@staix/agent-hub 0.12.36 → 0.12.37

package/docs/security.md

@@ -23,7 +23,7 @@ agent-hub connects agents that can each run commands. This page says what the hu
 
 ## Native memory authority and profile selection
 
-The portable core is the exact-pinned first-party `@staix/agent-mem` 0.3.1 package; it does not replace the hub's caller identity, PII policy or task-write authority. Deny, hardened git, real paths and process identity are single-sourced in its Node-safe platform entry. Current project privacy is applied by the hub before promotion and again before model-facing reads. Standalone person reads are unscreened, and the standalone `--policy-free` acknowledgement grants no hub or peer authority.
+The portable core is the exact-pinned first-party `@staix/agent-mem` 0.4.0 package; it does not replace the hub's caller identity, PII policy or task-write authority. Deny, hardened git, real paths and process identity are single-sourced in its Node-safe platform entry. Current project privacy is applied by the hub before promotion and again before model-facing reads. Standalone person reads are unscreened, and the standalone `--policy-free` acknowledgement grants no hub or peer authority.
 
 `hub_memory_search`, `hub_memory_show` and `hub_memory_graph` take the project from the daemon, require `memory_read`, refuse private turns and validate UTF-8 input before logs or storage work. Complete records and graph metadata are screened before counts and truncation. Search is at most 20 lines/4 KiB (default 8); show accepts at most 8 ids and returns at most 8 KiB; graph is at most 120 nodes/240 edges/6 KiB (default 60 nodes), with no edge lacking an endpoint. Unknown, ambiguous and withheld ids share one neutral refusal. Arguments and results are excluded from hub-managed capture; this does not govern a vendor's independent transcript or memory hooks.
 
@@ -33,6 +33,8 @@ The hub binds the selected root/profile at open. Invalid/missing generation meta
 
 Before migrating any real home, every hub sharing it must first be on 0.12.30 or later with positive authenticated binding or unbound/quiesced proof from `ahub memory profile-check` in each relevant registry. An unknown or unreadable runtime is not proof of absence, and a matching ready binding still holds a handle that must be closed. Profile-check reports only its named registry inventory. Root paths, selector receipts and malformed-legacy counts are person-local diagnostics, excluded from ordinary peer status and allowed agent CLI reads. Source/fixture checks do not establish native capture, real migration or account/device-sync success.
 
+On a home split by `amem migrate --shards`, the hub opens only its own project's shard, with the user shard as overlay, under the alias-resolved project key (#534, #537); other projects' private notes are not in that store. Each memory entry rechecks the shard identity, and an alias that later remaps the key latches the binding unavailable. A split that is not active refuses and is never read as an empty or legacy store. A hub on 0.12.36 or earlier does not detect a split and keeps writing the old layout, so every hub on the home must run 0.12.37 or later, or be stopped, before splitting. `ahub memory profile-check` is not split-aware yet (#536): on a split home its mismatch reports are not evidence either way.
+
 ## What is not defended
 
 - **A malicious local process running as you.** It can read the control token, `hub.db`, the project and your home directory without the hub's help. The token keeps web pages and other users out, not your own processes.
@@ -238,7 +240,7 @@ never-ask still requires the person's confirmation. qwen_cmd is machine-local an
 never editable through settings. Legacy benchmark adapters remain unmanaged by
 this production table. Startup diagnostics withhold native host/payload details.
 
-Jcode is optional, source/version-fenced and runs native tools without a hub sandbox or hub permission-mode mapping. .jcode joins the scoped-grant exclusion, including lexical/resolved aliases. Only a person writes its unique project MCP entry; foreign/override/symlink entries refuse. The hub owns a private daemon/socket and ACP group, never the global daemon, and copies no credentials. Native diagnostics withhold payloads/hosts. Unproved conversation loads refuse; no fresh replacement is called a restore.
+Jcode is optional, source/version-fenced and runs native tools without a hub sandbox or hub permission-mode mapping. .jcode joins the scoped-grant exclusion, including lexical/resolved aliases. Only a person writes its unique project MCP entry; foreign/override/symlink entries refuse. The hub owns a private daemon/socket and ACP group, never the global daemon, and copies no credentials. It accepts only a plain jcode release from 0.98.0 up to, not including, 1.0.0 (#529), and runs every owned jcode process (version probe, daemon, ACP) with `JCODE_NO_TELEMETRY=1`, because jcode's telemetry can report the provider account's email. Native diagnostics withhold payloads/hosts. Unproved conversation loads refuse; no fresh replacement is called a restore.
 
