@staix/agent-hub 0.12.23 → 0.12.24

package/docs/security.md

@@ -55,7 +55,7 @@ the console. Merged and generated Claude settings live in 0600 state files and
 are passed by path, keeping caller settings out of process argv.
 
 Claude ask-when-needed grants only resolving project file targets outside
-.agenthub, .git, .claude, .codex, .qwen, .kimi, .pi and .mcp.json. Symlink escapes, protected aliases, traversal and
+.agenthub, .git, .claude, .codex, .qwen, .kimi, .kimi-code, .pi, .mcp.json, .agents and .claude.json. Symlink escapes, protected aliases, traversal and
 unresolved wildcard targets receive no decision. Names are compared folded (letter case, compatibility forms and
 the code points HFS+ ignores; case-insensitive APFS folds case but ignored none in the probe; so a look-alike such
 as a long s or a name with a zero-width joiner is the same name), the path is judged inside the project, and
@@ -109,11 +109,11 @@ Please report vulnerabilities privately through GitHub's "Report a vulnerability
 
 - `ahub ui` uses the authenticated console control connection to start an ephemeral HTTP listener on `127.0.0.1`. No UI listener exists before that command. The control and Codex proxy ports continue to refuse every `Origin` header.
 - The daemon issues a cryptographically random, single-use bootstrap ticket valid for 60 seconds. The CLI opens the dashboard with that ticket in the URL fragment, never a query string or the control token. The static page removes the fragment immediately and exchanges it with a same-origin POST. Tickets are consumed once; expired tickets cannot create sessions.
-- The exchange creates a separate random session, valid for one hour without renewal, in an `HttpOnly; SameSite=Strict; Path=/` cookie named for this listener's port. Sessions and tickets live only in memory and die with the daemon. The page itself keeps one more cookie, `agent-hub-theme` (issue #246): script-set, `SameSite=Strict`, kept for a year for the whole `127.0.0.1` host, and read back only as one of `system`, `light` or `dark`. HTTP is loopback-only; the cookie is not a substitute for the origin checks.
+- The exchange creates a separate random session, valid for one hour without renewal, in an `HttpOnly; SameSite=Strict; Path=/` cookie named for this listener's port. Sessions and tickets live only in memory and die with the daemon. The page itself keeps one more cookie, `agent-hub-theme` (issue #246): script-set, `SameSite=Strict`, kept for a year for the whole `127.0.0.1` host, and read back only as one of `system`, `light` or `dark`. A second script-set cookie, `agent-hub-office` (issue #264), keeps the Office view choice under the same attributes and is read back only as `off`, `flat` or `isometric`. HTTP is loopback-only; the cookie is not a substitute for the origin checks.
 - Every request must have the exact listener Host. Every data or action request, including the ticket exchange and snapshot polling, must be POST with the exact listener Origin and JSON content type. Foreign and missing origins, missing or expired sessions, oversized bodies and unknown actions are rejected. There is no CORS support. The only unauthenticated GET is the fixed, data-free HTML shell. No files or paths are served dynamically.
 - Responses are non-cacheable, cannot be framed, suppress referrers, and use a content security policy restricting scripts/styles to the shipped inline content and connections to this origin. Browser text is rendered with textContent, never interpreted as HTML.
-- The browser receives a bounded redacted event stream, peer states and queue counts, public task views, budget windows, pending approvals, the settings rows (closed values and ids, the file each comes from) and each startable peer's start plan (issue #269), and benchmark run summaries (issue #251): the newest runs in `~/.agenthub/bench/`, whichever project on this machine ran them, by suite name, arm label, state, the task id in progress, counts, tokens and times, never suite text. Private envelope bodies and PII task text never cross this endpoint. Local-worker and Pi approval titles can contain PII, so their details remain terminal-only; the dashboard identifies the request and directs the operator to `ahub tail` before allowing it. Budget checkpoint summaries are also omitted.
