@staix/agent-hub 0.12.32 → 0.12.34

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -374,7 +374,7 @@ Assignment is a pure function of `routing.toml`, the task's signals and the peer
 "skip_local"`, `pii = "local_only"`); `ahub route explain <id | --class <c> <title>>` runs the
 same function and prints its trace: signals, every candidate with the reason it was kept
 or skipped, owner, reviewer and route. `local` uses the class's `route` / `fixed_model` for a
-task turn and `[local]` otherwise. Verification failure (tests fail, review `changes_requested` twice) escalates
+task turn and `[local]` otherwise. Verification failure (tests fail, review `changes_requested` `tasks.escalate_after` times in a row, default 3, #488) escalates
 the task to the next peer in `escalate_to`; Switchyard handles per-call escalation
 inside a peer.
 
@@ -573,7 +573,7 @@ AGENTS.md, REVIEW.md
    `end_turn`, never lost.
 3. `[STATUS]` messages from one peer are batched into one digest per recipient.
 4. A task proposed by Claude, accepted by Codex, marked done, is auto-routed to the
-   reviewer; `changes_requested` twice escalates per `routing.toml`.
+   reviewer; `tasks.escalate_after` consecutive `changes_requested` (default 3) escalate per `routing.toml`.
 5. `ahub local` completes a `bulk_edit` task; OmniRoute log shows the request with the
    per-peer token and `x-omniroute-provider: vllm`; `ahub route explain` shows the
    chosen route.
@@ -3237,8 +3237,8 @@ The guard inventories AST comparisons, closed-list imports and vendor literals,
 including inline dashboard scripts, under stable file/symbol scopes. Its reviewed
 A1 baseline records the current source, rather than claiming the old A0 grep's
 265 line matches equal AST node counts. A new group, count growth or stale entry
-fails; later phases may only shrink this baseline. Only real, unshadowed registry
-resolver imports exempt kind-aware comparisons. Native adapter implementations and
+fails; later phases may only shrink this baseline. A1 originally exempted kind-aware comparisons from real, unshadowed registry
+resolver imports; the A2 amendment below counts them instead. Native adapter implementations and
 explicit non-peer config semantics remain the narrow exceptions. Existing literal
 catalog exports used by older recovery source probes are retained until their
 replacement compatibility proof is available; a refactor must not silently make a
@@ -3260,3 +3260,245 @@ same scanner reports 428/172 on that main and 415/171 on the combined A1 source.
 Every added or increased baseline entry matches that main-only delta; A1 still
 removes thirteen sites and one group. This explicit reconciliation precedes the
 first shipped baseline and does not permit later phases to grow it.
+
+## Adapter registry A2 amendment (#451)
+
+A2 counts native-name comparisons even when a trusted registry resolver supplies
+its left or right operand. These sites use the `kind-aware-comparison` inventory
+pattern and the same lexical file/symbol group as a raw comparison, including
+switch cases. Replacing a raw comparison with `kindOf` or `definitionOf(...).kind`
+therefore does not shrink a baseline group. Alias and shadowing checks remain in
+force. The pre-existing kind-aware preview site is counted explicitly; the A1
+source has 415 other sites plus that one site. A2 removes the transitional
+baseline by migrating policy, rather than by adding resolver exemptions.
+
+Session metadata distinguishes native resume arguments from daemon startup
+restoration. `session.resumeById` means that recovery passes the verified native
+session id to the start command (Qwen). `session.restoreOnStart` means that the
+daemon restores recorded startup options before automatic startup (Pi). Neither
+flag proves that a conversation can be resumed or permits a fresh replacement.
+Crash recovery tests `resumeById` and uses `crashIdentity`; transport choice or the
+presence of a factory does not establish that capability.
+
+A2 preserves literal `KNOWN_PEERS` and `OPTIONAL_PEERS` exports in
+`peer-catalog.ts` for released coordinators that inspect their source. The guard
+records these exact file/symbol exceptions separately with the reason
+"cross-release source probe", and tests their values against the typed registry
+catalog. The same exception preserves `start-mode.ts`'s literal `START_MODE_PEERS`, which released coordinators inspect before restoring Kimi headlessly. The three probes are counted separately (5 + 2 + 3 sites). The native vendor baseline is otherwise empty. A retained coordinator's
+existing source probe must accept the A2 target; no unsupported-target ceiling is
+introduced. ponytail: retire these compatibility literals only after a separately
+approved minimum supported upgrade source no longer reads them.
