@staix/agent-hub 0.12.26 → 0.12.27

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
 
+## 0.12.27
+
+- Refine the dashboard Office view with an intrinsic 12 px/unit scale, 1 px non-scaling hairlines and padded room cards in flat and isometric themes, and un-nest the desk More control into a separately reconciled sibling button so screen readers can reach it (#394).
+- Shrink the floating pet window to a compact 150x150 panel with the original pixel art in deeper state colors and a configurable base palette (`pet.palette`, or 1/2/3/4 while the window is key: blue, teal, violet, ochre) with a matching rim line so it reads on light backgrounds, reveal the status pill and message composer only while the pointer is over the character, and drop the pill shadow (#391 follow-up).
+- Split the local dashboard into cookie-backed views, compact task cards with shared dialog/column details, and exact-id attention badges; move character presentation to the standalone pet window (#391 Task A).
+- Add an opt-in macOS floating pet window with built-in pixels, counts-only local state, a console message pencil, saved position and signed process ownership; keep terminal pet reads available to agent shells (#391 Task B).
+
 ## 0.12.26
 
 - Import claude-mem observations under a checkout-independent identity, so the same observation is one entry on every machine after sync however the checkouts differ; scan the source database project-aware with a persisted machine-local cursor (`--restart` re-scans), so unrelated projects cannot starve the requested one; reconcile legacy duplicate imports with `ahub memory dedupe` through append-only supersede operations (#380).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker, with optional Qwen Code and Jcode support, collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.12.26, control protocol 16. Durable delivery records distinguish queued
+Status: 0.12.27, control protocol 16. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -33,7 +33,7 @@ cd <your project> && ahub init && ahub up
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.26 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.12.27 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.12.26 and control protocol 16. Live verification
+This guide describes ahub 0.12.27 and control protocol 16. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Command output
@@ -156,8 +156,8 @@ status read it says loading; later failures preserve the prior count with a noti
 Panels retain their existing full-board refresh and loading/error handling.
 
 The dashboard Task board shows the same shared public-board progress model,
-including state counts, waiting, stacked segments and a labeled four-stage track
-per row. Filtering rows does not filter overall progress. The existing signature guard
+including overall state counts, waiting and stacked segments; each task detail
+retains its labeled four-stage track. Filtering rows does not filter overall progress. The existing signature guard
 updates the live region only when progress changes. The stacked SVG fills the
 section width; its text legend carries every state count. Theme offers System,
 Light and Dark; it is applied before first paint and stored in a host-scoped loopback cookie
@@ -170,8 +170,8 @@ is tracked in `docs/smoke.md` and remains unverified until performed.
 The dashboard Office section (#264, phase 1 of 4) draws the same snapshot as a
 static flat office: one desk per peer in a stable slot (claude, codex, kimi, pi,
 local, then others by id; a peer going offline dims its desk and never moves
-another), rooms for the board columns in a fixed order (To Do, Work floor,
-Review, Done shelf as a count only), at most 8 cards per room with "+N more"
+another), rooms for the board columns in a fixed order (To do, Work floor,
+Review, Done as a count only), at most 8 cards per room with "+N more"
 filtering the task list to that state, and at most 12 desks with "+N peers".
 Work-floor cards sit at the owner's desk, marked for rework; a busy peer's task
 bubble names its task only when it has exactly one in progress. Every peer
@@ -1619,21 +1619,21 @@ section is what they run.
 