-- The closed action list is permission response, peer pause/resume, console message, task proposal, task assignment and, since issue #269, the settings actions below (set, undo, preview). These use the existing daemon/task paths and budget pause rules. `start_peer` (issue #269) starts a peer from a closed list in the mode a person set, with a command the hub assembles: the request carries a peer id and nothing else. There is no generic control proxy, task-detail read, shell, file access, free-form configuration edit, budget override, launch of a caller-chosen command or daemon shutdown API.
+- The browser receives a bounded redacted event stream, peer states and queue counts, public task views, budget windows, pending approvals, the settings rows (closed values and ids, the file each comes from) and each startable peer's start plan (issue #269), benchmark run summaries (issue #251): the newest runs in `~/.agenthub/bench/`, whichever project on this machine ran them, by suite name, arm label, state, the task id in progress, counts, tokens and times, never suite text, and the office view's optional fields (issue #264): each peer's open turn (start time, attributed task id, attribution kind), a `checking` flag on tasks whose check is running, and warning `links` of overlapping, conflicting or cohort tasks (task and peer ids only, never paths, symbols or reasons; a PII task never joins a link, and a private or PII-attributed turn exposes no task id). Private envelope bodies and PII task text never cross this endpoint. Local-worker and Pi approval titles can contain PII, so their details remain terminal-only; the dashboard identifies the request and directs the operator to `ahub tail` before allowing it. Budget checkpoint summaries are also omitted.
+- The closed action list includes permission response, peer pause/resume, console message, task proposal/assignment and the settings actions below (set, undo, preview). Project-board actions add revision-fenced planning, Backlog pull/return/split/undo and release planning/state changes through Tasks; they do not tag, publish or write GitHub state. These use the existing daemon/task paths and budget pause rules. `start_peer` (issue #269) starts a peer from a closed list in the mode a person set, with a command the hub assembles: the request carries a peer id and nothing else. There is no generic control proxy, task-detail read, shell, file access, free-form configuration edit, budget override, launch of a caller-chosen command or daemon shutdown API.
 - The listener stops with the daemon. Expired sessions must be reopened with `ahub ui`; the page does not silently obtain new credentials.
 
 ## Dashboard settings and the settings session (issue #269)
@@ -144,3 +144,110 @@ The manager can start registered hubs in attended mode. Its project launches do
 not inherit state, unattended or gateway URL/key overrides from the session that
 opened the manager. Native memory is deliberately not a project-isolation boundary:
 its existing basename/worktree aliases and provider accounts can remain shared.
+
+## Peer roster authority
+
+The running peer roster changes only through console-only settings requests.
+`ahub roster` is a person's CLI command, including its read form; no hub tool
+exposes the catalog or edits membership. An ordinary dashboard can remove a peer,
+but adding requires the existing settings-session authority. Removing the
+conductor holder is refused. Local and Pi scoped tools cannot write `.agenthub`.
+Claude, Codex and Kimi still follow their own file permissions and can edit a
+config file; such an edit changes participation only at the next hub start. A
+live settings write or undo applies its own roster key and does not adopt other
+file edits. External ids outside the known native catalog keep their prior
+admission rules.
+
+Kimi's pull-only TUI owns its tool approvals and session. The person's launcher
+merges/removes only the hub MCP entry; the daemon never edits that file and
+refuses headless starts while a stale entry exists. An attached Kimi TUI blocks
+controlled recovery instead of being treated as a hub-owned headless process.
+Scoped Pi and local-worker write/edit grants check both the original project-relative
+path and its resolved target for protected agent configuration names. A protected
+directory symlinked to an ordinary project directory still asks a person; an alias
+into a protected directory also asks. Effects use the guarded real path and recheck
+it after approval. Explicit approval and never-ask retain their existing meaning
+(#322). ACP permissions arriving offline are cancelled before any auto-approval or
+console request; pending permissions are withdrawn on watchdog, offline or stop,
+and a late person answer cannot grant them (#311).