+
+Native recovery hooks return read-only facts over the existing narrow DTOs.
+`zeroTurn({ stateDir, binding, phase })` reads Codex's existing event proof only
+for planning, and Claude's existing transcript absence only for attachment or
+verification. `restoreArgs(peer)` and `recoveryRefusal(peer)` are pure over the
+captured peer. `personFresh` and `missingEvidence` are policy data, not authority.
+`resumeArgv(binding, fresh)` returns the CLI tail; the coordinator supplies the
+interpreter, entrypoint and project prefix and retains all receipt, repair,
+waiver and unknown-state decisions. The restore oracle, supplemental matrix and
+transition code remain byte-unchanged.
+
+Quota and context readers are pure normalizers:
+`QuotaReader.read(value: unknown): UsageWindow[]` and
+`ContextReader.read(value: unknown, sessionId: string, measuredAt: number): ContextReading`.
+They preserve the existing malformed-input results. The coordinator still binds
+transport generation, native session and measurement time before reporting.
+Palette data additionally carries optional `tone` and `ansi`, preserving the
+existing terminal palette and rendered CSS bytes.
+
+P4 conformance is transport-specific. Delivery-only native drivers set busy
+synchronously at admission; pull-only WebSocket peers receive no unsolicited
+delivery or busy mutation; Claude push keeps its existing receipt/native-start
+busy contract. Native production behavior does not change to satisfy a generic
+conformance case. The kit also covers the existing generation fences, process
+groups, approvals, quota refusals, mode acknowledgement/timeout and recovery
+contracts for each applicable transport, with explicit unsupported outcomes.
+
+`resumeArgv` accepts the existing `SessionRef` (session id/file, backend and model),
+which withholds terminal and launch identity from a pure argument formatter.
+`recoveryRefusal(peer, phase?: "plan" | "restore")` defaults to planning and keeps
+both existing phase-specific native messages. Fixed private compatibility data
+`legacyTargetSupport` and `legacyHeadlessArgv` name only the existing catalog or
+start-mode literal exports; their old read points and regexes are unchanged.
+
+`start.daemonPort` is a closed, data-only engine tag (`codex-appserver`, `acp`,
+`owned-acp`, `pi-rpc`, `local-worker`), required when `start.create` exists. Unknown
+values are refused at registry load. Channel/pull definitions without a factory
+leave it absent. Typed registry-owned wrappers retain the existing `DaemonPorts`
+union; core selects the engine and retains lifecycle/authentication closures,
+while the definition factory remains the only native constructor.
+
+The trusted CLI host may supply `LaunchContext.pi` using the existing Pi builder
+options, extension path and live bridge port/token. A redacted preview supplies
+only redacted placeholders; bridge tokens never reach previews, logs or events.
+`LaunchPlan.env` preserves Pi's existing child environment. Definitions never
+load daemon config or infer executable commands from environment text.
+`VersionContext` adds `observedVersion`, `nativeCommand` and `projectRoot` once:
+the host still performs each probe, while definitions validate or display it.
+`cli.authority` and `cli.personOnlyFlags` can only restrict existing authority;
+identity.ts stays authoritative and missing/unknown metadata retains today's
+rule. `start.passthrough` is data only. The MCP hook is a pure plan over the
+existing project/state/server-entrypoint/form tuple; every write, ordering fence
+and finally cleanup remains in the CLI host.
+
+### A2 internal native host projections (2026-10-18)
+
+The remaining AST inventory after the first A2 checkpoint has 260 policy sites in
+113 lexical groups. Native CLI entrypoints and previews, configuration validators,
+settings rows, plugin inventory and recovery presentation need explicit definition
+projections in addition to the original frozen transport factory hooks. These are
+moves of existing built-in policy, with the same host-owned effects, argv, ordering,
+errors, privacy, permission and timing fences. They add no instance support,
+capability or native behavior.
+
+Private, statically imported built-in preview helpers implement the frozen
+`start.launch` / `publicLaunch` redaction path. They preserve current validation,
+JSON order and placeholders, and cannot execute a native process, connect to
+control, allocate runtime state or write authoritative state. They are not public
+`AdapterDefinition` / `NativeHooks` extension points; configuration cannot register
+a helper. Person CLI entrypoints are relocated into a fixed private built-in
+dispatcher for C1, without adding a public `cli.run` or `NativeHooks` callback.