 Upgrade running projects with the target release's own coordinator. It accepts
 a running source on control protocol 9 (0.6.x), 10 (0.7.0 through 0.12.0),
-11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.26), and only
+11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.27), and only
 a target on its own protocol, so the target's coordinator fits every supported
 source and carries every recovery fix released up to it. Protocol 8 and older
 (0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.12.26 ahub upgrade --to 0.12.26 --dry-run
-bunx --package @staix/agent-hub@0.12.26 ahub upgrade --to 0.12.26 --yes
+bunx --package @staix/agent-hub@0.12.27 ahub upgrade --to 0.12.27 --dry-run
+bunx --package @staix/agent-hub@0.12.27 ahub upgrade --to 0.12.27 --yes
 ```
 
 | Running now | Coordinator to use |
 | --- | --- |
 | 0.6.x (protocol 9) | the target's, through `bunx` as above |
-| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.26 (protocol 16) | the target's, through `bunx` as above |
+| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.27 (protocol 16) | the target's, through `bunx` as above |
 | any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
 | 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
 
@@ -1665,14 +1665,14 @@ projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.12.26 --dry-run
+ahub upgrade --to 0.12.27 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.12.26 --yes
+ahub upgrade --to 0.12.27 --yes
 ahub recovery status [<operation-id>]
 ahub recovery resume [<operation-id>]
 ahub recovery abort [<operation-id>]
@@ -2879,20 +2879,36 @@ nor drawing a character changes authority, config files, task state or polling.
 Explicit `ahub pet` and text status use the configured line face; prompt tokens
 remain character-independent. Native glyph width and tmux are unverified.
 
-## Dashboard attention character (#280)
+## Dashboard views and attention (#391, replaces the #280 in-page character)
+
+Top buttons select Board, Office, Stream, Agents, Message, Memory or Settings
+within the same page. The selected view and board column focus use the shared
+host-scoped cookie helper; the URL fragment remains reserved for the session
+ticket. Sections are hidden rather than fetched separately. Projects and
+Benchmarks live under Agents alongside peers, approvals and usage budgets.
+Office mode stays an explicit Off/Flat/Isometric preference inside Office.
+
+Board cards show id/title, priority, owner dot and overdue/check markers.
+Click or Enter opens a native detail dialog with the full stage/dependency,
+release/date, SDLC, detail and GitHub content plus existing Pull/Return/Assign
+controls. Snapshot changes refresh the dialog; project reset or a task leaving
+the snapshot closes it. Expand on a column shows one wide list of full details;
+Back returns to compact cards. State/agent/release filters still apply.
+
+The shared pure needs model now drives the nav attention badge and existing
+action-count tab title. Agents has a live pending-approval count even when
+attention metadata is unavailable. Activation switches to the matching view
+and focuses only the exact visible approval/task id; missing or filtered rows
+receive fixed structural guidance, with no peer or first-row fallback. No
+workflow action is issued and no filter is changed by attention navigation.
+Invalid/legacy attention hides its badge and restores the base title.
+
+The in-page pet, its SVG and character/pixel payload are removed. The standalone
+macOS window owns character presentation. Existing snapshot poll, session,
+request types and CSP hashes remain; no route, request or timer is added.
+Browser screenshots/CSP-console verification are separate manual evidence on
+the implementation PR; VM/HTTP fixtures do not establish human visual results.
 
-The dashboard header draws the configured built-in character independently of
-Office. It uses the same structural needs model as status and the console. The
-accessible button names the character, state and action/watch counts; the tab
-title shows the action count. Activating the button scrolls and focuses the exact
-visible approval/task/peer row, or its related section with fixed id-only guidance
-when the row is filtered or unavailable. It performs no action and changes no
-filters. Legacy snapshots without attention keep the widget hidden.
-
-Only a live approval alternates the two waiting poses once per second through
-CSS. `pet.blink:false` and reduced motion retain a static pose. No new timer,
-request, image protocol or character-file load is added. Project reset clears
-the widget and title. Native/browser visual validation remains unverified.
 With mini/full characters, active console notices remain visible away from the
 character: panel body rows show the bounded wrapped notice, and stream mode
 prints each fresh notice once through the existing local stream. Footer prose
@@ -2943,3 +2959,43 @@ A later issue lookup or profile-preparation failure also returns the IDs confirm
 Release cut audits return exact counts with at most 32 example IDs per category; the dashboard states how many IDs are shown when truncated. Scope grouping and indexed approval dates avoid scanning each task history for every release. Full audit pagination remains a future extension.
 
 Release cards include task states in their refresh key, so completion of an outside prerequisite updates blocked counts even when the release and audit preview are unchanged.
+
+## Standalone macOS pet window (#391)
+
+From a person's terminal, `ahub pet --window` starts one floating, transparent
+JXA panel per project; `ahub pet --window --close` closes it. Other platforms
+print unsupported and retain `ahub pet` / `ahub pet --short`. An agent-marked
+shell may read the terminal pet but cannot start or close the window.
+
+Set `pet.window: true` in `.agenthub/config.json` or `config.local.json` to start
+it with `ahub up`. A window-only local opt-in preserves inherited `pet:false`
+for terminal/status/dashboard presentation; explicit local character options
+retain their existing presentation override behavior. The
+window uses the configured built-in character, full pixel frame and blink
+choice. Its body opens `ahub ui`; the pencil opens an inline console message
+box (Enter sends through `ahub say`, Esc cancels). Drag the body to move it;
+`pet-window-pos.json` remembers the position, with an on-screen fallback if a
+saved display has disappeared. The panel joins all Spaces without a Dock icon.
+The 150x150 panel keeps the status pill and message composer hidden until the
+pointer is over the character. Deep state colors and a dark rim shadow keep the
+pixel silhouette readable on light backgrounds. `pet.palette` selects the base
+color: teal (default, b), blue (a), violet (c) or ochre (d), each with its own
+rim line; the waiting/blocked/review/offline colors stay fixed. While the
+window is key, 1/2/3/4 switch blue/teal/violet/ochre and save the choice.
+From a terminal, `ahub pet --palette <blue|teal|violet|ochre>` writes the
+choice to `pet.palette` in `.agenthub/config.local.json`.
+While working, the pixel art bobs in a 0.7-second stepped CSS loop; reduced-motion preferences keep it still.
+
+A detached Bun host refreshes `pet-view.json` once per second using `readPet`
+and `loadPetConfig`. The file contains only state/counts/character/blink and
+built-in pixels. It uses no dashboard session or HTTP listener. An unavailable
+hub displays Offline for two seconds, then the panel and host exit. Closing
+JXA exits the host too. `pet-window.pid` holds the host's process signature;
+an uncertain owner is retained rather than signalled. A stale owner requires
+an explicit `--close` before restarting; a malformed pidfile requires operator
+inspection. A send failure is unconfirmed: check the stream before retrying.
+
+Native transparency/floating and the bridge were verified in the macOS spike.
+Real keystrokes, dragging and persistence, Spaces, message delivery and body
+click need the manual PR checklist before merge; automated fixtures do not
+establish those native results.

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.26
+bun add -g github:STAIxBWLB/agent-hub#v0.12.27
 ahub setup
 ```
 