 # Transient ACP activity (#286)
 
@@ -343,6 +345,8 @@ Stall causes are persisted and deduplicated by cause and replanning revision. Pl
 
 A declared instance whose only role is reviewer gets review requests, task messages addressed to it and the person's messages; agent chat, digests and presence are discarded and journaled, and it gets no memory recall (#223). The headless Claude reviewer runs one new `claude -p` per review with `--setting-sources ""`, `--strict-mcp-config`, `--no-session-persistence`, tools limited to Read, Grep, Glob, `hub_review` and `hub_task_show`, and `dontAsk`. Its prompt holds hub facts and a bounded diff, never the builder's summary, and its `hub_task_show` drops the builder's notes. Changes touching `local.deny` or `pii.paths` are withheld and passed as `Read` deny rules, which Claude enforces, not the hub. Private tasks are never given to it. Its `hub_review` counts only while the child started for that task still runs; a stop or exit revokes it first, and surviving processes hold the delivery as `needs_review` and keep the reviewer busy.
 
+The fresh Codex reviewer (#519) needs `review_mode: "fresh"` and an installed Codex 0.146.0; any other version is unavailable. Before each review it requires a model-free isolation receipt: binary and config unchanged, only the two hub tools in the configured MCP inventory, plugins, hooks and Apps disabled (Apps by a separate feature readback), and a named filesystem profile whose fixtures prove public reads, private-path denial (exact, glob and symlink), standard host credential denial and write denial. Credential and tool-home roots are denied even with an empty `local.deny`; that list does not cover every personal file. Its shell is sandboxed read-only, not Claude's Read/Grep/Glob whitelist. Network and web search are configured disabled but not observed: managed requirements can still select cached web search, and no run has shown the review selecting the profile through `default_permissions`. A failed receipt or start never falls back to a continuing native session, and a child that ends without a saved verdict is never approval. Kimi and agy reviewers are unavailable placeholders and never run.
+
 The review brief (#520) withholds private changes whole (both sides of a move) and counts them; a rule file that fails the private-data screen is named, not shown. Attributes and rules are read at the merge base, so a change cannot loosen its own review. Spec acceptance, plan review, premature-review and cost reads fetch GitHub metadata only (edit times, check states, thread authorship and resolution), never issue bodies or comments. The CI workflow keeps `contents: read` and `actions: read`.
 
 ## Bounded task specs and isolated checks (#418)

package/docs/smoke.md

@@ -1709,9 +1709,9 @@ the native version and observed outcome here. No hub-driven Qwen TUI is offered.
 
 Qwen recovery source/fake proof: saved ids pass through the driver and CLI to ACP session/load, and the crash loader restores the recorded id/model. Actual native/provider recovery remains unverified.
 
-## Jcode 0.94.0 peer (#332)
+## Jcode peer, 0.98.0 to 1.0.0 (#332, #529)
 
-Source/fixture proof is recorded in verification/2026-10-11-jcode-peer-contract.md. Unverified: real provider/model, native project MCP discovery and hub-tool receipt, native tool policy and stop/child teardown. Native automatic restoration is withheld because the pinned ACP load does not prove the id. No benchmark comparison or default replacement ran.
+Source/fixture proof is recorded in verification/2026-10-11-jcode-peer-contract.md; the live owned-daemon and ACP handshake on 0.94.0 and 0.98.1 in verification/2026-10-19-jcode-0.98.1.md. Unverified: real provider/model, native project MCP discovery and hub-tool receipt, native tool policy and stop/child teardown. Native automatic restoration is withheld because the pinned ACP load does not prove the id. No benchmark comparison or default replacement ran.
 
