@staix/agent-hub 0.12.28 → 0.12.30

package/docs/smoke.md

@@ -2,6 +2,71 @@
 
 `scripts/check.sh` covers everything against fakes. The legs below need real accounts and an interactive terminal, so they are run by hand and recorded here.
 
+## Issue #273 operator execution plan (2026-10-16)
+
+The [execution plan and blocker record](verification/2026-10-16-273-live-verification.md)
+maps the outstanding issue entries to their procedures and required observations.
+The installed CLI and running project daemon both reported 0.12.28. This is an
+environment readback only. No outstanding live leg passed in this session:
+the installed 0.12.28 CLI refused `ahub ui` from Codex, and LCU refused Terminal access.
+These are dated observations. From 0.12.29, authorized agents use the audited
+`--live-test` route described below and in the execution plan; the external LCU
+restriction remains separate. The operator initially chose procedure preparation;
+#273 remains open.
+
+## Agent-operated verification (#408)
+
+For user-authorized live checks, the candidate CLI supports
+`ahub --live-test [--project <path|id>] <command> [args...]`, using audited console
+authority for that invocation. Follow [the operating procedure](operations.md#agent-operated-live-verification)
+and record each actual result below. References to a person in historical
+procedures describe their original authority requirement; an explicitly
+authorized agent may now execute those CLI steps through this option. Native
+account readiness, real terminal/browser observations, sign-off requirements and
+external computer-use restrictions still apply. No pending #273 item is checked
+by adding this path.
+
+2026-10-16, macOS, candidate CLI/source `40d13bc4`, daemon 0.12.28/protocol 16:
+an actual Codex-marked shell with a separate hub home and disposable Git project
+ran delegated `init`, `up --no-console`, `ui --no-open`, `permission pi ask`,
+`kill` and `reset --all --yes`, all exit 0. Unflagged `status --json` reported
+the exact scratch cwd. The dashboard URL returned HTTP
+200 and HTML; no browser or ticket/session exchange was performed in that shell run. The daemon recorded
+`agent_cli` events for init/up/daemon/ui/permission with peer `codex`,
+`delegated: true` and `refused: false`. The reset archive mode was 0700 and the
+scratch daemon was stopped. This verifies the delegated CLI path, without
+claiming a model turn, terminal look, conversation restoration or the complete
+#214/#273 live criteria. The automated console-subprocess and recovery-target
+checks remain separate fixture evidence.
+
+2026-10-16 review follow-up, source `fcbb18ec`: the same isolated Git scratch
+project was started from a Codex-marked shell. Flagged `say` produced a bus
+envelope from `codex`; person task-label writing refused. A delegated dashboard
+ticket exchanged for a session with HTTP 200, its snapshot returned HTTP 200,
+and a send action trying `liveTest: false` returned HTTP 403. The scratch daemon
+was stopped (kill exit 0). This was an actual CLI/HTTP run, without a model turn
+or browser visual inspection.
+
+Task #65 follow-up, source `5fbe50b6`: operational peer starts, pause and resume
+may delegate console authority; allowed-class messages/proposals/reviews retain
+the peer, while flagged task assign/escalate refuse. The temporary headless
+staging ceiling is removed. The recovery driver -> real target CLI -> scripted
+control server regression verifies headless Pi mode, saved sessionId,
+operationId, console hello and initiating-peer audit (225 related tests passed).
+This is fixture/CLI proof, not an actual native Pi restoration; that live leg
+remains owed in #273.
+
+## Console task and queue operations (#424)
+
+2026-10-16, macOS, source `691f00ac`: a disposable Git project and fake ACP
+peer ran the real console in `tmux` at 100x30. Through actual
+`ahub console --panels` key input, `a` plus a peer, Enter and `y` assigned with
+the displayed `flowRevision`; `u`, Enter and `y` removed the owner/reservation;
+and `r` plus a reason and `y` discarded a queued delivery. Readback showed
+`state=proposed`, `owner=null`, `reserved=null`, `flowRevision=3`, and queue
+states `completed`, `discarded`, `queued`. This was real terminal input and
+daemon readback, not a fake-terminal assertion or a model turn.
+
 ## Hub memory (#258)
 
 Not run yet (2026-10-12). Source and fakes cover tiers, the graph, retrieval, sync between two simulated homes and a bare remote, leases, import and suggestions (`test/memory-*.test.ts`).

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -159,8 +159,8 @@ hub CLI / console ── control WS 127.0.0.1:<ctl> ─────────
   30 s, then goes offline with queued work retained if no report arrives. `--model` maps to `kimi --model <alias> acp`
   (verified flag). Reusable for `opencode acp`.
 - Local worker (amended in M3): a hub-native tool-calling loop over non-streaming
-  `POST /chat/completions` with plain `fetch`, no SDK (the repo keeps zero runtime
-  dependencies). Tools `read`, `write`, `edit`, `bash`, `git`, `hub_send` (`hub_task_*` with
+  `POST /chat/completions` with plain `fetch`, no SDK (the repo keeps zero third-party runtime
+  dependencies; the first-party memory core is an exact-pinned library). Tools `read`, `write`, `edit`, `bash`, `git`, `hub_send` (`hub_task_*` with
   M4). Paths are realpath-scoped to cwd with a secrets denylist; `.git` and `.agenthub` are
   not writable. `write`, `edit`, `bash` and mutating `git` go through the console permission
   relay unless the hub runs `--unattended`. Everything that executes runs under seatbelt
@@ -554,7 +554,7 @@ New repo layout:
 src/hub/            daemon, bus, peer-registry, state-machines, board, budget, router
 src/adapters/       claude-channel.ts, codex-appserver.ts, acp.ts, local-worker.ts
 src/switchyard/     config generator, sidecar lifecycle, health
-src/memory/         claude-mem worker client, capture for the local worker, recall (inject, brief), remember
+src/memory/         hub memory integration: claude-mem client, capture, briefs and recall; portable core is @staix/agent-mem
 src/cli/            up, claude, codex, kimi, local, say, tail, board, route, budget, status, logs, kill, init
 plugins/agent-hub/  .claude-plugin/plugin.json, .mcp.json, server bundle, hooks (SessionStart health, Stop announce)
 .claude-plugin/marketplace.json
@@ -1255,7 +1255,8 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
   ignored with a note in `hub.log` and `ahub doctor`, and is no longer
   machine-local because nothing reads it.
