@staix/agent-hub 0.12.35 → 0.12.37

package/docs/verification/2026-10-19-0.12.37.md

@@ -0,0 +1,60 @@
+# 0.12.37 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or native/live acceptance.
+
+## Candidate
+
+Version 0.12.37, control protocol 16 (unchanged; the daemon now advertises the `release_trains` and `reviewer_pool` features), from merged main `86693a2a`. The person directed the release on 2026-10-19.
+
+- #529 (PR #530): the Jcode adapter accepts any plain jcode release in `[0.98.0, 1.0.0)` instead of exactly 0.94.0; the owned daemon's private socket is named `j.sock` so jcode's derived debug socket no longer collides; every owned jcode process runs with `JCODE_NO_TELEMETRY=1`.
+- #481 S11 (PR #527): release trains through the board's release assignments, missed-work moves with a reason, admitted cuts through host resource admission and fresh peer quota checks.
+- agent-mem#15 T2 host prerequisite (PR #534, hub task #237): the hub opens a split agent-mem home through `openShardStore` at the canonical memory directory; an inactive split refuses with the resume remedy; the exact `@staix/agent-mem` pin rises to 0.4.0.
+- #519 (PR #535, hub task #229): reviews rotate across fresh Claude and Codex reviewer sessions; `review_mode: "fresh"` opt-in; Codex isolation (plugins, hooks, Apps and web search disabled, native read-only sandbox, credential-root denies); optional-pool exhaustion keeps the planner fallback, a required pool blocks for the person.
+- #237 review fixes (PR #537): the daemon and `ahub memory`/`ahub goal` bind the alias-resolved project key the `amem` CLI uses, a later alias latches a bound hub unavailable, and a dangling or unreadable `shards.json` counts as a split marker.
+- CI (PR #538): the macOS check gate gets a 960 s hang bound inside a 20-minute job ceiling (the test step ran 650-808 s).
+- First-party dependency: `@staix/agent-mem` 0.4.0 (agent-mem PRs #24, #25, #26), published by its tag workflow and read back from the registry (`latest` 0.4.0, integrity `sha512-JJCOm8Pq...`, matching `bun.lock`).
+- Still open (unchanged): live native clients, installed managed-Pi #418 AC8 (#142), #438 AC7, the native console settings leg (#439 AC5), real upgrades with reattach (#463) and with a managed terminal and cancelled rows (#478), the live advise cycle of #481 AC9, the installed #493 D3 leg, the live two-instance run (#450 I4, #138), a live headless Claude review (#223) and a live long session over 32 MiB (#517).
+- New open legs:
+  - A live fresh Codex review with a real account: `default_permissions` selecting the `ahub-review` profile is configured, not observed (docs/verification/2026-10-19-reviewer-isolation.md).
+  - A live split of a real memory home with `amem migrate --shards` after every sharing hub runs 0.12.37; `ahub memory profile-check` is not split-aware yet (#536).
+- Not in this release: the Kimi fresh reviewer (#533, task #234, in progress) and the agy implementer peer (#485, task #241).
+
+## Reviews
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #530 (#529) | 4921ebe4 | planner via OCR delegation (read-only Claude subagent), approved | exact head, success |
+| #527 (#481 S11) | 18b96955 | planner: round 1 findings (quota for unread peers, receipt invalidation, cost-report paging, upgrade-gate scope ruled by the person), round 2 approved | exact head, success |
+| #534 (#237) | ba8e0755 | OCR delegation (read-only Claude subagent): I1 (symlinked home) fixed; the README warning updated after a bot P2, and the README and CHANGELOG older-hub wording corrected after the reviewer showed agent-mem 0.3.1 does not detect a split; approved. codex post-merge review: two findings, fixed in #537 | exact head, success |
+| #535 (#519) | ccb62a48 | planner with two read-only reviewers: round 1 two Important (planner fallback, ChatGPT Apps MCP), round 2 one Important (canonical credential roots on a symlinked TMPDIR), round 3 approved; 387/0 affected tests on macOS with the default TMPDIR | exact head, success |
+| #537 (#237 review) | 6b87d144 | OCR delegation (read-only Claude subagent) approved at a339848d after two bot P1s (daemon-start fallback, late-alias latch); only main merges followed. codex approved the merged commit 86693a2a | exact head, success (macOS after #538) |
