@staix/agent-hub 0.12.28 → 0.12.29

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
 
+## 0.12.29
+
+- Let an explicitly authorized agent run live verification through `ahub --live-test`, with operational console authority scoped to the invocation and its ahub continuations, the initiating peer retained in a mandatory delegation audit, and ordinary agent permissions unchanged (#408).
+
+- Remove the site caveat card accent edge and refresh the #273 live-verification ledger, including the machine-wide upgrade isolation requirements (#406, #273).
+
 ## 0.12.28
 
 - Recover an offline Pi owner with person-selected preserved history via `ahub pi --replace-session --session-file`, retaining prior identity metadata and queued work while refusing live owners and unsettled effects (#403).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker, with optional Qwen Code and Jcode support, collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.12.28, control protocol 16. Durable delivery records distinguish queued
+Status: 0.12.29, control protocol 16. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -33,7 +33,7 @@ cd <your project> && ahub init && ahub up
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.28 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.12.29 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/agent-notes/daemon.md

@@ -1,5 +1,8 @@
 # Daemon, control protocol and recovery
 
+- For explicitly user-authorized live verification, use the per-invocation CLI delegation in `docs/security.md` §Agent CLI identity and conductor authority; keep caller markers and record native evidence separately from fixtures.
+- Keep `export const LIVE_TEST_SUPPORTED = true;` in `src/cli/identity.ts`: delegated recovery staging reads this declaration before any source effect.
+
 - Console attention navigation selects a delivery only by an exact visible row id. A missing id or row prints read-only guidance; never select by peer or fall back to the first Queue row.
 
 Scope: the operator console, control WS and its protocol, state files, the dashboard listener and settings, the Claude channel's reconnect, `ahub setup`, git snapshots, upgrade and recovery. Read before editing `src/cli/console.ts`, `src/cli/console-state.ts`, `src/cli/attention.ts`, `src/ui/needs.ts`, `src/hub/daemon.ts`, `src/hub/ui.ts`, `src/hub/settings.ts`, `src/hub/control-client.ts`, `src/adapters/claude-channel.ts`, `src/hub/restart.ts`, `src/hub/recovery-store.ts`, `src/hub/snapshots.ts`, `src/hub/manager.ts`, `src/hub/lifecycle.ts`, `src/hub/crash.ts`, `src/hub/start-mode.ts`, `src/hub/terminal-open.ts`, `src/hub/recovery-error.ts`, `src/hub/db-timeout.ts`, `src/cli/setup.ts`, `src/cli/upgrade*.ts`, `src/cli/terminal-recovery.ts`, `src/cli/recovery-package.ts` or `src/cli/facts-hook.ts`, or before adding a native peer.

package/docs/operations.md

@@ -1,8 +1,46 @@
 # Operations guide
 
-This guide describes ahub 0.12.28 and control protocol 16. Live verification
+This guide describes ahub 0.12.29 and control protocol 16. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
+## Agent-operated live verification
+
+When the user explicitly authorizes a live test, its agent may run console
+commands using `ahub --live-test [--project <path|id>] <command> [args...]`.
+For example, `ahub --live-test --project <scratch-path> ui --no-open` starts the
+real dashboard listener and prints its one-time link without opening a browser.
+`ahub --project <scratch-path> --live-test reset --all --yes` exercises reset on
+that selected disposable project. The global options precede the command and
+may appear in either order; a flag after the command is not delegation.
+
+This grants console authority for operational console-class and peer-lifecycle conductor-class commands, including destructive actions, for one
+invocation and its ahub continuations. Use only the user-authorized targets and
+commands; destructive live checks belong in disposable projects. Existing
+project discovery still applies: initialize the scratch folder as its own Git
+repository before `ahub init`, then confirm `status --json` reports that exact
+`cwd` before any destructive check.
+Existing confirmations, process ownership checks, native identity fences and recovery
+locks still apply. Do not remove agent markers. The initiating peer and command
+label are audited before effects; an unavailable audit blocks delegation. A new
+unflagged invocation has ordinary peer authority again. Native tools launched
+by the command keep their own peer identity and receive no delegation flag.
+Allowed-class commands keep peer identity and permissions even with the flag:
+`--live-test say` sends as the peer. Peer starts, pause and resume may use
+delegated console authority. Flagged task assign/escalate refuse; omit the flag
+to use the ordinary actor-preserving conductor path when the peer has that role.
+Person verdicts and user-authored workflow writes are not delegated. Dashboard
+sessions issued through the flag retain operational controls but refuse message
+and task/planning content writes. Use native peer tools for agent-authored work.
+
+Use a CLI/coordinator containing this feature throughout the experiment. Older
+daemons do not understand the new delegated audit outcome; run the candidate
+daemon to capture its delegated event and console notice. This policy does not
+change external computer-use restrictions. Recovery staging refuses old targets
+without live-test support before source effects. Delegated headless recovery restores through the ordinary target CLI, carrying
+its operationId on the delegated console connection; existing native ownership
+and session-identity checks remain. Record actual observations in the
+smoke ledger; the presence of this option proves no outstanding #273 live leg.
+
 ## Command output
 
 `ahub status`, `board`, `budget`, `doctor`, `projects`, `queue list`, `turns` and `report` print shared console tables and labelled details.
@@ -1621,21 +1659,21 @@ section is what they run.
 
 Upgrade running projects with the target release's own coordinator. It accepts
 a running source on control protocol 9 (0.6.x), 10 (0.7.0 through 0.12.0),
-11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.28), and only
+11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.29), and only
 a target on its own protocol, so the target's coordinator fits every supported
 source and carries every recovery fix released up to it. Protocol 8 and older
 (0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.12.28 ahub upgrade --to 0.12.28 --dry-run
-bunx --package @staix/agent-hub@0.12.28 ahub upgrade --to 0.12.28 --yes
+bunx --package @staix/agent-hub@0.12.29 ahub upgrade --to 0.12.29 --dry-run
+bunx --package @staix/agent-hub@0.12.29 ahub upgrade --to 0.12.29 --yes
 ```
 
 | Running now | Coordinator to use |
 | --- | --- |
 | 0.6.x (protocol 9) | the target's, through `bunx` as above |
-| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.28 (protocol 16) | the target's, through `bunx` as above |
+| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.29 (protocol 16) | the target's, through `bunx` as above |
 | any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
 | 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
 
@@ -1667,14 +1705,14 @@ projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.12.28 --dry-run
+ahub upgrade --to 0.12.29 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.12.28 --yes
+ahub upgrade --to 0.12.29 --yes
 ahub recovery status [<operation-id>]
 ahub recovery resume [<operation-id>]
 ahub recovery abort [<operation-id>]

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.28
+bun add -g github:STAIxBWLB/agent-hub#v0.12.29
 ahub setup
 ```
 

package/docs/security.md

@@ -71,10 +71,35 @@ or the native Claude/Codex shell marker when the hub marker is absent. It connec
 as that peer in tools mode. Messages and task changes retain that actor;
 `say` defaults to status priority and important messages still require the peer's
 capability. Conflicting or malformed markers fail closed. There is no `--as-user`.
-Human-only operations are refused before connecting, including permission answers
+By default, console operations are refused before connecting, including permission answers
 and permission modes, queue resolution, budget overrides, benchmark runs, research
 backfill and task labels, stopping a peer (`ahub stop`), lifecycle and recovery
 operations, and `ask`.
+For live verification explicitly authorized by the user, an agent may invoke
+`ahub --live-test [--project <path|id>] <command> [args...]`. The flag delegates
+the existing console authority for console-class operations and conductor-class peer starts/holds, including approvals,
+settings, roster and lifecycle operations. It does not restrict effects to a
+scratch project: the agent must stay within the authorized commands and targets.
+Malformed or conflicting caller markers still refuse. The original peer and
+closed command label are recorded with outcome `delegated` before execution;
+if that audit cannot be written, the command refuses. The current daemon emits
+`agent_cli` with `delegated: true` and `refused: false`. Allowed-class commands retain the peer identity and capability checks, including
+messages, proposals and reviews. Peer starts, pause and resume may delegate
+operational console authority; task assign/escalate under the flag refuse. `--as-user`, person task labels,
+person-authored planning/release/memory/goal writes, SDLC record, benchmark run
+and the pet composer are refused. No argument text is copied into this audit.
+Delegated dashboard restrictions are bound to its server-issued ticket/session:
+operational settings/start/stop controls remain, but message, proposal and
+workflow-history actions refuse even if the body tries to clear the restriction.
+The flag is not stored in settings or exported to native agent children. Ahub's
+own daemon launch, console subprocesses, recovery runner, interactive follow-up commands and upgrade coordinator
+handover carry it explicitly in argv. Each new top-level invocation needs its
+own flag. An older CLI does not support it; use a candidate with this feature
+for the continuation too. Staging rejects a target without the pinned
+`LIVE_TEST_SUPPORTED` declaration before preparation or commit, including a
+previously cached stage. Delegated headless-native restoration uses the ordinary target CLI with its
+operationId through that operational console authority. Native and TUI
+restoration keep their existing identity and ownership checks. External computer-use restrictions remain unchanged.
 The operator uses a plain terminal or `ahub console`. A Claude `!` command that
 inherits the agent markers follows the same rule. The console strips control
 sequences from agent and daemon text before it quotes forged headers, and its

package/docs/smoke.md

@@ -2,6 +2,60 @@
 
 `scripts/check.sh` covers everything against fakes. The legs below need real accounts and an interactive terminal, so they are run by hand and recorded here.
 
