@staix/agent-hub 0.12.29 → 0.12.30

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -159,8 +159,8 @@ hub CLI / console ── control WS 127.0.0.1:<ctl> ─────────
   30 s, then goes offline with queued work retained if no report arrives. `--model` maps to `kimi --model <alias> acp`
   (verified flag). Reusable for `opencode acp`.
 - Local worker (amended in M3): a hub-native tool-calling loop over non-streaming
-  `POST /chat/completions` with plain `fetch`, no SDK (the repo keeps zero runtime
-  dependencies). Tools `read`, `write`, `edit`, `bash`, `git`, `hub_send` (`hub_task_*` with
+  `POST /chat/completions` with plain `fetch`, no SDK (the repo keeps zero third-party runtime
+  dependencies; the first-party memory core is an exact-pinned library). Tools `read`, `write`, `edit`, `bash`, `git`, `hub_send` (`hub_task_*` with
   M4). Paths are realpath-scoped to cwd with a secrets denylist; `.git` and `.agenthub` are
   not writable. `write`, `edit`, `bash` and mutating `git` go through the console permission
   relay unless the hub runs `--unattended`. Everything that executes runs under seatbelt
@@ -554,7 +554,7 @@ New repo layout:
 src/hub/            daemon, bus, peer-registry, state-machines, board, budget, router
 src/adapters/       claude-channel.ts, codex-appserver.ts, acp.ts, local-worker.ts
 src/switchyard/     config generator, sidecar lifecycle, health
-src/memory/         claude-mem worker client, capture for the local worker, recall (inject, brief), remember
+src/memory/         hub memory integration: claude-mem client, capture, briefs and recall; portable core is @staix/agent-mem
 src/cli/            up, claude, codex, kimi, local, say, tail, board, route, budget, status, logs, kill, init
 plugins/agent-hub/  .claude-plugin/plugin.json, .mcp.json, server bundle, hooks (SessionStart health, Stop announce)
 .claude-plugin/marketplace.json
@@ -1255,7 +1255,8 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
   ignored with a note in `hub.log` and `ahub doctor`, and is no longer
   machine-local because nothing reads it.
 - Capabilities: `propose`, `assign` (a proposal naming another peer as owner),
-  `remember`, `important`. A peer not listed in `capabilities` has all of them,
+  `remember`, `memory_correct` (screened correction candidates only, never acceptance), `memory_read` (the `hub_memory_search`, `hub_memory_show` and
+  `hub_memory_graph` read tools, #412 P2), `important`. A peer not listed in `capabilities` has all of them,
   which keeps today's behaviour, and a listed peer whose value is not a list has
   none; the console user and the hub are never limited. `remember` gates the
   `hub_remember` tool only, not the notes the hub keeps of done summaries and
@@ -1947,6 +1948,63 @@ task list polling does not. `hub_status` stays conductor-only.
   proposer as the actor with reason `manual` (on the `reassigned` or `reserved`
   entry), and writes no conduct audit event; during a PII turn it is refused
   like the conductor's.
+
+## Amendment: revision-safe console task and queue operations (issue #424)
+
+- Task list/show responses add `flowRevision`, the monotonic history length,
+  separate from `planningRevision` and the delivery journal revision. This is
+  additive public metadata and does not bump the control protocol. `Board.update`
+  can check an expected value in its synchronous read-check-write section.
+- A revision-bound `ahub task assign` uses the new console-only
+  `task_assign_checked`; unchecked `task_assign` remains compatible. The new
+  console-only `task_unassign` and checked operation are unknown to an older hub,
+  which therefore refuses rather than ignoring the revision. A console whose
+  rows lack `flowRevision` refuses task row actions and asks for an upgrade.
+  `ahub queue resolve` accepts an optional displayed revision and otherwise keeps
+  its existing fresh-show behavior. New operations and optional fields preserve
+  the protocol version.
+- Tasks and Queue selections follow ids across refreshes, never indices into
+  replacement rows. A row-started action fixes its id and revision while peer,
+  reason and final role/action remain editable; confirmation uses the validated
+  final command and its consequence. Refresh follows every completed console
+  command, including failure and saved-but-unconfirmed assignment, without an
+  automatic resend. Existing `AssignmentUndeliveredError` semantics remain.
+- Tasks `a` assigns owner in `proposed`, `in_progress` and `changes_requested`,
+  and reviewer in `in_review`; waiting owner assignment is a reservation. `u`
+  unassigns, and `r` reviews only in `in_review`. Direct owner reassignment or
+  unassignment in `in_review`, physical task deletion/cancellation and roster
+  removal stay outside this feature.
+- `Tasks.unassign` is person-only. It refuses `approved` and `backlog`, an
+  already absent role and owner removal in `in_review`. Owner removal clears the
+  owner and reservation and returns active work to `proposed`; reviewer removal
+  keeps the current state. The human reviewer of PII work cannot be removed.
+  Owner removal writes `unassigned` and leaves turn-free cohorts; reviewer
+  removal writes `reviewer changed`. Neither operation routes a replacement,
+  adds a decline exclusion, stops a native process or rolls back effects.
+- A person `unassigned` event suppresses later automatic owner offers across
+  dependency release, planner pulls, release timers and restart recovery until
+  an explicit assignment or reservation. The marker is derived from history, so
+  no schema migration is needed, and it also fences planner undo and re-pull.
