@staix/agent-hub 0.12.34 → 0.12.35

package/docs/security.md

@@ -7,7 +7,7 @@ agent-hub connects agents that can each run commands. This page says what the hu
 - **Other agents' text is untrusted.** Every message that crosses from one peer to another is framed as untrusted input: a channel tag with `meta.source` for Claude started with `ahub claude`; otherwise a fixed header line (`frame()`, `[agent-hub message from ...]`) with an instruction that says it is untrusted, the plugin's server instructions for a tools-only Claude reading `hub_inbox` and a standing instruction for the others. A message body cannot forge the hub's own headers: such lines are quoted (`sanitize`). Replies inherit a hop count capped at 3, so agents cannot ping-pong forever; neither a digest nor a steer can reset it.
 - **The control link is loopback plus a secret.** The daemon and the Codex proxy bind 127.0.0.1 only. The control WebSocket requires a per-run token (`.agenthub/state/control-token`, mode 600), and both servers refuse any request that carries an `Origin` header: any web page can open a WebSocket to localhost, and browsers always send `Origin`. External clients cannot claim the console user's id or a hub-managed peer's id.
 - **Permission prompts stay on unless an operator selects a permission mode.** `ask` leaves native decisions unchanged. `ask-when-needed` grants scoped Claude file tools or Pi/local writes and edits; Kimi and Codex use their own native policies. `never-ask` requires explicit runtime confirmation or a person's console `y` for a config default at hub start. Until that config confirmation the peer runs in `ask`. Kimi's and `local`'s permission requests are relayed to the console and cancelled after `approvals.timeout_s` (default 120 s) of silence; the macOS notification for a waiting request carries the peer and the tool name only. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They invoke hub-owned operations rather than arbitrary file or shell tools, and every call passes the hub's own checks. Identity comes from the exact permission title, or from the earlier tool-call title bound to the same call id and resolved against the configured MCP servers when the permission title contains argument JSON (Qwen). Payload text and unrelated display titles never establish identity. For ACP agents, a payload longer than the console shows is marked as cut and never offers a session-wide grant. Pi's write, edit, shell and git write requests are relayed the same way and can be answered `Always allow <tool> until Pi restarts`: later calls of that tool by the same Pi start skip the prompt but stay inside the path guard and sandbox. The grant covers every later call of that tool whatever its payload, is kept in memory only, cannot be given from the dashboard, and each call it allows is logged by tool name. A Pi or `local` request whose call was cancelled or whose turn ended is withdrawn at once: a later answer is refused and grants nothing, an `Always allow` included. One shell command runs without a hub approval: the `!command` a person types in the managed Pi TUI. It stays inside the same sandbox and denylist, and the hub takes it only from the verified owner process of a Pi in TUI mode, while Pi is idle, on a reservation that is used once; a model's own bash call never takes that path (issue #253). `--unattended` turns prompts off, says so loudly, and is never the default.
-- **A committed config cannot choose launch commands, credential files, data endpoints, permission modes or a wider sandbox.** The machine-local fields (`kimi_cmd`, `permission_modes`, `codex_bin`, `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`, `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`, `local.read_allow`, `local.bash_network`, `local.network_allow`, `terminal.open`) apply only from a config file git confirms nobody committed: `.agenthub/config.json` or `.agenthub/config.local.json`, matched by file identity so no other spelling the file system accepts slips past, and `.agenthub` itself not a committed symlink or submodule. Without a repository, or when git fails, they keep their defaults; an empty value always means the default. "Untracked" is answered by the repository that contains the project: a checkout copied or extracted into an unrelated repository, or into an ignored directory of one, is trusted like your own files. So a cloned repository cannot choose a launch command, a completion check, a gateway to send a key file to, a memory endpoint, a permission mode, the command that opens a terminal, or a wider sandbox. A command in `checks` runs as you, outside the local worker's sandbox, like a git hook. So do the `setup` and `verify` commands of a benchmark suite (issue #251): `ahub bench run <suite.json>` is a person's command, refused from an agent session, and it resets the work tree for each attempt, so it runs only with `bench.enabled`, at the root of a clean repository that tracks nothing under `.agenthub/`. Nothing in `routing.toml` or in task text is ever run. `routing.toml` and the other shared fields still come from the checkout, and they matter: `routing.toml` picks the models the local worker and the hub's inference use at your gateway and can turn the PII constraint off, and roles and budget shape who does what. Review them in a repository you do not trust. The hub's own git calls outside the sandbox (snapshots, facts, config trust, project discovery, memory recall, the bench runner) all use the single hardened implementation in the exact-pinned first-party `@staix/agent-mem/platform` package, re-exported by `src/hub/git.ts`, which disables the programs a repository's configuration can name — the file-system monitor, hooks, external diff, the pager, and the credential and askpass helpers, with prompts failing closed — so a config that ever does get written cannot run code with the hub's rights. Of those, the monitor, hooks and external diff are reachable by commands the hub issues (the planted-program test exercises all three; a `diff --no-index` reads the repo's config, so that call also passes `--no-ext-diff` and `--no-textconv`); the pager is not (every call pipes stdout). Credential and askpass helpers are disabled for project repositories; memory sync alone may use credentials for its own memory repository, without prompts. The cost: `core.fsmonitor=false` also turns off a person's enabled built-in monitor for the hub's own calls, so the per-turn snapshot's `add -A` scans the whole tree (the snapshot has a 10 s cap). git has no global switch for filter drivers, and of the hub's commands only the snapshot's `add`/`restore` would run one (its driver command lives in the protected `.git/config`).
+- **A committed config cannot choose launch commands, credential files, data endpoints, permission modes or a wider sandbox.** The machine-local fields (`kimi_cmd`, `permission_modes`, `codex_bin`, `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`, `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`, `local.read_allow`, `local.bash_network`, `local.network_allow`, `terminal.open`, `instances`) apply only from a config file git confirms nobody committed (`instances` is read only from an untracked `.agenthub/config.local.json`; in `config.json` it is ignored even when untracked): `.agenthub/config.json` or `.agenthub/config.local.json`, matched by file identity so no other spelling the file system accepts slips past, and `.agenthub` itself not a committed symlink or submodule. Without a repository, or when git fails, they keep their defaults; an empty value always means the default. "Untracked" is answered by the repository that contains the project: a checkout copied or extracted into an unrelated repository, or into an ignored directory of one, is trusted like your own files. So a cloned repository cannot choose a launch command, a completion check, a gateway to send a key file to, a memory endpoint, a permission mode, the command that opens a terminal, or a wider sandbox. A command in `checks` runs as you, outside the local worker's sandbox, like a git hook. So do the `setup` and `verify` commands of a benchmark suite (issue #251): `ahub bench run <suite.json>` is a person's command, refused from an agent session, and it resets the work tree for each attempt, so it runs only with `bench.enabled`, at the root of a clean repository that tracks nothing under `.agenthub/`. Nothing in `routing.toml` or in task text is ever run. `routing.toml` and the other shared fields still come from the checkout, and they matter: `routing.toml` picks the models the local worker and the hub's inference use at your gateway and can turn the PII constraint off, and roles and budget shape who does what. Review them in a repository you do not trust. The hub's own git calls outside the sandbox (snapshots, facts, config trust, project discovery, memory recall, the bench runner) all use the single hardened implementation in the exact-pinned first-party `@staix/agent-mem/platform` package, re-exported by `src/hub/git.ts`, which disables the programs a repository's configuration can name — the file-system monitor, hooks, external diff, the pager, and the credential and askpass helpers, with prompts failing closed — so a config that ever does get written cannot run code with the hub's rights. Of those, the monitor, hooks and external diff are reachable by commands the hub issues (the planted-program test exercises all three; a `diff --no-index` reads the repo's config, so that call also passes `--no-ext-diff` and `--no-textconv`); the pager is not (every call pipes stdout). Credential and askpass helpers are disabled for project repositories; memory sync alone may use credentials for its own memory repository, without prompts. The cost: `core.fsmonitor=false` also turns off a person's enabled built-in monitor for the hub's own calls, so the per-turn snapshot's `add -A` scans the whole tree (the snapshot has a 10 s cap). git has no global switch for filter drivers, and of the hub's commands only the snapshot's `add`/`restore` would run one (its driver command lives in the protected `.git/config`).
 - **Telemetry holds no bodies.** `.agenthub/state/events.jsonl` (issue #40) records envelope ids, routing and sizes, task ids and states, overlapping paths and token counts, and the task id (with a PII flag) that each usage and token record is attributed to. It never records a message body, a task title or detail, and marks private (PII) envelopes and tasks as such. It stays on the machine; `ahub export` only prints it. Two opt-in stores copy numbers from it into your home directory, shared by every project on the machine (directories mode 700, files 600): research records (issue #247, `research.enabled`) in `~/.agenthub/research/` hold per approved task the ids, states, counts, tokens, times and PII flag the events hold, a person's label from a closed list, and a hash in place of the project id; benchmark runs (issue #251) in `~/.agenthub/bench/` hold suite name and hash, arm label, the attached peers' ids, models and permission modes, task ids, outcomes, exit codes, counts, tokens and times, never suite text or a command's output.
 - **Snapshots stay in your repository.** Per-turn snapshots (issue #33) are git objects in the project's own object store, written through a temporary index; nothing is referenced, pushed or copied elsewhere, and `git gc` prunes them. They hold what the work tree held, including untracked files that are not ignored, so keep secrets in ignored files. They carry the repository's own permissions, and nothing caps their disk use but `git gc`. A turn of a peer holding an open PII task is not snapshotted; a PII file left in the project is snapshotted by later turns like any other file. `ahub undo` restores only files whose current content is exactly what the turn left.
 - **The edit hook reads, never decides.** `ahub check-path --hook` (issue #32) reads hub.db and returns context for Claude and a line for you; it sets no permission decision, so your permission rules stay in charge. It names other owners' task ids, titles and states, which then reach Claude's model; PII tasks are left out.
@@ -163,13 +163,13 @@ Please report vulnerabilities privately through GitHub's "Report a vulnerability
 