 - Capabilities: `propose`, `assign` (a proposal naming another peer as owner),
-  `remember`, `important`. A peer not listed in `capabilities` has all of them,
+  `remember`, `memory_correct` (screened correction candidates only, never acceptance), `memory_read` (the `hub_memory_search`, `hub_memory_show` and
+  `hub_memory_graph` read tools, #412 P2), `important`. A peer not listed in `capabilities` has all of them,
   which keeps today's behaviour, and a listed peer whose value is not a list has
   none; the console user and the hub are never limited. `remember` gates the
   `hub_remember` tool only, not the notes the hub keeps of done summaries and
@@ -1947,10 +1948,74 @@ task list polling does not. `hub_status` stays conductor-only.
   proposer as the actor with reason `manual` (on the `reassigned` or `reserved`
   entry), and writes no conduct audit event; during a PII turn it is refused
   like the conductor's.
+
+## Amendment: revision-safe console task and queue operations (issue #424)
+
+- Task list/show responses add `flowRevision`, the monotonic history length,
+  separate from `planningRevision` and the delivery journal revision. This is
+  additive public metadata and does not bump the control protocol. `Board.update`
+  can check an expected value in its synchronous read-check-write section.
+- A revision-bound `ahub task assign` uses the new console-only
+  `task_assign_checked`; unchecked `task_assign` remains compatible. The new
+  console-only `task_unassign` and checked operation are unknown to an older hub,
+  which therefore refuses rather than ignoring the revision. A console whose
+  rows lack `flowRevision` refuses task row actions and asks for an upgrade.
+  `ahub queue resolve` accepts an optional displayed revision and otherwise keeps
+  its existing fresh-show behavior. New operations and optional fields preserve
+  the protocol version.
+- Tasks and Queue selections follow ids across refreshes, never indices into
+  replacement rows. A row-started action fixes its id and revision while peer,
+  reason and final role/action remain editable; confirmation uses the validated
+  final command and its consequence. Refresh follows every completed console
+  command, including failure and saved-but-unconfirmed assignment, without an
+  automatic resend. Existing `AssignmentUndeliveredError` semantics remain.
+- Tasks `a` assigns owner in `proposed`, `in_progress` and `changes_requested`,
+  and reviewer in `in_review`; waiting owner assignment is a reservation. `u`
+  unassigns, and `r` reviews only in `in_review`. Direct owner reassignment or
+  unassignment in `in_review`, physical task deletion/cancellation and roster
+  removal stay outside this feature.
+- `Tasks.unassign` is person-only. It refuses `approved` and `backlog`, an
+  already absent role and owner removal in `in_review`. Owner removal clears the
+  owner and reservation and returns active work to `proposed`; reviewer removal
+  keeps the current state. The human reviewer of PII work cannot be removed.
+  Owner removal writes `unassigned` and leaves turn-free cohorts; reviewer
+  removal writes `reviewer changed`. Neither operation routes a replacement,
+  adds a decline exclusion, stops a native process or rolls back effects.
+- A person `unassigned` event suppresses later automatic owner offers across
+  dependency release, planner pulls, release timers and restart recovery until
+  an explicit assignment or reservation. The marker is derived from history, so
+  no schema migration is needed, and it also fences planner undo and re-pull.
+  Former queued task/review requests are withdrawn, but accepted, dispatching
+  and needs_review deliveries are never implicitly resolved. Withdrawal notices
+  use delivery evidence or accepted/claimed board evidence, never an unread
+  queue alone. Former agents fail current-authority checks while the person's
+  explicit review override remains.
+- Assignment/review publication has a role-specific fence after every await and
+  immediately before publication. Existing supersession events, role generation
+  and task state suppress obsolete envelopes; accept, done and approval count as
+  supersession even when the owner id is unchanged. Supersession returns the
+  current task rather than aborting the remaining operation. Current metadata is
+  re-read before constructing a still-valid envelope, so reviewer-only changes
+  refresh reviewer content and quiet bookkeeping does not suppress valid owner
+  delivery.
+- Queue `r` prefills `discard` for `queued` and `retry` for `needs_review`, never
+  `completed` by default. Every resolve needs reason and confirmation. Queued
+  discard removes queued originals; needs-review discard settles its receipt and
+  hold. Retry creates one linked attempt. None cancels a task or claims native
+  or external rollback. Task and queue projections retain their distinct PII and
+  envelope-privacy redaction.
+
+## Amendment: delegated agent live verification (#408)
+
+- Decision, 2026-10-16: an agent explicitly authorized by the user to perform a live test may use the global `--live-test` flag, before the command and in either order with `--project`. Duplicate global options refuse. Default command classification and malformed/conflicting identity refusals stay unchanged.
+- Console-class operations and conductor-class peer starts/pause/resume may use console authority after the original caller is validated; allowed-class commands retain peer identity and capability checks. Flagged task assign/escalate refuse rather than writing user-attributed history. A mandatory ids-only audit records its peer, closed command label and `delegated` outcome before execution. The daemon emits an `agent_cli` event with `delegated: true`, `refused: false`, and a console notice naming the peer. User impersonation, person labels and person-authored workflow writes refuse. Delegated dashboard tickets/sessions allow operational controls but refuse user-attributed content and history actions on both project and unified surfaces; request bodies cannot widen the session.
+- This is a user-authorized operating policy, not a sandbox or authenticated grant. It includes console mutations and requires the agent to remain within the authorized targets and operations. Command-specific confirmations, process ownership, provider identity and recovery locks still apply.