+  Former queued task/review requests are withdrawn, but accepted, dispatching
+  and needs_review deliveries are never implicitly resolved. Withdrawal notices
+  use delivery evidence or accepted/claimed board evidence, never an unread
+  queue alone. Former agents fail current-authority checks while the person's
+  explicit review override remains.
+- Assignment/review publication has a role-specific fence after every await and
+  immediately before publication. Existing supersession events, role generation
+  and task state suppress obsolete envelopes; accept, done and approval count as
+  supersession even when the owner id is unchanged. Supersession returns the
+  current task rather than aborting the remaining operation. Current metadata is
+  re-read before constructing a still-valid envelope, so reviewer-only changes
+  refresh reviewer content and quiet bookkeeping does not suppress valid owner
+  delivery.
+- Queue `r` prefills `discard` for `queued` and `retry` for `needs_review`, never
+  `completed` by default. Every resolve needs reason and confirmation. Queued
+  discard removes queued originals; needs-review discard settles its receipt and
+  hold. Retry creates one linked attempt. None cancels a task or claims native
+  or external rollback. Task and queue projections retain their distinct PII and
+  envelope-privacy redaction.
+
 ## Amendment: delegated agent live verification (#408)
 
 - Decision, 2026-10-16: an agent explicitly authorized by the user to perform a live test may use the global `--live-test` flag, before the command and in either order with `--project`. Duplicate global options refuse. Default command classification and malformed/conflicting identity refusals stay unchanged.
@@ -2921,3 +2979,46 @@ and repo-heavy work was coordinated over chat it read too late.
   holder whose pid is gone is reaped. The slot works with no hub running. It is
   not bus-visible; moving it into the hub is the upgrade if pid reuse or reap
   races bite.
+
+
+## Amendment: consume the first-party agent-mem package (#412, P5)
+
+The portable core is the first-party `@staix/agent-mem` library, initially exact-pinned at `0.1.1`; agent-hub keeps zero third-party runtime dependencies. Its store, sync, claude-mem import, project/home helpers and raw memory/goal commands are imported from the package root, with no vendored copies. Platform helpers use the public Node-safe `@staix/agent-mem/platform` subpath: `0.1.0` exposes only a root that loads `bun:sqlite`, which cannot load in Node-hosted Pi extensions. `0.1.1` supplies the required compatibility export without changing the platform algorithms. The package is the single implementation of deny, hardened git, realPath and process identity, re-exported through the existing local/hub/Pi modules so their callers retain one contract. Package storage semantics and the compatibility schema/hash/path invariants are unchanged.
+
+`src/memory/` retains only hub integration: briefs, recall, the optional claude-mem worker client and capture. The hub owns `src/hub/memory-policy.ts` (`withoutPii`, `promotionScreen`, `mentionsPrivatePath`), `src/hub/read-tools.ts`, task lifecycle writes, lease renewal, model-suggested edges, ask and dashboard consumers. Current project policy is injected through `StoreOptions.screen` and the raw command callbacks. Tasks remains the write authority; PII-turn refusals, current-policy screening before counting/truncation, capture exclusion and the peer read-tool byte budgets remain unchanged.
+
+`ahub memory` and `ahub goal` keep the hub's argument and identity contract, screened agent-readable views, project configuration and TTL. The standalone person-only `amem` CLI is the package's interface; its `--policy-free` acknowledgement is not an ahub option or a reason to bypass host privacy policy. Memory availability and sync remain fail-open for hub turns, while privacy checks keep their existing fail-closed behavior. Data directory precedence is supplied by the package's `memoryHome()` without migration: `AMEM_HOME`, then `$AGENTHUB_HOME/memory`, then `~/.agenthub/memory`; explicit `StoreOptions.home` retains its parent-directory meaning.
+
+`docs/memory.md` documents hub integration; [agent-mem](https://github.com/STAIxBWLB/agent-mem) owns the portable data model and CLI documentation. Portable-core import boundary checks belong to the agent-mem package CI. The former hub-local core boundary checker and its check.sh step are removed with the core; the hub keeps its exact first-party dependency pin. Consuming the package does not complete the owed live legs: copied-home old/new parity, source-unchanged checks, rollback and unrun account/device/sandbox receipts are reported separately. No release, runtime replacement or live proof is implied by the source change.
+
+The consumed package requires Bun >=1.4.2; the hub manifest, plain-JavaScript startup guard and installation guide share that minimum. Node still receives the actionable refusal before any TypeScript or Bun-only import.
+
+Recovery source preservation retains the exact first-party memory package under the preserved runtime, without copying any other node_modules content or linking to the mutable global install. Package identity/version and all retained dependency bytes participate in the recovery digest; cached or preserved dependency drift is refused. Preserved-source verification requires the package inside its own node_modules, refusing a missing or symlinked copy rather than falling back to a mutable ancestor installation. Staged release verification similarly binds dependency lookup to its retained install directory, including cached releases and a fresh coordinator. Releases without runtime dependencies keep their historical digest.
+
+
+## Amendment: P7 Stage A read-only memory presentation (#412 P7-1)
+
+The exact first-party pin is `@staix/agent-mem` 0.2.0. Agent-hub adds advisory plan-matching live fails to owner briefs and reviewer checklists, optional labeled fail text validated before the 4000-byte cap, person-only decay review, and privacy-filtered bounded read-time staleness markers. The task/PII boundaries remain in Tasks and the daemon. Details and ceilings are in `docs/memory.md`; no new v1 op, stored marker, candidate writer or live-leg claim is introduced.