 
 ## Project board (#263)
@@ -1935,3 +1935,19 @@ hub instance stays running with its queue and pauses intact. Record the source
 head, terminal and daemon readbacks separately before claiming AC5 native smoke.
 
 For the guarded CLI leg, edit a disposable untracked WIP limit, run `ahub settings reload`, inspect its complete before -> after preview, decline and verify the running limit is retained. Repeat and confirm y, then verify the same instance and queue/pause state. Record this separately from the scripted CLI fixture; the token proves freshness within console authority, and the CLI supplies the person-presence checks.
+
+
+## Reviewer pool native legs (#519, 2026-10-19)
+
+Native account/model acceptance is **UNVERIFIED**. See [reviewer isolation evidence](verification/2026-10-19-reviewer-isolation.md) for the exact source/version pins and offline probes. Those probes used temporary fixtures and no model prompt, account login or credential copy. Fake-CLI tests and CI are separate host-contract evidence. Existing #223 Claude behavior is retained without a new live Claude claim.
+
+Complete these legs in a disposable project with authorized accounts after source integration and exact-head CI:
+
+- Declare headless Claude and Codex reviewer-only instances, adding `review_mode: "fresh"` to Codex. Claude retains the automatic #223 declaration. For Codex, select the proved 0.146.0 binary and verify its runtime isolation receipt before a model turn; a 0.163.0 PATH executable must remain unavailable.
+- Submit a small public change with a pinned reviewed head. Confirm a different-family reviewer, fresh native session, expected read-only policy, the fixed two hub tools and a verdict carrying `reviewContext: fresh`, `reviewerFamily` and `reviewerReason`. Confirm builder done narrative is absent from both prompt and `hub_task_show`.
+- Request a delta review and confirm the same eligible independent reviewing family receives a new session with prior findings. After an earlier same-family fallback, a newly available independent family still takes precedence. Exercise configured re-rotation separately. Stop or exhaust one reviewer and confirm the pure routing walk chooses the next eligible candidate; no failed start or child ending without a saved verdict becomes approval. Check the next candidate even when the missing verdict followed a vendor quota error; no text-based quota classifier is assumed.
+- Make all pool candidates unavailable and confirm a blocked review awaiting planner/person action. Then test a different fresh session in same-family fallback only when no other family can run. Verify stale-child, changed-head and private-review verdict refusals.
+- Verify compatibility separately: a Codex/Kimi headless reviewer-role declaration without `review_mode` keeps its native app-server/ACP behavior and existing worktree/permission options, and stays outside the fresh pool. An explicit fresh declaration must refuse an unsupported backend without downgrading.
+- Keep Kimi and agy out of the default pool. Explicitly requesting either currently yields unavailable and a skip, not a model launch or pass. No Kimi/agy launch code is included in #229. Their follow-up #533 (hub task #234) needs strict MCP/config, private-read, write-denial and fresh-session receipts before native smoke can count; the future agy launcher belongs in `src/adapters/agy/`.
+
+Record source head, exact executable version/hash, isolation receipt, task/head identities, route walk, distinct native session evidence and persisted verdict separately. Do not record credentials or raw transport environments. Codex sandboxed shell must not be described as Claude's Read/Grep/Glob-only whitelist. Network policy is configured disabled; no network-denial probe or native LLM isolation result has been recorded by this investigation.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -2454,11 +2454,12 @@ the queue.
 