+- No settings/environment opt-in persists. Native argv does not receive the flag. Ahub's own daemon launch, console subprocesses, recovery runner, interactive continuation commands and newer-version coordinator handover carry it explicitly; older CLIs cannot accept it. The recovery driver's target CLI environment preserves the initiating peer for its delegation audit. Staging checks the target's pinned LIVE_TEST_SUPPORTED declaration before its cached-stage return and before prepare/commit; unsupported old targets refuse without source effects. Headless-native restoration uses the ordinary target CLI with the operationId on its delegated console connection; no headless staging ceiling is added. External computer-use policies remain outside this change. No #273 live success is inferred from this implementation.
+
 ## Amendment: ahub reset (issue #214)
 
 `ahub reset [--all] [--yes]` returns a project's hub to a clean state. It is
-human-only (the CLI identity gate refuses it from an agent shell) and a dry run
+console-only by default (explicit authorized delegation is described in #408) and a dry run
 unless `--yes`: the dry run reads `hub.db` read-only (with `immutable=1` when
 `hub.db-wal` or `-shm` is absent, so it creates neither) and prints delivery ids,
 peer names and counts per category, never task or message text. With `--yes`
@@ -2914,3 +2979,46 @@ and repo-heavy work was coordinated over chat it read too late.
   holder whose pid is gone is reaped. The slot works with no hub running. It is
   not bus-visible; moving it into the hub is the upgrade if pid reuse or reap
   races bite.
+
+
+## Amendment: consume the first-party agent-mem package (#412, P5)
+
+The portable core is the first-party `@staix/agent-mem` library, initially exact-pinned at `0.1.1`; agent-hub keeps zero third-party runtime dependencies. Its store, sync, claude-mem import, project/home helpers and raw memory/goal commands are imported from the package root, with no vendored copies. Platform helpers use the public Node-safe `@staix/agent-mem/platform` subpath: `0.1.0` exposes only a root that loads `bun:sqlite`, which cannot load in Node-hosted Pi extensions. `0.1.1` supplies the required compatibility export without changing the platform algorithms. The package is the single implementation of deny, hardened git, realPath and process identity, re-exported through the existing local/hub/Pi modules so their callers retain one contract. Package storage semantics and the compatibility schema/hash/path invariants are unchanged.
+
+`src/memory/` retains only hub integration: briefs, recall, the optional claude-mem worker client and capture. The hub owns `src/hub/memory-policy.ts` (`withoutPii`, `promotionScreen`, `mentionsPrivatePath`), `src/hub/read-tools.ts`, task lifecycle writes, lease renewal, model-suggested edges, ask and dashboard consumers. Current project policy is injected through `StoreOptions.screen` and the raw command callbacks. Tasks remains the write authority; PII-turn refusals, current-policy screening before counting/truncation, capture exclusion and the peer read-tool byte budgets remain unchanged.
+
+`ahub memory` and `ahub goal` keep the hub's argument and identity contract, screened agent-readable views, project configuration and TTL. The standalone person-only `amem` CLI is the package's interface; its `--policy-free` acknowledgement is not an ahub option or a reason to bypass host privacy policy. Memory availability and sync remain fail-open for hub turns, while privacy checks keep their existing fail-closed behavior. Data directory precedence is supplied by the package's `memoryHome()` without migration: `AMEM_HOME`, then `$AGENTHUB_HOME/memory`, then `~/.agenthub/memory`; explicit `StoreOptions.home` retains its parent-directory meaning.
+
+`docs/memory.md` documents hub integration; [agent-mem](https://github.com/STAIxBWLB/agent-mem) owns the portable data model and CLI documentation. Portable-core import boundary checks belong to the agent-mem package CI. The former hub-local core boundary checker and its check.sh step are removed with the core; the hub keeps its exact first-party dependency pin. Consuming the package does not complete the owed live legs: copied-home old/new parity, source-unchanged checks, rollback and unrun account/device/sandbox receipts are reported separately. No release, runtime replacement or live proof is implied by the source change.
+
+The consumed package requires Bun >=1.4.2; the hub manifest, plain-JavaScript startup guard and installation guide share that minimum. Node still receives the actionable refusal before any TypeScript or Bun-only import.
+
+Recovery source preservation retains the exact first-party memory package under the preserved runtime, without copying any other node_modules content or linking to the mutable global install. Package identity/version and all retained dependency bytes participate in the recovery digest; cached or preserved dependency drift is refused. Preserved-source verification requires the package inside its own node_modules, refusing a missing or symlinked copy rather than falling back to a mutable ancestor installation. Staged release verification similarly binds dependency lookup to its retained install directory, including cached releases and a fresh coordinator. Releases without runtime dependencies keep their historical digest.
+
+
+## Amendment: P7 Stage A read-only memory presentation (#412 P7-1)
+
+The exact first-party pin is `@staix/agent-mem` 0.2.0. Agent-hub adds advisory plan-matching live fails to owner briefs and reviewer checklists, optional labeled fail text validated before the 4000-byte cap, person-only decay review, and privacy-filtered bounded read-time staleness markers. The task/PII boundaries remain in Tasks and the daemon. Details and ceilings are in `docs/memory.md`; no new v1 op, stored marker, candidate writer or live-leg claim is introduced.
+
+The P7-1 hint C3 probe gate assumes the tree is not modified during a call: no probe reaches a declared private/denied path in that scope. Concurrent ancestor swaps by a process running as the person are outside the security threat model and may expose one existence bit; this ceiling has a deterministic witness test.
+
+
+## P7 candidate producers and local observations (#412)
+
+Tasks produces a fail candidate from a public changes-requested review with unmet items, after the current Tasks privacy screen clears the complete candidate text. The review evidence identifies the task, review event and reviewed head (explicitly unknown when absent). Missing cause or retry conditions remain explicitly unknown. Candidate failure never changes the saved review outcome.
+
+`hub_memory_correct {id, text, reason}` requires its own `memory_correct` capability and refuses a PII turn. Input caps are checked before logging or storage; exact or unique visible-prefix resolution uses the current project and full-record screening. Tasks checks the proposed text like `hub_remember`, then rechecks context and target after asynchronous screening. A successful call records the full target id and revision in CandidateStore and returns only its candidate id and person-review guidance. MCP/Pi/local share the tool definition; capture excludes both arguments and results.