+The dispatcher cannot load external modules or accept caller-selected callbacks;
+its typed context contains only the original CLI host operations. Identity,
+command access, live-test delegation, audit and project/lifecycle admission remain
+in the host before dispatch, and each moved body retains its native effects,
+ordering, errors, environment and cleanup. Doctor projections carry existing probe
+metadata; the host retains probe execution and output. Configuration projections receive the current validator vocabulary and
+return the existing schema/settings entries. Recovery projections carry the current
+crash plan, continuity decoder/bookmark and unrecorded-terminal classification.
+Reporting flags, tool classification, recall source and display tones are semantic
+data; a consumer must not replace raw comparisons with kind-name wrappers or
+constant aliases. Plugin inventory takes the existing home/cwd/env context and
+returns the existing typed Addon rows, correcting the unused string-array
+placeholder. Arbitrary daemon callbacks and caller-chosen executables, paths,
+permissions or policy remain forbidden. External module publication/validation is
+still A4 and must freeze its accepted subset separately.
+
+Claude's channel is native-hook-driven: delivery insertion remains idle until an
+authenticated native-start observation. Its conformance case asserts that behavior;
+transport adapters retain the synchronous-busy requirement. Unsupported native
+quota or process ownership is an explicit applicability result, never synthetic
+success. Every applicable P4 behavior is exercised with the real adapter and fake
+transport, without changing existing assertions or claiming live-account evidence.
+
+The P4 late-result probe exposed an existing Codex watchdog defect on the unchanged
+54e631d8 adapter: a completed agent message could refill the answer after watchdog
+invalidation, then its stale turn completion could broadcast it without its former
+audience. A2 repairs this intended generation fence in source. It discards answer
+notifications without an active turn and notifications naming an inactive turn,
+retains the legacy unknown-turn compatibility path, and clears expired deltas.
+The new probe keeps its strict no-message/needs-review assertions. Supported native
+RPC behavior, approvals, quota classification and existing tests stay unchanged.
+
+The watchdog fence also covers acceptance before a queued `turn/started` report
+and unanswered hub `turn/start` RPCs. Cancelled named ids remain retired until their
+exact completion or session teardown; late acknowledgements cannot restore a
+cancelled audience or relabel uncertainty as `failed_safe`. Ordinary legacy
+unknown-id starts keep their fallback. After an invalidation with no provable
+native identity, unnamed lifecycle reports cannot be safely attributed: keep the
+peer offline and require a verified reattachment rather than guess a new turn.
+
+### A2 daemon semantic projections (2026-10-18)
+
+The daemon constructs every native driver through `start.create` and the fixed,
+transport-typed `DAEMON_PORTS` wrappers. Protocol lifecycle dispatch may select the
+actual engine; provider policy does not select an unrelated capability as an alias
+for a kind. Existing host callbacks retain their original effect authority,
+privacy, owner checks, ordering and timing.
+
+The internal definitions additionally carry the existing start-only enable-switch
+membership rule, exclusive-start refusal, tool-refresh requirement, explicit
+headless-mode argument, attached-worker reconfiguration rule, dashboard start
+command and pure ACP argv builder. Attach metadata serializes recovery launch
+identity and carries the existing pull-only admission and status guidance.
+Permission status text is separate from the existing permission refusal text;
+`permission.trackUnattended` keeps native unattended ownership accounting distinct
+from protocol dispatch.
+Budget metadata names the soft-token reset on resume. Session metadata declares
+native conversation revert support; the host still checks the actual driver and
+latest turn and owns the pause while reverting. CLI metadata formats retained
+terminal and roster-return notices and supplies the existing preview argument
+tail. These fields only move native policy, preserving existing output bytes and
+behavior. The version hook consumes the already frozen `observedVersion` and peer
+fields; the daemon retains the bounded native transcript probe.
+
+The doctor command consumes fixed built-in metadata and pure observed-value
+projections exported through the registry. Native tool order, plugin probe argv,
+optional roster checks, section/severity, recovery identity fields and legacy
+capture labels stay in the built-in implementation. The CLI retains every spawn,
+source-verification, connection, gateway and memory effect in its existing order
+and privacy boundary. This private data adds no public definition member,
+executable callback or configurable probe; unknown names retain their existing
+Hub/unknown classification.