+| #538 (CI) | 23f6fc2b | OCR delegation (read-only Claude subagent), approved | exact head, success |
+
+## Document review
+
+Eleven documents were stale against the 0.12.36 stamps. Two fresh-context reviewers read them against the six PRs above: one took the person-facing documents, the other the agent notes and `AGENTS.md`. The planner checked their edits and fixed `docs/sdlc.md`'s S11 status line.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.12.37 (protocol 16 unchanged); the jcode range 0.98.0 up to 1.0.0 (#529); the verification link; open legs add a live fresh Codex review (#519) and a live split of a real memory home (#536); shard rollout now says every sharing hub must run 0.12.37 or later. |
+| `docs/quickstart.md` | corrected | Install pin `v0.12.37`; "Upgrading to 0.12.37" covers restarting Claude sessions for the release-train tools (#481 S11), the reviewer pool and `review_mode: "fresh"` (Kimi not offered, agy planned as an implementer under #485), the upgrade refusal for targets without `release_trains` or `reviewer_pool`, the jcode range and telemetry opt-out, and agent-mem 0.4.0 with the split rollout rule (#536). |
+| `docs/operations.md` | corrected | Version and upgrade commands 0.12.37; the agent-mem pin was still 0.3.0 (already stale) and is now 0.4.0; a shard paragraph in Hub memory (#534, #537); S11 marked shipped; Jcode telemetry opt-out; the reviewer pool section dated to 0.12.37 with the agy decision and the native-acceptance caveat kept. |
+| `docs/security.md` | corrected | Shard binding (project shard plus user overlay, entry recheck, late-alias latch, inactive split never read as empty); the jcode version fence and telemetry opt-out; the fresh Codex reviewer's pinned policy, receipt, read-only shell and its configured-not-observed limits. |
+| `docs/sdlc.md` | corrected | S11 release-train governance ships in 0.12.37. |
+| `docs/agent-notes/adapters.md` | corrected | Registry `isSupportedPeer` answers from `ADAPTERS`; `reviewer` is a restricted builtin field; reviewer-variant selection needs headless, roles exactly `["reviewer"]`, and an automatic declaration or `review_mode: "fresh"`; `ReviewerPrintPeer` replaces `ClaudePrintPeer`; new rules for the jcode range, owned env and `.sock` name (#530), reviewer backends (receipt and `current()` before every spawn, bus admission after `start()`, failure reports after group exit, output caps), Codex isolation, and never passing the control token to a reviewer child. |
+| `docs/agent-notes/tasks.md` | corrected | Scope adds `reviewer-pool.ts`, `reviewer-pool-config.ts`, `release-admission.ts`; rules for pool selection inside `assign()`, required versus optional pool, `retryReviewer` fences, and S11 release trains. |
+| `docs/agent-notes/daemon.md` | corrected | Scope adds `memory-profile.ts` and `usage.ts`; rules for `memoryProjectFor` and the `projectKey` latch (#537), `lstat` marker detection and `openShardStore` (#534), recovery target-feature floors, and `review_mode`/`review.pool` validation. |
+| `docs/agent-notes/budget.md` | corrected | Reviewer variants keep their base kind's account; the release-cut quota rule. |
+| `docs/agent-notes/tests.md` | corrected | Raise the macOS job ceiling together with `AHUB_CHECK_HANG_S` (#538); the Codex reviewer fake never stands in for native isolation. |
+| `docs/agent-notes/bus.md` | no change | Only `envelope.ts` gained an optional `refs.reviewRevision`, whose rule lives in `tasks.md`. |
+| `docs/agent-notes/benchmarks.md` | no change | The `acp.ts` change (a version predicate) is Jcode-only. |
+| `docs/agent-notes/README.md` | no change | Stale only because `daemon.md`, a tracked path, changed; its index still matches the notes. |
+
+`AGENTS.md` lists `reviewer-pool.ts`, `reviewer-pool-config.ts` and `release-admission.ts` under tasks and `memory-profile.ts` under daemon.
+
+Found during the review, not changed here: `src/hub/peer-catalog.ts` and the daemon's local `isSupportedPeer` (`daemon.ts:645`) still answer from `definitionOf`, so the declaration-only `agy` passes the person-only `ahub permission` peer check (`daemon.ts:4887`). agy cannot start in this release, so the effect is a stored, unused mode; it is handed to the agy implementer task (#485, hub task #241).
