@staix/agent-hub 0.12.16 → 0.12.17

package/CHANGELOG.md

@@ -4,6 +4,14 @@ Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the
 
 ## Unreleased
 
+## 0.12.17
+
+- Add an operator console with confirmed approvals, bounded status polling and optional peer, approval, task, queue and event panels; open it from interactive `up` and preserve the tail renderer (#190, #191).
+- Identify agent shell CLI calls as their peer, refuse human-only commands before connecting and record ids-only audit notices without an as-user bypass (#193).
+- Grant steering tools only to one explicit conductor role, preserve the actor on task changes and keep conductor holds separate from human, budget and recovery holds (#194).
+- Batch public task milestones and human-action reminders through the existing digest window, replace repeated pending notices and report completed native supervision turns with unknown usage preserved (#195).
+- Advance the control protocol to 15 for approval lifecycle and supervision metadata, retaining controlled recovery from supported previous sources.
+
 ## 0.12.16
 
 - Record source-verification commits for current operating documents and agent notes; fail missing coverage, invalid stamps and README version drift, and report stale source scopes deterministically (#188).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.12.16, control protocol 14. Durable delivery records distinguish queued
+Status: 0.12.17, control protocol 15. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -22,13 +22,13 @@ Install from npm:
 
 ```bash
 bun add -g @staix/agent-hub && ahub setup
-cd <your project> && ahub init && ahub up && ahub tail
+cd <your project> && ahub init && ahub up
 ```
 
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.16 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.12.17 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.
@@ -100,7 +100,7 @@ only. `--backend dgx` or `--backend mlx` explicitly pins a Pi session's backend.
 Pi connects to an authenticated relay with model aliases `dgx/coding`,
 `dgx/fast`, and `mlx/fast`; upstream gateway credentials stay in the hub.
 Its managed tools use the existing path guards, shell sandbox and terminal
-approval flow. Keep `ahub tail` open to approve write/edit/shell operations.
+approval flow. Keep `ahub console` open to approve write/edit/shell operations.
 Tool-call receipts survive daemon restart; an interrupted operation with an
 unknown outcome must be reconciled before repeating it. Cancelling a Pi turn
 does not automatically hand its task to a cloud peer.

package/docs/agent-notes/adapters.md

@@ -15,4 +15,5 @@ Scope: the Codex, ACP and Pi adapters and the Pi extension (turn `generation` an
 - Native owner teardown must handle a lost shutdown acknowledgement using verified process identity. Pending launches must be revocable, and active tools/streaming output must count as watchdog activity.
 - Pi owner identity is one shared contract, `processSignature` in `src/pi/process-signature.ts`; the startup claim check, the extension's claim, the TUI owner monitor, `recoveryReady` and the verified teardown all go through it. Its `ps` read pins LC_ALL=C and TZ=UTC (the `processTable` contract) because `lstart` follows the reader's timezone and locale, and a hub on UTC with a Pi child on system time otherwise hashes different strings for the same process and refuses the valid owner (#174). Strict pid + start + command identity stays; never accept PID-only or a fuzzy command match.
 - Return the shared `toolResultFailed` verdict as `/tool`'s `failed`; map only `failed === true` to Pi's `isError`. Preserve text and the older bridge's absent-flag behavior.
+- Spawn a native peer with `peerChildEnv(peer, source)` so its own `AGENTHUB_PEER_ID` replaces inherited agent markers. Sandbox tool environments carry their executing peer too. Preserve the native shell environment policy; Codex's `CODEX_THREAD_ID` supplies the fallback after filtering. Before changing marker detection or launcher environments, read `docs/verification/2026-10-09-agent-shell-t0.md` for pinned source and live-probe limits.
 - Emit Pi's ceiling event at the pre-effect rejection boundary (`src/pi/ceiling.ts`), before `agent_end`. Accept only a valid current-session/current-generation signal during a running turn; retain the first signal and attach it to that turn's failure. Never classify a ceiling from free text.