+
+A2 reanchors thirteen seeded mutants to the same moved semantic guards: explicit Pi
+roster precedence, supported roster keys, retained-terminal result text, Kimi TUI
+recovery refusal and admission cleanup, Qwen opt-in/session/crash resume, planning
+reservation support, active Kimi TUI settings floor, live headless Kimi watch,
+disabled Codex plugins and bounded
+regular-file tooling reads. Seed ids and test targets remain unchanged; the other
+406 seed objects remain byte-identical. The mutation pairs must still demonstrate
+green production behavior and failure with that guard removed.
+
+The final A2 AST inventory is empty for core policy: zero sites and zero lexical
+groups. The reviewed policy baseline is explicitly `[]`; it is never generated
+from source during tests. Three cross-release literal probes remain separate
+(`KNOWN_PEERS` five, `OPTIONAL_PEERS` two, `START_MODE_PEERS` three). Precise
+screening-provider/lifecycle enum false positives remain scoped by file, symbol
+and AST shape; negative fixtures still catch vendor comparisons in those scopes.
+
+Quota participation and execution-budget instrumentation are independent.
+`budget.quotaExempt` preserves native quota exemption while retaining `account`
+and instrumented execution limits: local sets it, Pi does not. Registered kinds
+without budget metadata remain quota-exempt; external ids retain manual quota
+accounting. The A1 named compatibility metadata export preserves its original
+wrapper plans and observable shape, while the registry consumes separate native
+runtime definitions. Native display constants retain reference identity; private
+stream tone selection does not add fields to that observable display object.
+
+Configurable start-mode fallback reads the registered definition's default form,
+retaining explicit overrides and existing unknown-id behavior. The Kimi default
+mutant changes that native metadata from TUI to headless, so the original default
+assertion observes it directly; it does not remove a settings row or mutate the
+retained cross-release source literal.
+
+A2 preserves the recovery tests' assertion contract while reconnecting their
+execution harnesses to production code. The Pi CLI parser harness imports its
+extracted pure parser rather than extracting a removed main.ts declaration.
+The reattach parser VM receives the real registry resolver, and the attachment
+wait VM receives the real exported session-field resolver. Every existing
+`expect` line in these three files remains byte-identical; no fallback, mock
+policy, weaker condition or changed expected result is introduced.
+
+### A2 round-1 parity and capability-scope constraints
+
+Quota handoff uses the registry's native platform projection, preserving exactly
+Claude, Codex, Kimi, Qwen and Jcode. The per-delivery `recallInjected` flag remains
+independent: adding Kimi/Jcode handoff platforms does not make their own sessions
+part of injected-platform exclusion.
+
+Routing reads on-prem trust for PII admission. Legacy fixed-model/relay policy,
+local-allowed refusal text, context handling, preference tier, relay ordering and
+trace labels are native definition data. Host routing and task flow retain their
+existing policy calculations, messages and candidate ordering (including class
+fallback duplicates). This native routing data is not an external configuration
+surface.
+
+Registry loading calls `assertNativeCapabilityScope` before publication. A
+non-builtin definition cannot declare `start.acpCommand`, `attach.admission`,
+`budget.resetSoftTokensOnResume`, `session.crashIdentity`, a `pi-rpc` daemon port,
+or the native `routing` policy block. Fixed builtin membership is object identity,
+not a caller-supplied kind name. Current consumers combine these fields with fixed-builtin assumptions or
+host-global native state; generic shapes are follow-up work before A3/A4 loading. Other ordinary ACP
+metadata remains valid.
+
+The Qwen conductor refusal uses the original generic CLI text. Pi terminal
+observation reads only observed top-level/nested session-file metadata, never
+launch `args.sessionFile`. Pi TUI recovery bindings preserve the captured
+`CLAUDE_CONFIG_DIR` fallback while retaining Codex's `CODEX_HOME` selection.
+
+The guard resolves immutable peer-id constant aliases and supplied-source
+import/reexport bindings through lexical symbols before classifying comparisons.
+Shadowed and unrelated bindings remain independent; named non-peer enum exceptions
+keep their exact scope. It performs no filesystem or package lookup.

package/docs/specs/2026-09-20-upgrade-recovery-design.md

@@ -849,3 +849,23 @@ Recovery authorization and the presentation parser share the pure
 skipping the accepted one-shot presentation flags (`--json`, `--verbose`, `--color=<mode>`). Such flags never hide
 person-only reattachment from agent or live-test refusal checks; normalization
 confers no authority and unknown flags still fail the command parser.