+
+## Checks
+
+- Each merged PR's exact-head CI passed (table above). The release branch is main `86693a2a` plus the version, release notes and document corrections; the bundle is rebuilt with the pinned Bun 1.4.2 and is fresh; `tsc` is clean.
+- The twelve stale stamps are restamped to the reviewed commit `9a4869c5`; `node scripts/check-docs.mjs` reports 0 stale documents. `--require-fresh` runs again on the merged main before the tag.

package/docs/verification/2026-10-19-jcode-0.98.1.md

@@ -0,0 +1,30 @@
+# Jcode 0.98.1 and the version range (#529)
+
+Installed release builds, read through `--quiet version --json`: 0.94.0 (b6c63ff04, the pinned contract in 2026-10-11-jcode-peer-contract.md), 0.95.0 (6487bbd7e) and 0.98.1 (1c7426eb1, installed by jcode's own updater on 2026-10-17), all kept side by side by jcode's updater. All three are [1jehuang/jcode](https://github.com/1jehuang/jcode). The full probe ran on 0.94.0 and 0.98.1; 0.95.0 ran only the old-socket `serve` check below.
+
+## Live probe
+
+A probe spawned the owned daemon and the ACP client with the adapter's own argv (`jcodeCommand`), under an isolated `HOME` and `JCODE_HOME` (an empty `mcp.json`, no credentials), `JCODE_SOCKET` and `JCODE_READY_FD` set as the adapter sets them. A before/after hash of the person's real Jcode config files showed no change.
+
+- With the adapter's socket name `s`, `serve` exits 1 with `Address already in use (os error 48)` on 0.94.0, 0.95.0 and 0.98.1 alike. Source: `debug_socket_path()` (`crates/jcode-app-core/src/server/socket.rs`, unchanged between the tags) names the debug socket `file_name.replace(".sock", "-debug.sock")`, so a name without `.sock` binds the main path twice. The owned peer could never start natively before this fix; the fake did not bind a debug socket, so tests passed.
+- With `j.sock` (the fix), on both 0.94.0 and 0.98.1:
+  - `serve` signals readiness on the private socket within about 100 ms and leaves `j-debug.sock`, `j.sock.hash` and `j.sock.server.json` beside it (0.98.1 adds `j.sock.daemon.lock`). The process group is gone after SIGTERM.
+  - `initialize`: `protocolVersion` 1, `agentInfo` `{ name: "jcode", title: "Jcode", version: <semver> }`, `loadSession: true`, `authMethods: []`.
+  - `session/new` returns `sessionId` with `configOptions` and `models`.
+  - `session/load` returns `configOptions` and `models` only, with no `sessionId`. The restored identity stays unproven, so `requireLoadSessionEcho` and the withheld automatic recovery are unchanged.
+
+Telemetry: without an opt-out, the first 0.98.1 `serve` wrote `telemetry_id` and milestone files into `JCODE_HOME` and tried to send an event (`telemetry payload send failed` in its log, the probe host being offline for that endpoint). With the adapter's `JCODE_NO_TELEMETRY=1` (and none in the caller's environment), the patched `JcodePeer` start and stop on 0.98.1 left no telemetry file and logged no send. Source: `is_truthy("JCODE_NO_TELEMETRY") || is_truthy("DO_NOT_TRACK")` in `crates/jcode-telemetry-core/src/lib.rs`.
+
+No prompt was sent: provider/model serving, a real hub-tool call through the project MCP entry, native tool policy and child teardown under load stay unverified, as in the 0.94.0 record.
+
+## Source comparison v0.94.0..v0.98.1
+
+234 commits, read only (nothing built from the clone).
+
+- ACP (`src/cli/acp.rs`): protocol pinned to 1, the same methods, still no `session/set_mode` or `request_permission`, session `mcpServers` still ignored. Additions: `Subscribe` sends `supports_user_response: false`, and a corrected trailing text piece arrives as an extra `agent_message_chunk`.
+- CLI and socket: every flag the adapter passes is still defined; `JCODE_SOCKET` wins, `JCODE_READY_FD` gets one byte; the update check is still skipped for `serve` and `acp`. The daemon lock now follows a custom socket (`<socket>.daemon.lock`) instead of one runtime-wide lock, so an owned `serve` no longer collides with the person's own jcode daemon.