+## Issue #273 operator execution plan (2026-10-16)
+
+The [execution plan and blocker record](verification/2026-10-16-273-live-verification.md)
+maps the outstanding issue entries to their procedures and required observations.
+The installed CLI and running project daemon both reported 0.12.28. This is an
+environment readback only. No outstanding live leg passed in this session:
+the installed 0.12.28 CLI refused `ahub ui` from Codex, and LCU refused Terminal access.
+These are dated observations. From 0.12.29, authorized agents use the audited
+`--live-test` route described below and in the execution plan; the external LCU
+restriction remains separate. The operator initially chose procedure preparation;
+#273 remains open.
+
+## Agent-operated verification (#408)
+
+For user-authorized live checks, the candidate CLI supports
+`ahub --live-test [--project <path|id>] <command> [args...]`, using audited console
+authority for that invocation. Follow [the operating procedure](operations.md#agent-operated-live-verification)
+and record each actual result below. References to a person in historical
+procedures describe their original authority requirement; an explicitly
+authorized agent may now execute those CLI steps through this option. Native
+account readiness, real terminal/browser observations, sign-off requirements and
+external computer-use restrictions still apply. No pending #273 item is checked
+by adding this path.
+
+2026-10-16, macOS, candidate CLI/source `40d13bc4`, daemon 0.12.28/protocol 16:
+an actual Codex-marked shell with a separate hub home and disposable Git project
+ran delegated `init`, `up --no-console`, `ui --no-open`, `permission pi ask`,
+`kill` and `reset --all --yes`, all exit 0. Unflagged `status --json` reported
+the exact scratch cwd. The dashboard URL returned HTTP
+200 and HTML; no browser or ticket/session exchange was performed in that shell run. The daemon recorded
+`agent_cli` events for init/up/daemon/ui/permission with peer `codex`,
+`delegated: true` and `refused: false`. The reset archive mode was 0700 and the
+scratch daemon was stopped. This verifies the delegated CLI path, without
+claiming a model turn, terminal look, conversation restoration or the complete
+#214/#273 live criteria. The automated console-subprocess and recovery-target
+checks remain separate fixture evidence.
+
+2026-10-16 review follow-up, source `fcbb18ec`: the same isolated Git scratch
+project was started from a Codex-marked shell. Flagged `say` produced a bus
+envelope from `codex`; person task-label writing refused. A delegated dashboard
+ticket exchanged for a session with HTTP 200, its snapshot returned HTTP 200,
+and a send action trying `liveTest: false` returned HTTP 403. The scratch daemon
+was stopped (kill exit 0). This was an actual CLI/HTTP run, without a model turn
+or browser visual inspection.
+
+Task #65 follow-up, source `5fbe50b6`: operational peer starts, pause and resume
+may delegate console authority; allowed-class messages/proposals/reviews retain
+the peer, while flagged task assign/escalate refuse. The temporary headless
+staging ceiling is removed. The recovery driver -> real target CLI -> scripted
+control server regression verifies headless Pi mode, saved sessionId,
+operationId, console hello and initiating-peer audit (225 related tests passed).
+This is fixture/CLI proof, not an actual native Pi restoration; that live leg
+remains owed in #273.
+
 ## Hub memory (#258)
 
 Not run yet (2026-10-12). Source and fakes cover tiers, the graph, retrieval, sync between two simulated homes and a bare remote, leases, import and suggestions (`test/memory-*.test.ts`).

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1947,10 +1947,17 @@ task list polling does not. `hub_status` stays conductor-only.
   proposer as the actor with reason `manual` (on the `reassigned` or `reserved`
   entry), and writes no conduct audit event; during a PII turn it is refused
   like the conductor's.
+## Amendment: delegated agent live verification (#408)
+
+- Decision, 2026-10-16: an agent explicitly authorized by the user to perform a live test may use the global `--live-test` flag, before the command and in either order with `--project`. Duplicate global options refuse. Default command classification and malformed/conflicting identity refusals stay unchanged.
+- Console-class operations and conductor-class peer starts/pause/resume may use console authority after the original caller is validated; allowed-class commands retain peer identity and capability checks. Flagged task assign/escalate refuse rather than writing user-attributed history. A mandatory ids-only audit records its peer, closed command label and `delegated` outcome before execution. The daemon emits an `agent_cli` event with `delegated: true`, `refused: false`, and a console notice naming the peer. User impersonation, person labels and person-authored workflow writes refuse. Delegated dashboard tickets/sessions allow operational controls but refuse user-attributed content and history actions on both project and unified surfaces; request bodies cannot widen the session.
+- This is a user-authorized operating policy, not a sandbox or authenticated grant. It includes console mutations and requires the agent to remain within the authorized targets and operations. Command-specific confirmations, process ownership, provider identity and recovery locks still apply.
+- No settings/environment opt-in persists. Native argv does not receive the flag. Ahub's own daemon launch, console subprocesses, recovery runner, interactive continuation commands and newer-version coordinator handover carry it explicitly; older CLIs cannot accept it. The recovery driver's target CLI environment preserves the initiating peer for its delegation audit. Staging checks the target's pinned LIVE_TEST_SUPPORTED declaration before its cached-stage return and before prepare/commit; unsupported old targets refuse without source effects. Headless-native restoration uses the ordinary target CLI with the operationId on its delegated console connection; no headless staging ceiling is added. External computer-use policies remain outside this change. No #273 live success is inferred from this implementation.
+
 ## Amendment: ahub reset (issue #214)
 
 `ahub reset [--all] [--yes]` returns a project's hub to a clean state. It is
-human-only (the CLI identity gate refuses it from an agent shell) and a dry run
+console-only by default (explicit authorized delegation is described in #408) and a dry run
 unless `--yes`: the dry run reads `hub.db` read-only (with `immutable=1` when
 `hub.db-wal` or `-shm` is absent, so it creates neither) and prints delivery ids,
 peer names and counts per category, never task or message text. With `--yes`

package/docs/verification/2026-10-16-0.12.29.md

@@ -0,0 +1,25 @@
+# 0.12.29 release verification
+
+This record covers release preparation and source review. Publication and installation receipts are recorded separately after their gates succeed.
+
+## Candidate
+
+0.12.29 carries PR #409 (#408), the site correction in PR #406 and the #273 execution-plan corrections in PR #407. Control protocol remains 16.
+
+- Explicit `--live-test` delegation permits operational console and peer lifecycle actions with a mandatory initiating-peer audit. Allowed agent commands retain their peer identity; person-attributed writes refuse under delegation.
+- Dashboard delegation is bound to the issued session and checked server-side. Recovery refuses unsupported target packages before effects; supported headless restores use the ordinary target CLI with the recovery operation id.
+- The #273 ledger includes the current native checks and makes machine-wide upgrade isolation explicit. No native leg is marked passed by these preparation changes.
+
+## Document review
+
+Security, Operations and the design specification describe the reviewed delegation boundary. README, Quickstart and the current Operations examples name 0.12.29. The stale area notes are checked against the CLI identity, console, recovery, dashboard and audit changes; their existing rules remain applicable. Document stamps name the release preparation commit, which must remain an ancestor of the merge commit.
+
+## Recorded checks
+
+- PR #409 head a8b9a56b: independent source review and board tasks #64/#65 approved. Exact-head Ubuntu and macOS full gates passed (`check: OK`); the headless restoration regression is fixture/CLI proof, not native Pi restoration.
+- Original PR #407 head c637a088: Ubuntu, macOS and seeded guards passed in CI run 38791043404. The corrected execution plan was independently reviewed at 780853b6.
+- The final release head requires its own Ubuntu/macOS `scripts/check.sh` and seeded guards before merging. Committed document freshness and stamp ancestry are checked again before tagging. The release workflow requires green CI for the identical tree before npm publication.
+
+## Not verified by this record
+
+Native, account, visual and research checks remain tracked in #273 and #1. Package publication, global CLI/plugin installation and running-hub upgrade are separate operational results; this preparation record does not claim them.