+
+
+## Recovery-held hub publication amendment (#478)
+
+2026-10-18: Keep exact carried-queue integrity equality. Every checked prepare renewal carries the verified target features stored on the operation. Ordinary post-commit observational inspection stays free of pre-commit compatibility checks.
+
+Only an authenticated recovery operation with verified target support opts into hub deferral; a bare bus delivery fence retains its existing queue admission and does not confer daemon operation authority. The bus accepts hub-originated, deliverable notices during recovery into optional `BusSnapshot.deferredHub`, persisted by the existing private delivery journal and restart snapshot. These originals are outside delivery queues and their integrity projection. The accepted audience and envelope metadata, including private marking, are captured without new text-writing paths. FYI and hop-dropped publications keep their existing record-only behavior. Withdrawal and role/feed revocation also cover deferred originals. Backlog retention counts them as accepted work.
+
+A target advertises `recovery_deferred_hub` beside `task_cancel`. Before a commit to a target without that verified feature, the source materializes deferred originals into normal queues; expected integrity therefore verifies those rows normally. No old target is asked to preserve a field it cannot read.
+
+Deferred restore validation refuses malformed, non-hub, duplicate or already-accepted ids with a typed recovery error. The FIFO is capped at 2048 originals; overflow refuses admission without dropping accepted work or releasing the hold. Each release transfers an original through normal publication and checkpoints its removal from the deferred FIFO together with its queued/seen state before delivery is allowed. A crash resumes from the journal, preserving id dedupe. Failed checkpoints leave the original pending and recovery held. A retry of an already archived release still completes the bus release; a later ordinary startup also completes durable pending publication. Abort and lease expiry retain their recovery ownership until pending publication can be checkpointed.
+
+When no typed presentation cause exists, the human blocked screen shows only the existing sanitized first recorded error line, with controls removed and a 512-code-point cap. The action is uniform: resolve the recorded error, then resume or choose an offered action. Feature compatibility is a conditional option only, never classified from an error substring. JSON and piped rendering are unchanged.
+
+
+### Deferred-notice edge paths (#478 review amendment)
+
+An expired source lease retries a failed release checkpoint on a short timer; a vanished coordinator is not required to unstick the hold once storage recovers. Reset previews count deferred recipients as pending delivery ids, and stopped-runtime reset atomically records their discard audit and removes the originals without publication. Deferred records require their captured recipient array. Flush rollback restores only publication-owned state (affected queue arrays in place, deferred and seen ids, withdrawal bookkeeping and pending outcomes); it never reloads a live bus snapshot or changes its recovery mode, prefaces or independent pauses. Advisory nudges, like publication events, run after the checkpoint.
+
+A corrupt deferred field still refuses daemon restore. Coordinator inspection catches only the typed deferred-corruption error, keeps independently verified stopped evidence, reports an unknown snapshot binding with a static blocker, and leaves person abort/stop-and-archive exits available. It never claims that the corrupt snapshot can be resumed, repairs it or exposes rejected content.

package/docs/verification/2026-10-18-0.12.33.md

@@ -0,0 +1,42 @@
+# 0.12.33 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or native/live acceptance.
+
+## Candidate
+
+Version 0.12.33, control protocol 16 (`src/hub/control-client.ts`), from merged main `fe53b272db455fd5b95b4a504e806a0a0625a26c`. The candidate includes the one PR merged since `v0.12.32`: #479 (issue #478). The exact first-party memory pin remains `@staix/agent-mem` 0.3.1.
+
+- The upgrade runs with the target release's own coordinator (`bunx --package @staix/agent-hub@0.12.33 ahub upgrade`). An upgrade from 0.12.32 into 0.12.33 therefore already uses the fixed lease renewal and the deferred hub notices.
+- #479 adds the target feature `recovery_deferred_hub` beside `task_cancel`. A target without it gets deferred notices in its ordinary queues before commit, so mixed-version upgrades keep exact queue verification.
+- Still open: a real upgrade with a managed TUI and cancelled rows (#478), a real Orca upgrade exercising `ahub recovery reattach` (#463), the native real-terminal console settings leg (#439 AC5), installed managed-Pi #418 AC8 (#142) and #438 AC7.