+- MCP: project file order, the `mcpServers` alias, `shared: false`, the first-use Codex import and `JCODE_DISABLE_CLAUDE_MCP` are unchanged. New: http, streamable-http and sse entries in project MCP files are now connected instead of skipped (OAuth only through `jcode mcp login`).
+
+## Decision
+
+The adapter accepts a plain release from 0.98.0 (the minimum, set by the owner; 0.98.1 is the release verified live) up to, not including, 1.0.0 (the assumed breaking version); the minor is not pinned. Releases before 0.98.0 are refused, 0.94.0 included, although the probe above also passed on it. A release shown to break the contract lowers `JCODE_BREAKING_VERSION` (`src/adapters/jcode.ts`).

package/docs/verification/2026-10-19-reviewer-isolation.md

@@ -0,0 +1,119 @@
+# Reviewer isolation evidence (#519)
+
+Status: source integration and model-free production-backend admission are verified. Exact-head CI is a separate required PR gate. This report separates offline native evidence, fake-CLI regressions and unverified account/model behavior. No live review prompt, account login or credential copy was performed for this investigation.
+
+## Admission ruling
+
+- Planner ruling, 2026-10-19: #229 ships #519 R3-R6 for Claude and Codex only; ship only reviewer profiles with demonstrated isolation. Kimi and agy remain unavailable and outside the default pool until they have a passing isolation receipt. #229 adds unavailable-reason metadata for them and no launch code. All of their launch/isolation/receipt work belongs to [#533](https://github.com/STAIxBWLB/agent-hub/issues/533), hub task #234; the future agy launcher belongs in `src/adapters/agy/`. Failure, missing evidence and quota exhaustion never count as a verdict.
+- The default logical kind order is Claude, Codex, fixed before modulo; undeclared or unavailable slots are skipped without renumbering. An explicit pool may name the registered unavailable Kimi/agy placeholders; local/Pi are refused. An explicit pool with no declarations blocks, while an omitted pool without declarations preserves legacy routing. An unavailable result must be skipped, never treated as approval. With no explicit required pool, exhausted fresh candidates retain #223 R5 eligible-planner fallback; without one the person reviews. The exhausted walk remains in trace/history. Required explicit-pool exhaustion remains blocked for the person.
+- Existing #223 Claude behavior is retained. This work adds no new live Claude acceptance proof.
+- Codex/Kimi fresh reviewer declarations require `review_mode: "fresh"`. Existing headless instances with roles `["reviewer"]` but no opt-in retain native transport/worktree/permission behavior and stay outside the fresh pool. Claude keeps #223 automatic selection; agy remains metadata-only unavailable. A failed fresh start never downgrades to a continuing native session.
+
+## Codex native evidence
+
+- Exact executable used for offline probes: `/opt/homebrew/bin/codex`, reporting `codex-cli 0.146.0`. Its npm package resolves to a native binary. A separate fnm executable on PATH reports 0.163.0; that version has no receipt in this slice and must be unavailable.
+- Primary source pin: `openai/codex`, tag `rust-v0.146.0`, commit `e363b08c9175ac1cbe5893615dd2cb9ddf95043b`.
+- `exec --ephemeral --ignore-user-config --ignore-rules` is accepted by the installed help. These switches respectively remove session persistence, the user config layer and user/project execpolicy rules. They do not remove every config layer. [Pinned exec implementation](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/exec/src/lib.rs)
+- Native `mcp list --json` in temporary homes showed that a CLI `mcp_servers={agent-hub={...}}` table merges with user/project servers. Self-contained disabled stdio/HTTP stubs retained valid configuration both with and without the original user layer. Only the fixed hub remained enabled among configured servers. This inventory does not enumerate runtime ChatGPT Apps contributions and cannot alone prove strict MCP isolation. Native `mcp get agent-hub --json` exposes the exact `enabled_tools` allowlist. The schema specifies that disabled servers are not initialized and only listed enabled tools are registered. [Pinned MCP schema](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/config/src/mcp_types.rs)
+- The original inventory probes included `--disable plugins --disable hooks` and a CLI override marking the physical project root untrusted. The review correction adds `--disable apps` and `web_search="disabled"`, with separate effective-feature proof (see below). Plugin loading has an explicit disabled return path; `--ignore-user-config` alone is insufficient. [Pinned plugin manager](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/core-plugins/src/manager.rs), [config loader](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/config/src/loader/mod.rs)
+
+The named profile used filesystem `/ = read`, private entries `= deny` and `network.enabled = false`. Native `sandbox -P <profile>` fixtures produced:
+
+```text
+nested/secret.env READ_DENIED
+alias.env READ_DENIED
+nested/SECRET.ENV READ_DENIED
+public.txt READ_ALLOWED
+WRITE_DENIED
+```
+
+Both exact and glob deny entries passed; the symlink and case alias existed. No write file appeared. A plain read-only profile without a deny entry could read the private fixture. `debug models --bundled` accepted the CLI profile configuration offline. [Pinned permission schema](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/config/src/permissions_toml.rs)
+
+The source receipt producer repeats bounded model-free inventory and sandbox checks before a review, including nested glob and symlink private-read denial. It hashes the native executable/prefix once per preparation and binds the profile and config metadata, then checks dev/ino/size/mtime/ctime through `current()` immediately before model spawn. Repeated current checks do not synchronously reread the native binary. A bare deny name is compiled at the project root and at nested segment depth; `~/` is resolved against the home directory. Raw MCP output, transport environments and config contents are not receipt evidence. Unsupported version, changed/unknown inventory, own-server collision, failed sandbox proof, abort or changed metadata makes the backend unavailable.