package/docs/security.md

@@ -109,7 +109,7 @@ Please report vulnerabilities privately through GitHub's "Report a vulnerability
 
 - `ahub ui` uses the authenticated console control connection to start an ephemeral HTTP listener on `127.0.0.1`. No UI listener exists before that command. The control and Codex proxy ports continue to refuse every `Origin` header.
 - The daemon issues a cryptographically random, single-use bootstrap ticket valid for 60 seconds. The CLI opens the dashboard with that ticket in the URL fragment, never a query string or the control token. The static page removes the fragment immediately and exchanges it with a same-origin POST. Tickets are consumed once; expired tickets cannot create sessions.
-- The exchange creates a separate random session, valid for one hour without renewal, in an `HttpOnly; SameSite=Strict; Path=/` cookie named for this listener's port. Sessions and tickets live only in memory and die with the daemon. The page itself keeps one more cookie, `agent-hub-theme` (issue #246): script-set, `SameSite=Strict`, kept for a year for the whole `127.0.0.1` host, and read back only as one of `system`, `light` or `dark`. A second script-set cookie, `agent-hub-office` (issue #264), keeps the Office view choice under the same attributes and is read back only as `off`, `flat` or `isometric`. HTTP is loopback-only; the cookie is not a substitute for the origin checks.
+- The exchange creates a separate random session, valid for one hour without renewal, in an `HttpOnly; SameSite=Strict; Path=/` cookie named for this listener's port. Sessions and tickets live only in memory and die with the daemon. The page itself keeps one more cookie, `agent-hub-theme` (issue #246): script-set, `SameSite=Strict`, kept for a year for the whole `127.0.0.1` host, and read back only as one of `system`, `light` or `dark`. A second script-set cookie, `agent-hub-office` (issue #264), keeps the Office view choice under the same attributes and is read back only as `off`, `flat` or `isometric`. The #391 view split adds two more script-set cookies under the same attributes: `agent-hub-view`, read back only as one of the seven view names, and `agent-hub-column-focus`, read back only as one of the five board columns or empty. HTTP is loopback-only; the cookie is not a substitute for the origin checks.
 - Every request must have the exact listener Host. Every data or action request, including the ticket exchange and snapshot polling, must be POST with the exact listener Origin and JSON content type. Foreign and missing origins, missing or expired sessions, oversized bodies and unknown actions are rejected. There is no CORS support. The only unauthenticated GET is the fixed, data-free HTML shell. No files or paths are served dynamically.
 - Responses are non-cacheable, cannot be framed, suppress referrers, and use a content security policy restricting scripts/styles to the shipped inline content and connections to this origin. Browser text is rendered with textContent, never interpreted as HTML.
 - The browser receives a bounded redacted event stream, peer states and queue counts, public task views, budget windows, pending approvals, the settings rows (closed values and ids, the file each comes from) and each startable peer's start plan (issue #269), benchmark run summaries (issue #251): the newest runs in `~/.agenthub/bench/`, whichever project on this machine ran them, by suite name, arm label, state, the task id in progress, counts, tokens and times, never suite text, and the office view's optional fields (issue #264): each peer's open turn (start time, attributed task id, attribution kind), a `checking` flag on tasks whose check is running, and warning `links` of overlapping, conflicting or cohort tasks (task and peer ids only, never paths, symbols or reasons; a PII task never joins a link, and a private or PII-attributed turn exposes no task id). Private envelope bodies and PII task text never cross this endpoint. Local-worker and Pi approval titles can contain PII, so their details remain terminal-only; the dashboard identifies the request and directs the operator to `ahub tail` before allowing it. Budget checkpoint summaries are also omitted.
@@ -226,11 +226,14 @@ owner/reviewer ids, approval ids and numeric times, peer delivery states and
 budget pause times. It is assembled from the same allowlisted input as status;
 task text, plans, approval prose, error text and paths are excluded. This input
 is supplied only inside console-authorized dashboard snapshots, never ordinary
-status replies or status.json. The pet creates trusted inline SVG pixel nodes
-from built-in literal frames with existing theme colours, without HTML insertion,
-inline handlers, style attributes or external assets. Existing CSP hashing,
-headers, origin and session authorization remain in force. Clicking scrolls and
-focuses only; it cannot grant permissions or invoke a mutation.
+status replies or status.json. The #391 dashboard projects this input into nav
+and tab-title counts; the in-page pet and its character/pixel injection are gone.
+Attention navigation switches a local view and focuses an exact visible row id,
+with structural guidance when missing. It cannot grant permissions or invoke a
+mutation. Compact-card detail/dialog controls retain the existing authenticated
+workflow actions and project/instance fencing. Existing CSP hashing, headers,
+origin and session authorization remain in force; data uses text/DOM nodes,
+without HTML insertion, inline handlers or external assets.
 