 ## Amendment: optional owned Jcode peer (#332)
 
-- jcode is optional on the roster, default off, with implementer/verifier guidance and no default routing replacement. Its source-pinned native identity is jcode 0.94.0.
+- jcode is optional on the roster, default off, with implementer/verifier guidance and no default routing replacement. Its native identity is jcode from 0.98.0 (the minimum; verified live on 0.98.1) up to, not including, 1.0.0 (the assumed breaking version); the minor is not pinned. Lower the breaking version when a release is shown to break the contract (#529).
 - A private foreground daemon/socket and ACP client belong to this peer. The global daemon is never adopted or stopped. No automatic update, self-dev or credential copy. The native MCP store must already exist to avoid implicit Codex import.
 - ACP session MCP arrays are ignored natively, so the person launcher manages only agent-hub-jcode, shared:false, in project .jcode/mcp.json. Later override layers, foreign names and links refuse. Daemon starts verify read-only. .jcode is outside scoped grants.
 - Native policy is unmanaged and has no hub sandbox. Hub permission mappings refuse; native quota/consumption are not inferred. Every task mutation stays in Tasks and PII remains at existing redaction/routing boundaries.
-- Native 0.94.0 load lacks identity proof. Controlled recovery refuses before effects, crash recovery is manual and a load without an exact echoed id refuses before a prompt or restored claim. Real provider/tool/teardown evidence and comparative measurement remain unverified.
+- The private socket name ends in `.sock`: jcode names its debug socket by replacing that suffix. Every owned jcode process runs with `JCODE_NO_TELEMETRY=1` (#529).
+- Native ACP load (verified on 0.94.0 and 0.98.1) lacks identity proof. Controlled recovery refuses before effects, crash recovery is manual and a load without an exact echoed id refuses before a prompt or restored claim. Real provider/tool/teardown evidence and comparative measurement remain unverified.
 
 # ACP watch amendment, 2026-10-11 (#286)
 
@@ -3575,6 +3576,18 @@ Owner decision 2026-10-18 (#450 comment 6248184754), R1-R5. R3's mechanism, chos
 - **Settlement.** A start failure before any review in a delivery ran is `failed_safe`; after one ran, the delivery is held as `needs_review`. A failing facts or verdict-check callback is logged, and the review counts as without a recorded verdict.
 - **Never an owner.** The reviewer variant carries `routing.reviewOnly`; assignment refuses it as an owner for every task class and when named.
 
