an idle owner as idle-owner findings, and in-review tasks with a
+reviewer as review-pending findings. Separate minute thresholds and a ladder
+interval are configured through the strict `task_sweep` config block described
+in operations. The daemon ticks only an enabled sweep and clears its timer on
+shutdown. No control message shape changes.
+
+The activity identity is the last real history entry index, so simultaneous
+real events are distinct. Typed sweep entries persist finding kind, activity
+index, step and injected sweep time in the existing hub.db task history. They
+never reset activity or invalidate a pending completion check. Persisting a
+step precedes its notice: restart does not repeat the step, but a crash between
+write and publish can leave the attempted notice unpublished or uncertain.
+This is not an exactly-once delivery claim.
+
+The ladder sends one ordinary task reminder to the responsible peer, then
+notifies the console and available planner-role peers, then suggests an
+alternative from pure `assign()`. Every notice uses public task titles and
+numeric task refs only; PII text and task refs/plans are absent from notices and
+ladder records. Busy/paused/offline/native-active peers, unresolved dependencies,
+completion checks, queued/in-flight/held deliveries, recovery/shutdown and live
+silent cohorts suppress the sweep. Human review reminders go to the console.
+
+The Claude launcher and preview share one native-observation hook selector.
+Turn-free coordination selects facts observations; an enabled task sweep also
+selects the existing PreToolUse/PostToolUse/Stop transport in advisory mode.
+Advisory observations update native turn evidence without enabling facts
+injection. A delivery receipt or task transition never counts as a native Stop.
+Explicit caller settings remain authoritative, with a diagnostic that the
+managed idle observation hooks are disabled for that session.
+
+Automatic reassignment remains off. Explicit `auto_reassign: true` enables only
+an owner handover to an available routed alternative through Tasks' existing
+assignment path; reviewer handovers remain suggestions. No failed-work outcome
+is inferred from elapsed time. Existing route-explain behavior is unchanged,
+and offline-owner release and delivery-journal retries remain separate policies.
+
+## Initialization and launcher previews (issue #189)
+
+Initialization provides a read-only action/path/reason plan with managed-block
+insert/replace/remove metadata. Normal initialization applies the same planner.
+
+Claude/Codex/Kimi/Pi launcher previews share native command builders with actual
+launches. Preview exits before project registration, runtime setup or terminal
+ownership records. JSON contains argv/settings with arbitrary user-supplied
+values and custom executable overrides redacted, environment names only, and
+explicit reasons for unresolved native-assigned endpoints/session identities.
+A preview does not assert runtime, account or executable readiness.
+Claude/Codex previews report the conditional daemon/Orca launcher identity
+environment names and unresolved reasons without reading runtime identity,
+querying Orca, allocating a launch id or exposing values. Existing Pi launch
+behavior and its builder-derived environment preview remain unchanged.
+
+
+
+## Native context telemetry and checkpoints (issue #185)
+
+Context occupancy is separate from quota and accumulated billable session usage.
+Claude reports `context_window.used_percentage` and `context_window_size` from
+its status-line payload. A valid `current_usage` counter tuple is required;
+null, malformed or missing current usage is unknown, including immediately
+after compaction. Its input occupancy excludes output and sums input tokens,
+cache creation and cache reads, matching the [official status-line schema](https://code.claude.com/docs/en/statusline).
+Codex reports `tokenUsage.last.totalTokens / tokenUsage.modelContextWindow` in
+`thread/tokenUsage/updated`. The [native protocol](https://github.com/openai/codex/blob/main/codex-rs/app-server-protocol/schema/typescript/v2/ThreadTokenUsage.ts)
+and [native TUI](https://github.com/openai/codex/blob/main/codex-rs/tui/src/token_usage.rs)
+distinguish the last active context from the accumulated `total`; the displayed
+raw occupancy does not apply the TUI's baseline-adjusted remaining percentage.