 
 ## Hub-owned structured memory (#258)
@@ -251,3 +254,28 @@ refused; unknown visibility proceeds with a warning for the configured remote.
 Short-term segments, machine identity and the derived index are excluded from
 sync. Suggested graph edges are off by default and are not evidence until a
 person confirms them. Operational details and limits: [hub memory](memory.md).
+
+## Standalone pet window (#391)
+
+The macOS window reads local files only. Its detached host reuses `readPet`,
+including signed-daemon liveness and recovery-lock handling, and publishes an
+atomic counts-only `pet-view.json` (state, act/watch, known character, blink,
+palette from the closed list, built-in pixel frame). It excludes item ids,
+task titles/text, refs, paths,
+notices and approval prose. Missing or unconfirmed status produces only
+`{offline:true}`. Process and position files are separate from this view.
+
+The local WKWebView has a deny-by-default CSP, with only its shipped inline
+script/style allowed and network connections forbidden. Text never becomes
+HTML or executable source. The retained JXA bridge accepts fixed drag/send/
+palette/open/close operations; `NSTask` invokes the host-supplied Bun/CLI/project argv
+and appends `say`, `--` and a single message argument, or `pet`, `--palette`
+and one closed palette name. It does not evaluate a
+shell string. Message text is never logged by the window/host; command stdout
+and stderr go to the null device. `ahub say` keeps its existing console-message
+authority and recording behavior, and `ahub ui` opens its existing session.
+The CLI restricts `pet --window` (including close) to console identity, while
+plain terminal pet reads and `pet --palette` remain available to agent shells;
+the palette write merges only the closed name into `.agenthub/config.local.json`,
+validated and replaced by temp file and rename. Signed pidfiles
+fence instance ownership and close; unknown owners are never signalled.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -710,7 +710,11 @@ fragment ticket for an HttpOnly, SameSite=Strict browser session. The control li
 retains its blanket Origin refusal. The browser receives no control token.
 
 One static HTML file, without a build step or runtime dependency, polls public
-snapshots once per second. The latest 200 redacted bus events are retained only
+snapshots once per second. #391 Task A keeps this `/` surface and poll while
+splitting its sections into Board/Office/Stream/Agents/Message/Memory/Settings
+views with a cookie-backed selection. Compact task cards open a native dialog;
+one `taskDetail` function renders both the dialog and expanded-column cards.
+Filters, exact-id attention navigation and existing workflow controls remain. The latest 200 redacted bus events are retained only
 once the listener starts. The API exposes only permission answers, peer
 pause/resume, console messages, task proposal and assignment. All task changes
 use `Tasks`; budget pauses keep the terminal's override requirement.
@@ -731,7 +735,9 @@ project registry and adds explicit project selection, authenticated instance
 ownership and a separate optional dashboard manager. Runtime data and routing
 remain per project. Native memory aliases remain compatible and shared.
 Control protocol 7 adds project/instance identity and console-only dashboard
-snapshot/action forwarding. Existing project-local UI security rules still apply.
+snapshot/action forwarding. Existing project-local UI security rules still apply. #391 Task A changes only client view selection;
+project/instance fencing still invalidates open task details and stale controls.
+No additional project route, request or timer is introduced.
 