+
+The shared scoped-grant exclusion also covers `.agents` skills and `.claude.json`.
+The latter is conservatively protected by name; its default documented location
+is in the home directory, not a project loader. The source inventory and limits
+are in [the configuration inventory](verification/2026-10-11-agent-config-inventory.md).
+Instruction files `AGENTS.md`, `CLAUDE.md` and `QWEN.md` remain grantable by default.
+A person can set `scoped_grants.protect_instructions` to true to require approval
+for scoped writes and edits through original or resolved spellings. It applies
+live after a settings write or undo, never changes reads or never-ask, and cannot
+be set through an agent, tools or conductor surface. Claude's daemon response
+withholds the scoped mode on these writes so an older hook grants nothing too.
+
+Qwen Code's optional production ACP peer requires qwen-code 0.25.0 native identity
+and advertised mode ids before setting a policy or starting work. Its own tools
+have no hub sandbox; auto-edit approves file edits, yolo every tool. Configured
+never-ask still requires the person's confirmation. qwen_cmd is machine-local and
+never editable through settings. Legacy benchmark adapters remain unmanaged by
+this production table. Startup diagnostics withhold native host/payload details.
+
+Jcode is optional, source/version-fenced and runs native tools without a hub sandbox or hub permission-mode mapping. .jcode joins the scoped-grant exclusion, including lexical/resolved aliases. Only a person writes its unique project MCP entry; foreign/override/symlink entries refuse. The hub owns a private daemon/socket and ACP group, never the global daemon, and copies no credentials. Native diagnostics withhold payloads/hosts. Unproved conversation loads refuse; no fresh replacement is called a restore.
+
+# Transient ACP activity (#286)
+
+- Watch activity can contain file contents, thoughts and command output. It is console-role only, kept in a bounded in-memory ring and exposed only through the `watch` control request. Agent shells, conductor tools, dashboard snapshots, hub tools and memory observers cannot read it. Terminal bodies pass through the console's sanitization and wrapping helpers. Slow sockets close instead of accumulating unbounded output.
+- Private/PII turns show a single stub; the adapter latches privacy for that turn. The existing final-answer bus and native approval paths (console and dashboard) remain independent, with their existing privacy rules. Watch never adds activity to either path or any disk log.
+- There is no Qwen dual-output input file or TUI transport in this slice; Q2-Q6 are unverified and TUI mode stays refused.
+
+## Global attention metadata (#280, phase 3)
+
+The optional status `needs` projection contains act/watch counts, a known state
+and the first item (kind, level, peer/id and numeric times only). Status JSON has
+no console-local unread-message count and no full item list. The console-role
+reply to the existing status request additionally supplies `attentionItems`,
+using the same body-free allowlist so stream navigation needs no board-text read.
+Peer/tools status callers do not receive that full list. The summary and item
+projection never reads task title/detail, approval title/options, pause reason,
+error text or paths, and is never forwarded to memory. PROTOCOL remains 16 and
+EVENTS_SCHEMA remains 1; clients that ignore optional fields remain compatible.
+
+The file-reading pet command verifies the recorded process identity through the
+shared liveness contract and treats missing/unconfirmed evidence as unavailable.
+Recovery uses the existing lock/runner read path; unknown is never absent and
+navigation grants no permission or mutation authority. Built-in characters and the dashboard projection use the same structural
+privacy boundary described below.
+
+Built-in text-frame characters are literal data, not user files or runtime image
+loads. Presentation config admits only known ids/sizes/glyph modes, never paths
+or arbitrary glyph bodies. Character cycling emits no workflow effects. Larger
+frames carry only structural need ids/counts and exclude source/notice prose;
+private task and approval details remain in their existing operator views.