+## Reviewer pool amendment (#519, hub task #229)
+
+Planner ruling, 2026-10-19: #229 implements R3-R6 for Claude and Codex; admission is receipt-gated. Only proved reviewer profiles ship as runnable variants. The existing #223 Claude variant is retained; Codex is restricted to its verified 0.146.0 profile and a passing runtime receipt. Kimi and agy remain unavailable with metadata reasons and outside the default pool; #229 adds no launch code for either. All Kimi/agy launch, isolation and receipt work is in #533 (hub task #234), with the future agy launcher in `src/adapters/agy/`. The [isolation evidence report](../verification/2026-10-19-reviewer-isolation.md) records primary sources, offline probes and untested native legs. Source integration and model-free admission are verified; final-head verification remains the required PR gate.
+
+- **Pool and routing.** The default logical kind order is Claude, Codex as fixed configured kind slots; undeclared/unavailable slots are skipped after modulo without renumbering. `review.pool` accepts registered reviewer kinds (Claude, Codex, Kimi and agy), including the unavailable placeholders; local/Pi are refused. An explicit pool with no declared candidates blocks for the person. An omitted pool with no fresh reviewer declaration retains legacy routing. With an omitted pool, exhaustion retains the #223 R5 eligible-planner fallback, preserving the exhausted pool walk and reason in trace/history; absent an eligible planner, the person reviews with a blocked result. This applies also to unavailable-only declarations outside the default pool. An explicit required pool remains blocked for the person on exhaustion; explicit nominations cannot bypass backend unavailability. Unavailable never means pass. Pure `assign()` starts at PR number modulo the fixed configured kind count when linked, otherwise task id modulo that count, walks unavailable/paused/quota/failing candidates and skips the implementer's family while another can run. Delta review keeps the preceding reviewing family by default when it remains eligible and independent, with configurable re-rotation. Family independence still takes precedence over continuity after an earlier same-family fallback. A start failure or any child ending without a saved verdict walks the remaining candidates for that review; no quota category is inferred from vendor text. Explicit named reviewer choices remain outside automatic pool replacement; a failed pinned review stays held for the person. Board transitions still go through Tasks. A same-family fallback uses a different fresh child and is recorded. Exhaustion records `blocked: no reviewer can run` and leaves planner/person review available; it never auto-approves.
+- **Variants and authority.** Fresh variants require a declared headless instance with roles exactly `["reviewer"]`. Codex and Kimi additionally require `review_mode: "fresh"`; without that opt-in, existing headless reviewer-role instances retain their native app-server/ACP transport, worktree and permission semantics and do not join the fresh pool. Claude retains #223 automatic selection for its headless reviewer-only declaration; agy remains an automatically unavailable metadata-only declaration. An unsupported fresh backend refuses without falling back to a native continuing session. Ordinary implementer instances retain their native adapters. The common lifecycle starts a fresh child per review, never resumes, filters builder narrative/shared memory, retains private-diff/read/verdict fences and permits only `hub_review` and `hub_task_show` from the hub. Process-group cleanup and the per-child verdict token retain #223 semantics. A missing receipt refuses before a model starts.
+- **Codex receipt.** The producer resolves a host executable outside the project and binds its native binary hash and config metadata. It checks the exact supported version, performs bounded model-free MCP inventory/readback, disables ambient stdio/HTTP servers with self-contained stubs and verifies the fixed hub's two-tool allowlist. Plugins, hooks and Apps are disabled and the physical project is untrusted. Because `mcp list` omits runtime ChatGPT Apps contributions, a separate bounded `features list` readback must prove Apps disabled; inventory alone is not a strict-MCP receipt. The policy requests disabled web search and is passed to exec. There is no effective-turn web-search readback; managed requirements can override this request to Cached at the pin, as recorded in the verification ceiling. A named filesystem profile is read-only with portable core deny rules, explicit private-path/subtree rules, standard host credential directories/files (including configured XDG/tool-home overrides, deepest-existing-ancestor canonical paths for absent descendants and existing real-path aliases), the hub state directory and network disabled; a native temp-fixture proof, including synthetic gh/kube/docker credential reads, precedes the ephemeral exec launch. These standard credential denies supplement the portable core and project policy; they do not classify arbitrary personal files elsewhere on the host. The binary is hashed once during preparation, with dev/ino/size/mtime/ctime rechecked before spawn along with config metadata. PATH Codex 0.163.0 is unsupported, not an inferred pass. No credential copy or blanket approval bypass is added.
+- **Read-only meaning.** Codex retains sandboxed shell under that filesystem/network policy; it does not have Claude's Read/Grep/Glob-only whitelist. The offline fixture measured filesystem denial, not a model turn or network-denial result. No recorded run shows exec selecting `ahub-review` through `default_permissions`; the configured exec argument and explicit-profile sandbox proof remain separate evidence. Post-check same-user mutation remains a documented ceiling. Kimi plan mode and agy plan mode alone are not isolation receipts.
+- **Registry contract.** The data-only agy declaration is separate from the native runtime catalog and does not extend the legacy supported-peer or optional-peer lists. Their existing pinned expectations and the empty registry-guard baseline stay intact. Only declared unavailable reviewer instances can name that metadata; it adds no agy native adapter or launcher.
+- **Recovery compatibility.** A configured pool or declared fresh reviewer requires target feature `reviewer_pool`; an older target cannot drop `review_mode: "fresh"` or silently restore it under ordinary adapter policy.
+- **History compatibility.** Keep `reviewContext` as its existing `fresh`/`continuing` string. Add host-recorded `reviewerFamily` and `reviewerReason` fields for rotation, implementer skip, unavailable skip and same-family fallback. `ahub route explain` renders the same pure routing walk; agent prose never supplies routing authority or a passing receipt.
+
 ## Review brief amendment (#520, hub task #228)
 
 ahub builds the review brief that the workspace gate used to take from `ocr delegate preview` and `rule`, and gives the same brief to every reviewer.
@@ -3702,7 +3715,7 @@ and mutant result, per the reviewer's explicit ruling.
 ## Amendment: planner plan review and board governance, 2026-10-18 (#481 S9)
 