 ## Dashboard settings and the settings session (issue #269)
 
-- Settings are a closed registry (`src/hub/settings.ts`). The dashboard and `ahub settings` can write only its keys, each checked against its own closed values, and only to `.agenthub/config.local.json` and `.agenthub/routing.local.toml`. A file git tracks is never written, so the shared `config.json` and `routing.toml` stay byte-identical; in a repository where git cannot answer, nothing is written either. Commands and binaries (`kimi_cmd`, `codex_bin`, `pi.cmd`, `checks`, `mlx`), credential files and gateway URLs (`omniroute`, `memory.worker_url`), the local worker's reach (`local.read_allow`, `local.bash_network`, `local.network_allow`), `bench.enabled` and `terminal` are refused by name from every surface: they choose what the hub runs or where secrets and task text go.
+- Settings are a closed registry (`src/hub/settings.ts`). The dashboard and `ahub settings` can write only its keys, each checked against its own closed values, and only to `.agenthub/config.local.json` and `.agenthub/routing.local.toml`. A file git tracks is never written, so the shared `config.json` and `routing.toml` stay byte-identical; in a repository where git cannot answer, nothing is written either. Commands and binaries (`kimi_cmd`, `codex_bin`, `pi.cmd`, `checks`, `mlx`), credential files and gateway URLs (`omniroute`, `memory.worker_url`), the local worker's reach (`local.read_allow`, `local.bash_network`, `local.network_allow`), `bench.enabled`, `terminal` and `instances` are refused by name from every surface: they choose what the hub runs or where secrets and task text go.
 - `routing.local.toml` holds `stay_switch` and, per class, `peers`, `escalate_to`, `route` (an id `routing.toml` defines) and `pi_backend`, and nothing else: targets, routes, signals and the PII constraint cannot be set through it. A write is read by the hub's own loader before it replaces the file (temp file and rename), and one previous version is kept for undo.
 - An ordinary dashboard session (`ahub ui`) reads settings, lowers a mode to `ask`, turns `pi.auto_start`, `task_sweep.enabled` or `task_sweep.auto_reassign` off, sets a start mode back to `tui` or a WIP limit to 0, and changes the safe switches (`research.enabled`, `approvals.notify`, `snapshots.enabled`, `coordination`). Whatever can widen what agents do without asking needs a settings session: a non-ask mode now or at hub start, routing, starting Pi with the hub, removing a machine-local value, and undo. `ahub ui --settings` opens one: its ticket marks the session for 15 minutes, after which it is an ordinary session. `never-ask` also needs the peer's id typed as the confirmation, and a stored never-ask default still waits for the console's `y` at each hub start. An undo never puts never-ask back, and removing a machine-local value that uncovers a never-ask in the shared file needs the same confirmation. "Lowering to `ask`" means handing the decision back to the agent's own rules: for Codex that is the approval policy the person configured natively, which the hub does not judge.
 - A settings session is as strong as the console for these settings and no stronger elsewhere. A mode change is the console's own request with the same refusals; tool approvals stay deny-only for Pi and local; there is still no shell, file, task-detail or launch-command API. `ahub ui --settings` and `ahub settings` pass the same identity gate as `ahub permission`, which is an operating policy, not authentication. The hostile-agent boundary above applies unchanged: an agent with an unrestricted shell as the same user can impersonate the console, and so can open a settings session.
 - Every change writes a `settings` event (the key, the value before and after, the source `dashboard` or `terminal`) and a line in `hub.log` and open consoles; opening a settings session is logged too. The unified dashboard (`ahub ui --all`) forwards settings actions as an ordinary session and opens no settings session.
 - Configuration reload (issue #439). The daemon watches `config.json`, `config.local.json`, `routing.toml` and `routing.local.toml` and re-reads the complete candidate after a change, as the dashboard's Reload configuration and `ahub settings reload` do; an invalid candidate applies nothing. Each changed key is then authorized on its own against its file's actual git provenance. A privacy tightening (local-only PII, the model screen on, added PII patterns, narrower roles or capability lists, unless it moves the planner or conductor) and a safe registered setting apply from any file. Every other change, machine-local fields included, keeps its running value when its file is tracked or git cannot answer. From an untracked file such a guarded change is adopted only by `ahub settings reload` in an interactive terminal, after it lists each guarded key with its full before and after values and the person types `y` within 30 seconds; the confirmation is bound to the file contents and accepted state it was shown for. File watches and dashboard reloads, a settings session's included, never confirm, and no reload changes the roster: membership moves only through the roster setting. Keys whose consumers are bound at start (memory, the gateway and MLX, checks, the privacy and sandbox policy of existing sessions, the terminal provider and others) stay pending until a restart.
-- Start modes. A start the hub makes itself (the dashboard's Start control, `peer_start` from a console child, the conductor's `hub_peer_start`, `pi.auto_start`) takes the peer's start mode. Through settings only a settings session or the terminal can set it to headless; a config file can also set `peers.<id>.start_mode`, the shared one included (it is not a machine-local field: headless was the only form for Pi, Kimi and the local worker before this change, a hub-made headless Codex start is the app-server the hub already ran for it, and a start mode grants nothing a permission mode or a capability controls). For a TUI the hub opens a terminal running `<runtime> <its own entry point> --project <this project> <peer>` (and `--mode tui` for Pi): every word is the hub's own, the command line is those words each quoted for a POSIX shell, and no request field, tool argument or agent message is part of it. In a `terminal.open` template `{command}` is that quoted line and `{title}` and `{cwd}` are raw text for argv elements of their own; each placeholder is substituted once, so a project path that itself contains a placeholder, a quote or `$` stays one word. A provider's own error text goes to `hub.log`, not to the caller. The terminal comes from `terminal.open`, a machine-local command template that config trust refuses from a committed file and that no settings surface can write, or from Orca. The opened terminal's environment carries no agent marker, so `ahub` there has the console's identity. Without a provider the start is refused with the command to run by hand; it is never downgraded to headless. A conductor can start a peer but cannot choose its mode.
+- Start modes. A start the hub makes itself (the dashboard's Start control, `peer_start` from a console child, the conductor's `hub_peer_start`, `pi.auto_start`) takes the peer's start mode. Through settings only a settings session or the terminal can set it to headless; a config file can also set `peers.<id>.start_mode`, the shared one included (it is not a machine-local field: headless was the only form for Pi, Kimi and the local worker before this change, a hub-made headless Codex start is the app-server the hub already ran for it, and a start mode grants nothing a permission mode or a capability controls). A declared extra instance accepts only `headless` from any surface. For a TUI the hub opens a terminal running `<runtime> <its own entry point> --project <this project> <peer>` (and `--mode tui` for Pi): every word is the hub's own, the command line is those words each quoted for a POSIX shell, and no request field, tool argument or agent message is part of it. In a `terminal.open` template `{command}` is that quoted line and `{title}` and `{cwd}` are raw text for argv elements of their own; each placeholder is substituted once, so a project path that itself contains a placeholder, a quote or `$` stays one word. A provider's own error text goes to `hub.log`, not to the caller. The terminal comes from `terminal.open`, a machine-local command template that config trust refuses from a committed file and that no settings surface can write, or from Orca. The opened terminal's environment carries no agent marker, so `ahub` there has the console's identity. Without a provider the start is refused with the command to run by hand; it is never downgraded to headless. A conductor can start a peer but cannot choose its mode.
 