package/docs/verification/2026-10-16-273-live-verification.md

@@ -0,0 +1,150 @@
+# Issue #273 operator execution plan
+
+## Scope and dated observations
+
+- Date: 2026-10-16, Asia/Seoul.
+- Initial observation source: main `426bab99`, release 0.12.28, protocol 16. The following CLI refusals describe that installed version, before #408.
+- Issue #273 was read live, including its 2026-10-14 additions at initial preparation; the matrix below was refreshed for the five 2026-10-16 additions before release. Every checkbox remained unchecked.
+- `ahub --version` returned `0.12.28`.
+- `ahub status --json` returned daemon version `0.12.28`, protocol `16`, `stopping: false`, Claude idle, Codex busy, Kimi offline and Pi idle. These are status observations, not model-delivery or restoration receipts.
+- `ahub ui` exited 1 with `ahub: codex cannot run ahub ui; the person runs it in ahub console or a terminal`.
+- LCU app selection for `com.apple.Terminal` returned `Computer Use is not allowed to use the app 'com.apple.Terminal' for safety reasons.` No Terminal inspection or input occurred.
+- The operator selected procedure and blocker preparation before live execution. No identity markers were removed, no console connection was impersonated, and no lifecycle, reset, roster, quota or provider experiment was run.
+
+## Supported execution route and remaining boundaries
+
+From 0.12.29, an explicitly authorized agent runs operational CLI steps with
+`ahub --live-test <command> [args...]`, including `init`, `up`, `console`,
+`settings`, `reset`, `upgrade`, `recovery` and roster operations. Follow
+[Agent-operated live verification](../operations.md#agent-operated-live-verification).
+Record the initiating peer and the mandatory delegation audit (`agent_cli`
+event or retained CLI audit), alongside the command and operational receipts.
+The original 0.12.28 refusal above is historical evidence, not a current CLI
+blocker. Identity markers remain intact; the supported option supplies authority.
+
+Allowed-class commands retain the agent's peer identity, including messaging
+and review verdicts. The flag refuses person-attributed writes, including
+`--as-user`, task labels, task assign/escalate and planning/memory writes.
+Delegated dashboard sessions permit operational controls but refuse sending,
+proposals and person-attributed planning/history actions; changing a request body
+cannot remove that restriction. Exercises requiring those actions or a person's
+sign-off need the ordinary authorized actor path and cannot be completed merely
+by adding the flag.
+
+LCU's Terminal denial is a separate external computer-use restriction and remains
+in force. CLI delegation does not grant Terminal app access or prove native
+visual, account or accessibility observations. Record any inaccessible native
+surface as unverified while continuing reachable authorized CLI checks.
+
+## Execution order
+
+Use a disposable Git project under the workspace scratchpad, outside this
+checkout, and initialize its own Git boundary before `ahub init`. An authorized
+agent runs `ahub --live-test init`, reviews the resulting configuration and starts
+it with `ahub --live-test up`. Record its absolute path, project id and delegation
+audit. Keep destructive recovery/reset experiments separate from the project
+used for browser and model checks. Recovery can hold a machine-wide lock, so
+inspect `ahub --live-test recovery status` before starting an operation and wait
+for unrelated operations to finish. Upgrade isolation has the additional
+machine-wide and shared-configuration requirements below.
+
+Use installed, authenticated native tools. Record each version before its first
+turn. Do not change credentials, buy access or exhaust quota to produce a result.
+Do not run another session's stop or reset. Keep identity fencing in effect and
+use the documented delegation route rather than removing identity markers.
+
+1. Run reachable operational checks through `ahub --live-test`; retain their delegation audits and readbacks. Inspect terminal/dashboard rendering only through an available permitted native surface.
+2. Run native messaging and role/planner exercises on the disposable project using the ordinary peer or person path as required by attribution; the delegation flag does not authorize person-content writes.
+3. Run roster and recovery experiments with disposable conversations only, using the delegated operational CLI route and recording native continuity separately.
+4. Run the real repository SDLC cycle only with an explicitly selected issue and release window, retaining required person verdicts.
+5. Record each result in `docs/smoke.md`, retaining any unverified remainder and external blocker.
+
+## Required observations by issue entry
+
+All rows below are pending. A procedure reference is not evidence of execution.
+Section names refer to [the smoke checklist](../smoke.md).
+
+| Entry | Procedure or setup | Evidence required before checking the issue box |
+| --- | --- | --- |
+| #201 AC2/AC7, #213 AC7 | Console layout and readability | Light/dark terminal, stream and panels; terminal name, dimensions, readable text and observed clipping |
+| #205 AC3 | Claude without channel evidence | Managed Claude push and settlement beside plain Claude tools-only; correlated message and settlement ids |
+| #206 AC4 | Upgrade procedure below | Two distinct releases, unmanaged Claude marked reconnect-only, same native conversation after reconnect |
+| #214 AC6 | ahub reset on a scratch project | Both reset scopes, queue/board checks, archive permissions and restored board, same project id |
+| #215 AC6 | Expired-lease procedure below | Real expired lease and missing transcript, daemon/CLI/lock/project/archive outcomes, completion or audited disposition |
+| #225 AC9 | Target-crash procedure below | Target killed after peers-restored, supported resume, original conversation and restart count readback |
+| #269 AC10 | Settings from the dashboard and the terminal, parts 1-2 | Light/dark, phone width and keyboard path; actual Orca and terminal.open launches with native Pi attached |
+| #285 phase 1 | Record table, #285 live item 1 | Real Kimi turn, status context source/value, usage_update timing relative to correlated prompt result |
+| #284 phase 1 | One-shot command output | status/board/budget/doctor, light/dark, 80 and wider columns, console rendering and full suggested ids |
+| #298 | Unified dashboard slow start | Real browser unconfirmed text, 30-second hold and keyboard focus after Start; a deterministic slow native start is a prerequisite |
+| #296 | Ending Codex turn | Correlated native turn/steer response, elapsed time and exact refusal; a successful steer alone does not prove refusal matching |
+| #315 Codex | Live roster return | Removal exit, printed resume command, restored same thread and peer reattachment |
+| #315 Pi | Live roster return | Retained terminal/process, admission refused off roster, same TUI reattaches; prepare blocked until retained TUI ends |
+| #316 trust and ingestion | Kimi TUI pull mode | Actual trust screen, project MCP tools and model-visible managed instructions/tool descriptions |
+| #316 messaging/discovery | Kimi TUI pull mode | Correlated hub_inbox/hub_send exchange with another peer; trusted project and overlay discovery |
+| #316 headless return | Kimi TUI pull mode | TUI to headless to TUI, session/config restoration readback; argv fixtures are insufficient |
+| #256 identity/modes | Qwen Code 0.25.0 production peer | Real ACP supported identity and advertised modes; stop on CLI/ACP mismatch |
+| #256 native provider | Qwen Code 0.25.0 production peer | Actual model identity, delivery, exact tool call/result and mode confirmation |
+| #256 stop/recovery | Qwen Code 0.25.0 production peer | Owned stop and controlled/crash recovery retain the recorded conversation |
+| #256 quota | Observe an organic refusal only | Version and exact sanitized native refusal; unknown remains failed delivery |
+| #259 AC11 | Research-profile exercise | Two native agents, three sources, configured routing/classes, plans, role/tool ingestion, deterministic citations and person sign-off |
+| #259 converters | Intended formats and configured converters | Actual conversion, review and undo previews; timing, caps and named-only fallback |
+| #259 guidance | Same native profile sessions | Native profile/custom-stage guidance retention; preserve separate #295 and research measurements |
+| #257 AC6 | SDLC gates | Real repository issue through merge/release under advise; issue/PR/head ids, gate blockers and release report |
+| #295 AC16 | Native role/task cycle | Role text ingestion, retention after actual compaction, assignment/reassignment notice and review duty |
+| #280 AC11 | Console attention, Global attention status, Approved character, Dashboard character | Per-phase light/dark, tmux, colour off, blocks/ascii and actual dashboard look |
+| #263 AC11 | Planning and release controls | Native planner creates two releases; planned/actual dates read back |
+| #263 board/intake | Project board | Desktop/phone browser against real hub, permission/state readback and actual GitHub issue intake |
+| #306 | Observe an organic Kimi weekly/monthly refusal only | CLI version and exact sanitized prefix; do not deliberately consume quota |
+| #403 | Offline Pi preserved-history recovery | Actual selected native session restored with identity/queue retained; a live owner refused |
+| #398 | Pull-only important-message advisory | Real Kimi TUI and plain Claude see the tool-result advisory; hub_inbox drains it |
+| #391 pet lifecycle | Standalone pet window | Actual stop changes it to Offline and host exits; native screenshots of states |
+| #391 dashboard CSP | Split dashboard views | Browser-console capture of CSP behavior, separate from the earlier owner browser look |
+| #394 VoiceOver | Office desk More control | Native VoiceOver traversal; DOM/click/Enter/Space regressions remain separate |
+
+## Upgrade with unmanaged Claude (#206)
+
+1. An authorized operator starts the disposable project on a known older release, records its version/project id and attaches an unmanaged Claude session using the documented plain-Claude tools-only setup. Record its native session id and a harmless conversation marker.
+2. Use an isolated test environment for the hub home/registry and shared Claude plugin setup. Upgrade is machine-wide, even when invoked from the scratch cwd: it plans all registered running projects and changes the shared package/plugin; `--project` does not scope it. Run the target coordinator with `ahub --live-test upgrade --to 0.12.29 --dry-run` and retain the complete plan. Verify every planned root is a disposable fixture, record the shared CLI/plugin fate, and confirm the intended unmanaged Claude is reconnect-only. Stop without applying if any non-disposable project or shared setup is in scope. A separate AGENTHUB_HOME alone does not isolate the shared plugin; use a dedicated native configuration/test environment too.
+3. The authorized agent applies that same target with `ahub --live-test upgrade --to 0.12.29 --yes` after reviewing the plan (a person may use the ordinary interactive path). Retain the delegation audit. Record operation id, source and target versions, terminal fate and plugin reconnect outcome. Do not substitute a restart at the same version.
+4. Read back `ahub status`, the original native session id and marker, and one correlated hub message receipt. Record whether a second terminal appeared or a conversation was replaced.
+5. Capture final operation and lock status. A refusal or failed reconnect is a failed leg, with its exact wording; it is not a pass based on the dry-run plan.
+
+## Expired preparation lease with missing Codex transcript (#215)
+
+This needs an isolated failure-injection setup before it is executable. There is
+no public `ahub recovery prepare` CLI. Do not invent one or edit production
+recovery JSON to claim a native reproduction. `test/upgrade.test.ts`,
+`expiredLease`, is a scripted-driver fixture and is only a setup reference.
+
+1. Give disposable Codex its own native session store and complete a harmless turn so its transcript exists. Record project id, daemon instance, native thread id and transcript path. Keep the original transcript outside the fixture's missing-path condition; never remove a production transcript.
+2. In a controlled scratch-only harness, stop the coordinator after real source preparation and before commit, preserving its operation receipt. Record the daemon's preparation, terminal close receipts and runner identity. The harness and its pause point must be reviewed before use.
+3. Make only the disposable transcript unavailable and allow the real preparation lease to expire. Confirm expiry from the daemon log/readback rather than changing a clock or receipt timestamp.
+4. The authorized agent runs `ahub --live-test recovery status <operation-id>` and the supported next action it offers. Capture the exact missing-session refusal. Restore the disposable transcript and resume, or use the offered audited disposition with a reason. Do not force a fresh conversation and label it restoration.
+5. Record daemon and CLI outcomes, operation/lock state, project id before/after, archive paths and modes, and the final continuity or lostContinuity disposition. Preserve failed intermediate receipts.
+
+## Target crash after peers-restored (#225)
+
+1. In a separate disposable project, establish native conversations with harmless markers and start a controlled recovery. Save its operation id and source conversation ids.
+2. Observe the real `peers-restored` phase before release. A controlled pause at that boundary is required: if the operation already completed, this run cannot demonstrate this failure point. Do not fabricate the phase by editing a receipt.
+3. Verify the target pid belongs to this disposable project's daemon and record its instance id. The authorized operator ends only that target daemon through a permitted process-control surface. Record native launcher/process state after the exit.
+4. Run `ahub --live-test recovery status <operation-id>`, then its offered `ahub --live-test recovery resume <operation-id>`. Retain the delegation audits. If a surviving launcher blocks it, end the identified disposable launcher as instructed and retry the supported action.
+5. Verify the new target instance, recorded restart count, same native conversations and markers, no duplicate terminal, final operation status and lock release. A missing snapshot or failed native resume remains a failure, with the precise refusal and the supported disposition recorded.
+
+## Recording and closure
+
+For each execution record: date/time, source commit, hub/native versions, project
+id, exact command or interaction, expected observation, actual observation,
+correlated ids, sanitized evidence path and pass/fail/unverified verdict. Record
+partial success at the substep level. Keep raw tokens, cookies, private task text
+and account details out of committed evidence.
+
+On a confirmed defect, preserve its failure wording and open a linked defect
+issue within the user's authorized scope. Check a #273 item only after its dated
+record covers the entire item, or a failed run is recorded with a linked defect.
+Environment/tool restrictions remain unverified prerequisites. They do not meet
+the issue's failed-product-run alternative. #273 cannot close from this plan.
+
+The initial preparation ran no full check or native model turn. Its original
+commit c637a088 subsequently passed Ubuntu/macOS full gates and seeded guards
+in CI run 38791043404. The release candidate must earn its own exact-head checks;
+none of those automated results completes a live leg.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -74,7 +74,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -86,7 +86,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -98,7 +98,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -155,7 +155,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -172,7 +172,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -191,7 +191,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "6dcc7fe00c38f13613bcf53524fa3d1527a708e5",
+      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.28",
+  "version": "0.12.29",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.28",
+  "version": "0.12.29",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -16157,7 +16157,7 @@ import { join as join4 } from "path";
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.28",
+  version: "0.12.29",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/cli/console.ts