+
+The optional dashboard attention input contains only structural task ids, states,
+owner/reviewer ids, approval ids and numeric times, peer delivery states and
+budget pause times. It is assembled from the same allowlisted input as status;
+task text, plans, approval prose, error text and paths are excluded. This input
+is supplied only inside console-authorized dashboard snapshots, never ordinary
+status replies or status.json. The pet creates trusted inline SVG pixel nodes
+from built-in literal frames with existing theme colours, without HTML insertion,
+inline handlers, style attributes or external assets. Existing CSP hashing,
+headers, origin and session authorization remain in force. Clicking scrolls and
+focuses only; it cannot grant permissions or invoke a mutation.
+
+
+## Hub-owned structured memory (#258)
+
+With a project config, native hub memory is enabled unless `memory.native` is
+false. Append-only segments and their derived index stay in the private hub-home
+memory directory, created with 0700 directory permissions. New note segments request mode 0600, and `index.db` receives a best-effort
+0600 chmod. Existing file modes and SQLite-created WAL/shared-memory sidecar
+modes are not a per-file guarantee; the store protects access through its
+explicitly chmodded 0700 parent directory.
+PII-task notes, PII-pattern notes and secret-looking text are refused before
+persistence; promotions are
+screened again. The index can be rebuilt from segments and does not replace the
+separate claude-mem worker database.
+
+Sync starts only after a person configures a remote. Public GitHub remotes are
+refused; unknown visibility proceeds with a warning for the configured remote.
+Short-term segments, machine identity and the derived index are excluded from
+sync. Suggested graph edges are off by default and are not evidence until a
+person confirms them. Operational details and limits: [hub memory](memory.md).

package/docs/smoke.md

@@ -2,6 +2,49 @@
 
 `scripts/check.sh` covers everything against fakes. The legs below need real accounts and an interactive terminal, so they are run by hand and recorded here.
 
+## Hub memory (#258)
+
+Not run yet (2026-10-12). Source and fakes cover tiers, the graph, retrieval, sync between two simulated homes and a bare remote, leases, import and suggestions (`test/memory-*.test.ts`).
+
+- [ ] Real sync between two physical machines through a private GitHub remote over SSH: entries, a forget, a lease and a conflict each visible on the other side.
+- [ ] `gh` reports a public test remote and the sync refuses it.
+- [ ] `ahub memory import claude-mem` against the live claude-mem store of this machine: counts and skipped classes, claude-mem unchanged.
+- [ ] `memory.suggest_edges: true` with the hub's model reachable: suggestions appear, are drawn dashed, and stay out of briefs until confirmed.
+- [ ] Dashboard Memory section and Long-term tasks tab in a browser, light and dark, at phone width.
+- [ ] AC11 arms on a bench project (`--memory off`, `claude-mem`, `native`), 5 repeats each, and two weeks of research records with `briefs`.
+
+## Office view (#264, phases 1-4)
+
+Not run live yet (unverified). Phases 1-4 ship the office with its Off/Flat/
+Isometric control: snapshot-driven motion (card moves, message arcs, delivery
+marks, the busy latch, the settle rule), the optional turn/checking/links
+snapshot fields (exact task bubble, check-running mark, finishing-a-turn,
+warning lines), and the isometric projection of the same model.
+`test/office-model.test.ts`, `test/office-view.test.ts`,
+`test/tasks.test.ts` and `test/daemon.test.ts` cover the model, the daemon
+fields, the cookie, the CSP cleanliness, the motion wiring, the settle rule and
+the projection (same focus order and names as Flat) against fakes, but no
+browser was opened.
+The live leg: `ahub up` on a scratch project with two agents working, `ahub ui`,
+set the Office View control to Flat and to Isometric. Check the scene in both
+projections, in both themes and at phone
+width with the browser console open (no CSP violations), that cards glide between
+rooms and desks as tasks change state, that arcs and marks fade after about ten
+seconds, that desks and cards are focusable with sensible names in the same
+order under both projections, that activating
+one scrolls to and highlights the matching list row, that reduced motion gives
+static positions, and that the page weight stays within the 30 KB budget of the
+issue. Record the look here when performed.