 ## Multi-project manager (protocol 7)
 

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1837,7 +1837,8 @@ push `accepted` and show none of them.
   selection excludes pull-only peers; only explicit role-specific naming or an
   honored owner reservation permits assignment.
 - `hub_inbox` sends `inbox`. The daemon answers "not attached yet; retry"
-  between welcome and attach, and refuses it for a session with pushes.
+  between welcome and attach. Since #493 the current channel owner may also
+  explicitly pull its queued work, including while its native turn is busy.
   `Bus.pull` is held by every hold a drain respects (`Bus.held`: recovery, an
   uncertain delivery, a console, budget or conductor pause), though unlike a
   drain it does not wait for the peer to be idle; a held pull journals nothing
@@ -1876,6 +1877,45 @@ push `accepted` and show none of them.
 - Control protocol 16 adds the hello `channel` field and `inbox`. Recovery
   sources add protocol 15 (0.12.17 through 0.12.19); the transition from a real
   0.12.19 hub is not yet proven.
+
+## Amendment: channel queue visibility and explicit pull (issue #493)
+
+- A channel session's `hub_inbox` reads the daemon queue through the same
+  authenticated `peer` socket as a tools-only Claude session. The daemon checks
+  current socket ownership and the shared roster, pause, recovery, lifecycle and
+  uncertain-delivery holds. It does not require an idle native turn. Tools-role
+  sockets cannot consume another transport's queue.
+- `Bus.pull` claims one batch synchronously and completes it with its bus
+  checkpoint in the existing journal transaction. A later idle drain or another
+  concurrent inbox call cannot hand those originals out again. Existing accepted
+  pushes remain independent; a pull does not complete them. The hand-out-before-
+  model-read ceiling documented above remains. Framing, `sanitize`, public PII
+  projections and task-offer read evidence retain their existing paths.
+- The plugin also returns its existing bounded local buffer of failed pushes
+  without journal ids. Journaled failed pushes stay in `needs_review`; the plugin
+  never consumes them from this local buffer. A daemon refusal or an unavailable
+  connection cannot prevent reading that local fallback.
+- `delivery_holds` adds optional same-peer `queued` and `important` counts, with
+  no bodies or caller-selected target. Every agent-hub tool-call result can show
+  fresh counts when important work waits. Channel and tools-mode sessions remain
+  silent when an older daemon supplies no counts. Plain pull-only sessions keep
+  their old advisory nudge compatibility. A current zero clears old nudges;
+  unavailable metadata never changes a saved result or its effect classification.
+  Inbox replies show counts without suggesting a repeated refused read, and a
+  tools-mode hint does not grant an inbox capability to that transport.
+- `[FYI]` remains record-only. PR ready, done or submitted, ruling-needed,
+  blocker and changed-contract/path messages require an unmarked or important
+  update. `hub_task_done` and `hub_review` already notify the assigned audience;
+  an extra chat with the same outcome is unnecessary.
+- Native busy-notification evidence and the decision about channel steering are
+  recorded separately in `docs/verification/2026-10-18-493-claude-busy-channel.md`.
+  Claude Code 2.1.302 / Sonnet 5.5 returned the random notification token before
+  the original interactive turn ended. Push-capable `WsPeer` therefore exposes
+  important-only steer through the existing journal/generation-bound push path;
+  detach and pull-only attach remove that capability. Ordinary messages remain
+  queued while busy. A notification write alone is not proof that the native
+  model saw it; the earlier print-mode probe was inconclusive.
+
 ## Amendment: owner and reviewer read their task (issue #208)
 
 `hub_task_show` stays a conductor tool, and a task's current owner and current
@@ -2398,7 +2438,7 @@ the queue.
 - Tasks owns optional board artifact receipts and every mutation. Repository, issue/PR ids, claimed local result/head and a reviewed full SHA are distinct from fresh external evidence. Only the owner/reviewer/person records; only the reviewer/person binds a review head. Invalid identities, unsupported externally supplied facts and private-turn cloud records are refused before effects.
 - Enforce rechecks the current PR head, successful required checks, local receipt on that head, GitHub review and complete unresolved-thread readback before approval. Missing/unknown data blocks, a new head invalidates derived readiness, and changes requested needs no green CI. Advise exposes gates without additional blocks; off retains existing transitions. Historical board approval is not approval of a new head.
 - CLI sdlc status/explain reads bounded structured metadata, not remote bodies. Shared console/dashboard views expose unknown external evidence and the next actor/action; they cannot certify freshness. No merge/release authority is granted.
-- Custom definitions, full merge/release presentation, gsd-lite and a native advise cycle remain pending; see docs/sdlc.md.
+- Later custom definitions and read-only merge/release reports are described below. #481 supersedes the original lifecycle vocabulary and workflow option; a full native advise cycle remains pending. See docs/sdlc.md.
 ## Amendment: optional Qwen Code 0.25.0 ACP peer (#256)
 
 - `qwen` joins the known catalog with default participation off. Only the project's roster selects it; no second enabled switch or default routing preference is added. Its flow roles default to implementer/verifier, which is guidance, not a claim of native reliability.
@@ -2422,9 +2462,9 @@ the queue.
 - Activity contains delivery ids/senders, message/thought chunks, bounded tool summaries, plans, permission request/outcome ids and turn end. It never enters persistent events/logs, UI, tools or cloud memory. Existing final answers still travel through the answer bus.
 - Kimi TUI defaults remain pull-only. Qwen TUI and native visualizer support remain gated by unverified T0 checks. See [verification](../verification/2026-10-11-acp-watch-t0.md).
 
-# gsd-lite amendment, 2026-10-11 (#257)
+# Historical workflow amendment, 2026-10-11 (#257, superseded by #481)
 
-- Optional workflow none|gsd-lite, none by default, uses existing SDLC receipts and Tasks authority. A reviewer/person-owned checklist stores bounded criterion ids, hashed evidence refs and verified/failed/unverified claims bound to the reviewed head.
+- The original optional workflow selector used existing SDLC receipts and Tasks authority; its current replacement is the #481 amendment below. A reviewer/person-owned checklist stores bounded criterion ids, hashed evidence refs and verified/failed/unverified claims bound to the reviewed head.
 - Existing task/predecessor ids must match current Tasks.after edges; missing/cyclic/private cross-links are refused before effects. Imports do not change task ownership, reservations or dependencies.
 - Required unknown/failed criteria and stale heads keep readiness false. Advise remains nonblocking; enforce adds these only to existing approval gates. Route explain, console/dashboard lifecycle views and read-only hashed exports derive the same board/config state. No second writable workflow store, automatic advance, permissions, merge/release or study execution.
 