@@ -28,6 +28,8 @@ export interface ConsoleOptions {
   terminal?: ConsoleTerminal;
   color?: boolean;
   noPet?: boolean;
+  /** Explicit delegation inherited only by this console's ahub subprocesses. */
+  liveTest?: boolean;
   /** Injected command runner must use argv, closed stdin, and return a cancellation handle. */
   runCommand?: (args: string[], output: (text: string) => void, done: () => void, columns?: number) => (() => void);
   pollMs?: number;
@@ -188,7 +190,7 @@ export async function runConsole(options: ConsoleOptions): Promise<void> {
     finally { polling = false; }
   };
   const run = options.runCommand ?? ((args, output, finished, commandColumns) => {
-    const child = Bun.spawn([process.execPath, fileURLToPath(new URL("./main.ts", import.meta.url)), "--project", options.cwd, ...args], {
+    const child = Bun.spawn([process.execPath, fileURLToPath(new URL("./main.ts", import.meta.url)), "--project", options.cwd, ...(options.liveTest ? ["--live-test"] : []), ...args], {
       cwd: options.cwd, stdin: "ignore", stdout: "pipe", stderr: "pipe",
       env: { ...process.env, COLUMNS: String(commandColumns), NO_COLOR: "1" },
     });

package/src/cli/help.ts

@@ -11,6 +11,7 @@ const SECTIONS: [string, [usage: string, description: string][]][] = [
     ["ahub projects remove <id>", "forget a stopped registration (keeps project files)"],
     ["ahub setup [--yes]", "install or update the Claude Code channel plugin from this package, then run doctor"],
     ["ahub init [--profile dev|research|writing|general] [--shadow] [--dry-run --json]", "preview or write .agenthub/config.json and the AGENTS.md marker block (drops a legacy CLAUDE.md block)"],
+    ["ahub --live-test [--project <path|id>] <command> [args...]", "user-authorized operational console delegation; ordinary calls retain peer identity; person-authored content refuses"],
     ["ahub help [command]", "this help, or one command's entries; also --help and -h"],
     ["ahub version | --version", "print the installed version"],
   ]],

package/src/cli/identity-audit.ts

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { cliCommandLabel } from "./identity.ts";
 
 export interface CliAudit {
-  v: 1; id: string; at: number; peer: string; command: string; outcome: "run" | "refused" | "invalid";
+  v: 1; id: string; at: number; peer: string; command: string; outcome: "run" | "refused" | "invalid" | "delegated";
 }
 const MAX_FILES = 256;
 const MAX_BYTES = 64 * 1024;
@@ -14,7 +14,7 @@ const valid = (row: any): row is CliAudit => row?.v === 1 && typeof row.id === "
   && typeof row.at === "number" && Number.isFinite(row.at) && row.at > 0
   && typeof row.peer === "string" && /^[a-z][a-z0-9-]{0,31}$/.test(row.peer) && !/\s/.test(row.peer)
   && typeof row.command === "string" && row.command.length <= 64 && row.command === cliCommandLabel(...splitLabel(row.command))
-  && ["run", "refused", "invalid"].includes(row.outcome);
+  && ["run", "refused", "invalid", "delegated"].includes(row.outcome);
 const splitLabel = (label: string): [string, string[]] => { const [command = "unknown", ...args] = label.split(" "); return [command, args]; };
 