+
+## Document review
+
+`node scripts/check-docs.mjs --require-fresh` reported 10 stale documents, all made stale by #479; editing `daemon.md` made an 11th, `docs/agent-notes/README.md`. Each was compared against the #479 source diff (`cf3026fe..fe53b272`). The limits and messages cited were checked in the source: `MAX_DEFERRED_HUB` is 2048 (`src/hub/deferred-hub.ts`), the blocked-screen cap is 512 code points and the label is `typed cause unknown` (`src/cli/upgrade-presentation.ts`), and the snapshot blocker message comes from `src/cli/upgrade-runtime.ts`. Version references were moved to 0.12.33 in the same pass. No document review is deferred.
+
+| Document | Prior source stamp | Review result | Checked claims and correction |
+| --- | --- | --- | --- |
+| `README.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | Status 0.12.33; Jcode entry unchanged; the verification link and the open #478 live leg. `task_cancel` text still holds. |
+| `docs/quickstart.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | `v0.12.33` install example and the upgrade section for the #478 fixes; reattach and resume text unchanged. |
+| `docs/security.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | Blocked-screen recorded error passes the terminal sanitizer, controls stripped, capped; a corrupt snapshot is reported with a fixed message only. |
+| `docs/operations.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | 0.12.33 header and upgrade examples; deferred hub notices during recovery and the downgrade path; the lease-expiry retry; the corrupt-snapshot blocker; the blocked-screen fallback; runtime reset discards deferred notices; features sent on lease renewal. |
+| `docs/agent-notes/README.md` | `cf3026feab218207f0c21b300552eada0d5be227` | unchanged | Stale only because this pass edited `daemon.md`; the console exact-row navigation rule it explains is unchanged. |
+| `docs/agent-notes/adapters.md` | `cf3026feab218207f0c21b300552eada0d5be227` | unchanged | #479 touched only recovery and bus wiring in `daemon.ts`; no adapter, spawn or approval rule changed. |
+| `docs/agent-notes/budget.md` | `cf3026feab218207f0c21b300552eada0d5be227` | unchanged | Pause persistence and resume-notice order unchanged; "publish, then withdraw" holds, and withdraw now also covers deferred notices. |
+| `docs/agent-notes/bus.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | Deferred notices stay outside queues and the integrity view, every pending-work read includes them, the cap refuses rather than drops; release checkpoints each move and a failed checkpoint restores only publication state. |
+| `docs/agent-notes/daemon.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | Every prepare sends stored `targetFeatures`; when hub notices are deferred and the lease-expiry retry; `inspectRecovery` catches only `RecoveryDeferredHubError`; the `renderBlocked` fallback rule. |
+| `docs/agent-notes/tasks.md` | `cf3026feab218207f0c21b300552eada0d5be227` | corrected | Role withdrawal finds unread requests through `bus.pendingEnvelopes`, which includes deferred notices. |
+| `docs/agent-notes/tests.md` | `cf3026feab218207f0c21b300552eada0d5be227` | unchanged | The new tests follow the existing rules; `scripts/check.sh`, seeds and CI are unchanged. |
+
+`AGENTS.md` area notes and `docs/verified.json` paths now include `src/hub/deferred-hub.ts` (bus and daemon) and `src/cli/reset.ts` (bus), the modules the new bus and daemon rules describe. A separate manifest commit restamps the reviewed documents against the reviewed source; it does not stamp itself. The release PR must use a merge commit, and committed freshness is rerun on main before tagging.
+
+## Recorded checks
+
+| PR | Final head | CI run |
+| --- | --- | --- |
+| [#479](https://github.com/STAIxBWLB/agent-hub/pull/479) | `e832901d10ab263e3887426534a6aebd3e8612ef` | [39085109057](https://github.com/STAIxBWLB/agent-hub/actions/runs/39085109057) |
+
+Both OS check jobs, all four seeded shards and the `seeded guards` aggregate succeeded. The PR passed two OCR delegation review rounds by a Claude subagent: 21 of 21 files were accounted for, and the round-1 findings were fixed and verified at the final head. These prior PR gates do not replace the release candidate's own exact-head CI.
+
+- Generated assets: `bun install --frozen-lockfile` and `bun run build` ran locally at `894350fa`. The only change to `plugins/agent-hub/server.js` and the plugin manifest is the version string 0.12.32 -> 0.12.33; the release PR's CI checks bundle freshness.
+- The release PR's own exact-head CI and the release workflow's tag checks are recorded on the PR and the tag, not here.