@@ -2508,12 +2548,12 @@ pii.paths and data.readonly accept exact paths/subtrees and *, ? and whole-segme
 
 ## Amendment: custom lifecycle data (#257)
 
-Optional ordered stage definitions map at most 32 bounded ids to the existing seven semantic bases, existing actor guidance and closed issue/pr/local/review/checks/phase entry/exit gates. Explicit after edges name at most eight earlier configured ids; missing/self/forward/cyclic references refuse. Review and merge base destinations are required by existing Tasks completion transitions. Built-in names cannot change base. Existing holder/person authority and the full approval floor remain; enforce additionally checks an explicit custom stage-change actor without granting a new caller authority. Off/advise preserve claim behavior. Config-aware receipts, projections and every managed native/local task schema use the same stage ids. Historical removed definitions remain unknown, not silently remapped. No new state, executable gate, auto-advance, merge, release, import authority or native success is introduced.
+Optional ordered stage definitions map at most 32 bounded ids to the semantic bases, existing actor guidance and closed entry/exit gates (updated to nine bases and the criteria gate by #481 below). Explicit after edges name at most eight earlier configured ids; missing/self/forward/cyclic references refuse. Review and merge base destinations are required by existing Tasks completion transitions. Built-in names cannot change base. Existing holder/person authority and the full approval floor remain; enforce additionally checks an explicit custom stage-change actor without granting a new caller authority. Off/advise preserve claim behavior. Config-aware receipts, projections and every managed native/local task schema use the same stage ids. Historical removed definitions remain unknown, not silently remapped. No new state, executable gate, auto-advance, merge, release, import authority or native success is introduced.
 
 
 ### Custom lifecycle review corrections (#257)
 
-Phase gates require gsd-lite phase views at configuration validation. Authenticated daemon status gains optional lifecycleStages metadata, with no protocol bump. Separate MCP tools lists use that active snapshot; a live legacy daemon without the field keeps seven stages, while unknown/unavailable metadata withholds the lifecycle-record tool. Editing project data during a live daemon no longer changes its advertised stage ids.
+The original phase gate validation is superseded by the criteria gate and compatibility window in #481 below. Authenticated daemon status gains optional lifecycleStages metadata, with no protocol bump. Separate MCP tools lists use that active snapshot; a live legacy daemon without the field keeps seven stages, while unknown/unavailable metadata withholds the lifecycle-record tool. Editing project data during a live daemon no longer changes its advertised stage ids.
 