+Pi's RPC state exposes no measured native counter. Its extension context API
+returns an estimate, so Pi and unsupported peers remain unknown here.
+
+Each reading records source and measurement time. Claude's status-line file is
+bound to the daemon instance, managed launcher and native session; Codex's
+notification is fenced by its owning link and native thread. Stale, invalid,
+disconnected or replaced-session readings expose unknown occupancy, never zero.
+`context.gate` defaults to 0 (off); `context.stale_min` defaults to 30.
+A valid above-gate reading emits one metadata-only `context_pressure` event
+and one crossing notice. Invalid or stale readings do not rearm a crossing;
+a valid below-gate reading or a new native session does. A crossing held by pause or recovery remains unlatched and is reconsidered after release using only a still-fresh, current-session reading; no new native sample is required.
+
+Context and quota checkpoints share the same request/wait path. Only one
+request per peer may wait at a time. Context responses must carry the supplied
+`request_id` and match the attached peer and native session. Timeout,
+disconnection, recovery hold, shutdown and session replacement invalidate the
+request. Context requests leave quota records, task assignments, pause state,
+native compaction settings and session ownership unchanged.
+
+A valid non-private context response is saved in the state directory as a
+0600 `context-checkpoint-<peer>.json` note. With memory enabled, its text is
+also saved as a handover note only after the active-turn, task PII and text
+pattern checks. It is never broadcast to peers or quoted in logs/events.
+Private turns and all non-approved PII tasks associated with the peer as owner or reviewer, including tasks already in review, block requests and completion. The current routing PII policy is rechecked at both boundaries. The operator chooses
+whether to continue the native session or restart; this change provides no
+automatic session replacement. Status, tail and dashboard expose readings with
+source, measurement time and freshness beside quota information.
+
+Release 0.12.16 uses control protocol 14. Recovery sources 9 through 13 remain
+supported; protocol 13 identifies releases 0.12.4 through 0.12.15, while
+0.12.16 uses protocol 14.
+
+## Operator console and conductor (issues #190, #191, #193, #194, #195)
+
+`ahub console` owns one authenticated console connection. It shares tail's
+renderer, renders a DECSTBM stream and footer, and provides optional alternate
+screen panels. `up` opens it only with terminal input and output, unless
+`--no-console` is given. Tail remains a plain stream. Console commands use an
+allowlisted argv with stdin closed; lifecycle and native launches are excluded.
+Allow options require confirmation and never interpret nonempty input as an
+approval. Deny is direct. Pending requests include expiry and are withdrawn by
+`permission_closed` on any answer or cancellation. Answer audits have no title.
+Panels expose Peers, Approvals, Tasks, Queue and Events with bounded polling and
+Unicode cell widths, fall back below 80x24, and restore terminal state on exit.
+
+Agent shell CLI calls connect as the detected peer in tools mode. Hub launches
+set `AGENTHUB_PEER_ID`; the pinned installed Codex shell injects
+`CODEX_THREAD_ID` after environment filtering, and Claude uses `CLAUDECODE`.
+Malformed or conflicting markers fail closed. Console-only commands are denied
+before connecting, with no as-user escape. Refusals enter a bounded ids-only
+local audit spool which a running daemon consumes; this preserves the no-connect
+rule while making refusals visible on the console and in the log. A stopped
+daemon cannot show a live notice; it consumes remaining records on startup.
+This does not establish a security boundary against an unrestricted shell
+which can read the token. Native source evidence and live probe results remain
+separate in the smoke ledger.
+
+Exactly one explicit conductor role may be configured. Default-allow
+capabilities do not grant it; role authority is checked on each operation and
+refreshed on a subsequent connection. Shared MCP tools provide public status,
+public task history, actor-preserving assign/escalate, headless local/Kimi/Pi
+start, and conductor-owned persistent holds. TUI starts return launch commands.
+Assign/escalate need `assign` if the peer has a capabilities entry. Approval
+answers, durable queue resolution, budget overrides and lifecycle remain human
+operations. A conductor cannot release human or budget holds. Audit events are
+ids-only and report counts their actions.