+
+Codex "read-only tools" means sandboxed shell with filesystem read-only/private-deny policy and network disabled. It does not mean Claude's Read/Grep/Glob tool whitelist. No native LLM review, network-denial probe, post-start glob mutation or concurrent filesystem/config swap was tested. No recorded run shows exec selecting `ahub-review` through `default_permissions`; argv pinning and `sandbox -P ahub-review` test different paths. The profile declares the network boundary; it is not a measured network result. Same-user concurrent changes after the final check remain a ceiling, not a claimed atomic filesystem snapshot.
+
+## Kimi evidence and gap
+
+- Installed version: 2.2.0. Primary source pin: `MoonshotAI/kimi-code`, tag `@moonshot-ai/kimi-code@2.2.0`, commit `472192c34c1efad89a369870eff0da0b708ce9bb`.
+- An explicit `--agent-file` profile can allow only Read/Grep/Glob and the two hub MCP tools, with `subagents: []`. The runtime executor registers a tool-policy guard; the allowlist is more than prompt text. [Pinned policy guard](https://github.com/MoonshotAI/kimi-code/blob/472192c34c1efad89a369870eff0da0b708ce9bb/packages/agent-core-v2/src/agent/toolPolicy/toolPolicyService.ts)
+- `KIMI_CODE_HOME` separates config, sessions and credentials. ACP session MCP servers are additive: trusted project/user/plugin servers can still load. No strict-MCP or no-persistence CLI profile was demonstrated. Reusing ordinary authentication through an isolated home was not tested or authorized by this investigation. Kimi remains unavailable. [Pinned MCP loader](https://github.com/MoonshotAI/kimi-code/blob/472192c34c1efad89a369870eff0da0b708ce9bb/packages/agent-core-v2/src/workspace/workspaceMcpConfig/workspaceMcpConfigService.ts), [bootstrap paths](https://github.com/MoonshotAI/kimi-code/blob/472192c34c1efad89a369870eff0da0b708ce9bb/packages/agent-core-v2/src/app/bootstrap/bootstrapService.ts)
+
+## agy evidence and gap
+
+- Installed version: 1.4.2. Help exposes `-p`, `--output-format stream-json`, `--mode plan`, `--sandbox` and `--agent`; no isolation receipt was produced.
+- Official documentation describes plan mode as a `/plan` prompt prefix. Headless mode auto-allows workspace reads and writes; the terminal sandbox mounts project folders read-write. These are insufficient for a read-only reviewer. [Execution modes](https://www.agy.dev/docs/cli/modes/), [headless permissions](https://www.agy.dev/docs/cli/headless/), [terminal sandbox](https://www.agy.dev/docs/sandbox/)
+- Custom-agent documentation lists tool limits and MCP settings, but this investigation did not establish a CLI-only, host-owned profile path with strict config/MCP isolation. agy remains unavailable. No profile, account or model execution was attempted. [Custom agents](https://www.agy.dev/docs/subagents?tab=cli)
+
+## Remaining verification
+
+- Final integration tests and exact-head CI must validate pure rotation, delta continuity, start-failure/no-verdict walking, blocked exhaustion, fresh child authority and additive family/reason metadata. Any child ending without a saved verdict retries the remaining eligible walk; no quota classification is inferred from vendor text.