package/docs/agent-notes/bus.md

@@ -1,5 +1,7 @@
 # Bus, digests and replies
 
+- Supervision replaces only pending, never attempted or accepted, envelopes with the same stable key. Preserve the first batch deadline and existing digest/queue ceilings; role/feed revocation withdraws pending notices only. Count supervision from actual transport admission followed by a successful native turn completion, never from enqueue or failure-to-idle.
+
 Scope: delivery, digests and condensation, reply addressing, priority and limits. Read before editing `src/hub/bus.ts`, `src/hub/envelope.ts`, `src/hub/limits.ts`, `src/hub/delivery-journal.ts`, `src/hub/inference.ts` (digest condensation), or how an adapter addresses a reply or sets its priority.
 
 - A failed digest is retried one envelope at a time, so a poison envelope cannot take its neighbours down with it.

package/docs/agent-notes/tasks.md

@@ -1,7 +1,9 @@
 # Task board and hub tools
 
-Scope: the task flow, assignment, the state machine and the hub's MCP tools. Read before editing `src/hub/tasks.ts`, `src/hub/board.ts`, `src/hub/routing.ts`, `src/hub/task-sweep.ts` or `src/hub/hub-tools.ts`.
+Scope: the task flow, assignment, the state machine and the hub's MCP tools. Read before editing `src/hub/tasks.ts`, `src/hub/board.ts`, `src/hub/routing.ts`, `src/hub/task-sweep.ts`, `src/hub/conductor.ts`, `src/hub/supervision.ts` or `src/hub/hub-tools.ts`.
 
 - Tool callers are models: MCP `inputSchema` is not enforced on the way in. Normalize at the boundary (`cleanRefs`) before anything reaches the board, and never throw after a board write.
 - `assign()` never defaults to the task's current owner, or a decline can only come back to the decliner.
 - The state machine allows `in_progress -> approved` only for classes without a reviewer; `review()` checks `in_review` itself.
+- Conductor authority requires the explicit unique role before capability checks. Assignments preserve the acting peer. A peer releases only its own conductor hold; operator release and manual, quota and recovery holds remain separate paths.
+- Supervision reasons use structured enums, never history notes, check output or approval titles. Round signatures survive restart; later summaries count only newly joined tasks.

package/docs/agent-notes/tests.md

@@ -5,4 +5,5 @@ Scope: tests, fakes and the test gate. Read before adding or changing a test or
 - Tests that are not about batching build the bus with `batchMs: 0`; with the default 15 s window a lone status envelope looks like a lost message.
 - In Bun 1.3.14 a test timeout that fires while `Bun.spawnSync` runs can start the next test inside spawnSync's own event loop, where another spawnSync then spins at full CPU for good (trigger not pinned down; see README). Bun 1.4.2 still runs the next test inside the outer spawnSync's event loop. `scripts/check.sh` runs tests with a 20 s timeout and under `scripts/hang-watch.sh`; a test that spawns and reads the process table gets a timeout of its own.
 - A child process gets a scrubbed environment, so test knobs for fakes travel in a wrapper script, not in `process.env`.
+- Bind agent identity markers explicitly in native/CLI fixture children. The full gate starts the test runner without inherited agent markers for human CLI fixtures; never weaken production marker detection to make them pass.
 - Run `bun scripts/seeded-check.ts` before reporting the seeded-guard gate complete. Keep the six `scripts/seeds.json` cases sequential; require the same named test green before its seeded assertion fails. Seed rot, survivors, setup/compiler failures, timeout/watchdog termination and process leaks fail the gate. Never run the full seed runner from a unit test or mutate the source checkout; inspect preserved failed fixtures before removing them. CI runs this in the required Linux `seeded guards` job after the ordinary check, separately from `scripts/check.sh`.