+
+The P7-1 hint C3 probe gate assumes the tree is not modified during a call: no probe reaches a declared private/denied path in that scope. Concurrent ancestor swaps by a process running as the person are outside the security threat model and may expose one existence bit; this ceiling has a deterministic witness test.
+
+
+## P7 candidate producers and local observations (#412)
+
+Tasks produces a fail candidate from a public changes-requested review with unmet items, after the current Tasks privacy screen clears the complete candidate text. The review evidence identifies the task, review event and reviewed head (explicitly unknown when absent). Missing cause or retry conditions remain explicitly unknown. Candidate failure never changes the saved review outcome.
+
+`hub_memory_correct {id, text, reason}` requires its own `memory_correct` capability and refuses a PII turn. Input caps are checked before logging or storage; exact or unique visible-prefix resolution uses the current project and full-record screening. Tasks checks the proposed text like `hub_remember`, then rechecks context and target after asynchronous screening. A successful call records the full target id and revision in CandidateStore and returns only its candidate id and person-review guidance. MCP/Pi/local share the tool definition; capture excludes both arguments and results.
+
+Journal handoff observes rendered native memory lines in the final preface/brief payload. First positive journal acknowledgement observes delivered for that delivery and its original render context, not a later turn; pull's completed read is the existing journal acknowledgement contract. Peer messages and cleared task completion summaries observe visible `mem:<id8+>` citations. Counter keys use full entry id, project and known task/turn/session plus journal delivery id for rendered/delivered. Unattributed citations use message:<envelope-id> or summary:<task>:<history-index> observation keys with rendered/delivered unknown; these are citation counts, not proof of a causal per-delivery ratio. Absent observations and identities remain unknown. A bounded in-memory render-context map does not reconstruct acknowledgements after restart, so those delivered values remain unknown. Private envelopes, PII tasks and PII turns produce no rows. There is no usage sync or note mutation.
+
+The machine-local candidate/counter sidecar remains outside native import, recall, briefs, ask and graph evidence. A person accepts or rejects through `amem review` with its existing TTY/policy authority. Dashboard acceptance is deferred. No new v1 operation, note kind or scope is introduced.
+
+## Amendment: selected memory profiles in the hub (#412 P9)
+
+The exact first-party dependency pin is `@staix/agent-mem` 0.3.0. The memory root `M` follows the package's existing home precedence independently of project state. An absent `M/profile.json` binds shared v1; an explicit generation binds `M/generations/G` through the package profile API. The hub supplies current promotion/privacy policy and TTL at that open boundary. Generation reads include the package's readonly legacy bridge; writes and generation sync stay in `G`, outside legacy logs and legacy-main history. No hub tool gains migration or prune authority, and shared-v1 operation semantics remain unchanged.
+
+One explicit profile binding is used by daemon Tasks, read tools, briefs/recall/ask/dashboard, lease renewal, suggestions and sync. Hub memory and goal CLI opens use the same profile resolution. Invalid selector or missing/corrupt active generation makes native memory unavailable while bus/task service continues, with no automatic shared-v1 fallback. Daemon status distinguishes the memory package/profile binding and availability from hub health. Existing handles remain bound: periodic checks and explicit checks at hub operation entry fence later stale calls rather than rebinding the daemon. No proxy/private core ABI is used. These checks are not atomic with an in-flight core operation, so in-flight cutover is excluded: consumers must be quiesced and closed before migration/selector changes. A public core pre-write hook is the named upgrade path for an atomic fence.
+
+Candidates/counters remain at the independent root `M/candidates.db` using the package's explicit sidecar home API. They are neither migrated into `G` nor synced. Selector changes fence Tasks candidate producers and retained telemetry callbacks as well as native note operations; asynchronous privacy work rechecks binding before side effects. Standalone generation `amem review` remains unsupported and refuses; this change adds neither candidate acceptance nor dashboard acceptance for generations.
+
+PII authority, complete-row host screening, capture exclusion, byte budgets and fail-open task delivery remain unchanged. Memory/goal domain JSON remains unchanged; `memoryProfile` is additive only in daemon status, profile-check and the decay object. Synthetic integration must show bridged legacy reads, cross-writes through the package CLI and daemon tools, failure without fallback for invalid/missing generation state, and no note/candidate/counter writes for calls begun after a selector change while bus service remains available. Source/fixture evidence does not authorize real installation, migration or session restart. Real rollout requires separately approved deployed versions and matching live root/profile/selector bindings, synthetic canaries and quiesced/closed/reopened handles. Every running hub using this home needs an authenticated receipt: a matching ready binding, or a generation-capable unbound receipt (`disabled` when native memory is off, `unavailable` when opening failed) proving it holds no memory handle. An unbound daemon and zero running hubs are quiesced for memory; a stale bound handle, unreadable registry or unknown runtime is not ready. Native capture, account/device sync and real memory receipts remain open until observed.

package/docs/verification/2026-10-17-0.12.30.md

@@ -0,0 +1,70 @@
+# 0.12.30 release verification
+
+This record covers release preparation and source review. Publication, installation, running-hub upgrade and real memory migration require their own operational receipts; none is claimed here.