+
+## Add-on arms and fingerprints (#248)
+
+Not run yet (2026-10-12). Source and fakes cover the fingerprint, the arm check and the report (`test/tooling.test.ts`, `test/bench.test.ts`, `test/research.test.ts`).
+
+- [ ] Live fingerprint: `ahub claude` and `ahub codex` attached on the development machine, `events.jsonl` shows one `tooling` event per attach with claude-mem, ponytail, ripwire and dot-admit as installed.
+- [ ] Arms on a bench project for each of claude-mem, ponytail and ripwire: `all-on`, `<tool>-off`, `all-off`, 5 repeats each, interleaved and with a randomized task order (docs/bench.md, Add-on arms); then `ahub bench compare`.
+- [ ] Field data: `research.enabled` on this repository for at least two weeks, then `ahub research addons`.
+- [ ] Update `docs/addons/*.md` from the results.
+
 ## Settings from the dashboard and the terminal (#269, part 1)
 
 Not run live yet (unverified). `test/settings.test.ts` drives a real daemon, its
@@ -1548,3 +1591,242 @@ In the console run `status --all`, `queue list`, `queue show <id>`, `turns`, `bu
 run `ahub projects`, `ahub doctor --orphans` and `ahub models status` in the terminal outside the console. Status's informational ids can be compared with `status --full`.
 Confirm JSON output stays plain under `--color=always`. Record the exact head and visual verdict here after the owner performs this leg.
 
+
+## Live roster return (#315)
+
+- Codex 0.146.0: run without a model turn against the real native app-server and
+  hub proxy. The TUI reached attached/idle with zero input/output tokens; removal
+  closed its socket with 4000, and it printed the off-roster reason and exited 1.
+  Re-adding left the preserved proxy/app-server unattached. A person must relaunch
+  with `ahub codex resume <thread-id>` (or the resume picker) after adding it back. No tool
+  update or model prompt was run. Actual native resume after the exit is not
+  verified: the follow-up no-turn probe was admission-deferred with exit 75
+  before starting, and was not bypassed or retried. The scripted proxy test sends
+  thread/resume with the same thread id; this is separate transport evidence.
+- Pi native TUI: not run. Resource admission deferred the live probe with exit
+  75; it was not bypassed. The scripted authenticated bridge tests separately
+  verify retained owner identity, idle/busy return and queue delivery.
+
+
+## Kimi TUI pull mode (#316), not run live
+
+- Kimi Code 2.1.1 source preflight: trusted ACP workspaces read the project MCP
+  file, and the model request path ignores MCP initialize instructions. This is
+  source evidence, not a live session observation.
+- In a disposable initialized project, run `ahub kimi --print-command`, confirm
+  no file changed, then `ahub kimi`. Observe the folder-trust prompt naming the
+  server and confirm the tool list includes hub_inbox and hub_send. Unverified.
+- With another peer attached, queue chat, an explicitly owned task and a named
+  review. Ask the model to call hub_inbox, then hub_send; confirm one read and one
+  reply per item, public PII stubs only, and last-read status. Confirm managed
+  AGENTS instructions and tool descriptions are available; do not claim MCP
+  initialize instructions are model-visible. Unverified.
+- End the TUI, start `ahub kimi --mode headless`, and inspect that only the project
+  hub entry was removed before ACP starts. Confirm no second baseline hub MCP
+  process in a trusted project. Stop ACP and return to a new TUI, preserving queued
+  work and task ownership. Unverified.
+
+## Initial SDLC gates (#257)
+
+Unverified: a live repository cycle through merge/release under advise. Fake-gh and task fixture checks are source/unit evidence only. Custom lifecycle gates and full release-readiness presentation remain pending; no live cycle or automatic merge is claimed.