+
+Journal handoff observes rendered native memory lines in the final preface/brief payload. First positive journal acknowledgement observes delivered for that delivery and its original render context, not a later turn; pull's completed read is the existing journal acknowledgement contract. Peer messages and cleared task completion summaries observe visible `mem:<id8+>` citations. Counter keys use full entry id, project and known task/turn/session plus journal delivery id for rendered/delivered. Unattributed citations use message:<envelope-id> or summary:<task>:<history-index> observation keys with rendered/delivered unknown; these are citation counts, not proof of a causal per-delivery ratio. Absent observations and identities remain unknown. A bounded in-memory render-context map does not reconstruct acknowledgements after restart, so those delivered values remain unknown. Private envelopes, PII tasks and PII turns produce no rows. There is no usage sync or note mutation.
+
+The machine-local candidate/counter sidecar remains outside native import, recall, briefs, ask and graph evidence. A person accepts or rejects through `amem review` with its existing TTY/policy authority. Dashboard acceptance is deferred. No new v1 operation, note kind or scope is introduced.
+
+## Amendment: selected memory profiles in the hub (#412 P9)
+
+The exact first-party dependency pin is `@staix/agent-mem` 0.3.0. The memory root `M` follows the package's existing home precedence independently of project state. An absent `M/profile.json` binds shared v1; an explicit generation binds `M/generations/G` through the package profile API. The hub supplies current promotion/privacy policy and TTL at that open boundary. Generation reads include the package's readonly legacy bridge; writes and generation sync stay in `G`, outside legacy logs and legacy-main history. No hub tool gains migration or prune authority, and shared-v1 operation semantics remain unchanged.
+
+One explicit profile binding is used by daemon Tasks, read tools, briefs/recall/ask/dashboard, lease renewal, suggestions and sync. Hub memory and goal CLI opens use the same profile resolution. Invalid selector or missing/corrupt active generation makes native memory unavailable while bus/task service continues, with no automatic shared-v1 fallback. Daemon status distinguishes the memory package/profile binding and availability from hub health. Existing handles remain bound: periodic checks and explicit checks at hub operation entry fence later stale calls rather than rebinding the daemon. No proxy/private core ABI is used. These checks are not atomic with an in-flight core operation, so in-flight cutover is excluded: consumers must be quiesced and closed before migration/selector changes. A public core pre-write hook is the named upgrade path for an atomic fence.
+
+Candidates/counters remain at the independent root `M/candidates.db` using the package's explicit sidecar home API. They are neither migrated into `G` nor synced. Selector changes fence Tasks candidate producers and retained telemetry callbacks as well as native note operations; asynchronous privacy work rechecks binding before side effects. Standalone generation `amem review` remains unsupported and refuses; this change adds neither candidate acceptance nor dashboard acceptance for generations.
+
+PII authority, complete-row host screening, capture exclusion, byte budgets and fail-open task delivery remain unchanged. Memory/goal domain JSON remains unchanged; `memoryProfile` is additive only in daemon status, profile-check and the decay object. Synthetic integration must show bridged legacy reads, cross-writes through the package CLI and daemon tools, failure without fallback for invalid/missing generation state, and no note/candidate/counter writes for calls begun after a selector change while bus service remains available. Source/fixture evidence does not authorize real installation, migration or session restart. Real rollout requires separately approved deployed versions and matching live root/profile/selector bindings, synthetic canaries and quiesced/closed/reopened handles. Every running hub using this home needs an authenticated receipt: a matching ready binding, or a generation-capable unbound receipt (`disabled` when native memory is off, `unavailable` when opening failed) proving it holds no memory handle. An unbound daemon and zero running hubs are quiesced for memory; a stale bound handle, unreadable registry or unknown runtime is not ready. Native capture, account/device sync and real memory receipts remain open until observed.

package/docs/verification/2026-10-16-0.12.29.md

@@ -0,0 +1,25 @@
+# 0.12.29 release verification
+
+This record covers release preparation and source review. Publication and installation receipts are recorded separately after their gates succeed.
+
+## Candidate
+
+0.12.29 carries PR #409 (#408), the site correction in PR #406 and the #273 execution-plan corrections in PR #407. Control protocol remains 16.
+
+- Explicit `--live-test` delegation permits operational console and peer lifecycle actions with a mandatory initiating-peer audit. Allowed agent commands retain their peer identity; person-attributed writes refuse under delegation.
+- Dashboard delegation is bound to the issued session and checked server-side. Recovery refuses unsupported target packages before effects; supported headless restores use the ordinary target CLI with the recovery operation id.
+- The #273 ledger includes the current native checks and makes machine-wide upgrade isolation explicit. No native leg is marked passed by these preparation changes.
+
+## Document review
+
+Security, Operations and the design specification describe the reviewed delegation boundary. README, Quickstart and the current Operations examples name 0.12.29. The stale area notes are checked against the CLI identity, console, recovery, dashboard and audit changes; their existing rules remain applicable. Document stamps name the release preparation commit, which must remain an ancestor of the merge commit.
+
+## Recorded checks
+
+- PR #409 head a8b9a56b: independent source review and board tasks #64/#65 approved. Exact-head Ubuntu and macOS full gates passed (`check: OK`); the headless restoration regression is fixture/CLI proof, not native Pi restoration.
+- Original PR #407 head c637a088: Ubuntu, macOS and seeded guards passed in CI run 38791043404. The corrected execution plan was independently reviewed at 780853b6.
+- The final release head requires its own Ubuntu/macOS `scripts/check.sh` and seeded guards before merging. Committed document freshness and stamp ancestry are checked again before tagging. The release workflow requires green CI for the identical tree before npm publication.
+
+## Not verified by this record
+
+Native, account, visual and research checks remain tracked in #273 and #1. Package publication, global CLI/plugin installation and running-hub upgrade are separate operational results; this preparation record does not claim them.