+
+## Candidate
+
+Version 0.12.30, control protocol 16, from main `6363f4dbfb1a90900b291a397b892a978922f7b5`. The candidate includes every PR merged since `v0.12.29`: #413, #415, #417, #419, #420, #421, #422, #423, #425, #426, #427, #429 and #430. Every PR body was read against its final merged source; intermediate descriptions of copied memory helpers are superseded by the final single-source package imports.
+
+- The portable core is the exact-pinned first-party `@staix/agent-mem` 0.3.0; hub privacy policy and caller authority stay in agent-hub. Shared v1 remains the default, with no automatic migration.
+- Screened memory read tools, display-only recall filtering/deduplication, plan-fail advice, structured fail notes, decay review, file-level staleness and machine-local candidates/counters retain their evidence and privacy boundaries. Generation `amem review` remains refused.
+- Profile binding fails closed for invalid or changed selectors while the bus/board remain available. Person profile-check distinguishes matching ready bindings, authenticated capable unbound/quiesced receipts and unknown/stale runtime evidence; registry scope is explicit.
+- Before migrating a real home, upgrade every hub sharing it to 0.12.30, inventory each registry, obtain positive profile-check receipts, then quiesce consumers and close handles. A ready binding is compatible but still open; the operation-entry fence is not an atomic live-cutover guarantee.
+- Console task and queue controls bind selections to ids/revisions, preserve person unassignment and use peer-specific receipt evidence. Recovery retains exact dependencies and waits for managed peer attachment without creating duplicate terminals.
+- Version 0.13.0's promised removal of `local.bash_network: "direct"` has not happened; the existing ceiling and retirement plan remain unchanged.
+
+## Document review
+
+The initial freshness check reproduced all 13 stale documents below. Each was compared with the source changes under its manifest paths since the prior full-SHA stamp through the candidate source. Changed source was traced to the final symbols, not inferred from prose changes alone. No document review was deferred. The already-fresh models note is outside this stale set and keeps its existing stamp.
+
+| Document | Prior source stamp | Review result | Checked claims and correction |
+| --- | --- | --- | --- |
+| `README.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Current version and Bun requirement; first-party memory tools/candidate boundary, checked console controls and pre-migration upgrade/quiesce order. |
+| `docs/agent-notes/README.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | unchanged | Exact-id console attention selection and navigation remain accurate after the console controls. |
+| `docs/agent-notes/adapters.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | unchanged | Node-safe process identity re-exports, tool catalogs, capability/PII checks and capture exclusions already match the final source. |
+| `docs/agent-notes/benchmarks.md` | `2d3b120ab177e4fd9e6f991d038c22ca4ccb6977` | unchanged | Only deny/process helper re-exports changed in the covered source delta; runner, sandbox and retained benchmark contracts remain accurate. |
+| `docs/agent-notes/budget.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | unchanged | Budget semantics remain unchanged; reviewed shared bus/daemon wiring and retained quota/hold contracts. |
+| `docs/agent-notes/bus.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Recall preface merge/deduplication and delivery/counter observation boundaries. |
+| `docs/agent-notes/daemon.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Person-only diagnostics wording includes authenticated status and person CLI receipts; reduced shell-readable status stays distinct. |
+| `docs/agent-notes/local-worker.md` | `6dcc7fe00c38f13613bcf53524fa3d1527a708e5` | unchanged | Single-source hardened git/deny re-exports and local-worker memory-tool capture exclusions already match the final source. |
+| `docs/agent-notes/tasks.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Revision-bound task/queue controls and the current peer's own acceptance since its latest ownership event. |
+| `docs/agent-notes/tests.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Test preload clears inherited AMEM_HOME as well as isolating AGENTHUB_HOME. |
+| `docs/operations.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Bun/current version, package/profile rollout, screened tools and candidates, recall, withdrawal evidence and preserved-runtime attachment behavior. |
+| `docs/quickstart.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | Bun/current release example and person profile-check with upgrade/quiesce/migration order. |
+| `docs/security.md` | `0463ea1f251cea17ec7f32a2861de8c554fe4062` | corrected | First-party platform helper and memory credentials boundary, screened read/correction tools, sidecar isolation and non-atomic profile transition. |
+
+The unstamped memory integration guide also clarifies person CLI diagnostics and the all-hubs-0.12.30 migration prerequisite.
+
+Reviewed source commit `79a113dfc4395a0e00890ba8b8d2d90bb289ee9f` contains the reviewed content, package version and generated plugin assets. A separate manifest follow-up stamps that full source SHA; the manifest need not stamp itself. The release PR must be merged with a merge commit so every stamp remains an ancestor. Before tagging, run `node scripts/check-docs.mjs --require-fresh` on the committed tree again. Source freshness is not a certification of native/live behavior.
+
+## Recorded checks
+
+The following existing PR receipts were read back from GitHub at their final heads. Every listed run reports successful Ubuntu, macOS and seeded-guard jobs; these are recorded prior gates, not a substitute for the release candidate's own CI.