 
 ## Amendment: externally managed Ollama MLX (issue #51)
@@ -2678,21 +2684,21 @@ C/dumb/linux/unknown locale surfaces use ASCII even when blocks were requested.
 Body foreground is uncoloured; only the Gyul leaf uses an existing accent tone.
 Native terminal/font/tmux proof remains a separate verification leg.
 
-## Shared dashboard attention (#280, phase 4)
+## Shared dashboard attention (#280, replaced by #391 Task A)
 
-The existing authenticated UI snapshot receives an optional allowlisted attention
-input and enabled/character/blink presentation fields. Status wire/file callers
-retain their phase3 summary/items projection and never receive this input. The
-page invokes the same injected needs function on this body-free input, renders
-the selected built-in full block frame as SVG pixels and exposes state/counts
-through an accessible button. Its click only reaches an exact visible list row
-or the relevant heading with fixed structural guidance; no action request occurs.
+The authenticated snapshot retains optional body-free needs input. The same
+injected pure needs function drives global nav action/watch counts and the
+existing tab-title action count; status/file readers retain their summary/items
+projection. The Agents button separately shows live pending approvals. The
+in-page character, SVG, character frames and pixel injection are removed; the
+standalone #391 Task B window owns that presentation.
 
-DOM writes and title counts follow the derived signature, not every poll. A
-waiting pulse uses CSS transform/opacity only, with a static reduced-motion and
-blink-off escape. There is no extra timer, request, route or authority; legacy
-or invalid snapshots make attention unavailable. Project changes clear stale
-attention and restore the title. The existing CSP/header policy is unchanged.
+Attention activation switches views and selects only the exact visible
+approval/task id. Default/delivery/budget items without a visible exact target
+show their related heading and fixed id-only guidance, never a peer or first-row
+fallback. Filters and workflow state are unchanged. Signature guards suppress
+unchanged DOM writes, invalid legacy input stays unavailable, and project
+changes reset attention and close stale dialogs. CSP/header policy remains.
 
 ## Amendment: hub memory, tiers and graph (#258, phase 1)
 
@@ -2710,20 +2716,12 @@ and rebuilds; the dashboard's Memory section is read-only inside the existing CS
 long-term tasks with leases (decision 9's amendment), claude-mem import and model-suggested edges follow in later phases.
 
 
-## Dashboard attention projection (#280, phase 4 in progress)
+## Dashboard attention projection (#280, superseded by #391)
 
-The existing dashboard snapshot supplies optional allowlisted needs input and
-known presentation choices; normal status/file payloads do not gain that input.
-The header independently projects the shared pure needs function into literal
-built-in SVG pixels and an accessible state/count label. Unchanged state and
-choices do not rewrite pet DOM. Clicks navigate only to exact visible rows or
-related headings, never issue actions or alter filters. Missing/invalid legacy
-input hides the widget. Project resets clear retained navigation and title.
+#391 Task A replaces the in-page pixel widget with nav/title counts as defined
+in Shared dashboard attention above. Native character presentation is the
+standalone Task B window; browser attention uses no character data or frames.
 
-The two approved waiting frames alternate in CSS once per second only while
-a live approval exists. Reduced motion and blink-off remain static. Every other
-state stays still. No timer/request or new asset dependency is introduced;
-existing header policy and computed CSP hashes apply.
 ## Amendment: hub memory between machines and long-term tasks (#258, phase 2)
 