package/docs/verification/2026-10-18-0.12.34.md

@@ -0,0 +1,48 @@
+# 0.12.34 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or native/live acceptance.
+
+## Candidate
+
+Version 0.12.34, control protocol 16 (`src/hub/control-client.ts`), from merged main `f1c4140032d81f4840941a91137e9ab593349d9f`. The candidate includes the three PRs merged since `v0.12.33`: #487 (#451 A2), #491 (#488) and #492 (#485 S0). The exact first-party memory pin remains `@staix/agent-mem` 0.3.1.
+
+- #451 A2 moves built-in native policy behind the adapter registry. Native behaviour is unchanged except the disclosed Codex watchdog fence: late results of a cancelled turn are dropped, and a cancellation without a verified native id takes Codex offline until reattach. The round-2 delta reviews (task #132 review note) diffed base and head probe output (permission, start, roster, palette, crash plans, launch env, previews, `routing.assign` over 3,840 inputs) and found no other difference. The registry guard baseline is `[]`.
+- #488 replaces the fixed two-rejection escalation with `tasks.escalate_after` (default 3, live). Upgrading changes the default behaviour; `docs/quickstart.md` says how to keep two.
+- #485 S0 protects `.agent`, `_agents`, `_agent`, `.gemini` and `.grok` like other agent configuration directories. Scoped grants under them now ask.
+- Still open: live native clients, installed managed-Pi #418 AC8 (#142) and #438 AC7.
+
+## Document review
+
+`node scripts/check-docs.mjs --require-fresh` reported 14 stale documents. Each was compared with its covered source changes from its stamp to the candidate by two read-only reviews, one for the user documents and one for the agent notes. Symbols, paths and limits were checked in the source. No document review is deferred.
+
+| Document | Review result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.12.34; the Jcode MCP entry is byte-identical (moved into a definition); the verification link and open legs. |
+| `docs/quickstart.md` | corrected | `v0.12.34` install; the upgrade section for the escalation default (#488) and the new protected directories (#485). |
+| `docs/operations.md` | corrected | 0.12.34 header, protocol 16 range and upgrade examples; escalation via `tasks.escalate_after`; the Claude ask-when-needed protected list; the Codex watchdog fence and offline latch. |
+| `docs/security.md` | corrected | The protected agent configuration list and the #485 directories with their look-alike rule. |
+| `docs/agent-notes/README.md` | unchanged | Background only; the console tone lookup change touches no rule. |
+| `docs/agent-notes/adapters.md` | corrected | `session.zeroTurn` replaces `codexZeroTurn`; registry lists and cross-release literals; the empty guard baseline and alias resolution; native capability scope. Paths now include the registry guard test and baseline. |
+| `docs/agent-notes/benchmarks.md` | unchanged | The Pi command now comes from its definition with the same value. |
+| `docs/agent-notes/budget.md` | corrected | Context readers in `native-context.ts`; checkpoint requests keyed on `budget.checkpoint`; `QUOTA_HANDOFF_PLATFORMS`; quota exemption rules. Scope and paths include the moved readers and the registry. |
+| `docs/agent-notes/bus.md` | unchanged | Bus, journal and deferred-hub sources are unchanged; daemon changes swap peer names for definition fields only. |
+| `docs/agent-notes/daemon.md` | corrected | The registry's `KNOWN_PEERS`; the recovery literal probes; scope and paths include the moved recovery, policy, config and CLI definition modules. |
+| `docs/agent-notes/local-worker.md` | unchanged | `grantablePath` and grant rules hold with the larger protected set. |
+| `docs/agent-notes/models.md` | unchanged | Tool classification now reads `hooks.classifyTool` with the same result. |
+| `docs/agent-notes/tasks.md` | corrected | The PII gate by `trust.onPrem`; `escalateAfter()` read per verdict. Paths include `builtin-metadata.ts` and `src/hub/bus.ts` (`pendingEnvelopes`, backlog #193). |
+| `docs/agent-notes/tests.md` | corrected | Guard failures move policy into a definition, and the baseline stays `[]`; conformance records unsupported cases explicitly. |
+
+`AGENTS.md` area notes list the new definition modules for Budget and Daemon and recovery. A separate manifest commit restamps the reviewed documents against the reviewed source; it does not stamp itself. The release PR must use a merge commit, and committed freshness is rerun on main before tagging.