+## Qwen Code 0.25.0 production peer (#256)
+
+Unverified: real provider handshake, a native model/tool turn, context occupancy,
+owned stop/recovery and the first authoritative quota refusal. Fake ACP tests are
+separate evidence. CLI --version returned 0.25.0 locally but installed package and
+ACP source returned 0.24.1; this drift is not a native readiness claim. Select
+roster.qwen and a verified qwen_cmd before the live leg. Confirm mode ids and
+visible boundaries, inbox/tool approval, stop and exact-head results, then record
+the native version and observed outcome here. No hub-driven Qwen TUI is offered.
+
+Qwen recovery source/fake proof: saved ids pass through the driver and CLI to ACP session/load, and the crash loader restores the recorded id/model. Actual native/provider recovery remains unverified.
+
+## Jcode 0.94.0 peer (#332)
+
+Source/fixture proof is recorded in verification/2026-10-11-jcode-peer-contract.md. Unverified: real provider/model, native project MCP discovery and hub-tool receipt, native tool policy and stop/child teardown. Native automatic restoration is withheld because the pinned ACP load does not prove the id. No benchmark comparison or default replacement ran.
+
+
+## Project board (#263)
+
+- Source model and isolated DOM/daemon regressions cover five columns, ready/wait
+  reasons, public stubs, owner/reviewer markers, keyboard buttons, assignment and
+  staging authority, stale/foreign gesture fences and legacy capability refusal.
+- Current source checks are pending for this draft; browser visual verification
+  at desktop/phone widths and real peer permission/state readback are unverified.
+- Native planner grooming into two releases, planned/actual date measurement and
+  GitHub import remain unverified or unimplemented in later source slices. No
+  release, installation, account experiment or live activation is implied.
+
+
+## Planning and release controls (#263)
+
+Source/fixture coverage is in planning.test.ts and planning-surfaces.test.ts:
+legacy/restart persistence, revision/role/pin/person order/frozen scope/undo/ship,
+actual task dates, CLI marker authority, public PII and research reset identities.
+All current platform and seeded checks remain pending. Desktop/phone rendering and
+native planner grooming into two releases are unverified; no real account run,
+tag, publish, install or live activation was performed.
+
+## Office stack merge review (#355, #357, #358, #360)
+
+Current-main integration and review corrections are being verified on an owned
+merge worktree. Source regressions cover the visible Off selector, filtered-card
+activation, card/desk sibling layers, sparse sticky bounds, Work/rework overflow,
+reduced-motion/settled cleanup, expired arcs, explicit unattributed turn omission,
+conflict priority under the cap and distinct parallel warning coordinates.
+Platform/full206-guard proof is pending. Desktop/phone/real-peer visual readback
+remains unverified; no account, release, installation or live activation ran.
+
+
+Dependency/reservation grooming regression covers direct/transitive cycles,
+missing or duplicate ids, off-roster reservations, atomic rejection and undo,
+and started-task refusal. Current source/fixture proof remains pending.
+
+
+Planner pull source regressions cover slot capacity, role and revision, P0/person
+reservation floors, post-screen races, offer-time capacity changes, dependency
+approval and pin refusal, pending-only undo, bounded integer settings/local
+store and actual HTTP/tool/status projections. Current full proof and native
+planner/two-release/desktop/phone readback remain unverified.
+
+
+Split fixtures cover atomic callbacks/rollback, earlier-part DAGs, cycle refusal,
+changed/referenced children, private phase inheritance, P0 prerequisites and
+actual tool/CLI/authenticated HTTP undo. Full current source/native/visual proof
+remains pending; the inherited started fixture exception is still unresolved.
+
+
+GitHub intake fixtures cover fixed read-only selection, page and identity
+validation, persistent/restart/after-screen dedupe, PII source projection,
+confirmed partial progress and person CLI classification. Current full and
+native/visual evidence remain pending. No real-account import ran.