 Decision 9 is amended for memory only: the memory directory is a git repository that tracks `log/*.jsonl` and syncs
@@ -2830,3 +2828,54 @@ session instead of assuming that an older extension provides the fence.
 Prompt lineage lasts until logical `agent_settled`: native retry, compaction or
 continuation starts inside that run retain the same command id. A later personal
 run has no hub command lineage.
+
+## Amendment: standalone attention window (#391 Task B, supersedes #280 dashboard pet)
+
+The #280 phase-4 dashboard pet is replaced by an optional standalone macOS JXA
+window. Task B adds the window first; #391 Task A removes the existing in-page
+character and retains shared attention counts/navigation. Terminal characters
+and read-only `ahub pet` behavior remain.
+
+`ahub pet --window` / `--window --close` are console-identity commands;
+`pet.window:true` opts into startup from `ahub up`. Non-macOS reports unsupported.
+One detached Bun host per project holds a signed pidfile in stateDir, reads
+`readPet` and `loadPetConfig` every second and atomically writes state, act/watch,
+character, blink and the full built-in `petPixels(CHARACTERS[...])` frame. No
+item ids/text/titles or external image assets are included. Unavailable status
+writes exactly `{offline:true}`; JXA displays Offline for two seconds, exits,
+and the host follows. A closed/crashed JXA also ends the host. A stale owner
+requires explicit close; an unconfirmed owner is retained.
+
+`osascript -l JavaScript` creates an accessory, borderless nonactivating
+NSPanel subclass that can become key, uses NSFloatingWindowLevel and
+canJoinAllSpaces | stationary, and embeds a transparent local WKWebView. Its
+one-second NSTimer loads the atomic view and calls `update(json)` with an
+explicit no-op completion function (a JS null completion block crashes on the
+verified macOS). The fixed bridge moves/saves position, makes the pencil's
+inline text box key, sends a console message through NSTask argv to `ahub say`,
+opens the dashboard through `ahub ui`, or closes. Enter sends; Esc cancels.
+No shell evaluation, new dependency, compile step, HTTP listener or network
+request is added. Message contents are not logged by this surface.
+Working animates only the pixel SVG through a 0.7-second stepped CSS bob, disabled by prefers-reduced-motion; no frame, timer or view-file change is added.
+
+The repaired Mac spike verified a transparent floating key panel and both
+bridge directions. Real input/drag/Spaces and end-to-end stream delivery remain
+manual acceptance evidence on the implementation PR, not inferred from the
+spike's process metrics or automated fixtures.
+
+## Amendment: dashboard views and task detail (#391 Task A)
+
+The existing page has one nav button per view, with `aria-current`; sections
+carry `data-view` and selection toggles only `hidden`. A shared cookie helper
+stores theme, Office mode, selected view and optional board column focus.
+The one-time ticket keeps exclusive use of the URL fragment. Projects and
+Benchmarks join peers, approvals and budgets under Agents.
+
+Compact task cards retain drag/drop, id/title, priority, owner dot and
+check/overdue markers. Click/Enter opens a native `dialog` via `showModal()`.
+`taskDetail` supplies full current public content and existing controls to that
+dialog and to a focused column's one-wide-list cards. Each snapshot updates the
+open detail; disappearance/project reset closes it. Back restores compact mode,
+and state/peer/release filters remain active in focus. Attention targets exact
+visible row ids with heading guidance when absent. No new route, API request,
+timer, source text/ref/history projection or external asset is introduced.