+- Native account/model smoke remains manual, as listed in [smoke.md](../smoke.md#reviewer-pool-native-legs-519-2026-10-19). Fake CLI tests prove the host contract and refusal paths, not vendor model behavior.
+
+## Production admission readback
+
+On 2026-10-19 the actual `codexReviewerBackend.prepare` ran against `/opt/homebrew/bin/codex` 0.146.0 in a new temporary repository directory, with empty temporary HOME and CODEX_HOME and a fixed inert hub transport. It returned `readOnly: true`, `strictMcp: true`, `ephemeral: true` and `current: true` after the native MCP, exact/glob/symlink denial, public read and write-denial probes. The temporary home and fixtures were removed. This did not execute `codex exec`, initialize an account, copy credentials or issue a model request. Network blocking remains a configured restriction, not a separately observed network probe.
+
+The first correctly initialized native run exposed an admission bug: the pinned bundled model catalog exceeds the 128 KiB inventory-output cap. Configuration validation now drains that one command without retaining its output, with a separate 4 MiB ceiling; MCP/version/sandbox metadata retain the 128 KiB ceiling. A red-first regression covers a larger valid catalog and refuses a catalog above the ceiling. The production-backend admission then passed.
+
+The shared review child also bounds a stream frame to 256 KiB and total stdout to 4 MiB. Overflow revokes verdict authority before process-group teardown and only then reports head/revision-bound `no_verdict` failures for the current and unprocessed requests. A person's stop suppresses automatic fallback. Fake-CLI regressions cover both limits, batch failure, watchdog cleanup and stop-generation revocation.
+
+Agy declaration metadata is separate from the native runtime catalog. Existing supported/optional peer projections, exact legacy catalog tests, registry-guard expectations and the empty baseline are unchanged. An unavailable-only declaration set cannot fall through to automatic approval; an omitted pool may select an eligible planner under #223 R5; its static #533 reason remains in routing explanations, including explicit nominations.
+
+## Core deny policy
+
+Codex imports the exact-pinned portable core's `DENY_NAMES` and `DENY_SEGMENTS` and translates the supported literal-prefix/suffix regex forms into conservative native deny globs. Unknown syntax refuses admission. The profile includes each subtree explicitly, and the daemon also supplies its concrete state directory. Runtime fixtures now require both `.env` and `.agenthub/state/private.txt` to be unreadable. The production backend passed again with these global core rules on 2026-10-19, with `portable-core-name-and-state-deny` in its evidence. Explicit private paths protect lexical and existing real paths and include descendants; plain relative substring entries are conservatively broadened.
+
+This global policy does not enumerate the filesystem on the verified macOS path: the pinned native implementation translates unreadable globs into anchored Seatbelt regular expressions, including `**/`, at read time. A glob containing `**` does not automatically protect descendants, which is why the explicit `/**` rules are required. [Pinned Seatbelt compiler](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/sandboxing/src/seatbelt.rs#L441-L581), [policy-level glob semantics](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/protocol/src/permissions.rs#L306). Other native platforms must pass their runtime proof; no native Linux account/model success is claimed.
+
+## Focused verification
+
+Pinned Bun 1.4.2 on the remote Linux runner passed TypeScript, plugin-bundle freshness and 365 tests in 20 affected files (2,883 assertions). The actual macOS Codex 0.146.0 preparation passed again with core deny, explicit paths and nested substring rules. All 421 existing seed anchors remain unique; this static check is not a seeded-runtime result. These focused results predate the compatibility repair and do not establish a successful final-head full gate. Existing catalog/guard tests, the registry baseline and seed manifest are byte-unchanged.
+
+
+## Compatibility repair checkpoint
+
+The full CI run at historical head `4aa64c12` exposed nine failures in unchanged I2 compatibility tests: the original headless Codex/Kimi reviewer-role declaration had been reinterpreted as a fresh variant. That head's 421 seeded guards passed; seed success did not waive the compatibility failures. The repair adds explicit `review_mode: "fresh"` opt-in for Codex/Kimi, preserves existing Claude selection and keeps legacy native reviewer-role instances outside the fresh pool. The native production privacy-profile proof is unchanged by this declaration repair. The repaired head's final full CI gate is pending.