 /**

package/src/cli/identity.ts

@@ -1,5 +1,19 @@
 import { isSupportedPeer } from "../hub/peer-catalog.ts";
 
+/** Recovery reads this declaration before delegating to another package's CLI. */
+export const LIVE_TEST_SUPPORTED = true;
+
+/** Person verdicts and user-authored workflow content are never delegated. */
+export function liveTestRefusal(command: string, args: readonly string[]): boolean {
+  if (args.some(arg => arg === "--as-user" || arg.startsWith("--as-user="))) return true;
+  const sub = args.find(arg => arg !== "--json");
+  return ["task", "role", "goal"].includes(command)
+    || (command === "backlog" && sub !== "list") || (command === "release" && !["list", "show"].includes(sub ?? ""))
+    || (command === "memory" && sub !== "graph")
+    || (command === "board" && args[0] === "import") || (command === "sdlc" && args[0] === "record")
+    || (command === "bench" && args.find(arg => arg !== "--json") === "run") || command === "pet";
+}
+
 export type CliIdentity =
   | { role: "console" }
   | { role: "tools"; peer: string }

package/src/cli/main.ts

@@ -63,7 +63,7 @@ import { addonReport, appendRecords, formatAddons, formatResearch, LABELS, label
 import { summarize, summarizeByTask } from "../hub/report.ts";
 import { hasTree, planUndo, repoOf, restore, Turns } from "../hub/snapshots.ts";
 import { pathWarnings } from "../hub/conflicts.ts";
-import { classifyPeerCommand, cliCommandLabel, detectCliIdentity, peerCommandRefusal } from "./identity.ts";
+import { classifyPeerCommand, cliCommandLabel, detectCliIdentity, liveTestRefusal, peerCommandRefusal } from "./identity.ts";
 import { recordCliAudit } from "./identity-audit.ts";
 import { runConsole } from "./console.ts";
 import { paint, permissionBoundary, resolveColor, wrap, type Span } from "./console-state.ts";
@@ -83,10 +83,16 @@ const since = (): number => {
 
 const argv = process.argv.slice(2);
 let selector: string | undefined;
-if (argv[0] === "--project") {
-  argv.shift();
-  selector = argv.shift();
-  if (!selector || selector.startsWith("--")) fail("--project needs a path or project ID");
+let liveTest = false;
+while (argv[0] === "--project" || argv[0] === "--live-test") {
+  if (argv.shift() === "--live-test") {
+    if (liveTest) fail("--live-test may appear only once");
+    liveTest = true;
+  } else {
+    if (selector !== undefined) fail("--project may appear only once");
+    selector = argv.shift();
+    if (!selector || selector.startsWith("--")) fail("--project needs a path or project ID");
+  }
 }
 const [given = "help", ...rest] = argv;
 // `ahub <command> -h` alone asks for that command's help instead of running it. Elsewhere `-h` may be message text
@@ -114,17 +120,27 @@ const projectConfig = () => {
   return config;
 };
 const stateDir = selected.stateDir;
-const identity = detectCliIdentity(process.env);
+const caller = detectCliIdentity(process.env);
 const commandLabel = cliCommandLabel(cmd, args);
 const commandAccess = classifyPeerCommand(cmd, args);
+// Agent-authored content keeps its peer. Operational starts/holds may borrow console authority for live verification.
+const delegationRefused = liveTest && caller.role === "tools" && commandAccess !== "allowed" && liveTestRefusal(cmd, args);
+const delegatedPeer = liveTest && caller.role === "tools" && commandAccess !== "allowed" && !delegationRefused ? caller.peer : undefined;
+const identity = delegatedPeer ? { role: "console" as const } : caller;
 function audit(outcome: "run" | "refused" | "invalid"): void {
-  if (identity.role === "console") return;
-  try { recordCliAudit(stateDir, identity.role === "tools" ? identity.peer : "unknown", commandLabel, outcome); }
-  catch { console.error("ahub: CLI audit could not be recorded (outbox unavailable or full)"); }
+  if (caller.role === "console") return;
+  try { recordCliAudit(stateDir, caller.role === "tools" ? caller.peer : "unknown", commandLabel, delegatedPeer && outcome === "run" ? "delegated" : outcome); }
+  catch {
+    if (delegatedPeer) fail("live-test delegation audit unavailable; nothing was executed");
+    console.error("ahub: CLI audit could not be recorded (outbox unavailable or full)");
+  }
 }
 if (identity.role === "invalid") { audit("invalid"); fail(`${identity.reason}; use ahub console or a terminal with no agent markers`); }
+if (delegationRefused) { audit("refused"); fail("live-test cannot write person-attributed content; use peer tools or a person's terminal"); }
 if (identity.role === "tools" && commandAccess === "console") { audit("refused"); fail(peerCommandRefusal(identity.peer, commandLabel)); }
-if (identity.role === "tools") audit("run");
+if (identity.role === "tools" || delegatedPeer) audit("run");
+// Forward only to ahub's own continuation commands, never to native agent argv or an environment flag.
+const liveTestArgs = liveTest ? ["--live-test"] : [];
 const invokedFrom = process.cwd(); // relative paths a person types (a bench suite) are theirs, not the project's
 try { process.chdir(cwd); } catch { fail(`project directory is unavailable: ${cwd}`); }
 /** One-shot output flags do not alter the fetched JSON document. */
@@ -381,7 +397,7 @@ async function hold(t: "pause" | "resume"): Promise<void> {
 }
 