package/docs/operations.md

@@ -1,8 +1,99 @@
 # Operations guide
 
-This guide describes ahub 0.12.16 and control protocol 14. Live verification
+This guide describes ahub 0.12.17 and control protocol 15. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
+## Operator console and panels
+
+`ahub console` combines the existing tail stream with peer, quota, approval-age
+and input rows. `ahub up` opens it when both input and output are terminals;
+`--no-console` and redirected input/output retain the start-only behavior.
+`ahub tail` remains available with its existing rendering.
+
+Allowing an approval requires selection and a separate confirmation. Denying
+does not. Only options the daemon supplied are selectable. Typing a command
+prevents approval shortcuts from interpreting that input as an answer. Full
+approval titles are terminal-only; expiry and answers from another console remove
+the pending item. Approval audit records contain id, peer, option kind, response
+time and answering surface, without the title.
+
+Tab toggles stream and panels; `ahub console --panels` starts in panels. Peers,
+Approvals, Tasks, Queue and Events support arrow keys or j/k, Enter for detail,
+Escape to return and `?` for help. `:` enters a command. Assignment, delivery
+resolution and allow decisions require confirmation; delivery resolution requires
+a reason. Tasks use the same public redaction as the board. Panels need at least
+80 columns by 24 rows; smaller terminals stay in stream mode. Task and queue
+polling runs only while the corresponding panel is visible. Leaving restores
+the terminal and returning from panels replays the bounded stream buffer.
+
+The command input accepts existing status, board, task, review, say, pause,
+resume, budget, queue, permit, ask, remember, route, turns, undo, check-path and
+report operations. It executes an argument vector with closed stdin. Lifecycle,
+launch, nested console, setup, UI, logs and tail commands are refused.
+
+## Conducting a team from Claude Code or Codex
+
+Start the daemon with `ahub up --no-console`, set exactly one conductor in the
+project configuration, then open `ahub console` in a split terminal for approvals:
+
+```json
+{
+  "roles": { "claude": ["planner", "reviewer", "conductor"] },
+  "conductor": { "feed": "own" }
+}
+```
+
+Launch that peer with `ahub claude` for channel pushes, or select `codex` in
+`roles` and launch `ahub codex`. The conductor splits work into owned tasks,
+observes `hub_status`, moves stalled work and obtains review before reporting
+results and open decisions. It does not implement the tasks it handed out.
+`hub_peer_start` starts local, Kimi or headless Pi; requests for native TUIs
+return the `ahub` command for the person to run, after validating it through
+the shared launcher planner. The wrapper plans again at launch when native
+endpoints are available. `hub_peer_hold` and `hub_peer_release`
+manage only holds placed by that conductor. Assignment also requires `assign`
+when the conductor has an explicit capabilities list.
+
+Check the returned owner and task state after assignment. Routing skips paused
+peers, so assign work before placing a delivery hold. Hand work out through the
+board and report to the person with `hub_send` addressed to `user`, or a `[FYI]`
+final response in the native TUI. Broadcasting implementation instructions can
+cause an otherwise unassigned owner to claim duplicate work.
+
+The person answers approvals in the console, resolves `needs_review` deliveries
+with `ahub queue resolve`, and handles budget overrides and hub lifecycle.
+Running these commands from an agent shell is refused; the CLI retains the
+agent's identity even when invoked through a shell tool.
+
+`conductor.feed` is `own` by default, `all` for all tasks, or `off`. Ordinary
+milestones share the existing digest window and collapse repeated queued
+task/kind notices. They wait behind a busy conductor. An aged approval or
+`needs_review` hold is important, contains only peer/tool-age or delivery id,
+and directs the conductor to ask the person. A completed task set emits one
+round notice until a new task joins. Removing the role or switching the feed
+off withdraws pending feed notices.
+
+For a Claude conductor, `ahub claude` also observes native session and turn
+boundaries when facts injection and task-idle sweeps are off. Keep the managed
+hooks enabled to measure completion and supervision usage. Passing your own
+`--settings` takes precedence and produces a warning when it replaces that
+observation. The launcher records its private session identity in ordinary
+terminals too; this does not grant terminal-recovery authority.
+Ordinary Claude sessions with turn-free facts or task-idle sweeps enabled get the
+same session/start observation. Other ordinary launches remain non-opt-in.
+
+`ahub report` records conductor actions and completed native turns containing
+supervision. Tokens describe the whole measured turn, which may also contain
+other work; they are not a per-notice cost estimate. Missing measurements stay
+unknown. Use the live smoke ledger to assess observed turns and tokens per
+approved task before choosing `all`; an unmeasured run is not a cost benchmark.
+Claude turn counts use authenticated native completion events. Older logical
+state counts are labelled; an idle channel or approved task alone does not prove
+that the native answer finished.
+The Stop hook acknowledgement is not a counted completion. The daemon checks the
+native transcript after the hook can return; missing or changed-session evidence
+stays unknown.
+
 ## Install and start
 