+
+| PR | Final head | CI run | Recorded result |
+| --- | --- | --- | --- |
+| [#413](https://github.com/STAIxBWLB/agent-hub/pull/413) | `fc25b2ba765196bc403c834d2c136e0b33481c1e` | [38814762057](https://github.com/STAIxBWLB/agent-hub/actions/runs/38814762057) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#415](https://github.com/STAIxBWLB/agent-hub/pull/415) | `cc1d70e4984a7a9dc2aee2f1359e749cf31d1b8b` | [38825015199](https://github.com/STAIxBWLB/agent-hub/actions/runs/38825015199) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#417](https://github.com/STAIxBWLB/agent-hub/pull/417) | `80d61f5b2fb483a8b33693cca2fcb9c7b9b6d57b` | [38848260715](https://github.com/STAIxBWLB/agent-hub/actions/runs/38848260715) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#419](https://github.com/STAIxBWLB/agent-hub/pull/419) | `0a3a8cc253be65911224ddd7e5495d4caffba29c` | [38855570074](https://github.com/STAIxBWLB/agent-hub/actions/runs/38855570074) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#420](https://github.com/STAIxBWLB/agent-hub/pull/420) | `649d368d73130bdffcb90109d8125b9135515a30` | [38855611042](https://github.com/STAIxBWLB/agent-hub/actions/runs/38855611042) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#421](https://github.com/STAIxBWLB/agent-hub/pull/421) | `d43d3e1047e0aeca4bd074ee17e854ff3e204a13` | [38862981281](https://github.com/STAIxBWLB/agent-hub/actions/runs/38862981281) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#422](https://github.com/STAIxBWLB/agent-hub/pull/422) | `8e5ddc7e6cec38d3b6f38d1a3e88d97a9cd15f79` | [38870904837](https://github.com/STAIxBWLB/agent-hub/actions/runs/38870904837) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#423](https://github.com/STAIxBWLB/agent-hub/pull/423) | `e934357ce089e3a6fbff9d71de50dd494aebc4b2` | [38878006900](https://github.com/STAIxBWLB/agent-hub/actions/runs/38878006900) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#425](https://github.com/STAIxBWLB/agent-hub/pull/425) | `c8ea0f2a64c4443d54e867122709d16c95197f04` | [38894400519](https://github.com/STAIxBWLB/agent-hub/actions/runs/38894400519) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#426](https://github.com/STAIxBWLB/agent-hub/pull/426) | `cf293a202605c664a1f74ce8407731be557dfc7f` | [38901783257](https://github.com/STAIxBWLB/agent-hub/actions/runs/38901783257) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#427](https://github.com/STAIxBWLB/agent-hub/pull/427) | `0a1b7bc984595b41ba36c15ba1ce88f5983abead` | [38923859188](https://github.com/STAIxBWLB/agent-hub/actions/runs/38923859188) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#429](https://github.com/STAIxBWLB/agent-hub/pull/429) | `b0a8e130f6c95e2766a6485ba05f170ef0b8b58c` | [38931755760](https://github.com/STAIxBWLB/agent-hub/actions/runs/38931755760) | Ubuntu/macOS `check: OK`; seeded guards passed |
+| [#430](https://github.com/STAIxBWLB/agent-hub/pull/430) | `138aa9d175152b050a13cd4eafa6154aced56eb4` | [38936506477](https://github.com/STAIxBWLB/agent-hub/actions/runs/38936506477) | Ubuntu/macOS `check: OK`; seeded guards passed |
+
+- Preparation: `bun install --frozen-lockfile` and `bun run build` completed under resource admission on the remote Linux runner. The generated plugin is 598 KB and its manifest is stamped 0.12.30; no dependency tree was copied to the Mac.
+- Preparation checks: `bun x tsc --noEmit` and bundle freshness passed on the admitted remote runner; `node scripts/check-package.mjs` reported `package: OK (272 files, @staix/agent-hub@0.12.30)`.
+- The final committed candidate requires its own `scripts/check.sh` or exact-head PR CI on Ubuntu/macOS, including seeded guards, before merge. Committed document freshness and stamp ancestry are checked independently; the tag workflow requires successful CI for the identical release tree before npm publication.
+- The retained source/fixture tests for profile binding, package preservation and same-home cross-writes do not prove an installed native session upgrade or real migration.
+
+## Not verified by this record
+
+- Native/live legs in #273 and #1 remain open according to their own ledgers. This release preparation does not turn fixture, CLI or historical operational evidence into native success.
+- #412 P5 live legs L03 (real claude-mem import), L04 (real model suggestions and person confirmation) and L05 (Memory/Long-term tasks visual checks) remain unrun.
+- The person's real-home migration, real remote synchronization and post-migration profile/prune readbacks are not performed in this task. Inventory/quiesce/reopen and runtime capability receipts are prerequisites, not completed results.