package/docs/verification/2026-10-16-273-live-verification.md

@@ -0,0 +1,150 @@
+# Issue #273 operator execution plan
+
+## Scope and dated observations
+
+- Date: 2026-10-16, Asia/Seoul.
+- Initial observation source: main `426bab99`, release 0.12.28, protocol 16. The following CLI refusals describe that installed version, before #408.
+- Issue #273 was read live, including its 2026-10-14 additions at initial preparation; the matrix below was refreshed for the five 2026-10-16 additions before release. Every checkbox remained unchecked.
+- `ahub --version` returned `0.12.28`.
+- `ahub status --json` returned daemon version `0.12.28`, protocol `16`, `stopping: false`, Claude idle, Codex busy, Kimi offline and Pi idle. These are status observations, not model-delivery or restoration receipts.
+- `ahub ui` exited 1 with `ahub: codex cannot run ahub ui; the person runs it in ahub console or a terminal`.
+- LCU app selection for `com.apple.Terminal` returned `Computer Use is not allowed to use the app 'com.apple.Terminal' for safety reasons.` No Terminal inspection or input occurred.
+- The operator selected procedure and blocker preparation before live execution. No identity markers were removed, no console connection was impersonated, and no lifecycle, reset, roster, quota or provider experiment was run.
+
+## Supported execution route and remaining boundaries
+
+From 0.12.29, an explicitly authorized agent runs operational CLI steps with
+`ahub --live-test <command> [args...]`, including `init`, `up`, `console`,
+`settings`, `reset`, `upgrade`, `recovery` and roster operations. Follow
+[Agent-operated live verification](../operations.md#agent-operated-live-verification).
+Record the initiating peer and the mandatory delegation audit (`agent_cli`
+event or retained CLI audit), alongside the command and operational receipts.
+The original 0.12.28 refusal above is historical evidence, not a current CLI
+blocker. Identity markers remain intact; the supported option supplies authority.
+
+Allowed-class commands retain the agent's peer identity, including messaging
+and review verdicts. The flag refuses person-attributed writes, including
+`--as-user`, task labels, task assign/escalate and planning/memory writes.
+Delegated dashboard sessions permit operational controls but refuse sending,
+proposals and person-attributed planning/history actions; changing a request body
+cannot remove that restriction. Exercises requiring those actions or a person's
+sign-off need the ordinary authorized actor path and cannot be completed merely
+by adding the flag.
+
+LCU's Terminal denial is a separate external computer-use restriction and remains
+in force. CLI delegation does not grant Terminal app access or prove native
+visual, account or accessibility observations. Record any inaccessible native
+surface as unverified while continuing reachable authorized CLI checks.
+
+## Execution order
+
+Use a disposable Git project under the workspace scratchpad, outside this
+checkout, and initialize its own Git boundary before `ahub init`. An authorized
+agent runs `ahub --live-test init`, reviews the resulting configuration and starts
+it with `ahub --live-test up`. Record its absolute path, project id and delegation
+audit. Keep destructive recovery/reset experiments separate from the project
+used for browser and model checks. Recovery can hold a machine-wide lock, so
+inspect `ahub --live-test recovery status` before starting an operation and wait
+for unrelated operations to finish. Upgrade isolation has the additional
+machine-wide and shared-configuration requirements below.
+
+Use installed, authenticated native tools. Record each version before its first
+turn. Do not change credentials, buy access or exhaust quota to produce a result.
+Do not run another session's stop or reset. Keep identity fencing in effect and
+use the documented delegation route rather than removing identity markers.
+
+1. Run reachable operational checks through `ahub --live-test`; retain their delegation audits and readbacks. Inspect terminal/dashboard rendering only through an available permitted native surface.
+2. Run native messaging and role/planner exercises on the disposable project using the ordinary peer or person path as required by attribution; the delegation flag does not authorize person-content writes.
+3. Run roster and recovery experiments with disposable conversations only, using the delegated operational CLI route and recording native continuity separately.
+4. Run the real repository SDLC cycle only with an explicitly selected issue and release window, retaining required person verdicts.
+5. Record each result in `docs/smoke.md`, retaining any unverified remainder and external blocker.
+
+## Required observations by issue entry
+
+All rows below are pending. A procedure reference is not evidence of execution.
+Section names refer to [the smoke checklist](../smoke.md).
+
+| Entry | Procedure or setup | Evidence required before checking the issue box |
+| --- | --- | --- |
+| #201 AC2/AC7, #213 AC7 | Console layout and readability | Light/dark terminal, stream and panels; terminal name, dimensions, readable text and observed clipping |
+| #205 AC3 | Claude without channel evidence | Managed Claude push and settlement beside plain Claude tools-only; correlated message and settlement ids |
+| #206 AC4 | Upgrade procedure below | Two distinct releases, unmanaged Claude marked reconnect-only, same native conversation after reconnect |
+| #214 AC6 | ahub reset on a scratch project | Both reset scopes, queue/board checks, archive permissions and restored board, same project id |
+| #215 AC6 | Expired-lease procedure below | Real expired lease and missing transcript, daemon/CLI/lock/project/archive outcomes, completion or audited disposition |
+| #225 AC9 | Target-crash procedure below | Target killed after peers-restored, supported resume, original conversation and restart count readback |
+| #269 AC10 | Settings from the dashboard and the terminal, parts 1-2 | Light/dark, phone width and keyboard path; actual Orca and terminal.open launches with native Pi attached |
+| #285 phase 1 | Record table, #285 live item 1 | Real Kimi turn, status context source/value, usage_update timing relative to correlated prompt result |
+| #284 phase 1 | One-shot command output | status/board/budget/doctor, light/dark, 80 and wider columns, console rendering and full suggested ids |
+| #298 | Unified dashboard slow start | Real browser unconfirmed text, 30-second hold and keyboard focus after Start; a deterministic slow native start is a prerequisite |
+| #296 | Ending Codex turn | Correlated native turn/steer response, elapsed time and exact refusal; a successful steer alone does not prove refusal matching |
+| #315 Codex | Live roster return | Removal exit, printed resume command, restored same thread and peer reattachment |