 Use Bun 1.3 or newer. Install the released package and install its Claude
@@ -14,12 +105,11 @@ ahub setup
 cd <project>
 ahub init
 ahub up
-ahub tail
 ```
 
 `ahub init` writes the project configuration and managed instruction blocks.
 Run it after an upgrade when those blocks need refreshing. `ahub setup`
-updates the shared Claude plugin. Keep `ahub tail` open when a local worker
+updates the shared Claude plugin. Keep `ahub console` open when a local worker
 may request an approval.
 
 `.agenthub/config.json` can be committed and shared. The fields that choose
@@ -521,6 +611,13 @@ stays the default until an evaluation says otherwise (`docs/cooperbench.md`).
 
 Inspect permission requests in the terminal:
 
+```bash
+ahub console
+```
+
+Select the requested option in the console and confirm an allow decision.
+For a separate plain terminal, the existing command remains available:
+
 ```bash
 ahub tail
 ahub permit <request-id> allow
@@ -647,21 +744,21 @@ Rows without a live process are stale registrations; forget them with
 
 Upgrade running projects with the target release's own coordinator. It accepts
 a running source on control protocol 9 (0.6.x), 10 (0.7.0 through 0.12.0),
-11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15) or 14 (0.12.16), and only
+11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15) 14 (0.12.16) or 15 (0.12.17), and only
 a target on its own protocol, so the target's coordinator fits every supported
 source and carries every recovery fix released up to it. Protocol 8 and older
 (0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.12.16 ahub upgrade --to 0.12.16 --dry-run
-bunx --package @staix/agent-hub@0.12.16 ahub upgrade --to 0.12.16 --yes
+bunx --package @staix/agent-hub@0.12.17 ahub upgrade --to 0.12.17 --dry-run
+bunx --package @staix/agent-hub@0.12.17 ahub upgrade --to 0.12.17 --yes
 ```
 
 | Running now | Coordinator to use |
 | --- | --- |
 | 0.6.x (protocol 9) | the target's, through `bunx` as above |
-| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14) | the target's, through `bunx` as above |
+| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 (protocol 15) | the target's, through `bunx` as above |
 | any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
 | 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
 
@@ -693,14 +790,14 @@ projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.12.16 --dry-run
+ahub upgrade --to 0.12.17 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.12.16 --yes
+ahub upgrade --to 0.12.17 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.16
+bun add -g github:STAIxBWLB/agent-hub#v0.12.17
 ahub setup
 ```
 