+
+
+Remaining board projection fixtures exercise shared column mapping/waits and
+actual CLI release/JSON filters with peer backlog floors. Cut flags derive
+structured approval history and retain missing approval/cut as unknown. Current
+full source/phone/native proof remains pending.
+## Console attention (#280, phase 1)
+
+Automated coverage targets request ordering, read-only navigation/modal ownership,
+fixed footer/cursor cells at 80/99/100/120 columns and 24/40 rows, allowlisted
+structural projection, configuration precedence, deadline-only blink and plain
+message acknowledgement. Platform/full seeded gates are pending. Light/dark
+terminal, tmux, colour-off and actual terminal glyph readbacks are unverified;
+this phase renders ASCII only. No native account or live hub was activated.
+
+## Global attention status and CLI (#280, phase 3 in progress)
+
+Source/fixture checks target person review, offline ownership, unknown/absent
+recovery runners, status privacy/role separation, signed file ownership and CLI
+output without a token or connection. Full immutable-head platform/seed/review
+gates remain pending. Native light/dark terminal, tmux, glyph and account readback
+is unverified; no release, installation or live hub activation ran.
+
+## Attention status follow-up (#280)
+
+Regression fixtures cover reserved pseudo-peer ownership, preserved person
+reviews, selected SQL columns and actual status reads with unreadable unrelated
+JSON payloads. The focused tests pass; immutable-head platform/255-guard proof
+is pending. Native/account/artwork/dashboard legs remain unverified.
+
+Latest planner source fixes have an actual focused result of 11 pass/0 fail:
+reservation normalization/unsupported-id rejection and returned-work notices.
+The previous full262 guard job reached its 10-minute CI limit; the job cap is
+now20 minutes, with all named assertion and per-test/watchdog limits unchanged.
+Current immutable-head265 proof is pending.
+
+The actual queued planner notice regression and prior grooming/conductor group
+passed23/0 with235 assertions. The bus pull omitted a stale batch and the next
+notice contained only the remaining backlog id. Current full gates remain
+pending; no native grooming or live-account claim.
+
+Per-recipient retry and overflow source fixes passed26/0 with255 assertions
+once the owner approved the notice-only fixture. A separate no-worker diagnostic
+verified first2 ids, one consumed copy, stale0, retry1 to Pi, repeated Claude0.
+Roster, per-recipient retry and overflow guards each have actual isolated green
+-> named assertion detected proof. The owner also approved realPath normalization
+in three CLI fixtures, retaining every earlier assertion and identity validation.
+The descendant integration group passed53/0 with368 assertions, including real
+fake-account CLI pull/split/import and five-peer notice baselines. Full current
+platform/seed/review and native account verification remain pending.
+
+## Approved character source fixtures (#280, phase 2)
+
+The original STAIx reference and four existing Higgsfield concepts were inspected;
+210 hand-reduced frames satisfy the literal glyph and geometry limits. Actual
+console fixtures exercise all five choices plus off, full scroll geometry,
+resize fallback, keyboard-modal ownership, prompt preservation and unchanged
+config bytes. The focused console/config/geometry/runtime group passed138/0
+with23808 assertions. Immutable-head platform/seed/review proof is pending.
+Light/dark physical terminal, tmux and ambiguous-wide block glyphs are unverified.
+
+## Dashboard character (#280, phase 4 in progress)
+
+Source fixtures cover shared body-free review projection, selected configuration,
+status-input separation, bounded SVG pixels, unchanged-snapshot DOM writes,
+exact-row navigation, missing-row guidance and stale-navigation refusal. Existing
+dashboard authentication/CSP/page-size and Office regressions are retained.
+Current full platform, mutation, browser, mobile, light/dark and reduced-motion
+proof is pending. Native terminal/tmux/account legs remain unverified.