+| #315 Pi | Live roster return | Retained terminal/process, admission refused off roster, same TUI reattaches; prepare blocked until retained TUI ends |
+| #316 trust and ingestion | Kimi TUI pull mode | Actual trust screen, project MCP tools and model-visible managed instructions/tool descriptions |
+| #316 messaging/discovery | Kimi TUI pull mode | Correlated hub_inbox/hub_send exchange with another peer; trusted project and overlay discovery |
+| #316 headless return | Kimi TUI pull mode | TUI to headless to TUI, session/config restoration readback; argv fixtures are insufficient |
+| #256 identity/modes | Qwen Code 0.25.0 production peer | Real ACP supported identity and advertised modes; stop on CLI/ACP mismatch |
+| #256 native provider | Qwen Code 0.25.0 production peer | Actual model identity, delivery, exact tool call/result and mode confirmation |
+| #256 stop/recovery | Qwen Code 0.25.0 production peer | Owned stop and controlled/crash recovery retain the recorded conversation |
+| #256 quota | Observe an organic refusal only | Version and exact sanitized native refusal; unknown remains failed delivery |
+| #259 AC11 | Research-profile exercise | Two native agents, three sources, configured routing/classes, plans, role/tool ingestion, deterministic citations and person sign-off |
+| #259 converters | Intended formats and configured converters | Actual conversion, review and undo previews; timing, caps and named-only fallback |
+| #259 guidance | Same native profile sessions | Native profile/custom-stage guidance retention; preserve separate #295 and research measurements |
+| #257 AC6 | SDLC gates | Real repository issue through merge/release under advise; issue/PR/head ids, gate blockers and release report |
+| #295 AC16 | Native role/task cycle | Role text ingestion, retention after actual compaction, assignment/reassignment notice and review duty |
+| #280 AC11 | Console attention, Global attention status, Approved character, Dashboard character | Per-phase light/dark, tmux, colour off, blocks/ascii and actual dashboard look |
+| #263 AC11 | Planning and release controls | Native planner creates two releases; planned/actual dates read back |
+| #263 board/intake | Project board | Desktop/phone browser against real hub, permission/state readback and actual GitHub issue intake |
+| #306 | Observe an organic Kimi weekly/monthly refusal only | CLI version and exact sanitized prefix; do not deliberately consume quota |
+| #403 | Offline Pi preserved-history recovery | Actual selected native session restored with identity/queue retained; a live owner refused |
+| #398 | Pull-only important-message advisory | Real Kimi TUI and plain Claude see the tool-result advisory; hub_inbox drains it |
+| #391 pet lifecycle | Standalone pet window | Actual stop changes it to Offline and host exits; native screenshots of states |
+| #391 dashboard CSP | Split dashboard views | Browser-console capture of CSP behavior, separate from the earlier owner browser look |
+| #394 VoiceOver | Office desk More control | Native VoiceOver traversal; DOM/click/Enter/Space regressions remain separate |
+
+## Upgrade with unmanaged Claude (#206)
+
+1. An authorized operator starts the disposable project on a known older release, records its version/project id and attaches an unmanaged Claude session using the documented plain-Claude tools-only setup. Record its native session id and a harmless conversation marker.
+2. Use an isolated test environment for the hub home/registry and shared Claude plugin setup. Upgrade is machine-wide, even when invoked from the scratch cwd: it plans all registered running projects and changes the shared package/plugin; `--project` does not scope it. Run the target coordinator with `ahub --live-test upgrade --to 0.12.29 --dry-run` and retain the complete plan. Verify every planned root is a disposable fixture, record the shared CLI/plugin fate, and confirm the intended unmanaged Claude is reconnect-only. Stop without applying if any non-disposable project or shared setup is in scope. A separate AGENTHUB_HOME alone does not isolate the shared plugin; use a dedicated native configuration/test environment too.
+3. The authorized agent applies that same target with `ahub --live-test upgrade --to 0.12.29 --yes` after reviewing the plan (a person may use the ordinary interactive path). Retain the delegation audit. Record operation id, source and target versions, terminal fate and plugin reconnect outcome. Do not substitute a restart at the same version.
+4. Read back `ahub status`, the original native session id and marker, and one correlated hub message receipt. Record whether a second terminal appeared or a conversation was replaced.
+5. Capture final operation and lock status. A refusal or failed reconnect is a failed leg, with its exact wording; it is not a pass based on the dry-run plan.
+
+## Expired preparation lease with missing Codex transcript (#215)
+
+This needs an isolated failure-injection setup before it is executable. There is
+no public `ahub recovery prepare` CLI. Do not invent one or edit production
+recovery JSON to claim a native reproduction. `test/upgrade.test.ts`,
+`expiredLease`, is a scripted-driver fixture and is only a setup reference.
+
+1. Give disposable Codex its own native session store and complete a harmless turn so its transcript exists. Record project id, daemon instance, native thread id and transcript path. Keep the original transcript outside the fixture's missing-path condition; never remove a production transcript.
+2. In a controlled scratch-only harness, stop the coordinator after real source preparation and before commit, preserving its operation receipt. Record the daemon's preparation, terminal close receipts and runner identity. The harness and its pause point must be reviewed before use.
+3. Make only the disposable transcript unavailable and allow the real preparation lease to expire. Confirm expiry from the daemon log/readback rather than changing a clock or receipt timestamp.
+4. The authorized agent runs `ahub --live-test recovery status <operation-id>` and the supported next action it offers. Capture the exact missing-session refusal. Restore the disposable transcript and resume, or use the offered audited disposition with a reason. Do not force a fresh conversation and label it restoration.
+5. Record daemon and CLI outcomes, operation/lock state, project id before/after, archive paths and modes, and the final continuity or lostContinuity disposition. Preserve failed intermediate receipts.
+
+## Target crash after peers-restored (#225)
+
+1. In a separate disposable project, establish native conversations with harmless markers and start a controlled recovery. Save its operation id and source conversation ids.