@@ -34,8 +34,8 @@ In your project directory, one terminal each:
 
 ```bash
 ahub init          # .agenthub/config.json, .agenthub/routing.toml, the marker block in AGENTS.md
-ahub up            # the daemon for this directory (loopback only)
-ahub tail          # keep open: the conversation, state changes, permission requests
+ahub up            # starts the daemon and opens the operator console in a terminal
+ahub console       # use in another terminal if up used --no-console; Tab opens panels
 ahub kimi          # Kimi, headless
 ahub codex         # Codex TUI, attached through the hub
 ahub claude        # Claude Code with the hub channel

package/docs/security.md

@@ -28,6 +28,30 @@ agent-hub connects agents that can each run commands. This page says what the hu
 - **Network-level proof for PII.** The hub proves at its own boundaries (tests search every output) that PII text does not leave; packet-level verification of your gateway path is an operations check.
 - **Other operating systems' sandboxes.** Only macOS seatbelt is implemented.
 
+## Agent CLI identity and conductor authority
+
+Inside an agent session, `ahub` identifies the caller from `AGENTHUB_PEER_ID`,
+or the native Claude/Codex shell marker when the hub marker is absent. It connects
+as that peer in tools mode. Messages and task changes retain that actor;
+`say` defaults to status priority and important messages still require the peer's
+capability. Conflicting or malformed markers fail closed. There is no `--as-user`.
+Human-only operations are refused before connecting, including permission answers,
+queue resolution, budget overrides, lifecycle and recovery operations, and `ask`.
+The operator uses a plain terminal or `ahub console`. A Claude `!` command that
+inherits the agent markers follows the same rule.
+
+This is an honest default against accidental impersonation and injected commands.
+It does not make the token inaccessible to an agent with unrestricted project
+shell access. The existing OS sandbox and loopback authentication boundaries apply.
+
+Steering tools require an explicit `conductor` role, independent of default-allow
+capabilities. Only one peer may hold that role. A conductor may inspect public
+state, assign or escalate work, start supported headless peers and place its own
+delivery holds. It cannot answer approvals, resolve durable deliveries, override
+budget pauses or release a human hold. Pending approval summaries exclude titles;
+PII tasks remain public stubs. Conduct events contain ids only. Supervision feeds
+use structured reasons and never carry check output or approval bodies.
+
 ## Reporting
 
 Please report vulnerabilities privately through GitHub's "Report a vulnerability" on this repository rather than in a public issue.

package/docs/smoke.md

@@ -2,6 +2,99 @@
 
 `scripts/check.sh` covers everything against fakes. The legs below need real accounts and an interactive terminal, so they are run by hand and recorded here.
 
+## Operator console and conductor candidate (#190, #191, #193-#195)
+
+Candidate 0.12.17, protocol 15, observed on 2026-10-09 KST. The final Claude
+observer runs used immutable source `20ad5e6`; their native completion receipts
+and actual console effects were checked independently. The Kimi new-tool leg
+remains quota-blocked, as recorded below.
+
+- Actual Codex 0.146.0 (`gpt-5.5`) and Claude 2.1.295 (Opus 5.5) TUIs started
+  real local and headless Pi peers, proposed exactly two tasks owned initially
+  by local, reassigned Beta to Pi, and placed and released their own holds.
+  The real owners checked their outputs and called `hub_task_done`; the native
+  conductor independently read the exact files before approving both tasks.
+  Real CLI calls retained the agent actor, and human-only queue/permission
+  actions were refused from an agent shell.
+- The person authorized `alpha.txt = ALPHA` (5 bytes) and `beta.txt = BETA`
+  (4 bytes), both without a newline. Separate selection and confirmation keys
+  reached the actual console PTY and produced allow-once console audit records.
+  Out-of-scope directory-list commands were cancelled. The final Claude own
+  run used three allow-once answers because Pi combined its exact write and
+  bounded byte checks in one approved command; it also recorded two cancelled
+  local directory-list requests. No permission or task completion was fabricated.
+- The final Claude own run recorded nine completed native turns and nine
+  matching daemon Stop records, 27 unique native usage records, and
+  1,888,242 tokens including cached input. Eight completed native turns contained