+
+The conductor feed defaults to own tasks, also supports all and off, and uses
+the existing bus digest window. Repeated queued task/kind milestones replace
+the earlier pending notice; accepted or in-flight deliveries are preserved.
+Structured milestones carry public titles or PII stubs, never raw history
+notes or check output. Only aged approval summaries and needs-review delivery
+ids are important. Role/feed revocation withdraws pending feed notices. A
+completed task set produces one round notice until a new task joins; subsequent
+rounds count only newly joined tasks. Pure status supervision queues wait for
+the existing digest deadline rather than flushing at the ordinary batch-count
+threshold. Mixed traffic retains the ordinary admission behavior. The existing
+10-original digest ceiling and 200-entry queue ceiling still bound admission;
+larger windows may require multiple bounded deliveries.
+
+Supervision cost counts completed native turns that received feed notices,
+with whole-turn token readings when available. Other work may share a turn;
+these readings are not per-notice token attribution. Missing measurements are
+unknown. Native TUI conductor, sandbox and feed-on smoke results must be recorded
+as observed outcomes, separately from unit/fake protocol tests.
+
+Managed Claude launches with turn-free facts, task-idle sweeps or a conductor
+role install native observation hooks. A conductor receives them even when facts
+injection and task-idle sweeps are disabled; ordinary non-opt-in launches remain
+unchanged. SessionStart registers the native
+session and UserPromptSubmit starts observation; PreToolUse keeps a tool turn
+active and Stop closes it. Explicit caller settings remain authoritative and
+produce a warning when they replace these hooks. An ordinary terminal records a
+private launcher identity without creating an Orca terminal-recovery record.
+The facts control request accepts session/start/pre/post/stop phases and carries
+nativeInstanceId and nativeLaunchId alongside sessionId and transcriptPath.
+The command hook forwards launcher identity only for its matching state directory
+and peer; library calls targeting another hub do not inherit that identity.
+The daemon fences observations to its current instance and launcher, validates
+the session transcript, and rejects stale stop/post observations. Native prompt
+text is never included in those requests or events.
+
+A genuine native Stop requires the current daemon/launcher binding and an actual
+assistant end_turn transcript message at or after the native turn's first start,
+distinct from the completed-message baseline recorded at that start. Later tool
+activity does not move this turn-start boundary. Missing start evidence or a
+start from another session, launch or channel claim leaves completion unknown.
+Accepted completion consumes that start before the peer becomes idle, so another
+message cannot reuse it. A valid bound Stop request receives one prompt
+acknowledgement with pending=true, within the existing two-second hook deadline.
+The acknowledgement records observation only, never completion. After the hook
+can return, a deferred observer waits up to 1200 monotonic milliseconds for its
+transcript append to become visible. Each read and final consumption revalidate
+the captured start, session,
+launch, peer and claim. A seen previous-turn baseline still waits while a new
+current start exists; a consumed duplicate remains a no-op. Timeout, malformed or
+oversized evidence and superseded context leave completion unknown. This wait
+does not retry a user action or relax authority.
+The observer sends no second request reply and never changes global hook settings.
+The live harness also binds its final receipt to the current private launch id.
+Its opaque
+deduplication id binds session, launch and message; transport replacement or new
+activity cannot turn a replay into another completion. Unbound or idless legacy
+Stop events cannot certify completion or finish supervision. A current private
+launcher marker takes precedence over an older terminal-recovery launch id for
+native observation, while preserving the recovery records and their authority.
+Claude turn reports
+prefer unique native Stop events; historical logical-state counts are labelled
+as such, and an unobserved completion remains unknown. Channel idle, watchdog
+expiry, board approval and a tool reply do not independently establish native
+completion. The live harness waits for the current fixture/instance/session's
+final transcript end_turn and turn_duration after its last review before
+reporting a completed case or terminating its native TUI. It also requires the
+matching opaque native completion event, an idle peer and settled delivery rows.