+
+Actual source-only Ego Chromium QA at b54b7c6c exercised STAIx and all four
+selected alternatives. Screenshots were opened and inspected at390x844 and
+1440x1000 in light/dark projections: document widths matched, Enter on the
+review control focused exact task4, and no action callback ran. Reduced motion
+reported no animation, open pose opacity1 and blink pose opacity0. The task
+space finished and the admitted helper exited0. This is fixture/browser proof,
+not a native account or production runtime claim. Served bytes compared against
+phase2 with the same upstream main:146871 before,164034 after (+17163).
+The focused production-boundary correction group passed35/0 (145589 assertions);
+current full platform/seed/review proof remains pending.
+The expanded-footer follow-up group passed7/0 with6687 assertions: primary
+stream rows survive alternate panels and are cleared before queued events return;
+expired notices restore the selected approval id and expiry. No earlier assertion
+was removed. Native terminal/tmux proof and final full gates remain pending.
+
+After the optional dashboard title initializer was isolated from missing DOM
+capabilities, the unchanged Settings/role/Office regressions and new pet suite
+passed61/0 with139938 assertions. This fixes the full Linux gate's three helper
+initialization failures in production code; final platform/seed proof is pending.
+
+Dashboard blink now requires a live approval item, not merely waiting state
+(which also includes pending defaults). The actual pet suite passed6/0 with
+138742 assertions across defaults, live approvals, expired approvals and blink-off;
+a mutation guard covers this distinction. Full current-head proof is pending.
+Line-size console faces now honor the resolved ASCII/block selection, with the
+locale fallback retained and ASCII/CLI defaults unchanged. Actual line glyph,
+geometry, modal and runtime regression group passed19/0 with7165 assertions.
+All five faces stayed100 cells wide without colour escapes. Full gates pending.
+
+The first final265-guard run found a surviving line-glyph seed: shipped ASCII
+and block line faces intentionally have identical bytes. Added a separate
+observable catalog fixture, restored in finally, retaining every earlier assertion.
+Local execution of this additional case is admission-deferred, not a pass;
+current immutable-head full platform/seed proof is pending.
+
+Lowercase review eyes retain a distinct pixel mask, and Gyul leaf pixels use
+the defined amber attention tone in light/dark/system themes. The actual pet
+suite passed7/0 with138010 assertions across all five characters. Two mutation
+guards cover case preservation and the existing theme variable. Final full
+platform/seed/review and updated browser readback remain pending.
+
+The review-eye mask guard has actual admitted isolated green -> named assertion
+failure proof. Leaf-tone coverage now checks the bounded CSS fill value in a
+separate test while retaining the earlier HTML assertions: printing the entire
+HTML on failure contained unrelated runtime diagnostic strings, so the strict
+classifier correctly rejected the previous detection. The bounded leaf test now
+also has actual green -> named assertion detected proof. Full final gates pending.
+Final review found active notices suppressed by expanded footers. Source now
+shows them in panel body or once in the local stream, away from the character.
+Added output/expiry/prompt geometry regressions and two guards. First local
+execution was admission-deferred; final actual proof remains pending.
+
+
+## Project board phone-width fixture (2026-10-13)
+
+The current source fixture at 6d311a51dccd41d3703079175cac65a487189b15 used the normal loopback ticket/session/CSP path with synthetic data and refused production changes. Source board desktop/390px light/dark, release-cut text, pending WIP 2/0/inherit and Save payload, and date-control containment were verified. All nine PNGs were viewed. The refresh exposed and fixed phone date-field clipping that document width alone missed. The same approved Space 44 was reused and finished once; its server was stopped. Receipt: [phone-width verification](verification/2026-10-13-board-phone.md).
+
+This supersedes earlier phone-fixture pending statements only for this source. The old 1bbced04 captures remain historical; no later byte-identity premise is used. Native planner/two-release, accounts, model ingestion and measured effects remain unverified.
+
+The later bounded release-audit preview text is verified by DOM tests, not by a refreshed phone capture. The6d311a51 PNGs remain evidence for their pinned source; see the later-audit note in the phone verification report.