+  supervision, with 1,292,922 recorded tokens. Its final message UUID/id,
+  `end_turn`, `turn_duration`, instance/session/launcher and opaque Stop receipt
+  matched; native idle and an empty pending delivery queue were verified before
+  owned-process cleanup. Local recorded three turns and 72,046 gateway tokens;
+  Pi recorded two turns and 47,177 native tokens.
+- A read-only Claude feed-off continuation on the final observer preserved the
+  existing approved tasks and exact files. It verified one completed native turn,
+  four usage records and 263,413 cached-inclusive tokens, with matching daemon
+  Stop, native idle and delivery settlement. An obsolete review hold was first
+  discarded through the authenticated public operator API after fresh approved
+  task/history and exact BETA readback. That discard is not native execution.
+- A real console with two pending cards and no operator input consumed 0.07 CPU
+  seconds over 40.018 wall seconds in stream mode (0.175% of one CPU). A separate
+  actual Peers panel, 120x40, with two pending cards and no operator input used
+  0.07 CPU seconds over 40.012 wall seconds (0.175%). These are cumulative `ps`
+  process CPU samples in distinct modes/runs, not whole-host idle measurements.
+- In a plain Claude TUI without the development-channel flag, one actual
+  `hub_status` MCP call succeeded and the daemon audited the Claude status
+  action. A unique directed operator push was accepted by the bridge, but no
+  pushed native user row or answer appeared in the observed 20.075-second window.
+  This proves tool access separately from the bounded negative push observation.
+  The real channel-enabled runs above received actual review and supervision
+  pushes. The plain probe and cleanup completed in 56.724 seconds, with no model
+  file, shell, task or settings actions.
+- Real Kimi Code CLI 2.1.1 completed ACP initialization and `session/new`, then
+  rejected the single prompt with HTTP 403 for its weekly account usage limit.
+  No requested native tool event or role-refusal result occurred. The reset time
+  was not supplied. The owning CLI listed only the managed OAuth Kimi provider
+  (four models, default `kimi-code/k3`), so no configured alternative provider was
+  found. This is an incomplete external prerequisite, not a new-tool pass. No
+  purchase, provider/configuration change or model retry was performed; owned
+  processes were stopped after 3.142 seconds.
+
+The user explicitly approved release 0.12.17 with only the Kimi native new-tool
+and ordinary-role refusal T0 evidence deferred on 2026-10-09. That native
+prerequisite remains unverified; the quota rejection is not a tool pass. This
+decision does not defer the other native/source gates or authorize a purchase,
+credentials, provider/configuration change or account retry. The same isolated
+read-only Kimi probe remains required before its native coverage is marked verified.
+
+Earlier captures remain part of the evidence:
+
+- Codex feed-off included an interrupted original and read-only continuation:
+  six logical native turns, 49 increments and 1,979,016 tokens. Codex feed-own
+  recorded nine turns, 34 increments and 1,399,470 tokens. Their journals were
+  independently checked after cleanup. The first baseline interruption and
+  operator reconciliation are preserved; neither native task completion nor
+  board approval was substituted by the harness.
+- The original Claude runs approved the actual files but an early idle-based
+  harness stopped their final review answers. Subsequent `da2ebbc` feed-off
+  completed five native turns and 1,451,782 tokens but certified only one daemon
+  Stop. A `6034dd9` read-only continuation completed another native turn and
+  261,483 tokens, while its Stop remained unavailable during the native hook.
+  Both incomplete observer captures are preserved alongside raw and audited
+  summaries. The final post-ACK observer above closes the fresh completion proof;
+  it does not retroactively certify the earlier missed Stop records.
+
+All token totals describe whole native/model turns, including cached input and
+other work. Operator waiting, cancelled requests, marker probes, interrupted
+continuations and differing source revisions make these observations unsuitable
+for a causal feed-overhead or model-efficiency comparison. Unknown measurements
+and the Kimi prerequisite remain explicit.
+
+The harness uses real Python PTYs. Operator-file-input forwards only
+chat-authorized keys, removes inherited Orca terminal ownership from fixture