 function spawnRecovery(operation: RecoveryOperation, quiet = false): void {
-  const child = spawn(process.execPath, [join(operation.sourceRoot, "src/cli/main.js"), "recovery-run", operation.id], {
+  const child = spawn(process.execPath, [join(operation.sourceRoot, "src/cli/main.js"), ...liveTestArgs, "recovery-run", operation.id], {
     cwd, detached: true, stdio: "ignore", env: { ...process.env, AGENTHUB_RECOVERY_OPERATION: operation.id },
   });
   child.on("error", () => console.error(`runner launch failed; use ${recoveryCommand(operation, "resume")}`));
@@ -415,7 +431,7 @@ async function onTerminal(screens: (io: ScreenIO) => Promise<void>): Promise<voi
         // The command owns the terminal while it runs; a reader whose input already ended has nothing to pause.
         if (!ended) rl.pause();
         const done = (code: number) => { if (!ended) rl.resume(); resolve(code); };
-        const child = spawn(process.execPath, argv, { cwd, stdio: "inherit" });
+        const child = spawn(process.execPath, [argv[0]!, ...liveTestArgs, ...argv.slice(1)], { cwd, stdio: "inherit" });
         child.on("error", () => done(1));
         child.on("close", (code) => done(code ?? 1));
       }),
@@ -444,7 +460,7 @@ function upgradeHost(kind: "restart" | "upgrade", version: string): UpgradeHost
     lock: recoveryLock,
     read: (id) => readOperation<RecoveryOperation>(id),
     runner: recoveryRunner,
-    live: (op) => liveProjects(op, makeRecoveryDriver().inspect),
+    live: (op) => liveProjects(op, makeRecoveryDriver(undefined, delegatedPeer).inspect),
     endPeer: (planned, peer) => endPlannedPeer(planned, peer),
     runnerStoppable: (id) => signedRunner(id) !== undefined,
     stopRunner: (id) => stopSignedRunner(id),
@@ -470,7 +486,7 @@ async function upgrade(kind: "restart" | "upgrade"): Promise<void> {
   if (to !== undefined) { try { exactVersion(to); } catch (error) { fail((error as Error).message); } }
   // An older CLI must not coordinate a newer target (docs/operations.md): the target's own coordinator takes over.
   if (kind === "upgrade" && newerVersion(to!, VERSION) && process.env.AGENTHUB_UPGRADE_HANDOVER !== "1") {
-    const argv = ["x", "--package", `@staix/agent-hub@${to}`, "ahub", "upgrade", "--to", to!, ...rest];
+    const argv = ["x", "--package", `@staix/agent-hub@${to}`, "ahub", ...liveTestArgs, "upgrade", "--to", to!, ...rest];
     console.error(`ahub: ${to} is newer than this CLI (${VERSION}), so its own coordinator runs the upgrade: bun ${argv.join(" ")}`);
     if (interactive) {
       const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -532,31 +548,31 @@ const commands: Record<string, () => Promise<void> | void> = {
     const runner = recoveryRunner(id);
     if (action === "status") {
       // #215: abort and resume are offered by what the open sources show, read as the runner's errors read them.
-      const live = runner ? {} : await liveProjects(operation, makeRecoveryDriver().inspect);
+      const live = runner ? {} : await liveProjects(operation, makeRecoveryDriver(undefined, delegatedPeer).inspect);
       console.log(JSON.stringify(publicOperation(operation, runner, live), null, 2));
     }
-    else if (action === "abort") { await abortRecovery(id, makeRecoveryDriver()); console.log("preflight cancelled; no committed transition was rolled back"); }
+    else if (action === "abort") { await abortRecovery(id, makeRecoveryDriver(undefined, delegatedPeer)); console.log("preflight cancelled; no committed transition was rolled back"); }
     else if (action === "dispose") {
-      // #215: human-only (the identity gate refuses agent shells); the reason is kept in the operation's audit.
+      // Console authority (including explicit --live-test delegation); the reason is kept in the operation's audit.
       const { one, rest: flags } = takeFlags(rest, ["--fresh-session", "--reason"], []);
       const stop = flags.length === 1 && flags[0] === "--stop-and-archive";
       const reason = one["--reason"]?.trim() ?? "";
       if (!reason || reason.length > 500 || (flags.length && !stop) || stop === !!one["--fresh-session"]) fail(usage);
-      const result = await disposeRecovery(id, stop ? { stop: true } : { fresh: one["--fresh-session"]! }, reason, makeRecoveryDriver());
+      const result = await disposeRecovery(id, stop ? { stop: true } : { fresh: one["--fresh-session"]! }, reason, makeRecoveryDriver(undefined, delegatedPeer));
       if (!stop) { console.log(`${one["--fresh-session"]}: a fresh session is accepted and the lost one is recorded; resuming`); return spawnRecovery(result); }
       console.log(JSON.stringify(publicOperation(result), null, 2));
       console.log(`${result.plan.kind} abandoned, not completed; the recovery lock is released. A project whose target ran starts again with that version's CLI.`);
     }
     else if (["completed", "cancelled"].includes(operation.phase)) console.log(`recovery is already ${operation.phase}`);
     // #215: an operation being abandoned is never resumed, whichever coordinator started it (an older one would).
-    else if (operation.disposition) fail(`a stop-and-archive of this operation is partway; nothing was resumed; ${nextActionsText(operation, await liveProjects(operation, makeRecoveryDriver().inspect))}`);
+    else if (operation.disposition) fail(`a stop-and-archive of this operation is partway; nothing was resumed; ${nextActionsText(operation, await liveProjects(operation, makeRecoveryDriver(undefined, delegatedPeer).inspect))}`);
     else if (runner === "unknown") console.log(`whether a runner holds this operation could not be read; nothing was started; ${recoveryCommand(operation, "status")}`);
     else if (runner) console.log(`runner ${runner} is still working on this operation; ${recoveryCommand(operation, "status")}`);
     else spawnRecovery(operation);
   },
   "recovery-run": async () => {
     if (args.length !== 1 || process.env.AGENTHUB_RECOVERY_OPERATION !== args[0]) fail("recovery-run is an internal command");
-    const result = await runRecovery(args[0]!, makeRecoveryDriver());
+    const result = await runRecovery(args[0]!, makeRecoveryDriver(undefined, delegatedPeer));
     if (result.phase !== "completed") process.exitCode = 1;
   },
   help: () => {
@@ -593,12 +609,13 @@ const commands: Record<string, () => Promise<void> | void> = {
       return console.log("dashboard manager stopped; project hubs were kept running");
     }
     let url: string;
-    if (args.includes("--all")) url = await openManager();
+    if (args.includes("--all")) url = await openManager({ liveTest: !!delegatedPeer });
     else {
       const hub = await connect();
       try {
-        const res = await hub.request({ t: "ui", ...(settings ? { settings: true } : {}) }, 10_000);
+        const res = await hub.request({ t: "ui", ...(settings ? { settings: true } : {}), ...(delegatedPeer ? { liveTest: true } : {}) }, 10_000);
         if (!res.ok) fail(res.error);
+        if (delegatedPeer && res.liveTest !== true) fail("this hub cannot restrict delegated dashboard content; use a live-test-capable hub");
         // A hub older than #269 ignores the field and would hand out an ordinary session without saying so.
         if (settings && res.settings !== true) fail("this hub does not open settings sessions; upgrade the running hub to use ahub ui --settings");
         url = res.url;
@@ -673,17 +690,17 @@ const commands: Record<string, () => Promise<void> | void> = {
     if (args.some(arg => arg !== "--panels" && arg !== "--no-pet" && !arg.startsWith("--color=")) || args.filter(arg => arg.startsWith("--color=")).length > 1) fail("usage: ahub console [--panels] [--no-pet] [--color=auto|always|never]");
     const color = resolveColor(args.find(arg => arg.startsWith("--color="))?.slice("--color=".length), { isTTY: !!process.stdin.isTTY && !!process.stdout.isTTY, TERM: process.env.TERM, NO_COLOR: process.env.NO_COLOR });
     if (color instanceof Error) return fail("usage: ahub console [--panels] [--no-pet] [--color=auto|always|never]");
-    await runConsole({ client: await connect(), cwd, stateDir, panels: args.includes("--panels"), noPet: args.includes("--no-pet"), color });
+    await runConsole({ client: await connect(), cwd, stateDir, liveTest, panels: args.includes("--panels"), noPet: args.includes("--no-pet"), color });
   },
 
   up: async () => {
     const unattended = unattendedEnv || args.includes("--unattended");
     if (unattended) console.error(UNATTENDED_WARNING);
-    const status = await startProject(registeredProject(), { unattended });
+    const status = await startProject(registeredProject(), { unattended, liveTest });
     console.log(`ahub up (ws://127.0.0.1:${status.controlPort}), state in ${stateDir}`);
     try { if (loadPetConfig(cwd).window) console.log(await startPetWindow(stateDir, cwd)); }
     catch { console.error("Pet window was not started; run ahub pet --window to inspect it."); }
-    if (process.stdin.isTTY && process.stdout.isTTY && !args.includes("--no-console")) await runConsole({ client: await connect(), cwd, stateDir });
+    if (process.stdin.isTTY && process.stdout.isTTY && !args.includes("--no-console")) await runConsole({ client: await connect(), cwd, stateDir, liveTest });
   },
 
   claude: async () => {

package/src/cli/upgrade-runtime.ts

@@ -323,7 +323,7 @@ export function preserveSource(plan: UpgradePlan, home = hubHome()): string {
   return dest;
 }
 