+2. Observe the real `peers-restored` phase before release. A controlled pause at that boundary is required: if the operation already completed, this run cannot demonstrate this failure point. Do not fabricate the phase by editing a receipt.
+3. Verify the target pid belongs to this disposable project's daemon and record its instance id. The authorized operator ends only that target daemon through a permitted process-control surface. Record native launcher/process state after the exit.
+4. Run `ahub --live-test recovery status <operation-id>`, then its offered `ahub --live-test recovery resume <operation-id>`. Retain the delegation audits. If a surviving launcher blocks it, end the identified disposable launcher as instructed and retry the supported action.
+5. Verify the new target instance, recorded restart count, same native conversations and markers, no duplicate terminal, final operation status and lock release. A missing snapshot or failed native resume remains a failure, with the precise refusal and the supported disposition recorded.
+
+## Recording and closure
+
+For each execution record: date/time, source commit, hub/native versions, project
+id, exact command or interaction, expected observation, actual observation,
+correlated ids, sanitized evidence path and pass/fail/unverified verdict. Record
+partial success at the substep level. Keep raw tokens, cookies, private task text
+and account details out of committed evidence.
+
+On a confirmed defect, preserve its failure wording and open a linked defect
+issue within the user's authorized scope. Check a #273 item only after its dated
+record covers the entire item, or a failed run is recorded with a linked defect.
+Environment/tool restrictions remain unverified prerequisites. They do not meet
+the issue's failed-product-run alternative. #273 cannot close from this plan.
+
+The initial preparation ran no full check or native model turn. Its original
+commit c637a088 subsequently passed Ubuntu/macOS full gates and seeded guards
+in CI run 38791043404. The release candidate must earn its own exact-head checks;
+none of those automated results completes a live leg.

package/docs/verification/2026-10-17-0.12.30.md

@@ -0,0 +1,70 @@
+# 0.12.30 release verification
+
+This record covers release preparation and source review. Publication, installation, running-hub upgrade and real memory migration require their own operational receipts; none is claimed here.
+
+## Candidate
+
+Version 0.12.30, control protocol 16, from main `6363f4dbfb1a90900b291a397b892a978922f7b5`. The candidate includes every PR merged since `v0.12.29`: #413, #415, #417, #419, #420, #421, #422, #423, #425, #426, #427, #429 and #430. Every PR body was read against its final merged source; intermediate descriptions of copied memory helpers are superseded by the final single-source package imports.
+
+- The portable core is the exact-pinned first-party `@staix/agent-mem` 0.3.0; hub privacy policy and caller authority stay in agent-hub. Shared v1 remains the default, with no automatic migration.
+- Screened memory read tools, display-only recall filtering/deduplication, plan-fail advice, structured fail notes, decay review, file-level staleness and machine-local candidates/counters retain their evidence and privacy boundaries. Generation `amem review` remains refused.
+- Profile binding fails closed for invalid or changed selectors while the bus/board remain available. Person profile-check distinguishes matching ready bindings, authenticated capable unbound/quiesced receipts and unknown/stale runtime evidence; registry scope is explicit.
+- Before migrating a real home, upgrade every hub sharing it to 0.12.30, inventory each registry, obtain positive profile-check receipts, then quiesce consumers and close handles. A ready binding is compatible but still open; the operation-entry fence is not an atomic live-cutover guarantee.
+- Console task and queue controls bind selections to ids/revisions, preserve person unassignment and use peer-specific receipt evidence. Recovery retains exact dependencies and waits for managed peer attachment without creating duplicate terminals.
+- Version 0.13.0's promised removal of `local.bash_network: "direct"` has not happened; the existing ceiling and retirement plan remain unchanged.
+
+## Document review
+
+The initial freshness check reproduced all 13 stale documents below. Each was compared with the source changes under its manifest paths since the prior full-SHA stamp through the candidate source. Changed source was traced to the final symbols, not inferred from prose changes alone. No document review was deferred. The already-fresh models note is outside this stale set and keeps its existing stamp.
+
+| Document | Prior source stamp | Review result | Checked claims and correction |
+| --- | --- | --- | --- |
+| `README.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Current version and Bun requirement; first-party memory tools/candidate boundary, checked console controls and pre-migration upgrade/quiesce order. |
+| `docs/agent-notes/README.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | unchanged | Exact-id console attention selection and navigation remain accurate after the console controls. |
+| `docs/agent-notes/adapters.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | unchanged | Node-safe process identity re-exports, tool catalogs, capability/PII checks and capture exclusions already match the final source. |
+| `docs/agent-notes/benchmarks.md` | `2d3b120ab177e4fd9e6f991d038c22ca4ccb6977` | unchanged | Only deny/process helper re-exports changed in the covered source delta; runner, sandbox and retained benchmark contracts remain accurate. |
+| `docs/agent-notes/budget.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | unchanged | Budget semantics remain unchanged; reviewed shared bus/daemon wiring and retained quota/hold contracts. |
+| `docs/agent-notes/bus.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Recall preface merge/deduplication and delivery/counter observation boundaries. |
+| `docs/agent-notes/daemon.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Person-only diagnostics wording includes authenticated status and person CLI receipts; reduced shell-readable status stays distinct. |
+| `docs/agent-notes/local-worker.md` | `6dcc7fe00c38f13613bcf53524fa3d1527a708e5` | unchanged | Single-source hardened git/deny re-exports and local-worker memory-tool capture exclusions already match the final source. |
+| `docs/agent-notes/tasks.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Revision-bound task/queue controls and the current peer's own acceptance since its latest ownership event. |
+| `docs/agent-notes/tests.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Test preload clears inherited AMEM_HOME as well as isolating AGENTHUB_HOME. |
+| `docs/operations.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Bun/current version, package/profile rollout, screened tools and candidates, recall, withdrawal evidence and preserved-runtime attachment behavior. |
+| `docs/quickstart.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Bun/current release example and person profile-check with upgrade/quiesce/migration order. |
+| `docs/security.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | First-party platform helper and memory credentials boundary, screened read/correction tools, sidecar isolation and non-atomic profile transition. |
+
+The unstamped memory integration guide also clarifies person CLI diagnostics and the all-hubs-0.12.30 migration prerequisite.