+
+## Recorded checks
+
+| PR | Final head | CI run |
+| --- | --- | --- |
+| [#487](https://github.com/STAIxBWLB/agent-hub/pull/487) | `60e7f61fd9d6f3f0b15fe94d2baf69e32a504f97` | [39100633474](https://github.com/STAIxBWLB/agent-hub/actions/runs/39100633474) |
+| [#491](https://github.com/STAIxBWLB/agent-hub/pull/491) | `4af794fadfb00d3357c9e3e8011513bff4669f8e` | [39103534833](https://github.com/STAIxBWLB/agent-hub/actions/runs/39103534833) |
+| [#492](https://github.com/STAIxBWLB/agent-hub/pull/492) | `5895e3aa88a9b7f9f395680cb3818ba2ec942901` | [39105301256](https://github.com/STAIxBWLB/agent-hub/actions/runs/39105301256) |
+
+Each PR passed an OCR delegation review by Claude subagents at its final head, and its exact-head CI passed on both OSes with all four seeded shards. #491's macOS job hit the known 20 s `checks.test.ts` flake once; only that job was re-run, and it passed. These prior PR gates do not replace the release candidate's own exact-head CI.
+
+- Generated assets: `bun install --frozen-lockfile` and `bun run build` ran locally at `74899a40`. The only change to `plugins/agent-hub/server.js` and the plugin manifest is the version string 0.12.33 -> 0.12.34; the release PR's CI checks bundle freshness.
+- The release PR's own exact-head CI and the release workflow's tag checks are recorded on the PR and the tag, not here.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "c1c3bf1d5494f21847ae846e3ed030166ee20484",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "c1c3bf1d5494f21847ae846e3ed030166ee20484",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -58,11 +58,13 @@
         "src/cli/identity.ts",
         "src/local/tools.ts",
         "src/hub/start-mode.ts",
-        "src/hub/terminal-open.ts"
+        "src/hub/terminal-open.ts",
+        "test/registry-guard.test.ts",
+        "test/registry-guard.baseline.json"
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -74,7 +76,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -82,28 +84,34 @@
         "src/hub/delivery-journal.ts",
         "src/hub/restart.ts",
         "src/hub/context-window.ts",
-        "src/hub/daemon.ts"
+        "src/hub/daemon.ts",
+        "src/adapters/definitions/native-quota.ts",
+        "src/adapters/definitions/native-context.ts",
+        "src/adapters/registry.ts"
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
         "src/hub/limits.ts",
         "src/hub/delivery-journal.ts",
+        "src/hub/deferred-hub.ts",
         "src/hub/inference.ts",
         "src/hub/daemon.ts",
-        "src/hub/supervision.ts"
+        "src/hub/supervision.ts",
+        "src/cli/reset.ts"
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
         "src/adapters/claude-channel.ts",
         "src/hub/restart.ts",
+        "src/hub/deferred-hub.ts",
         "src/hub/recovery-store.ts",
         "src/hub/snapshots.ts",
         "src/hub/manager.ts",
@@ -135,11 +143,15 @@
         "src/hub/config-reload.ts",
         "src/hub/config-apply.ts",
         "src/hub/recovery-continuity.ts",
-        "src/cli/recovery-presentation-options.ts"
+        "src/cli/recovery-presentation-options.ts",
+        "src/adapters/definitions/native-recovery*.ts",
+        "src/adapters/definitions/native-policy-aux.ts",
+        "src/adapters/definitions/native-config-*.ts",
+        "src/adapters/definitions/native-cli-*.ts"
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
@@ -150,7 +162,7 @@
       ]
     },
     "docs/agent-notes/models.md": {
-      "verifiedAgainst": "6dcc7fe00c38f13613bcf53524fa3d1527a708e5",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "src/models/",
         "src/hub/inference.ts",
@@ -159,7 +171,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "c1c3bf1d5494f21847ae846e3ed030166ee20484",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -173,11 +185,13 @@
         "src/hub/supervision.ts",
         "src/hub/tool-refusal.ts",
         "src/hub/daemon.ts",
-        "src/hub/settled-roles.ts"
+        "src/hub/settled-roles.ts",
+        "src/adapters/definitions/builtin-metadata.ts",
+        "src/hub/bus.ts"
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -196,7 +210,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "cf3026feab218207f0c21b300552eada0d5be227",
+      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.32",
+  "version": "0.12.34",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.32",
+  "version": "0.12.34",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",