 
 ## Backlog foundation (#263)
@@ -3502,3 +3542,118 @@ The guard resolves immutable peer-id constant aliases and supplied-source
 import/reexport bindings through lexical symbols before classifying comparisons.
 Shadowed and unrelated bindings remain independent; named non-peer enum exceptions
 keep their exact scope. It performs no filesystem or package lookup.
+
+## Amendment: playbook lifecycle and criteria checklist, 2026-10-18 (#481 S0/S8)
+
+- The AI-Native SDLC Playbook supplies the built-in stage model of an enabled lifecycle: intent (Plan), spec (Design), plan and build (Build), test (Test), review, merge and release (Deploy), maintain (Maintain). `mode` advise or enforce without `stages` selects this list. Off (no file, or `mode = "off"`) keeps the seven #257 stages, so its config, receipts, `hub_sdlc_record` schema and status output stay byte for byte. An explicit #257 list still loads: off keeps it as written, and an enabled lifecycle keeps its order under canonical ids (spec, plan, build, review, test, merge, release). Any other list needs definitions.
+- Valid bases are the nine playbook stages plus the #257 names `implement` and `verify`, which mean build and test. A stored `implement` or `verify` receipt resolves to `build` or `test` in a playbook config; a write with the old id stores the id the config lists. Custom definitions keep loading with their old base names; a playbook-only built-in id (intent, build, test, maintain) cannot take another base. The test base takes the reviewer actor, like verify. Status carries `playbook` (the playbook stage) whenever the mode is not off; the dashboard shows it beside the stage.
+- The head-bound acceptance-criteria checklist (`criteria` in a receipt) belongs to the Compliance pass. It keeps id, head, 1..32 criteria with required, result and hashed refs, reviewer- or person-only writes and the reviewed-head binding; criterion ids may name issue AC ids (`AC8b`). Once recorded it adds its blockers in any enabled lifecycle; off ignores it unless the retired setting below asks for it. A `criteria` entry or exit gate needs no workflow selector: a missing checklist is a blocker the reviewer can clear.
+- Checklist task import is removed. A non-empty `tasks` list is refused before any write; dependencies stay with `Tasks.after` (`ahub task propose --after`). A receipt stored under `phase` reads as criteria, and its task list is shown with a note and never gates readiness. Board split-undo still treats such a stored list as a reference.
+- Deprecation window (constant `RETIRED_WORKFLOW_FROM`, 0.13.0): before it, `workflow = "none"` loads silently, `workflow = "gsd-lite"` loads with a `hub.log` warning and requires a criteria checklist on every task, the `phase` gate loads as an alias of `criteria` with a warning, and the `phase` receipt name is accepted silently. From 0.13.0 each is refused with a field-level reason; the aliases and their tests are then deleted.
+- Tool schema: when the mode is not off, daemon status carries `lifecycleCriteria: true`, and every managed surface (the channel and tools MCP servers and the local worker) advertises `criteria` instead of `phase` in `hub_sdlc_record`. Custom stage ids and the checklist rename are independent: off and older daemons, custom stage lists included, keep `phase`, because they accept only it. That off schema changes once, when the alias is removed at `RETIRED_WORKFLOW_FROM`.
+- `ahub sdlc export`: a plain off lifecycle (no retired setting) keeps the #257 export bytes (schema 1, `workflow: "none"`, `phase: null`). An enabled or retired-setting lifecycle emits schema 2: sanitized state (id, state, stage, criteria view or a private stub), `stateHash` and `sourceHash`, without the workflow field. In off, a `phase` receipt write also keeps its #257 bytes (`tasks: []`); task import stays retired in every mode, so a non-empty list is refused.
+- Contract amendment, seeds (419 before and after: 414 byte-unchanged, 3 modified, 2 removed, 2 added; the registry baseline is unchanged). Modified, each with the same id, test file, test name and mutation intent: `workflow-reviewer-only` (the criteria/phase check), plus `override-local-schema` and `lifecycle-native-schema`. The person approved the last two on 2026-10-18, because the `lifecycleCriteria` plumbing changed their call sites. Removed with the code they mutated: `workflow-exact-after` and `lifecycle-phase-view-required`. Added for the new guards: `criteria-task-import-retired` and `sdlc-workflow-window-closes`. Tests that pinned the retired gsd-lite behaviour (task import, phase naming, the workflow projection, the implement id stored in an enabled config) are amended in the same PR; every other test is unchanged.
+- S0/S8 implement none of S1-S7 and S9-S11. The issue stays the spec, Tasks owns mutations and GitHub owns PR, check and tag facts.
+## Headless peer instances I2 amendment (#450)
+
+`instances` is a person-authored, machine-local object in an untracked
+`.agenthub/config.local.json`. Each additional `<kind>-<name>` id names its kind
+explicitly and may set `roles`, `start_mode`, `permission_mode` and `worktree`.
+The bound catalog belongs to one project/daemon; there is no process-global
+registration or suffix inference. Declarations are validated before trust
+filtering, cloned and frozen, and limited to 64 additional ids of at most 32
+ASCII characters. Settings cannot create or modify declarations. Identity,
+execution directory and account membership are restart-bound; a live reload
+cannot publish their derived defaults ahead of that restart.
+
+I2 accepts definitions with a native headless factory and environment or ACP
+session MCP identity. Additional Claude/channel peers belong to I3. Jcode's
+project-file MCP identity is not isolated by this phase and is refused for extra
+instances. Additional instances start headlessly; the existing Codex native TUI
+still initializes and attaches to its instance's own app-server proxy. The hub
+never initializes that app-server on the TUI's behalf. `ahub <kind> --as <id>`
+selects the declared identity; selection is removed from native passthrough.
+Missing `peer_instances` evidence on an old daemon/upgrade target is a refusal
+before instance runtime effects, rather than a guess that the instance is a base
+peer.