+
+After the explicit-fresh declaration correction, pinned Bun 1.4.2 passed TypeScript, bundle freshness and 381 tests in 24 affected files (3,052 assertions), including every previously failing I2/reload/worktree/revert test. The isolation producer and common child lifecycle are byte-identical to the native-probed implementation. All 421 existing source anchors remain unique. Final full CI for the corrected head remains a separate PR gate.
+
+
+## Review correction: runtime Apps contribution
+
+Independent review found that the original `strictMcp` claim exceeded its evidence. In the pinned source, Apps is stable and enabled by default; the runtime MCP projection adds the ChatGPT Apps compatibility server independently of plugin loading. `mcp list` calls `configured_servers`, which intentionally omits those runtime contributions. The earlier empty-home admission did not exercise ChatGPT-authenticated connectors and is not proof that they were excluded. [Feature defaults](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/features/src/lib.rs), [runtime/configured MCP projections](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/core/src/mcp.rs), [CLI inventory](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/cli/src/mcp_cmd.rs).
+
+The corrected policy explicitly disables Apps and requires a bounded, unique effective-feature readback of `apps` as false, as well as plugins/hooks false, before granting a receipt. The fixed exec argv carries the same switches and disables web search, whose cached mode is served remotely. Missing, duplicate, malformed or enabled Apps readbacks refuse admission even if configured MCP inventory looks strict. Fake producer regressions and daemon argv assertions cover this distinction. On 2026-10-19 the corrected production backend passed again with empty temporary HOME and CODEX_HOME, using Codex 0.146.0 and an inert `/usr/bin/false` hub transport. It returned `apps-disabled-effective-feature-readback`, `web-search-disabled`, the existing filesystem/MCP evidence and `current: true`; no exec/model/account call ran. This verifies the effective Apps feature gate in addition to configured-server inventory, with the pinned source proving that the disabled gate removes the runtime compatibility server. The daemon argv regression pins Apps/plugins/hooks disable switches, project trust, named default permissions and disabled web search. Final-head CI remains a separate gate; account/model execution remains unverified.
+
+
+## Review correction: standard host credentials
+
+The PR bot identified a second privacy gap: portable core filename/state rules do not cover ordinary files such as `.config/gh/hosts.yml`, `.kube/config` and `.docker/config.json` under the host home. With `/ = read`, configured project-private patterns alone are insufficient. The correction adds fixed standard host credential directory/file denies, configured XDG/tool-home roots, existing real-path aliases and descendants. Credential protection does not depend on a person configuring `local.deny`.
+
+Regressions use a synthetic HOME and configured roots, never real credential contents. The native admission fixture also requires synthetic gh/kube/docker credential reads to fail. This is a bounded standard credential list, not a claim to discover or classify every personal/private file on the host; projects must continue to declare additional private paths. On 2026-10-19 the actual corrected production backend passed with Codex 0.146.0 in empty temporary HOME/CODEX_HOME. Its native sandbox denied synthetic gh/kube/docker credential files and a symlink alias, returning `standard-host-credential-roots-denied` alongside Apps-effective-state and existing filesystem evidence, with `current: true`. These fixtures contained only canary text; no account/model/exec call or credential copy was involved. Final-head CI remains the PR gate.
+
+
+## Review-fix focused gate
+
+After both Important fixes, the related nits and the host-credential correction, pinned Bun 1.4.2 on the remote Linux runner passed 445 tests in 29 affected files (3,164 assertions), TypeScript and generated-bundle freshness. The final native model-free preparation also passed on macOS as described above. All 421 existing seed anchors are unique; runtime seed success is a separate exact-head CI gate. Legacy/frozen tests, the registry baseline and seed manifest remain unchanged. These results do not supply independent approval or native account/model acceptance.
+
+
+## Review correction: canonical credential ancestors
+
+The prior Linux and CI evidence did not expose the developer Mac's default `/var` to `/private/var` TMPDIR alias. Local pinned Bun 1.4.2 reproduced both the existing synthetic-HOME failure and an explicit symlinked-HOME/missing-descendant regression before the fix. Standard names are now joined under both lexical HOME and its canonical deepest existing ancestor; every credential root also resolves its deepest existing ancestor before appending absent components. Both spellings and existing final symlink targets remain denied. Dangling links and unreadable ancestors refuse admission. The adapter keeps this short strict ancestor walk local because importing `path-policy` would introduce a registry cycle.