-export function makeRecoveryDriver(run: RunCommand = runCommand): RecoveryDriver {
+export function makeRecoveryDriver(run: RunCommand = runCommand, liveTestPeer?: string): RecoveryDriver {
   const now = () => Date.now();
   const sleep = (ms: number) => Bun.sleep(ms);
   const env = (op: RecoveryOperation, project?: Project): NodeJS.ProcessEnv => {
@@ -333,6 +333,7 @@ export function makeRecoveryDriver(run: RunCommand = runCommand): RecoveryDriver
       (project && /(?:_API_KEY|_ACCESS_TOKEN|_SECRET|_TOKEN)$/.test(key))) delete value[key];
     value.AGENTHUB_HOME = hubHome(); value.AGENTHUB_RECOVERY_OPERATION = op.id;
     value.AGENTHUB_UNATTENDED = "0";
+    if (liveTestPeer) value.AGENTHUB_PEER_ID = liveTestPeer;
     if (project) {
       value.AGENTHUB_PROJECT_DIR = project.root; value.AGENTHUB_STATE_DIR = project.stateDir;
       delete value.CODEX_HOME; delete value.CLAUDE_CONFIG_DIR;
@@ -345,7 +346,7 @@ export function makeRecoveryDriver(run: RunCommand = runCommand): RecoveryDriver
     return value;
   };
   const command = async (op: RecoveryOperation, args: string[], project?: Project) => {
-    const result = await run([process.execPath, join(op.targetRoot!, "src/cli/main.js"), ...(project ? ["--project", project.root] : []), ...args],
+    const result = await run([process.execPath, join(op.targetRoot!, "src/cli/main.js"), ...(project ? ["--project", project.root] : []), ...(liveTestPeer ? ["--live-test"] : []), ...args],
       { env: env(op, project), cwd: project?.root ?? op.plan.projects[0]!.project.root, timeoutMs: 180_000 });
     if (result.code !== 0) throw new Error(`target command ${args[0]} failed; inspect recovery state before retrying`);
     return result;
@@ -448,6 +449,10 @@ export function makeRecoveryDriver(run: RunCommand = runCommand): RecoveryDriver
       if (packageDigest(op.sourceRoot) !== op.plan.sourceDigest) throw new FinalRefusal("preserved source changed");
       const target = op.plan.kind === "restart" ? { root: op.sourceRoot, digest: verifyPackage(op.sourceRoot, op.plan.version) }
         : await stageRelease(op.plan.version, op.plan.integrity!, run);
+      const identityPath = join(target.root, "src/cli/identity.ts");
+      if (liveTestPeer && (!existsSync(identityPath) || !readFileSync(identityPath, "utf8").includes("export const LIVE_TEST_SUPPORTED = true;"))) {
+        throw new FinalRefusal("target does not support live-test delegation; choose a supporting target before retrying; runtimes unchanged");
+      }
       // #215: the protocol and waiver checks are properties of these bytes. Once they passed (the runner recorded the
       // digest), a resume does not check again, so a transient probe failure cannot refuse an operation for good;
       // changed bytes are the runner's final "staged target changed".

package/src/hub/daemon.ts

@@ -1459,9 +1459,12 @@ export async function startDaemon(opts: DaemonOptions) {
       supervision.checkRound();
       try {
         for (const audit of drainCliAudits(opts.stateDir)) {
-          const refused = audit.outcome !== "run";
-          event({ type: "agent_cli", peer: audit.peer, command: audit.command, refused });
-          notify(refused ? `${audit.peer} refused ahub ${audit.command}` : `${audit.peer} ran ahub ${audit.command} as ${audit.peer}`);
+          const delegated = audit.outcome === "delegated";
+          const refused = audit.outcome !== "run" && !delegated;
+          event({ type: "agent_cli", peer: audit.peer, command: audit.command, refused, ...(delegated ? { delegated: true } : {}) });
+          notify(refused ? `${audit.peer} refused ahub ${audit.command}` : delegated
+            ? `${audit.peer} ran ahub ${audit.command} with delegated live-test console authority`
+            : `${audit.peer} ran ahub ${audit.command} as ${audit.peer}`);
         }
       } catch { log("CLI audit outbox unavailable; inspect state before retrying an agent command"); }
       for (const peer of bus.knownPeers()) {
@@ -4204,7 +4207,7 @@ export async function startDaemon(opts: DaemonOptions) {
           writeStatus();
           // #269: `ahub ui --settings` is the same person's command; its ticket marks the session it opens.
           if (msg.settings === true) notify("settings session opened from ahub ui --settings: for 15 minutes that dashboard session may change permission modes, routing and start settings");
-          return void reply({ t: "ui", ok: true, url: dashboard.issue(msg.settings === true), ...(msg.settings === true ? { settings: true } : {}) });
+          return void reply({ t: "ui", ok: true, url: dashboard.issue(msg.settings === true, msg.liveTest === true), ...(msg.settings === true ? { settings: true } : {}), ...(msg.liveTest === true ? { liveTest: true } : {}) });
         } catch {
           return void reply({ t: "ui", ok: false, error: "could not start the dashboard" });
         }

package/src/hub/events.ts

@@ -43,7 +43,7 @@ export type HubEvent =
   | ({ type: "turn_end"; peer: string; turn: string; ms: number; tokens?: number; files?: number; snapshotMs?: number; preparedRoles?: RoleIdentity[] | null } & Partial<TaskAttribution>)
   | { type: "native_turn_end"; peer: string; id?: string }
   | { type: "conduct"; peer: string; action: string; task?: number; target?: string }
-  | { type: "agent_cli"; peer: string; command: string; refused: boolean }
+  | { type: "agent_cli"; peer: string; command: string; refused: boolean; delegated?: true }
   | { type: "permission"; id: string; peer: string; event: "requested" | "answered" | "expired" | "cancelled"; latencyMs?: number; surface?: "console" | "dashboard" | "terminal"; option?: "allow_once" | "allow_always" | "reject_once" | "reject_always" }
   /** Completed native turns that received supervision, not feed enqueues or inferred costs. */
   | { type: "supervision_turn"; peer: string; turn: string; tokens?: number; ms?: number }

package/src/hub/lifecycle.ts

@@ -138,7 +138,7 @@ export async function runProjectDaemon(project: Project, unattended = false): Pr
   }
 }
 
-export async function startProject(project: Project, options: { unattended?: boolean; env?: NodeJS.ProcessEnv } = {}): Promise<any> {
+export async function startProject(project: Project, options: { unattended?: boolean; env?: NodeJS.ProcessEnv; liveTest?: boolean } = {}): Promise<any> {
   assertLifecycleAvailable();
   const registry = new Registry();
   try {
@@ -160,7 +160,7 @@ export async function startProject(project: Project, options: { unattended?: boo
         // Native sessions can outlive the operation which launched them. An expired
         // operation ID must not make a later ordinary startup load a retired snapshot.
         if (launchEnv.AGENTHUB_RECOVERY_OPERATION !== recoveryLock()) delete launchEnv.AGENTHUB_RECOVERY_OPERATION;
-        const child = spawn(process.execPath, [join(import.meta.dir, "../cli/main.ts"), "--project", project.root, "daemon",
+        const child = spawn(process.execPath, [join(import.meta.dir, "../cli/main.ts"), "--project", project.root, ...(options.liveTest ? ["--live-test"] : []), "daemon",
           ...(options.unattended ? ["--unattended"] : [])], {
           cwd: project.root, detached: true, stdio: ["ignore", log, log],
           env: { ...launchEnv, AGENTHUB_STATE_DIR: project.stateDir, AGENTHUB_PROJECT_DIR: project.root,

package/src/hub/manager.ts

@@ -21,12 +21,12 @@ export type Lifecycle = {
   startProject(project: Project, options?: { unattended?: boolean; env?: NodeJS.ProcessEnv }): Promise<any>;
   stopProject(project: Project, expectedInstance?: string): Promise<void>;
 };
-export type ManagerOptions = { registry?: Registry; lifecycle?: Lifecycle; home?: string; cli?: string; orphanWatchMs?: number;
+export type ManagerOptions = { registry?: Registry; lifecycle?: Lifecycle; home?: string; cli?: string; orphanWatchMs?: number; liveTest?: boolean;
   /** Test clock seam: maps nominal forwarding deadlines, never comes from dashboard input. */
   forwardTimeoutMs?: (action: string, nominalMs: number) => number };
 type ManagerHandle = { stop(): Promise<void>; stopped: Promise<void> };
 type Manifest = { port: number; protocol: number; instanceId: string; pid: number; pidSignature?: string };
-const active = new Map<string, { handle: ManagerHandle; issue(): string }>();
+const active = new Map<string, { handle: ManagerHandle; issue(liveTest?: boolean): string }>();
 const CONTROL_TIMEOUT = 3000;
 // A current CLI may authenticate the previous protocol-9 manager while
 // refreshing it, then launch the current manager implementation.
@@ -178,7 +178,7 @@ export async function startManager(options: ManagerOptions = {}): Promise<Manage
     };
     dashboard = startDashboard({ projects: list, snapshot: (after, input = {}) => act({ ...input, action: "snapshot", after }), action: act });
     server = Bun.serve({ hostname: "127.0.0.1", port: 0, maxRequestBodySize: 1024,
-      fetch(req) {
+      async fetch(req) {
         if (req.headers.has("origin")) return new Response("forbidden", { status: 403 });
         if (req.headers.get("authorization") !== `Bearer ${token}`) return new Response("unauthorized", { status: 401 });
         if (req.method !== "POST") return new Response("POST required", { status: 405 });
@@ -186,7 +186,10 @@ export async function startManager(options: ManagerOptions = {}): Promise<Manage
         if (expected && expected !== instanceId) return Response.json({ ok: false, error: "manager instance changed" }, { status: 409 });
         if (stopping) return Response.json({ ok: false, error: "manager is stopping" }, { status: 409 });
         const path = new URL(req.url).pathname;
-        if (path === "/open") return Response.json({ ok: true, instanceId, protocol: PROTOCOL, url: dashboard!.issue() });
+        if (path === "/open") {
+          const input = await req.json().catch(() => ({})) as { liveTest?: boolean };
+          return Response.json({ ok: true, instanceId, protocol: PROTOCOL, url: dashboard!.issue(false, input.liveTest === true), ...(input.liveTest === true ? { liveTest: true } : {}) });
+        }
         if (path === "/stop") { setTimeout(() => void stop(), 0); return Response.json({ ok: true, instanceId }); }
         return new Response("not found", { status: 404 });
       },
@@ -204,31 +207,32 @@ export async function startManager(options: ManagerOptions = {}): Promise<Manage
     }, options.orphanWatchMs ?? 10_000);
     orphanWatch.unref?.();
     const handle = { stop, stopped };
-    active.set(home, { handle, issue: () => dashboard!.issue() });
+    active.set(home, { handle, issue: (liveTest) => dashboard!.issue(false, liveTest) });
     return handle;
   } catch (error) { cleanup(); throw error; }
 }
 