+
+Each additional implementer requires an explicit registered Git worktree at
+`<project>/.worktrees/<id>` with an attached branch. I2 creates no worktree or
+branch; I4 owns automatic worktree orchestration. A supplied reviewer worktree
+is checked by the same real-path, repository and registration boundary. Without
+a supplied directory, a reviewer may share the project checkout. The native
+process executes in that directory while its MCP environment retains the
+canonical project's hub binding. Launch/restore receipts keep canonical
+`projectRoot`, optional extra-instance `executionCwd` and observed `terminalRoot`
+separate. The terminal grouping root may be only that project root or the
+verified execution directory; exact live launcher, handle, incarnation and
+worktree evidence is still required. Native kind metadata alone never binds an
+extra instance. Revoked declarations or changed directories refuse reuse.
+Effective roles resolve from declaration roles, exact-id policy roles, kind policy
+roles, then definition defaults; launch validation uses the same order.
+
+I2 recovery ceiling: a recovering extra Codex launcher records its launch row only
+after the authenticated start response supplies its execution-root binding. Until
+then, the coordinator retains durable pending terminal-creation and attachment-wait
+evidence; it never records an assumed checkout. Base Codex pre-start recording is
+unchanged. Earlier recording for extras requires independently verified exact-instance
+execution-root evidence. Past-commit resumes do not repeat pre-commit instance
+compatibility checks. Abort and stop-and-archive validate historical receipt structure
+and authenticated runtime ownership independently of mutable declarations; restore,
+fresh and reattach retain current declaration authority.
+
+Routing expands a kind preference to its declared members and considers idle
+state, board WIP and queued load with stable ties. Exact manual candidates,
+reservations and nominations stay exact ids. Assignment and explain use the same
+pure decision and name the chosen instance. Reviewer independence compares
+families (the kind); an eligible other family takes precedence even when busy.
+Only when no other family is eligible may an assignment use its own family,
+recording `sameFamilyFallback=true` in assignment history. This independence rule
+also applies to an explicit same-family reviewer nomination. A declared owner of
+implement, bulk-edit or test work requires the current implementer role and positive
+host evidence tied to the actual adapter generation started in a verified noncanonical
+worktree; a role-only reload cannot promote a canonical reviewer process. External
+ids, including console recipients, retain their existing admission and explicit
+nomination behavior without acquiring native metadata or automatic kind expansion.
+
+Quota readings, pause records and reset windows are shared by the definition's
+account (one account per kind in I2). Member telemetry retains its exact reporter
+id, native context remains per instance, and the shared account's quota pause,
+checkpoint, handoff and reset notice cover all its members. Existing manual
+pauses remain in force. A startup migration conservatively merges old alias
+pause rows, retaining their provenance and moves; no pause is discarded.
+Per-instance ports, native session paths, Pi tool ledgers and model relay
+callbacks do not borrow another instance's process or conversation.
+
+Worktree facts and native turn snapshots use the validated execution checkout,
+while task and turn ids remain in the canonical hub database. An additive
+`turn_workspaces` receipt stores the exact extra-instance root and its snapshot
+fields atomically with turn creation. The legacy `turns` snapshot fields remain
+unknown for those rows, so an older CLI cannot restore their files into the
+canonical checkout. New readers hydrate the same public turn shape from the
+receipt. An absent receipt preserves historical external-peer undo behavior;
+an existing receipt requires the current trusted declaration and the same
+validated root before context changes or file restoration. Pruning a turn also
+prunes its workspace receipt. Review projections resolve converter programs, task
+paths and private-path policy in the execution checkout while their sandbox denies
+other canonical project file data, including when read_allow encloses that project.
+Overlap refusal remains conservative across
+separate worktrees; it may refuse an undo rather than assume independence.
+
+The I2 seed contract amendment re-anchors only `roster-r-pi-override`,
+`roster-r-catalog`, `roster-result-stop-text`, `roster-detached-pi-recovery`,
+`data-pi-factory-wire`, `projection-local-trust`,
+`planning-reservation-supported` and `planner-reserved-status-row` to the
+contextual resolver, aggregate Pi ledger, execution directory and declared-id
+forms. Each keeps its id and named test and removes the same guarantee. The
+projection mutant still removes only `text_projection`; the status mutant still
+removes only reservations. The other 411 seeds and registry baseline are
+unchanged. The PR records every old and new search/replacement and its clean
+and mutant result, per the reviewer's explicit ruling.
+
+## Amendment: roster membership in status, 2026-10-18 (#484)
+
+- The authenticated `status` reply carries `roster: {peer, on}[]` for every supported peer, optional peers included, with the same `on` that `ahub roster list` shows. The field is additive, with no protocol bump; older CLIs ignore it.
+- Launchers that check membership before starting (`ahub jcode`, `ahub kimi --mode tui`) read it through `rosterInStatus` in `src/hub/status-roster.ts` (no imports, so the registry's native CLI entries add no cycle). A reply without the field (an older hub) is unknown: the launcher stops with an upgrade-or-restart remedy and starts nothing. It never reads unknown as off (the jcode bug) or as on (the dead kimi guard; daemon admission still refused off-roster Kimi, so that one was harmless).
+- `settings_get` stays console-only.
+- With declared headless instances, status includes each startup-bound extra id as well as every built-in and optional peer, with its own roster membership. No undeclared suffix acquires a row.