+children, and generates no approval automatically. Private original and
+continuation captures remain separate. The shell-marker probes and vendor
+limits are recorded in [the identity T0 ledger](verification/2026-10-09-agent-shell-t0.md).
+
 ## Approval race live reproduction and candidate verification (#98)
 
 Measured on 2026-10-02 KST with installed 0.12.1 and the correction candidate,

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1343,6 +1343,125 @@ whether to continue the native session or restart; this change provides no
 automatic session replacement. Status, tail and dashboard expose readings with
 source, measurement time and freshness beside quota information.
 
-The control contract is protocol 14. Recovery sources 9 through 13 remain
+Release 0.12.16 uses control protocol 14. Recovery sources 9 through 13 remain
 supported; protocol 13 identifies releases 0.12.4 through 0.12.15, while
 0.12.16 uses protocol 14.
+
+## Operator console and conductor (issues #190, #191, #193, #194, #195)
+
+`ahub console` owns one authenticated console connection. It shares tail's
+renderer, renders a DECSTBM stream and footer, and provides optional alternate
+screen panels. `up` opens it only with terminal input and output, unless
+`--no-console` is given. Tail remains a plain stream. Console commands use an
+allowlisted argv with stdin closed; lifecycle and native launches are excluded.
+Allow options require confirmation and never interpret nonempty input as an
+approval. Deny is direct. Pending requests include expiry and are withdrawn by
+`permission_closed` on any answer or cancellation. Answer audits have no title.
+Panels expose Peers, Approvals, Tasks, Queue and Events with bounded polling and
+Unicode cell widths, fall back below 80x24, and restore terminal state on exit.
+
+Agent shell CLI calls connect as the detected peer in tools mode. Hub launches
+set `AGENTHUB_PEER_ID`; the pinned installed Codex shell injects
+`CODEX_THREAD_ID` after environment filtering, and Claude uses `CLAUDECODE`.
+Malformed or conflicting markers fail closed. Console-only commands are denied
+before connecting, with no as-user escape. Refusals enter a bounded ids-only
+local audit spool which a running daemon consumes; this preserves the no-connect
+rule while making refusals visible on the console and in the log. A stopped
+daemon cannot show a live notice; it consumes remaining records on startup.
+This does not establish a security boundary against an unrestricted shell
+which can read the token. Native source evidence and live probe results remain
+separate in the smoke ledger.
+
+Exactly one explicit conductor role may be configured. Default-allow
+capabilities do not grant it; role authority is checked on each operation and
+refreshed on a subsequent connection. Shared MCP tools provide public status,
+public task history, actor-preserving assign/escalate, headless local/Kimi/Pi
+start, and conductor-owned persistent holds. TUI starts return launch commands.
+Assign/escalate need `assign` if the peer has a capabilities entry. Approval
+answers, durable queue resolution, budget overrides and lifecycle remain human
+operations. A conductor cannot release human or budget holds. Audit events are
+ids-only and report counts their actions.
+
+The conductor feed defaults to own tasks, also supports all and off, and uses
+the existing bus digest window. Repeated queued task/kind milestones replace
+the earlier pending notice; accepted or in-flight deliveries are preserved.
+Structured milestones carry public titles or PII stubs, never raw history
+notes or check output. Only aged approval summaries and needs-review delivery
+ids are important. Role/feed revocation withdraws pending feed notices. A
+completed task set produces one round notice until a new task joins; subsequent
+rounds count only newly joined tasks. Pure status supervision queues wait for
+the existing digest deadline rather than flushing at the ordinary batch-count
+threshold. Mixed traffic retains the ordinary admission behavior. The existing
+10-original digest ceiling and 200-entry queue ceiling still bound admission;
+larger windows may require multiple bounded deliveries.
+
+Supervision cost counts completed native turns that received feed notices,
+with whole-turn token readings when available. Other work may share a turn;
+these readings are not per-notice token attribution. Missing measurements are
+unknown. Native TUI conductor, sandbox and feed-on smoke results must be recorded
+as observed outcomes, separately from unit/fake protocol tests.