+
+These additions use control protocol 15. Supported recovery sources include
+protocol 14 (0.12.16) alongside the previous source protocols.
+
+For release 0.12.17 only, the user explicitly accepted deferral of real Kimi ACP
+new-tool invocation and ordinary-role refusal T0 evidence on 2026-10-09. The
+managed OAuth account rejected its prompt with HTTP 403 for the weekly quota
+before any tool event; reset time is unknown and no configured native alternative
+was found. This prerequisite remains unverified. Actual Claude/Codex conductor
+workflows, Claude shell/channel observations, shared MCP/fake-adapter authority
+checks, real Kimi ACP initialization/session creation and full source gates are
+separately qualified. The deferral authorizes no purchase, credentials,
+provider/configuration change, account retry or authority relaxation. Once quota
+is available under an authorized account, the same isolated read-only status-tool
+and ordinary-role refusal probe must record a native tool event and daemon result
+before this Kimi prerequisite can be marked verified.

package/docs/verification/2026-10-09-agent-shell-t0.md

@@ -0,0 +1,123 @@
+# Agent shell identity T0, issues #193 and #194
+
+## Evidence collected
+
+- Installed CLI reports `codex-cli 0.146.0` (`codex --version`, 2026-10-09). `codex app-server --help` supports configuration overrides and WebSocket listeners; its example names `shell_environment_policy.inherit=all`.
+- The [version-pinned native environment implementation](https://github.com/openai/codex/blob/rust-v0.146.0/codex-rs/protocol/src/shell_environment.rs) applies inheritance, default exclusions, custom exclusions, explicit values, and `include_only` in that order. It then injects `CODEX_THREAD_ID`. `AGENTHUB_PEER_ID` is an ordinary inherited variable and can be removed by filtering. The native thread marker is injected after filtering, which supplies a fallback without widening the user's environment policy.
+- The [version-pinned core wrapper](https://github.com/openai/codex/blob/rust-v0.146.0/codex-rs/core/src/exec_env.rs) explicitly documents thread-marker injection even with `include_only`.
+- The [current configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference) describes inheritance and filtering, and now describes a `filters` map alongside legacy `exclude` and `include_only`. Current documentation is not evidence that every new option exists in installed 0.146.0.
+- The hub's Codex adapter passes a child environment even without optional launch values. It now sets its own marker and removes stale vendor markers inherited from the caller. Recovery authority remains scrubbed by `childEnv`.
+
+## Native Codex observations (2026-10-09)
+
+- Real installed `codex exec --json --model gpt-5.5 --sandbox workspace-write`
+  completed a single fixed Python shell probe in an isolated git fixture.
+  With explicit `inherit=all`, the hub marker, native thread marker and harmless
+  canary were present; a Claude marker was absent. The disposable loopback
+  responder was reachable by the harness, while the native shell request failed
+  with `URLError`, errno 1. No sandbox or network exception was requested.
+- A second real run used `inherit=none`, an explicit PATH and
+  `include_only=["PATH"]`. The hub marker, native marker and canary still appeared
+  in the observed shell. This does not establish that filtering removed them;
+  the difference from the pinned environment construction is unresolved in this
+  installed host environment. The fallback is supported by source and marker
+  presence, without widening the caller's configured policy.
+- A real native MCP call under `workspace-write` completed `agent-hub.hub_status`
+  against the candidate bundle and an isolated conductor daemon. Native JSONL
+  recorded the MCP call completing, and the daemon independently recorded a
+  codex `conduct/status` event. Only this exact hub tool was approved through the
+  existing per-tool `approval_mode=approve` configuration; its daemon role check
+  still applied. This proves MCP access separately from the blocked shell path.
+- The first run with the user's configured `gpt-6.1-sol` failed before tools:
+  that slug was rejected by the installed ChatGPT-account endpoint. The probe's
+  explicit model selection did not change the user's configuration.