package/docs/specs/2026-10-12-office-view-design.md

@@ -29,8 +29,8 @@ asset is copied.
   No timer, no `requestAnimationFrame`, no request. Colours come from the
   page's theme tokens through CSS classes; every state also carries a glyph
   and a text label.
-- An always-visible View control in the page header offers Off (the default), Flat, and in
-  phase 4 Isometric; the choice persists in the host-scoped `agent-hub-office`
+- The Office view section contains a mode control offering Off (the default),
+  Flat and Isometric; the choice persists in the host-scoped `agent-hub-office`
   cookie with the `agent-hub-theme` attributes and try/catch fallback (#246).
 - Layout: stable desk slots (claude, codex, kimi, pi, local, then others by id;
   sticky across snapshots via the previous scene, so a peer keeps its slot when
@@ -40,7 +40,8 @@ asset is copied.
   section width: rooms left to right when wide, stacked when narrow.
 - Interaction: desks and cards are focusable SVG groups with `role="button"`
   and accessible names; activation scrolls to and highlights the matching list
-  row, and a list row highlights its desk or card on focus and hover. The scene
+  row; a card also opens the shared task detail dialog (#391). A list row
+  highlights its desk or card on focus and hover. The scene
   performs no action and sends no request; the closed action list is unchanged.
 - Room counts equal `taskProgress(tasks).counts` for the same snapshot (pinned
   by a test, including randomized boards).
@@ -64,7 +65,7 @@ Phase 1 decisions within the spec:
 - The primary condition of a desk is the first of offline, paused, waiting on
   approval, busy, idle; the raised-hand count, inbox tray, mode badge and break
   sign are independent marks that combine freely with it.
-- Work-floor cards sit at the owner's desk (at most 3, then "+N more" as text);
+- Work-floor cards sit at the owner's desk (at most 3 in Flat, then an owner-filtered "+N more" control);
   a card whose owner has no visible desk waits in the Work floor room. Tasks in
   an unknown state are counted (`counts.unknown`) but placed nowhere.
 - The busy bubble names the task only when the peer has exactly one
@@ -142,11 +143,30 @@ Phase 4 decisions within the spec:
   parallelogram polygons (the linear image of their rect); cards, text labels,
   bubbles, marks and arc labels stay upright. No WebGL, no library, no new
   route, no CSP change.
-- The DOM is projection-independent: the same keyed nodes in the same order
-  with the same accessible names, so focus order is identical (AC7, tested by
-  comparing serialized tab order between Flat and Isometric). The viewBox is
-  the projected bounding box with a small margin; the SVG keeps `width: 100%`,
-  so phone width scales without horizontal page scroll.
+- Keyboard targets follow model order independently of visual paint depth. Each
+  visible card has one transparent, focusable hit target with its full accessible
+  name; a separate `aria-hidden` paint layer is ordered back to front under
+  Isometric. Click, Enter and Space open the same task detail. Shared visible
+  cards retain their relative tab order across projections and switching back
+  restores Flat's model order. Correctly placed nodes are untouched during
+  snapshots; actual reorders use state-preserving DOM movement when available
+  and restore active focus without scrolling on the insertBefore fallback.
+  #394 allows Isometric to omit cards that do not
+  fit and expose the omitted count through the existing "+N more" control, so
+  its visible target inventory can be smaller than Flat's.
+- #394 fixed-scale amendment (2026-10-14): the SVG width attribute is its actual
+  occupied projected viewBox width times 12 px/unit, with `max-width: 100%` and
+  automatic height. It remains centered and shrinks only when the panel is
+  narrower than this intrinsic width. Flat uses up to four room columns;
+  Isometric uses two on wide screens and bounds the occupied tiles rather than
+  blank grid corners, keeping the two-peer scene at the same scale at 1280 and
+  1920 px. The cos-30/sin-30 projection and desk slots remain unchanged.
+  Desk trays use 24 px card bodies with 6 px gaps and padding inside a 20-unit
+  desk. Isometric fits upright cards wholly inside the tile (two per desk),
+  preserving omitted counts in a keyboard-accessible owner-filtered board link.
+  Its room band shifts vertically below desk legs and labels, with a one-unit
+  gap before the top-layer room headers; header backdrops associate each count
+  with its room.
 - A projection switch repaints every node in place (the projection is part of
   each reconcile signature) and is treated as a settle: positions jump, no
   transform transition storms. Card moves under Isometric animate through the
@@ -154,7 +174,9 @@ Phase 4 decisions within the spec:
 - Size accounting against the issue's 30 KB budget (page base 59,329 bytes at
   phase 1 branch point): phase 1 +11,040, phase 2 +7,340, phase 3 +2,141,
   phase 4 +1,704, art polish +3,559; final 89,113 bytes, +25,784 total,
-  inside the budget. The iso shelf's base skirt was dropped to stay under it.
+  inside the original phase-4 budget. These are historical #264 figures; #394
+  adds a separately reviewed visual refinement. The iso shelf's base skirt was
+  dropped to stay under the original budget.
 - Art polish (2026-10-12): two reference concept images (a flat view and an
   isometric view) were generated with Higgsfield (nano_banana_pro) and kept
   outside the repo (scratchpad); they served as drawing references only. Per
@@ -168,7 +190,24 @@ Phase 4 decisions within the spec:
   wireframe iso room boxes with small-caps labels at the base, a Done shelf
   cabinet (flat) and stacked boxes on a slab (iso) with the count kept as
   text, two-column room cards with thin dividers, and arc arrowheads at the
-  target end.
+  target end. #394 supersedes the wireframe posts, small-caps base labels,
+  decorative empty shelf slots and two-column cards:
+  - Room names are sentence case, 13 px/600 in `--ink`; count pills are 12 px
+    monospace with tabular figures. Desk names are 13 px; card/state/meta text
+    is 12 px. Shapes use 1 px non-scaling hairlines; focus is 2 px.
+  - Room tiles have a one-unit gap horizontally and vertically. Room cards
+    use one 20-unit padded column, 28 px height and 6 px gap, keeping
+    the eight-card model cap and public fields. Labels show id plus public
+    title. Canvas measures the actual system/monospace fonts before clipping at
+    a nearby word boundary; an internal SVG clipPath guarantees the card text
+    boundary. The full title remains in SVG title, aria-label and task detail.
+  - Room title/count groups paint last above all tiles. Isometric cards remain
+    upright, fit wholly inside padded tile bounds and paint by projected depth;
+    omitted cards contribute to "+N more". Empty rooms and the empty Done shelf
+    show "No tasks"; populated shelf slots correspond to existing done count
+    up to the current Flat/Isometric caps.
+  - Existing theme tokens, public-view privacy, counts/placement classifications,
+    animations, reduced motion, keyboard activation and mode cookie remain.
 