package/docs/verification/2026-10-18-0.12.35.md

@@ -0,0 +1,49 @@
+# 0.12.35 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or native/live acceptance.
+
+## Candidate
+
+Version 0.12.35, control protocol 16 (unchanged), from merged main `ac6ff4e382abcec45b5dffcc1fc85f402383dccf`. The person directed the release on 2026-10-18, first so that #493 takes effect, then to ship all open PRs once merged.
+
+- #493 (PR #495): a busy `ahub claude` session reads its queue with `hub_inbox`, sees fresh queued and important counts, and receives important messages mid-turn; `[FYI]` is forbidden for actionable messages.
+- #484 (PR #500): `status` carries roster membership, and `ahub jcode` and `ahub kimi --mode tui` read it; an older hub is unknown, not off.
+- #219 task (PR #499): the protected-segment grant test no longer grows with the set (test-only).
+- #450 I2 (PR #497): declared headless peer instances with their own native and MCP identity, worktree execution roots for extra implementers, kind routing across instances, and account-shared quota.
+- #481 S0+S8 (PR #496): the playbook lifecycle as the enabled default, gsd-lite retired into the `criteria` checklist, and a deprecation window until 0.13.0. Off keeps its #257 bytes.
+- Still open (unchanged): live native clients, installed managed-Pi #418 AC8 (#142), #438 AC7, the native console settings leg (#439 AC5), a real upgrade with reattach (#463), a real upgrade with a managed terminal and cancelled rows (#478), and the live advise cycle of #481 AC9.
+- New open legs:
+  - After installation, a busy `ahub claude` session reads its queue with `hub_inbox` and sees a steered important message before its turn ends (#493 D3, installed).
+  - A live run of two instances of one kind (#450 I4, #138).
+
+## Reviews
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #495 (#493) | 3730bf20 | planner plus an independent OCR pass | exact head, success |
+| #500 (#484) | b4a1bd6b | codex, approved | exact head, success |
+| #499 (#219) | a67fd222 | codex, approved | exact head, success |
+| #497 (#450 I2) | 254ba163 | two fresh-context reviews (round 1: changes requested, B1-B5); round-2 fresh review, approved; merge-delta review | exact head, success (macOS watchdog job rerun once) |
+| #496 (#481 S0+S8) | b1120f96 | codex: round 1 five P2s, round 2 one P1 (off-mode PII screen), round 3 approved | exact head, success (macOS #463 attach-timeout job rerun once; passes locally) |
+
+## Document review
+
+Round 1 checked 10 documents against #495, round 2 against #499 and #500, and round 3 13 stale documents against #497 and #496, read by a fresh-context reviewer and applied by the planner.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected (round 1) | Status 0.12.35; the Jcode entry sentence's version; the verification link. Nothing #497 or #496 invalidates. |
+| `docs/quickstart.md` | corrected | `v0.12.35` install. Upgrade paragraphs for #493 (session restart), #484, the #481 deprecation (`workflow`, the `phase` gate, `criteria` receipts) and #450 I2 instances. |
+| `docs/operations.md` | corrected (rounds 1 and 2) | Busy channel sessions; the Jcode roster read. The #497 instance and #496 lifecycle sections match the code. |
+| `docs/security.md` | corrected | `instances` is machine-local (read only from an untracked `config.local.json`) and refused from every surface; extras accept only `headless`. |
+| `docs/sdlc.md` | corrected | The off schema-1 export, and the `phase` tool schema of off or older daemons. |
+| `docs/specs/2026-09-19-agent-hub-design.md` | corrected | The #481 deprecation bullet: only `workflow = "gsd-lite"` and the `phase` gate warn; the `phase` receipt name is accepted silently. |
+| `docs/agent-notes/tasks.md` | corrected | `checklistOf` screening and off compatibility; instance id resolution and family fallback; owner isolation proof. |
+| `docs/agent-notes/budget.md` | corrected | Account-keyed quota, pause, checkpoint and handoff with per-member fanout; scope includes `instance-budget.ts`. |
+| `docs/agent-notes/daemon.md` | corrected | Startup-bound declarations, execution roots, instance recovery and undo; scope includes the instance modules. |
+| `docs/agent-notes/adapters.md` | corrected | Spawn identity per instance; an ACP kind only from the host declaration. |
+| `docs/agent-notes/local-worker.md` | corrected | Scope includes the sandbox root in `instance-execution.ts`; no rule changed. |
+| `docs/agent-notes/bus.md` | corrected (round 1) | Channel pull while busy; `WsPeer.steer` scope. No #497/#496 rule. |
+| `docs/agent-notes/tests.md`, `benchmarks.md`, `README.md` | unchanged | #497/#496 touched only shared paths; no rule is wrong. |
+
+`AGENTS.md` area notes and their `docs/verified.json` paths now list `instances.ts`, `instance-config.ts`, `instance-execution.ts` and `instance-budget.ts`. A separate manifest commit restamps the reviewed documents. The release PR must be merged with a merge commit so the stamps stay ancestors of the tag.