+
+## Native Claude observations (2026-10-09)
+
+- The final observer proof used source `20ad5e6`. Its read-only feed-off
+  continuation verified one completed native turn, 263,413 cached-inclusive
+  tokens, a matching opaque daemon Stop receipt, native idle and no pending
+  deliveries. The fresh feed-own run verified two actual owner completions and
+  independent file reviews, nine native finals matched by nine daemon Stops,
+  27 unique usage records and 1,888,242 tokens. Eight completed turns contained
+  supervision, totalling 1,292,922 tokens. The receipt matched the final native
+  message, session, launcher and instance; earlier incomplete captures below
+  were not retroactively marked complete.
+
+- In the original captures, Claude Code 2.1.295, Opus 5.5, ran the candidate MCP tools in real PTYs
+  after its five-hour quota reset. Both feed-off and feed-own fixtures started
+  local and headless Pi, proposed two tasks, reassigned Beta to Pi, held and
+  released both peers, and independently read the exact ALPHA/BETA files before
+  approving their tasks. The console independently audited four allow-once
+  answers in each fixture, covering the two writes and bounded file checks.
+- The real feed-off TUI displayed inbound review requests; the feed-own TUI
+  displayed actual supervision and review pushes. MCP success and channel
+  delivery were observed separately. A transient startup warning about the
+  server name did not prevent the later observed channel deliveries.
+- In the feed-own native TUI, the operator submitted the fixed Python probe
+  through `!`. Its actual command output was `AGENTHUB_PEER_ID=true`,
+  `CLAUDECODE=true`, `CLAUDE_CODE_SESSION_ID=true`, `CODEX_THREAD_ID=false`.
+  This is shell output captured before Claude's interpretation of it.
+- A subsequent feed-off run pinned to `da2ebbc` executed the same fixed probe
+  through the model's actual native Bash tool and separately through `!`.
+  Both actual command outputs showed the same three Claude/hub markers present
+  and `CODEX_THREAD_ID` absent. This closes the separate model-shell observation;
+  neither command printed environment values.
+- The original harness accepted hub idle too early and stopped both last
+  review turns before a native final answer. Native transcripts independently
+  show two completed turns in feed-off and five in feed-own, with the last
+  assistant message still `tool_use` in each case. The board approvals are real;
+  complete final-turn verification and production supervision accounting were
+  incomplete for those captures. The harness now requires the current daemon instance, its session,
+  the fixture-specific transcript, a final `end_turn` and `turn_duration` after
+  the last actual review. Missing measurements remain unknown.
+- The `da2ebbc` run verified the final native message UUID, message id,
+  `end_turn`, subsequent `turn_duration`, daemon instance, session and launcher.
+  Its complete transcript contains five completed turns and 21 unique usage
+  records, totalling 1,451,782 tokens including cached input. The daemon certified
+  only one native Stop, however. Its log refused the other completions as an
+  unavailable completed transcript message or completion predating the current
+  turn; the final refusal occurred before cleanup. A normal review receipt
+  remained queued. Actual task/file/final-answer evidence is valid, while full
+  runtime accounting and delivery settlement remain incomplete.
+- The `6034dd9` read-only continuation preserved both approved tasks and exact
+  files. It completed one native turn with four unique usage records and 261,483
+  cached-inclusive tokens, but the matching daemon Stop remained absent. After
+  a bounded retry, the Stop handler logged unavailable completion at
+  01:39:04.087 UTC; the native stop summary/duration appeared at 01:39:04.095 UTC.
+  With no overlapping operator prompt, this strongly supports a transcript
+  visibility barrier while the native hook waits. The strict harness timed out
+  incomplete and stopped its owned processes. The final message's thinking/text
+  rows carried identical usage counters in these observed transcripts; this
+  observation does not replace the final text/duration requirement.