 ## Verification
 
@@ -186,6 +225,11 @@ Phase 4 decisions within the spec:
   timer/request/colour literal in the scene code, reduced-motion and motion CSS
   scans, no DOM write on an unchanged snapshot (counting fake document), focus
   and activation highlighting, "+N more" filtering, `resetView` clearing;
+  #394: fixed font/scene scale, 1 px hairlines, top-layer headers, actual shelf
+  counts, measured Latin/CJK title clipping and hard SVG bounds, cross-room
+  depth order, projection-independent shared-target tab order and Flat restore,
+  0/4/12-task two-peer geometry, count-stable placement changes and light/dark
+  text token contrast at least 4.5:1;
   phase 2: card moves keep their node and animate by transform, arcs/marks/
   latch draw once with fade timing, departure fade purges on animationend;
   phase 3: the exact bubble, finishing-a-turn line, check-running mark and

package/docs/verification/2026-10-15-0.12.27.md

@@ -0,0 +1,31 @@
+# 0.12.27 release verification
+
+This record covers release preparation and source verification. It does not certify tagging, package publication, global installation or a live upgrade; those receipts are recorded separately.
+
+## Candidate
+
+0.12.27 carries the console-presentation round for issues #391 and #394: PRs #392, #393, #395 and #396. Control protocol remains 16.
+
+- #392 (#391 Task B): an opt-in macOS floating pet window with built-in pixels, counts-only local state, a console message pencil, saved position and signed process ownership; terminal pet reads stay available to agent shells.
+- #393 (#391 Task A): the local dashboard split into cookie-backed views, compact task cards with shared dialog/column details and exact-id attention badges; character presentation moved to the standalone pet window.
+- #395 (#391 follow-up): the pet window shrinks to a compact 150x150 panel with the original pixel art in deeper state colors and a configurable base palette (`pet.palette`, or 1/2/3/4 while the window is key, or `ahub pet --palette`; blue, teal, violet, ochre) with a matching rim line; the status pill and message composer reveal only while the pointer is over the character, driven by a 10 Hz global-mouse-position poll against a page-posted hotspot rect because an inactive accessory panel receives no mouse-moved events; the pill shadow is dropped.
+- #396 (#394): the dashboard Office view renders at an intrinsic 12 px/unit scale with 1 px non-scaling hairlines and padded room cards in both themes, and the desk More control is a separately reconciled sibling button in the non-button marks layer so assistive technology can reach it.
+
+Review was adversarial and multi-round on the board: tasks #56 and #58 (owner kimi, reviewer claude) for the compact window and its round-3 fixes, #57 and #59 (owner codex, reviewer claude) for the Office refinement and its round-3 fixes. Owner iterations settled the final pet design (original art, teal default palette) and the hover-reveal interaction, each re-gated after the change.
+
+## Document review
+
+Every stale document was rechecked against the source commits of the four PRs. README, Quickstart and the adapters, daemon, tasks and tests area notes were confirmed accurate (version strings landed with the prepare commit; the new pet palette config write is console-local presentation and does not intersect the settings-registry rule). Operations and Security were amended at 59dd4803: Office room labels follow #396 (To do, Done), the pet window section names `ahub pet --palette`, Security enumerates the #391 view and column-focus cookies, the palette field in pet-view.json and the JXA bridge's palette operation with its validated config.local.json write path. All eight documents were restamped at 0f8a7ba4; `node scripts/check-docs.mjs --require-fresh` reports docs: OK.
+
+## Recorded checks
+
+- PR #395 head b8498c03: worktree `scripts/check.sh` 2744 pass, 0 fail, `check: OK`; CI Linux and macOS passed, seeded guards pending when the owner merged; the main-branch run of merge commit b2f076fd completed success, seeded guards included.
+- PR #396 head aee84ba1: owner-reported worktree gate 2761 pass, 0 fail, `check: OK`; CI Linux, macOS and seeded guards passed; board review approved (task #59).
+- Release candidate 9d21b1f4: local `scripts/check.sh` in an isolated worktree — 2761 pass, 0 fail, 190249 assertions, `check: OK`, no daemon leaks. The first candidate bundle (e9037e43) embedded `../../node_modules` paths because the worktree had no installed dependencies at build time; the bundle was rebuilt after `bun install` (9d21b1f4) and the freshness check passes. Later commits on this branch change documentation only.
+- Release head: CI, document freshness at the merge commit, and the release workflow are required before tagging is reported complete.
+
+Note: `scripts/check.sh` in the main checkout is not a valid signal there because the live hub daemon serving the project interferes (recorded in shared memory #194264); the isolated worktree gate is the valid signal.
+
+## Not verified
+
+Native, account and research legs remain open in #273 and #1. Native VoiceOver traversal of the pet window and the Office view was not run; accessibility is covered at DOM ancestry and keyboard level by tests. The installed runtime and live hubs are not upgraded by this release.