 - The person's mode-boundary ruling separates board governance from lifecycle enforcement. WIP-at-accept and planner/person return of accepted work without work evidence apply in every `sdlc.mode`; only the current plan-review receipt gate uses enforce/refuse, advise/report and off/no gate. Existing lifecycle schema aliases and ordinary off-mode receipts are unchanged.
-- Tasks owns plan-review receipts, accepted-untouched returns and all offers/acceptances. Review evidence contains the planner, planning revision, recorded time and fixed-query GitHub issue metadata. An issue body or comments are never fetched or stored by this readback. A changed body edit time or planning revision invalidates the receipt; missing evidence remains unknown. The synchronous acceptance API cannot bypass the fresh enforce readback.
+- Tasks owns plan-review receipts, accepted-untouched returns and all offers/acceptances. Review evidence contains the planner, planning revision, recorded time and fixed-query GitHub issue metadata. An issue body or comments are never fetched or stored by this readback. A changed body edit time or planning revision invalidates the receipt, except the complete contiguous release-only revision history defined by S11; issue identity/edit and cost-scope checks still apply; missing evidence remains unknown. The synchronous acceptance API cannot bypass the fresh enforce readback.
 - S1 person spec acceptance and S9 planner review remain independent. `acceptReviewed` reads both against one task snapshot before the acceptance write. A `done` that implicitly accepts proposed work checks WIP and both readbacks before any cohort or board write; the missing-spec refusal retains precedence over missing-plan admission. Off keeps its synchronous ungated acceptance path apart from the all-mode WIP rule.
 - The accepted-untouched exception is a distinct, revision-bound return transition with a screened reason. It preserves history and planning fields, withdraws former role requests and enables replanning. Historical acceptance still protects cancellation and undo. Done/check/review/integration evidence or branch/commit/PR/local/review artifacts refuses this exception; it does not grant a general planner unassign permission.
 - Grooming is an ids/codes-only read projection with repository-scoped comparisons, explicit unknown/truncated evidence and person-only actions rendered as commands. It does not infer a ruling from arbitrary task prose, fetch issue bodies, mutate dependencies or invoke a model. Limits are 500 task rows, 256 findings and eight metadata reads within four seconds; a future paginated repository resolver supplies exhaustive coverage.
@@ -3727,8 +3740,25 @@ S9 privacy and notice ceilings: private build work with an issue ref remains ina
 