+
+## Plain Claude and Kimi observations (2026-10-09)
+
+- Plain Claude 2.1.295, launched with the candidate MCP configuration but no
+  development-channel flag, completed one native `hub_status` call with an
+  independent daemon Claude status audit. Its only native tool calls were
+  ToolSearch and that status call. A unique operator push was bridge-accepted,
+  but no native pushed user row or response appeared in the observed
+  20.075-second window. This bounded negative observation is not a universal
+  claim about channel support. Actual channel-enabled review/supervision pushes
+  were observed separately in the conductor cases. The plain probe and cleanup
+  took 56.724 seconds and made no model file, shell, task or settings changes.
+- Real Kimi Code CLI 2.1.1 answered ACP `initialize` and created native session
+  `session_17eeb9dc-38d3-4685-b1aa-3db6a89b465c`. Its single prompt failed with
+  protocol error `-32000`, HTTP 403, for the managed account's weekly usage
+  limit before any requested tool event. No task-list/status result or ordinary
+  peer's conductor refusal was obtained. The owning CLI's safe provider list
+  showed only `managed:kimi-code`, type `kimi`, four models, OAuth, default
+  `kimi-code/k3`. No distinct configured provider was found. The reset time
+  remains unknown; no purchase, credential/configuration change or model retry
+  was attempted. Owned native processes and the fixture daemon were stopped.
+
+## Release disposition and remaining bounded live probe
+
+- On 2026-10-09 the user explicitly approved release 0.12.17 with only the Kimi native new-tool and ordinary-role refusal T0 evidence deferred. Kimi coverage remains unverified. This decision defers no other source/native gate and authorizes no purchase, credentials, provider/configuration change, account retry or authority relaxation.
+- Kimi ACP MCP: after native provider access is available under an authorized account, request the same read-only task list/status and ordinary-role refusal probes in isolated sessions. Verify actual native tool events/results and the daemon reply before marking this prerequisite verified. The existing quota failure proves neither new-tool access nor refusal behavior.
+
+## Verification limits
+
+- Codex shell and MCP probes used the root agent's serial resource slot. Claude `!`, model shell, enabled-channel pushes and the bounded plain-session comparison were observed in subsequent serial native cases. Kimi new-tool access remains unverified because its real account rejected the prompt before tools.
+- New unit and fake-adapter tests are prepared but have not been run by this worker. The root agent owns the final immutable-head checks.

package/docs/verified.json

@@ -0,0 +1,168 @@
+{
+  "schemaVersion": 1,
+  "documents": {
+    "README.md": {
+      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
+      "paths": [
+        "package.json",
+        "src/",
+        "templates/",
+        "plugins/agent-hub/.claude-plugin/plugin.json"
+      ]
+    },
+    "docs/security.md": {
+      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
+      "paths": [
+        "src/",
+        "templates/"
+      ]
+    },
+    "docs/operations.md": {
+      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
+      "paths": [
+        "package.json",
+        "src/",
+        "templates/",
+        "scripts/overlaps.ts",
+        "scripts/check-docs.mjs",
+        "scripts/seeded-check.ts",
+        "scripts/seeds.json",
+        ".github/workflows/check.yml",
+        "scripts/ci-gates.mjs",
+        "scripts/ci-reuse.mjs",
+        ".github/workflows/release.yml",
+        "scripts/smoke-conductor.ts"
+      ]
+    },
+    "docs/quickstart.md": {
+      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
+      "paths": [
+        "package.json",
+        "src/",
+        "templates/"
+      ]
+    },