package/docs/verification/2026-10-18-493-claude-busy-channel.md

@@ -0,0 +1,91 @@
+# Busy Claude channel notification receipt (#493)
+
+## Result
+
+Positive native interactive receipt: Claude Code 2.1.302, Sonnet 5.5 (the native
+`sonnet` alias), consumed a channel notification during the original busy turn.
+The model called the observation tool with the exact random token before its
+first `end_turn`. This supports important-only channel steering in the tested
+interactive mode. It does not prove an arbitrary notification was read merely
+because its stdout write succeeded, nor does it prove delivery in print mode.
+
+## Native experiment
+
+- A new scratch project outside the repository used one explicitly selected
+  development MCP channel, `busy-probe`. The harness preserved the executing
+  agent marker, removed live hub binding variables, loaded no project/user
+  settings or hooks, and exposed only three fixed fixture tools. It connected
+  neither to the person's hub nor to another peer.
+- The original instruction called `probe_hold`, then `probe_after_hold`, then
+  finished with `DONE`. It also asked the model to report any actually observed
+  channel token, without inventing one. The token was generated only after
+  `probe_hold` started; neither the prompt nor the hold result contained it.
+- While that tool was pending, the MCP server wrote
+  `notifications/claude/channel` with `priority: important` and the random token.
+  The fixed hold result contained only `ready: true`.
+- The interactive run used a real PTY. The operator confirmed that this was a
+  locally written development channel. No trust or tool-approval prompt was
+  answered automatically, and no second model prompt was sent. After the
+  original response completed, the operator exited with Ctrl-D.
+
+| Evidence | UTC on 2026-10-18 |
+| --- | --- |
+| Native tool barrier entered | 07:25:36.997 |
+| Notification written while tool pending | 07:25:37.298 |
+| Fixed hold result released | 07:25:38.801 |
+| Correct token received by observation tool | 07:25:41.948 |
+| First original assistant `end_turn`, `DONE` | 07:25:43.016 |
+
+The native transcript's zero-based record positions were 29 for the hold call,
+49 for the matching observation call, and 52 for the first original `end_turn`.
+The observation was after the tool barrier released but before that original
+turn ended. The TUI also displayed the channel notification during its busy
+indicator. Native exit was 0; process-table verification found no remaining
+probe-owned native, helper or MCP server processes. The 90-second deadline did
+not fire.
+
+The automatic resource controller initially deferred on ordinary Teams/Jump
+Desktop processes with no repository attribution. Manual inspection identified
+their application origins and confirmed normal memory/thermal state, CPU idle
+above 50%, no competing repository job and one probe worker. No existing app
+was stopped. Native account/session metadata writes were not suppressed or
+audited; this receipt does not claim the native client made no home-directory
+writes.
+
+## Preserved evidence
+
+Private run artifacts are retained under workspace-relative
+`scratchpad/temp/ahub-493-probe/interactive-zaTWkS/`; the invocation receipt points
+to the native client's own transcript. Raw account/profile paths and the random
+token are not copied into this document.
+
+| Artifact | SHA-256 |
+| --- | --- |
+| `receipt.json` | `5108a491e3469baf9de67860d7d3fff37b5eb89b980fa9f1835ff28510f524b7` |
+| `server-events.jsonl` | `43b079866ec2c8ac0437d51d2fd50549fec035b1a76feaa8c20142a58cdb1258` |
+| `native-tui.log` | `2fc9182a355038c0b26d662054ee7abee9fda78569ea6b07893afeb44fd6da51` |
+| `pty-events.jsonl` | `5ab8c672ea56512a6bdce111fe6960fc85ceb47ff88d7a1b17d528b1fdb10229` |
+| Native transcript | `0acfd6f66ec20f0cb5ad4fe020d044e326c240289019785c15f3af64ca188ede` |
+
+Token SHA-256:
+`ea4326fdc248ddc69ba250005a472f5393c2250b1876fbe039cbef0561125d08`.
+
+An earlier isolated print/stream-json run (`run-YwEcfC`) initialized the same
+channel and wrote a notification while the hold tool was pending, then finished
+without an observation call. That result remains inconclusive for interactive
+delivery. It was not treated as a negative, and steering was added only after
+the positive interactive receipt above.
+
+## Implementation boundary
+
+- A channel-capable attached `WsPeer` exposes steer only while it owns a push
+  socket; detach and pull-only attachment remove that capability. The bus admits
+  important work only, retains its existing pause/recovery/uncertainty holds and
+  removes the queued item before transport hand-off.
+- A steered notification uses the ordinary delivery id, connection generation,
+  accepted receipt and explicit completion/correlated-reply contract. A transport
+  failure stays uncertain. An idle transition must not deliver it again.
+- Queued ordinary work can be read through `hub_inbox` during a busy turn using
+  the existing atomic pull completion path. This does not settle a previously
+  accepted push. Fake-transport regressions cover these contracts separately
+  from this native observation.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "c1c3bf1d5494f21847ae846e3ed030166ee20484",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "c1c3bf1d5494f21847ae846e3ed030166ee20484",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -64,7 +64,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -76,7 +76,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -87,11 +87,12 @@
         "src/hub/daemon.ts",
         "src/adapters/definitions/native-quota.ts",
         "src/adapters/definitions/native-context.ts",
-        "src/adapters/registry.ts"
+        "src/adapters/registry.ts",
+        "src/hub/instance-budget.ts"
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -105,7 +106,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -147,18 +148,22 @@
         "src/adapters/definitions/native-recovery*.ts",
         "src/adapters/definitions/native-policy-aux.ts",
         "src/adapters/definitions/native-config-*.ts",
-        "src/adapters/definitions/native-cli-*.ts"
+        "src/adapters/definitions/native-cli-*.ts",
+        "src/hub/instances.ts",
+        "src/hub/instance-config.ts",
+        "src/hub/instance-execution.ts"
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
         "src/memory/capture.ts",
         "src/hub/facts.ts",
         "src/hub/permission-mode.ts",
-        "src/hub/git.ts"
+        "src/hub/git.ts",
+        "src/hub/instance-execution.ts"
       ]
     },
     "docs/agent-notes/models.md": {
@@ -171,7 +176,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "c1c3bf1d5494f21847ae846e3ed030166ee20484",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -191,7 +196,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -210,7 +215,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "b91d2cacb80b58ec85fa4cf538cdb1f3ed6079cc",
+      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.34",
+  "version": "0.12.35",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.34",
+  "version": "0.12.35",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",