+
+Privacy ceilings remain explicit: credential roots are derived from the child environment's HOME and configured overrides. If HOME is overridden, the separate account home returned by `os.userInfo().homedir` is not automatically included. The bounded list also does not include shell history/rc files (`.zsh_history`, `.bash_history`, `.zshrc`), `Library/Application Support`, `.pgpass`, `.m2/settings.xml`, `.gradle/gradle.properties` or `.oci`; additional private paths must be declared. This is not a universal private-home sandbox.
+
+`web_search="disabled"` is a requested config value, without effective-turn readback. At the pinned source, managed requirements that prohibit Disabled can make `resolve_web_search_mode_for_turn` select Cached instead. The receipt evidence label `web-search-disabled` records only that configured value. Therefore the flag is not proof that remote cached search is unavailable; the effective Apps feature proof and native filesystem denial evidence do not establish that separate boundary. [Pinned web-search resolution](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/core/src/config/mod.rs#L2979-L3005).
+
+
+Local verification after this correction used pinned Bun 1.4.2 and the unmodified default macOS TMPDIR: 40 tests across `codex-review-isolation` and `reviewer-pool-tasks` passed (166 assertions). A model-free native Codex 0.146.0 preparation also passed under a synthetic symlinked HOME; after the returned profile was built, a new synthetic `.kube/config` was created under the physical HOME and a direct native sandbox cat of that canonical path was denied. The fixture was removed. No account, credential copy, model request or `codex exec` was involved. The named exec-profile-selection and effective web-search ceilings remain unverified as described above.
+
+
+The corrected source then passed the remote Linux focused gate: 447 tests in 29 files (3,176 assertions), TypeScript and pinned Bun 1.4.2 bundle freshness. All 421 existing seed anchors remain unique. Final-head CI is required separately; the local default-TMPDIR result is the developer-Mac regression evidence, not inferred from CI.
+
+
+## Main rebase after shard-store merge
+
+The reviewer-pool branch was rebased onto main `29719a78` after #534 merged, retaining the memory-open changes and exact agent-mem 0.4.0 pin. The only rebase conflict was the generated plugin bundle; it was regenerated with pinned Bun 1.4.2 and the installed 0.4.0 dependency. Reviewer source/tests, including the canonical credential fix and same-family reason, are byte-identical to the locally verified pre-rebase versions. The imported platform helper file is also byte-identical between published 0.3.1 source and installed 0.4.0 (SHA-256 `2ab3908eb317833e000616760ad04c1dffe7befadea542535d8d9dba330411eb`).
+
+I separately ran the exact merged main's memory tests: 220 pass, 1 environment skip, 0 fail in 25 files (1,584 assertions), plus TypeScript. Further local integration/native reruns after rebase were deferred by host resource admission; no bypass was used. The new final-head CI must establish the combined tree's full gate. No new native-account/model result is claimed.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -64,7 +64,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -76,7 +76,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -88,11 +88,12 @@
         "src/adapters/definitions/native-quota.ts",
         "src/adapters/definitions/native-context.ts",
         "src/adapters/registry.ts",
-        "src/hub/instance-budget.ts"
+        "src/hub/instance-budget.ts",
+        "src/hub/claude-state.ts"
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -106,7 +107,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -151,7 +152,10 @@
         "src/adapters/definitions/native-cli-*.ts",
         "src/hub/instances.ts",
         "src/hub/instance-config.ts",
-        "src/hub/instance-execution.ts"
+        "src/hub/instance-execution.ts",
+        "src/hub/usage.ts",
+        "src/hub/claude-state.ts",
+        "src/hub/memory-profile.ts"
       ]
     },
     "docs/agent-notes/local-worker.md": {
@@ -176,7 +180,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -192,11 +196,15 @@
         "src/hub/daemon.ts",
         "src/hub/settled-roles.ts",
         "src/adapters/definitions/builtin-metadata.ts",
-        "src/hub/bus.ts"
+        "src/hub/bus.ts",
+        "src/hub/review-brief.ts",
+        "src/hub/reviewer-pool.ts",
+        "src/hub/reviewer-pool-config.ts",
+        "src/hub/release-admission.ts"
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -215,7 +223,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.35",
+  "version": "0.12.37",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",
@@ -17,7 +17,7 @@
     "bun": ">=1.4.2"
   },
   "dependencies": {
-    "@staix/agent-mem": "0.3.1"
+    "@staix/agent-mem": "0.4.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.35",
+  "version": "0.12.37",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",