+- npm publication/provenance, global CLI and plugin installation, running-hub upgrade, recovery completion and native session continuity need separate readbacks after the release is authorized and executed.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -62,7 +62,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "2d3b120ab177e4fd9e6f991d038c22ca4ccb6977",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -74,7 +74,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -86,7 +86,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -98,7 +98,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -135,7 +135,7 @@
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "6dcc7fe00c38f13613bcf53524fa3d1527a708e5",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
@@ -155,7 +155,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -172,7 +172,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -191,7 +191,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "0463ea1f251cea17ec7f32a2861de8c554fe4062",
+      "verifiedAgainst": "79a113dfc4395a0e00890ba8b8d2d90bb289ee9f",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.29",
+  "version": "0.12.30",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",
@@ -14,7 +14,10 @@
     "test": "bun test"
   },
   "engines": {
-    "bun": ">=1.3.0"
+    "bun": ">=1.4.2"
+  },
+  "dependencies": {
+    "@staix/agent-mem": "0.3.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.29",
+  "version": "0.12.30",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -6922,24 +6922,16 @@ var require_dist = __commonJS(function(exports, module) {
 
 // src/hub/control-client.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 
 // src/hub/project.ts
-import { existsSync, lstatSync, readFileSync, realpathSync } from "fs";
-import { basename, dirname, isAbsolute, join, resolve } from "path";
-
-// src/hub/git.ts
-import { spawnSync } from "child_process";
-var SAFE_CONFIG = ["core.fsmonitor=false", "core.hooksPath=/dev/null", "diff.external=", "core.pager=cat", "credential.helper=", "core.askpass="];
-var CREDENTIAL_KEYS = new Set(["credential.helper=", "core.askpass="]);
-var hubGitArgv = (args, opts = {}) => ["git", "--no-pager", ...SAFE_CONFIG.filter((c) => !opts.credentials || !CREDENTIAL_KEYS.has(c)).flatMap((c) => ["-c", c]), ...args];
-var hubGitEnv = (env = process.env) => ({ ...env, GIT_TERMINAL_PROMPT: "0" });
-function hubGitSync(args, options) {
-  const argv = hubGitArgv(args);
-  return spawnSync(argv[0], argv.slice(1), { ...options, env: hubGitEnv(options.env ?? process.env) });
-}
+import { existsSync, lstatSync, readFileSync } from "fs";
+import { dirname as dirname2, isAbsolute, join as join2, resolve as resolve2 } from "path";
 
-// src/hub/project.ts
+// node_modules/@staix/agent-mem/src/memory/platform.ts
+import { realpathSync } from "fs";
+import { basename, dirname, join, resolve, sep } from "path";
+import { spawnSync, execFileSync } from "child_process";
 var canonical = (path) => {
   const absolute = resolve(path);
   try {
@@ -6949,21 +6941,42 @@ var canonical = (path) => {
     return parent === absolute ? absolute : join(canonical(parent), basename(absolute));
   }
 };
+function canonicalPath(path) {
+  return canonical(path);
+}
+var SAFE_CONFIG = ["core.fsmonitor=false", "core.hooksPath=/dev/null", "diff.external=", "core.pager=cat", "credential.helper=", "core.askpass="];
+var CREDENTIAL_KEYS = new Set(["credential.helper=", "core.askpass="]);
+var memoryGitArgv = (args, opts = {}) => ["git", "--no-pager", ...SAFE_CONFIG.filter((c) => !opts.credentials || !CREDENTIAL_KEYS.has(c)).flatMap((c) => ["-c", c]), ...args];
+function memoryGitEnv(env = process.env, options = {}) {
+  const result = { ...env, GIT_TERMINAL_PROMPT: "0" };
+  if (options.repositoryIsolation) {
+    for (const key of Object.keys(result))
+      if (["GIT_DIR", "GIT_COMMON_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_NAMESPACE", "GIT_PREFIX", "GIT_SHALLOW_FILE", "GIT_GRAFT_FILE", "GIT_REPLACE_REF_BASE", "GIT_CONFIG_COUNT", "GIT_CONFIG_PARAMETERS"].includes(key) || /^GIT_CONFIG_(KEY|VALUE)_/.test(key))
+        delete result[key];
+    result.GIT_NO_REPLACE_OBJECTS = "1";
+  }
+  return result;
+}
+function memoryGitSync(args, options) {
+  const argv = memoryGitArgv(args);
+  return spawnSync(argv[0], argv.slice(1), { ...options, env: memoryGitEnv(options.env ?? process.env) });
+}
+// src/hub/project.ts
 function gitRoot(dir) {
-  const result = hubGitSync(["-C", dir, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+  const result = memoryGitSync(["-C", dir, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
   if (result.status !== 0)
     return;
   const root = result.stdout.trim();
-  return root ? canonical(root) : undefined;
+  return root ? canonicalPath(root) : undefined;
 }
 function hasConfig(dir) {
-  return existsSync(join(dir, ".agenthub", "config.json"));
+  return existsSync(join2(dir, ".agenthub", "config.json"));
 }
 function projectRoot(cwd) {
-  const input = isAbsolute(cwd) ? cwd : resolve(cwd);
+  const input = isAbsolute(cwd) ? cwd : resolve2(cwd);
   let dir;
   try {
-    dir = canonical(input);
+    dir = canonicalPath(input);
     if (!lstatSync(dir).isDirectory())
       throw new Error(`${cwd} is not a directory`);
   } catch (error) {
@@ -6971,27 +6984,27 @@ function projectRoot(cwd) {
   }
   const boundary = gitRoot(dir);
   const stop = boundary ?? parseRoot(dir);