+    "docs/agent-notes/adapters.md": {
+      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
+      "paths": [
+        "src/adapters/",
+        "src/pi/",
+        "src/hub/peers.ts",
+        "src/hub/child-process.ts",
+        "src/hub/lifecycle.ts",
+        "src/memory/capture.ts",
+        "scripts/benchmarks/teardown.ts",
+        "src/hub/daemon.ts"
+      ]
+    },
+    "docs/agent-notes/benchmarks.md": {
+      "verifiedAgainst": "8b7d7254f1bb5602ec5d658e7814e236f8fb43e7",
+      "paths": [
+        "scripts/benchmarks/",
+        "test/benchmarks/",
+        "src/pi/",
+        "src/adapters/acp.ts",
+        "src/adapters/pi.ts",
+        "src/models/relay.ts",
+        "src/local/"
+      ]
+    },
+    "docs/agent-notes/budget.md": {
+      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
+      "paths": [
+        "src/hub/budget.ts",
+        "src/cli/statusline-tee.ts",
+        "src/hub/bus.ts",
+        "src/hub/delivery-journal.ts",
+        "src/hub/restart.ts",
+        "src/hub/context-window.ts",
+        "src/hub/daemon.ts"
+      ]
+    },
+    "docs/agent-notes/bus.md": {
+      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
+      "paths": [
+        "src/hub/bus.ts",
+        "src/hub/envelope.ts",
+        "src/hub/limits.ts",
+        "src/hub/delivery-journal.ts",
+        "src/hub/inference.ts",
+        "src/hub/daemon.ts",
+        "src/hub/supervision.ts"
+      ]
+    },
+    "docs/agent-notes/daemon.md": {
+      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
+      "paths": [
+        "src/hub/daemon.ts",
+        "src/hub/control-client.ts",
+        "src/adapters/claude-channel.ts",
+        "src/hub/restart.ts",
+        "src/hub/recovery-store.ts",
+        "src/hub/snapshots.ts",
+        "src/hub/manager.ts",
+        "src/hub/lifecycle.ts",
+        "src/hub/crash.ts",
+        "src/cli/setup.ts",
+        "src/cli/upgrade*.ts",
+        "src/cli/terminal-recovery.ts",
+        "src/cli/recovery-package.ts",
+        "src/cli/facts-hook.ts",
+        "src/pi/process-signature.ts",
+        "src/hub/context-window.ts",
+        "src/hub/conductor.ts",
+        "src/cli/console.ts",
+        "src/cli/console-state.ts",
+        "src/cli/identity.ts",
+        "src/cli/identity-audit.ts"
+      ]
+    },
+    "docs/agent-notes/local-worker.md": {
+      "verifiedAgainst": "8b7d7254f1bb5602ec5d658e7814e236f8fb43e7",
+      "paths": [
+        "src/adapters/local-worker.ts",
+        "src/local/",
+        "src/memory/capture.ts",
+        "src/hub/facts.ts"
+      ]
+    },
+    "docs/agent-notes/models.md": {
+      "verifiedAgainst": "8b7d7254f1bb5602ec5d658e7814e236f8fb43e7",
+      "paths": [
+        "src/models/",
+        "src/hub/inference.ts",
+        "src/omniroute/",
+        "src/switchyard/"
+      ]
+    },
+    "docs/agent-notes/tasks.md": {
+      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
+      "paths": [
+        "src/hub/tasks.ts",
+        "src/hub/board.ts",
+        "src/hub/routing.ts",
+        "src/hub/hub-tools.ts",
+        "src/hub/task-sweep.ts",
+        "src/cli/launch.ts",
+        "src/cli/main.ts",
+        "src/cli/preview.ts",
+        "src/hub/conductor.ts",
+        "src/hub/supervision.ts"
+      ]
+    },
+    "docs/agent-notes/tests.md": {
+      "verifiedAgainst": "2a274289e280252b264716da3a1112f67b0c278e",
+      "paths": [
+        "test/",
+        "scripts/check.sh",
+        "scripts/hang-watch.sh",
+        "scripts/seeded-check.ts",
+        "scripts/seeds.json",
+        "scripts/ci-gates.mjs",
+        "scripts/ci-reuse.mjs",
+        ".github/workflows/check.yml",
+        ".github/workflows/release.yml"
+      ]
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.15",
+  "version": "0.12.17",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.15",
+  "version": "0.12.17",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",