+
+Managed Claude launches with turn-free facts, task-idle sweeps or a conductor
+role install native observation hooks. A conductor receives them even when facts
+injection and task-idle sweeps are disabled; ordinary non-opt-in launches remain
+unchanged. SessionStart registers the native
+session and UserPromptSubmit starts observation; PreToolUse keeps a tool turn
+active and Stop closes it. Explicit caller settings remain authoritative and
+produce a warning when they replace these hooks. An ordinary terminal records a
+private launcher identity without creating an Orca terminal-recovery record.
+The facts control request accepts session/start/pre/post/stop phases and carries
+nativeInstanceId and nativeLaunchId alongside sessionId and transcriptPath.
+The command hook forwards launcher identity only for its matching state directory
+and peer; library calls targeting another hub do not inherit that identity.
+The daemon fences observations to its current instance and launcher, validates
+the session transcript, and rejects stale stop/post observations. Native prompt
+text is never included in those requests or events.
+
+A genuine native Stop requires the current daemon/launcher binding and an actual
+assistant end_turn transcript message at or after the native turn's first start,
+distinct from the completed-message baseline recorded at that start. Later tool
+activity does not move this turn-start boundary. Missing start evidence or a
+start from another session, launch or channel claim leaves completion unknown.
+Accepted completion consumes that start before the peer becomes idle, so another
+message cannot reuse it. A valid bound Stop request receives one prompt
+acknowledgement with pending=true, within the existing two-second hook deadline.
+The acknowledgement records observation only, never completion. After the hook
+can return, a deferred observer waits up to 1200 monotonic milliseconds for its
+transcript append to become visible. Each read and final consumption revalidate
+the captured start, session,
+launch, peer and claim. A seen previous-turn baseline still waits while a new
+current start exists; a consumed duplicate remains a no-op. Timeout, malformed or
+oversized evidence and superseded context leave completion unknown. This wait
+does not retry a user action or relax authority.
+The observer sends no second request reply and never changes global hook settings.
+The live harness also binds its final receipt to the current private launch id.
+Its opaque
+deduplication id binds session, launch and message; transport replacement or new
+activity cannot turn a replay into another completion. Unbound or idless legacy
+Stop events cannot certify completion or finish supervision. A current private
+launcher marker takes precedence over an older terminal-recovery launch id for
+native observation, while preserving the recovery records and their authority.
+Claude turn reports
+prefer unique native Stop events; historical logical-state counts are labelled
+as such, and an unobserved completion remains unknown. Channel idle, watchdog
+expiry, board approval and a tool reply do not independently establish native
+completion. The live harness waits for the current fixture/instance/session's
+final transcript end_turn and turn_duration after its last review before
+reporting a completed case or terminating its native TUI. It also requires the
+matching opaque native completion event, an idle peer and settled delivery rows.
+
+These additions use control protocol 15. Supported recovery sources include
+protocol 14 (0.12.16) alongside the previous source protocols.
+
+For release 0.12.17 only, the user explicitly accepted deferral of real Kimi ACP
+new-tool invocation and ordinary-role refusal T0 evidence on 2026-10-09. The
+managed OAuth account rejected its prompt with HTTP 403 for the weekly quota
+before any tool event; reset time is unknown and no configured native alternative
+was found. This prerequisite remains unverified. Actual Claude/Codex conductor
+workflows, Claude shell/channel observations, shared MCP/fake-adapter authority
+checks, real Kimi ACP initialization/session creation and full source gates are
+separately qualified. The deferral authorizes no purchase, credentials,
+provider/configuration change, account retry or authority relaxation. Once quota
+is available under an authorized account, the same isolated read-only status-tool
+and ordinary-role refusal probe must record a native tool event and daemon result
+before this Kimi prerequisite can be marked verified.