+
+Reviewed source commit `79a113dfc4395a0e00890ba8b8d2d90bb289ee9f` contains the reviewed content, package version and generated plugin assets. A separate manifest follow-up stamps that full source SHA; the manifest need not stamp itself. The release PR must be merged with a merge commit so every stamp remains an ancestor. Before tagging, run `node scripts/check-docs.mjs --require-fresh` on the committed tree again. Source freshness is not a certification of native/live behavior.
+
+## Recorded checks
+
+The following existing PR receipts were read back from GitHub at their final heads. Every listed run reports successful Ubuntu, macOS and seeded-guard jobs; these are recorded prior gates, not a substitute for the release candidate's own CI.
+
+| PR | Final head | CI run | Recorded result |
+| --- | --- | --- | --- |
+| [#413](https://github.com/STAIxBWLB/agent-hub/pull/413) | `fc25b2ba765196bc403c834d2c136e0b33481c1e` | [38814762057](https://github.com/STAIxBWLB/agent-hub/actions/runs/38814762057) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#415](https://github.com/STAIxBWLB/agent-hub/pull/415) | `cc1d70e4984a7a9dc2aee2f1359e749cf31d1b8b` | [38825015199](https://github.com/STAIxBWLB/agent-hub/actions/runs/38825015199) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#417](https://github.com/STAIxBWLB/agent-hub/pull/417) | `80d61f5b2fb483a8b33693cca2fcb9c7b9b6d57b` | [38848260715](https://github.com/STAIxBWLB/agent-hub/actions/runs/38848260715) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#419](https://github.com/STAIxBWLB/agent-hub/pull/419) | `0a3a8cc253be65911224ddd7e5495d4caffba29c` | [38855570074](https://github.com/STAIxBWLB/agent-hub/actions/runs/38855570074) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#420](https://github.com/STAIxBWLB/agent-hub/pull/420) | `649d368d73130bdffcb90109d8125b9135515a30` | [38855611042](https://github.com/STAIxBWLB/agent-hub/actions/runs/38855611042) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#421](https://github.com/STAIxBWLB/agent-hub/pull/421) | `d43d3e1047e0aeca4bd074ee17e854ff3e204a13` | [38862981281](https://github.com/STAIxBWLB/agent-hub/actions/runs/38862981281) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#422](https://github.com/STAIxBWLB/agent-hub/pull/422) | `8e5ddc7e6cec38d3b6f38d1a3e88d97a9cd15f79` | [38870904837](https://github.com/STAIxBWLB/agent-hub/actions/runs/38870904837) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#423](https://github.com/STAIxBWLB/agent-hub/pull/423) | `e934357ce089e3a6fbff9d71de50dd494aebc4b2` | [38878006900](https://github.com/STAIxBWLB/agent-hub/actions/runs/38878006900) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#425](https://github.com/STAIxBWLB/agent-hub/pull/425) | `c8ea0f2a64c4443d54e867122709d16c95197f04` | [38894400519](https://github.com/STAIxBWLB/agent-hub/actions/runs/38894400519) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#426](https://github.com/STAIxBWLB/agent-hub/pull/426) | `cf293a202605c664a1f74ce8407731be557dfc7f` | [38901783257](https://github.com/STAIxBWLB/agent-hub/actions/runs/38901783257) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#427](https://github.com/STAIxBWLB/agent-hub/pull/427) | `0a1b7bc984595b41ba36c15ba1ce88f5983abead` | [38923859188](https://github.com/STAIxBWLB/agent-hub/actions/runs/38923859188) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#429](https://github.com/STAIxBWLB/agent-hub/pull/429) | `b0a8e130f6c95e2766a6485ba05f170ef0b8b58c` | [38931755760](https://github.com/STAIxBWLB/agent-hub/actions/runs/38931755760) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#430](https://github.com/STAIxBWLB/agent-hub/pull/430) | `138aa9d175152b050a13cd4eafa6154aced56eb4` | [38936506477](https://github.com/STAIxBWLB/agent-hub/actions/runs/38936506477) | Ubuntu/macOS `check: OK`; seeded guards passed |
+
+- Preparation: `bun install --frozen-lockfile` and `bun run build` completed under resource admission on the remote Linux runner. The generated plugin is 598 KB and its manifest is stamped 0.12.30; no dependency tree was copied to the Mac.
+- Preparation checks: `bun x tsc --noEmit` and bundle freshness passed on the admitted remote runner; `node scripts/check-package.mjs` reported `package: OK (272 files, @staix/agent-hub@0.12.30)`.
+- The final committed candidate requires its own `scripts/check.sh` or exact-head PR CI on Ubuntu/macOS, including seeded guards, before merge. Committed document freshness and stamp ancestry are checked independently; the tag workflow requires successful CI for the identical release tree before npm publication.
+- The retained source/fixture tests for profile binding, package preservation and same-home cross-writes do not prove an installed native session upgrade or real migration.
+
+## Not verified by this record
+
+- Native/live legs in #273 and #1 remain open according to their own ledgers. This release preparation does not turn fixture, CLI or historical operational evidence into native success.
+- #412 P5 live legs L03 (real claude-mem import), L04 (real model suggestions and person confirmation) and L05 (Memory/Long-term tasks visual checks) remain unrun.
+- The person's real-home migration, real remote synchronization and post-migration profile/prune readbacks are not performed in this task. Inventory/quiesce/reopen and runtime capability receipts are prerequisites, not completed results.
+- npm publication/provenance, global CLI and plugin installation, running-hub upgrade, recovery completion and native session continuity need separate readbacks after the release is authorized and executed.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -62,7 +62,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -74,7 +74,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -86,7 +86,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -98,7 +98,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -135,7 +135,7 @@
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "6dcc7fe00c38f13613bcf53524fa3d1527a708e5",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
@@ -155,7 +155,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -172,7 +172,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -191,7 +191,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "6dcc7fe00c38f13613bcf53524fa3d1527a708e5",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",