-  for (let current = dir;; current = dirname(current)) {
+  for (let current = dir;; current = dirname2(current)) {
     if (hasConfig(current))
-      return canonical(current);
-    if (current === stop || current === dirname(current))
+      return canonicalPath(current);
+    if (current === stop || current === dirname2(current))
       break;
   }
   return boundary ?? dir;
 }
 function parseRoot(dir) {
   let current = dir;
-  while (dirname(current) !== current)
-    current = dirname(current);
+  while (dirname2(current) !== current)
+    current = dirname2(current);
   return current;
 }
 function stateMarker(stateDir) {
-  for (const file of [join(stateDir, "project.json"), join(stateDir, "status.json")]) {
+  for (const file of [join2(stateDir, "project.json"), join2(stateDir, "status.json")]) {
     try {
       const value = JSON.parse(readFileSync(file, "utf8"));
       const root = value.root ?? value.cwd;
       if (typeof root === "string")
-        return canonical(root);
+        return canonicalPath(root);
     } catch {}
   }
   return;
@@ -7000,15 +7013,15 @@ function projectContext(cwd, env = process.env) {
   const root = projectRoot(cwd);
   const override = env.AGENTHUB_STATE_DIR?.trim();
   if (!override)
-    return { root, stateDir: canonical(join(root, ".agenthub", "state")) };
+    return { root, stateDir: canonicalPath(join2(root, ".agenthub", "state")) };
   const declared = env.AGENTHUB_PROJECT_DIR?.trim();
-  const stateDir = canonical(override);
+  const stateDir = canonicalPath(override);
   const recorded = stateMarker(stateDir);
   if (recorded === root)
     return { root, stateDir };
-  if (!recorded && declared && canonical(declared) === root)
+  if (!recorded && declared && canonicalPath(declared) === root)
     return { root, stateDir };
-  return { root, stateDir: canonical(join(root, ".agenthub", "state")) };
+  return { root, stateDir: canonicalPath(join2(root, ".agenthub", "state")) };
 }
 
 // src/hub/control-client.ts
@@ -7019,8 +7032,8 @@ var PROTOCOL = 16;
 var RECOVERY_SOURCE_PROTOCOLS = [9, 10, 11, 12, 13, 14, 15, PROTOCOL];
 function readControl(stateDir) {
   try {
-    const status = JSON.parse(readFileSync2(join2(stateDir, "status.json"), "utf8"));
-    const token = readFileSync2(join2(stateDir, "control-token"), "utf8").trim();
+    const status = JSON.parse(readFileSync2(join3(stateDir, "status.json"), "utf8"));
+    const token = readFileSync2(join3(stateDir, "control-token"), "utf8").trim();
     if (!Number.isInteger(status.controlPort) || status.controlPort < 1 || status.controlPort > 65535 || !token)
       return;
     return {
@@ -7318,7 +7331,7 @@ var OUTCOMES_KEPT_MS = 7 * 24 * 3600000;
 // src/hub/roles.ts
 import { createHash } from "crypto";
 import { constants, closeSync, fstatSync, lstatSync as lstatSync2, openSync, readSync, readdirSync } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 
 // templates/roles/dev/software-architect.md
 var software_architect_default = `---
@@ -7738,7 +7751,7 @@ function loadRoleCatalog(cwd) {
   if (!cwd)
     return { roles, errors };
   try {
-    const config = join3(cwd, ".agenthub"), dir = join3(config, "roles");
+    const config = join4(cwd, ".agenthub"), dir = join4(config, "roles");
     for (const path of [config, dir]) {
       const stat = lstatSync2(path);
       if (!stat.isDirectory() || stat.isSymbolicLink())
@@ -7750,7 +7763,7 @@ function loadRoleCatalog(cwd) {
     for (const file of files) {
       const id = file.slice(0, -3);
       try {
-        roles.set(id, parseRole(projectRole(join3(dir, file)), id, "project"));
+        roles.set(id, parseRole(projectRole(join4(dir, file)), id, "project"));
       } catch {
         errors.push({ id: ID.test(id) ? id : "invalid-file-id", reason: "invalid or unsafe project role" });
       }
@@ -16153,11 +16166,11 @@ class StdioServerTransport {
 
 // src/adapters/claude-channel.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.29",
+  version: "0.12.30",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",
@@ -16171,7 +16184,10 @@ var package_default = {
     test: "bun test"
   },
   engines: {
-    bun: ">=1.3.0"
+    bun: ">=1.4.2"
+  },
+  dependencies: {
+    "@staix/agent-mem": "0.3.0"
   },
   devDependencies: {
     "@modelcontextprotocol/sdk": "^1.27.1",
@@ -16265,7 +16281,11 @@ var TASK_TOOLS = [
   tool("hub_task_list", "The task board. PII tasks show as [pii].", { state: { type: "string", enum: ["proposed", "in_progress", "in_review", "approved", "changes_requested"] }, ready: { type: "boolean", description: "only proposed tasks with nothing left to wait for" } }),
   tool("hub_review", "Give your verdict on a task you were asked to review: map the changed signatures and call sites to the task's plan or detail, read the check result (hub_task_show has it, with the done summary), and list what is unmet. Two changes_requested in a row move the task to another peer.", { id, head: { type: "string", description: "full SHA actually reviewed; enforce binds approval to the current PR head" }, verdict: { type: "string", enum: ["approved", "changes_requested"] }, note: str, unmet: { type: "array", items: str, description: "each requirement of the plan or detail that the change does not meet" } }, ["id", "verdict"]),