-async function managerRequest(home: string, path: "/open" | "/stop"): Promise<{ status: Manifest; body: any }> {
+async function managerRequest(home: string, path: "/open" | "/stop", liveTest = false): Promise<{ status: Manifest; body: any }> {
   const status = readManifest(home);
   if (!status) throw new Error("manager manifest is unavailable");
   if (!SUPPORTED_MANAGER_PROTOCOLS.has(status.protocol)) throw new Error("manager protocol is incompatible; use its matching CLI to stop it");
   const token = readFileSync(files(home).token, "utf8").trim();
   if (!token) throw new Error("manager token is unavailable");
   const response = await fetch(`http://127.0.0.1:${status.port}${path}`, {
-    method: "POST", headers: { authorization: `Bearer ${token}`, "x-agenthub-instance": status.instanceId }, signal: AbortSignal.timeout(CONTROL_TIMEOUT),
+    method: "POST", headers: { authorization: `Bearer ${token}`, "x-agenthub-instance": status.instanceId }, ...(liveTest ? { body: JSON.stringify({ liveTest: true }) } : {}), signal: AbortSignal.timeout(CONTROL_TIMEOUT),
   });
   if (!response.ok) throw new Error(`manager refused request (${response.status}); ownership was not verified`);
   const body = await response.json() as { ok?: boolean; instanceId?: string; url?: string };
   if (!body.ok || body.instanceId !== status.instanceId) throw new Error("manager identity changed; refresh before retrying");
+  if (liveTest && (body as { liveTest?: boolean }).liveTest !== true) throw new Error("manager cannot restrict delegated dashboard content; use a live-test-capable manager");
   return { status, body };
 }
 
 export async function openManager(options: ManagerOptions = {}): Promise<string> {
   const home = options.home ?? hubHome();
   const local = active.get(home);
-  if (local) return local.issue();
-  try { return (await managerRequest(home, "/open")).body.url; }
+  if (local) return local.issue(options.liveTest);
+  try { return (await managerRequest(home, "/open", options.liveTest)).body.url; }
   catch (error) {
     const old = readManifest(home);
     if (old && processLiveness(old.pid, old.pidSignature) !== "gone") throw error;
@@ -246,7 +250,7 @@ export async function openManager(options: ManagerOptions = {}): Promise<string>
   const deadline = Date.now() + 8000;
   let error: unknown;
   while (Date.now() < deadline) {
-    try { return (await managerRequest(home, "/open")).body.url; }
+    try { return (await managerRequest(home, "/open", options.liveTest)).body.url; }
     catch (caught) { error = caught; await Bun.sleep(100); }
   }
   throw new Error(`manager readiness not confirmed: ${safeError(error)}; see ${join(f.dir, "manager.log")}`);

package/src/hub/ui.ts

@@ -10,7 +10,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
 
 /** What a request's session may do (#269): `settings` while a session opened by `ahub ui --settings` is inside its window. */
-export interface DashboardSession { settings: boolean; settingsUntil?: number }
+export interface DashboardSession { settings: boolean; settingsUntil?: number; liveTest?: true }
 export interface DashboardOptions {
   snapshot: (after: number, input?: Record<string, unknown>, session?: DashboardSession) => unknown | Promise<unknown>;
   action: (input: Record<string, unknown>, session?: DashboardSession) => unknown | Promise<unknown>;
@@ -30,8 +30,8 @@ const secret = () => randomBytes(32).toString("hex");
 /** Separate browser surface. Only the authenticated control console may construct it and issue tickets. */
 export function startDashboard(options: DashboardOptions) {
   const now = options.now ?? Date.now;
-  const tickets = new Map<string, { expires: number; settings: boolean }>();
-  const sessions = new Map<string, { expires: number; settingsUntil?: number }>();
+  const tickets = new Map<string, { expires: number; settings: boolean; liveTest?: true }>();
+  const sessions = new Map<string, { expires: number; settingsUntil?: number; liveTest?: true }>();
   // Inject the same pure public-board model used by the console before computing CSP hashes.
   const html = readFileSync(new URL("../ui/index.html", import.meta.url), "utf8")
     .replace("/* BOARD_MODEL */", () => `const boardColumns = ${boardColumns.toString()}; const peerPalette = ${JSON.stringify(PEER_PALETTE)};`)
@@ -57,7 +57,7 @@ export function startDashboard(options: DashboardOptions) {
   }
   const sessionOf = (cookie: string | undefined): DashboardSession => {
     const until = cookie ? sessions.get(cookie)?.settingsUntil : undefined;
-    return until !== undefined && until > now() ? { settings: true, settingsUntil: until } : { settings: false };
+    return { ...(until !== undefined && until > now() ? { settings: true, settingsUntil: until } : { settings: false }), ...(cookie && sessions.get(cookie)?.liveTest ? { liveTest: true as const } : {}) };
   };
   const server = Bun.serve({
     hostname: "127.0.0.1",
@@ -99,7 +99,7 @@ export function startDashboard(options: DashboardOptions) {
         if (!issued || !tickets.delete(ticket)) return reject(401, "ticket expired or used; run ahub ui");
         if (sessions.size >= LIMIT) return reject(429, "too many sessions; try later");
         const session = secret();
-        sessions.set(session, { expires: now() + SESSION_MS, ...(issued.settings ? { settingsUntil: now() + SETTINGS_MS } : {}) });
+        sessions.set(session, { expires: now() + SESSION_MS, ...(issued.settings ? { settingsUntil: now() + SETTINGS_MS } : {}), ...(issued.liveTest ? { liveTest: true } : {}) });
         return json({ ok: true }, 200, { "Set-Cookie": `${cookieName}=${session}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${SESSION_MS / 1000}` });
       }
       if (path === "/projects") {
@@ -131,6 +131,9 @@ export function startDashboard(options: DashboardOptions) {
         }
       }
       try {
+        if (sessionOf(cookie).liveTest && !["start", "stop", "pause", "resume", "permit", "start_peer", "setting", "setting_undo", "setting_preview", "sdlc_queue", "sdlc_release"].includes(String(input.action))) {
+          return reject(403, "live-test dashboard cannot write person-attributed content; use peer tools");
+        }
         if (input.action === "sdlc_queue" || input.action === "sdlc_release") server.timeout(req, 35);
         else if (input.action === "backlog_split") server.timeout(req, Math.ceil((BACKLOG_SPLIT_SCREEN_TIMEOUT_MS + HUB_DB_BUSY_TIMEOUT_MS + 5_000) / 1000) + 5);
         return json(await options.action(input, sessionOf(cookie)));
@@ -149,11 +152,11 @@ export function startDashboard(options: DashboardOptions) {
   return {
     origin,
     /** `settings`: the ticket of `ahub ui --settings`, whose session may raise authority for SETTINGS_MS (#269). */
-    issue(settings = false): string {
+    issue(settings = false, liveTest = false): string {
       prune(tickets);
       if (tickets.size >= LIMIT) tickets.delete(tickets.keys().next().value!);
       const ticket = secret();
-      tickets.set(ticket, { expires: now() + TICKET_MS, settings });
+      tickets.set(ticket, { expires: now() + TICKET_MS, settings, ...(liveTest ? { liveTest: true } : {}) });
       return `${origin}/#${ticket}`;
     },
     stop() {