   tool("hub_checkpoint", "Answer a checkpoint request from the hub (quota or context window pressure): what you were doing, what is half done, what whoever continues must know. Write the same to .agenthub/checkpoint.md first if you can.", { summary: str, request_id: { type: "string", description: "The request id supplied by a context checkpoint request; required for context checkpoints" } }, ["summary"]),
-  tool("hub_remember", "Save a decision, finding, contract or fail to the memory all agents share (the hub's memory and claude-mem); the other agents also get it with their next message. A fail is an approach you tried that does not work, and why: the most useful note, it stops the others spending their quota on it. Do not retry what a fail note rules out without new evidence. Conclusions worth recalling, not chatter. A note on an open task is short-term until the task is approved, when its decisions, contracts and fails become long-term; horizon long keeps it now, scope shared lets the person's other projects find it.", { text: str, title: str, kind: { type: "string", enum: [...NOTE_KINDS] }, task: id, horizon: { type: "string", enum: ["short", "long"] }, scope: { type: "string", enum: ["project", "shared"] } }, ["text"])
+  tool("hub_memory_search", "Search daemon-scoped visible memory, fails first. Query <=200 UTF-8 bytes; default 8, max 20 lines; whole output <=4 KB. Incomplete excerpts are marked. No project argument.", { query: { type: "string", maxLength: 200, description: "At most 200 UTF-8 bytes, enforced by the daemon" }, limit: { type: "integer", minimum: 1, maximum: 20 } }, ["query"]),
+  tool("hub_memory_show", "Read up to 8 visible memory ids or unique prefixes (6..64 UTF-8 bytes each). Original ids redirect; unavailable ids share one refusal. Whole output <=8 KB.", { ids: { type: "array", minItems: 1, maxItems: 8, items: { type: "string", minLength: 6, maxLength: 64, description: "6 to 64 UTF-8 bytes" } } }, ["ids"]),
+  tool("hub_memory_graph", "Read screened memory neighbourhoods, fails first. Up to 8 starts (<=200 UTF-8 bytes each), 1 or 2 hops; default 60/max 120 nodes, max 240 edges, whole output <=6 KB. No project argument.", { starts: { type: "array", minItems: 1, maxItems: 8, items: { type: "string", minLength: 1, maxLength: 200, description: "At most 200 UTF-8 bytes" } }, hops: { type: "integer", enum: [1, 2] }, limit: { type: "integer", minimum: 1, maximum: 120 } }, ["starts"]),
+  tool("hub_memory_correct", "Propose a correction to a visible memory entry. This creates a machine-local candidate only; a person accepts or rejects it with amem review. It never edits a note. id is an exact id or unique visible prefix; text and reason must each fit 4000 UTF-8 bytes.", { id: str, text: str, reason: str }, ["id", "text", "reason"]),
+  tool("hub_remember", "Save a decision, finding, contract or fail to the memory all agents share (the hub's memory and claude-mem); the other agents also get it with their next message. A fail is an approach you tried that does not work, and why: the most useful note, it stops the others spending their quota on it. Do not retry what a fail note rules out without new evidence. Conclusions worth recalling, not chatter. For kind fail, optional approach, symptom, cause, evidence and retry_when strings compose fixed labeled text; text may be omitted when structured fields are supplied. The complete text must fit 4000 UTF-8 bytes and is refused, never truncated, when oversized. A note on an open task is short-term until the task is approved, when its decisions, contracts and fails become long-term; horizon long keeps it now, scope shared lets the person's other projects find it.", { text: str, approach: str, symptom: str, cause: str, evidence: str, retry_when: str, title: str, kind: { type: "string", enum: [...NOTE_KINDS] }, task: id, horizon: { type: "string", enum: ["short", "long"] }, scope: { type: "string", enum: ["project", "shared"] } })
 ];
 var TASK_TOOL_NAMES = new Set(TASK_TOOLS.map((t) => t.name));
 var CONDUCTOR_TOOLS = [
@@ -16328,7 +16348,7 @@ var channel = !toolsMode && process.env.AGENTHUB_CHANNEL === "1";
 function roles() {
   const read = (name) => {
     try {
-      return JSON.parse(readFileSync3(join4(projectRoot2, ".agenthub", name), "utf8")).roles ?? {};
+      return JSON.parse(readFileSync3(join5(projectRoot2, ".agenthub", name), "utf8")).roles ?? {};
     } catch {
       return {};
     }
@@ -16341,7 +16361,7 @@ function sessionProfile() {
     for (const name of ["config.json", "config.local.json"]) {
       let data;
       try {
-        data = JSON.parse(readFileSync3(join4(projectRoot2, ".agenthub", name), "utf8"));
+        data = JSON.parse(readFileSync3(join5(projectRoot2, ".agenthub", name), "utf8"));
       } catch (error) {
         if (error.code === "ENOENT")
           continue;
@@ -16368,7 +16388,7 @@ function sessionRoles() {
     const read = (name) => {
       let raw;
       try {
-        raw = JSON.parse(readFileSync3(join4(projectRoot2, ".agenthub", name), "utf8")).catalog_roles;
+        raw = JSON.parse(readFileSync3(join5(projectRoot2, ".agenthub", name), "utf8")).catalog_roles;
       } catch {
         return {};
       }
@@ -16397,7 +16417,7 @@ var HELD = `another session is attached to the hub as "${peerId}"; this one is s
 var INBOX_CAP = 200;
 function peerHeld() {
   try {
-    const status = JSON.parse(readFileSync3(join4(stateDir, "status.json"), "utf8"));
+    const status = JSON.parse(readFileSync3(join5(stateDir, "status.json"), "utf8"));
     const peer = status.peers?.[peerId];
     if (channel && peer?.toolsOnly && !peer.claiming)
       return false;