 ### S10 cost governance amendment (#481, hub task #215)
 
-- Task plans carry explicit review scope (none/delta/full, bounded reviewer count) and CI scope (focused/full/reuse); S9 receipts copy the planner-selected values. None uses zero reviewers; other scopes use one to eight. Legacy scope is unspecified, readable and never guessed. Advise reports the gap; new enforce receipts require both scopes, while old scope-less receipts remain valid to their next planning revision. Omitted cost keys on an owner file-list update retain the reviewed scope; explicit prospective drift refuses enforce acceptance. Scope does not change reviewer authority or bypass CI; S2 owns actual conformance comparison.
+- Task plans carry explicit review scope (none/delta/full, bounded reviewer count) and CI scope (focused/full/reuse); S9 receipts copy the planner-selected values. None uses zero reviewers; other scopes use one to eight. Legacy scope is unspecified, readable and never guessed. Advise reports the gap; new enforce receipts require both scopes, while old scope-less receipts remain valid to their next non-release planning revision under the complete-history S11 exception. Omitted cost keys on an owner file-list update retain the reviewed scope; explicit prospective drift refuses enforce acceptance. Scope does not change reviewer authority or bypass CI; S2 owns actual conformance comparison.
 - Review admission is separate from #520 brief/coverage. Before done/cohort writes, enforce requires the task's exact PR head, successful configured checks (native default: both OS checks and seeded guards), and no unanswered pending bot thread. Resolution settles a thread; an unresolved thread needs a user reply after the last bot comment. Only metadata is fetched. Advise reports gaps, including a generic unknown-readiness notice when a private turn finishes its own PII task without remote metadata; ordinary work remains refused during a private turn. Off adds no readback. Identity/privacy/owner and runtime authority are rechecked across awaits and each external read. Background role maintenance may retain a saved role while holding an unadmitted review envelope; a manual reviewer resend performs fresh admission.
 - Whole-workflow repository serialization closes the admission race, keeping required check names and read-only permissions; queue:max retains up to 100 pending controllers instead of canceling the previous pending one. Identical-tree successful full proof is reused for PR and push. Reuse expands both OS matrix names and reports the required seeded aggregate, using only a `Reuse verified identical-tree full gate` marker step with the original run id. These successful reporting jobs and skipped jobs are not fresh full proof; duplicate active full gates and unknown active coverage refuse admission. Pending controllers do not run gates. CI proof searches are bounded; missed older success can require a new gate, never invent green evidence.
 - Cost reporting is read-only over bounded current public board links plus merged-PR/check metadata: review handoff rounds and elapsed time, CI run ids and extra attempts, full re-reviews versus deltas, and unknown scope. Private/relinked counterparts are excluded at each read and projection. Pure band-breach proposal data is delivered here; the S7 baseline/configuration/automatic board-card scheduler is deliberately not implemented in S10.
 - Nonblocking policy ceilings stay unchanged and are recorded in hub task #230: fail-closed metadata errors, repository-wide queue fairness, unknown thread author kinds, and strict advise readback races. Their planner-reviewed alternatives are deferred.
+
+### S11 release-train amendment (#481, hub task #216)
+
+- The existing `release` task field and release planning table remain authoritative. Additive optional train metadata records enumerated hotfix cause/reason, frozen task ids, and bounded actor/time/resource history. Legacy rows omit it.
+- "One open release" means one active/frozen train. Future planning rows are permitted as rollover destinations. A dedicated release-only assignment may move approved/in-flight tasks without modifying their execution state, owner, reservation, dependencies or person pins; every move needs a reason and current revision. Public reasons are screened; private scope moves are person-only and retain the reason solely in withheld board history without model screening. Public readiness/cut still refuses private scope. General backlog planning authority is unchanged.
+- The planned date is a due trigger, not a waiver. A cut requires nonempty approved scope; unfinished/cancelled tasks move out with a reason before cut. It pins the complete scope and release revision through all awaits and the final transaction. Planner cut is a dedicated operation; legacy planner freeze refusal stays intact. Enabled or configured-train freezes cannot bypass the admitted cut API. Ship/drop remain person-only; a changed frozen scope blocks shipment.
+- Cut admission holds a bounded five-second host-controller repository lease through the metadata freeze. The controller executable is host-resolved, its child command is fixed, and the shared gate lock is checked before and at freeze. Unknown admission or unknown/stale attached-peer account quota windows with a real quota source defer. A real source means the adapter definition supplies `budget.reader`, or it uses soft-token accounting with an enabled limit (Kimi: `kimi_tokens_5h > 0`); registered accounts without a configured source are reported as `no quota source` and do not defer for missing readings; unknown external accounts still require evidence. Budget-record and manual pauses still defer for every attached peer. Every later heavy step still needs its own admission.
+- Hotfix causes are closed: data/message loss, security/privacy defect, blocked upgrade/start, core flow without workaround. Reason is bounded and screened. No hotfix waives a gate, grants publish authority or starts an upgrade.
+- Actual cut/shipment event timestamps and frozen scope drive interval/approval lead-time metrics. Hotfix rate uses shipped releases. Bounded CI counts refer to planned-task PR metadata at cut, including attempts; review counts refer to board verdict history. Unavailable/legacy evidence remains unknown, and release-preparation PR costs require separate receipts. S7 owns bands/proposals; S6 owns authorization. The per-release "gates run" record is explicitly deferred to S6/S7; a cut record is not gate-execution evidence. No GitHub body, publish, merge or tag write is added.
+
+- Person ruling 2026-10-19 supersedes the earlier planner ruling on S11 upgrade admission: upgrade is excluded from S11 host-admission, quota and additional all-idle gates. Recovery retains the pre-S11 `recoveryReady()` requirement (no busy peers, pending approvals resolved and completion checks settled), operation-identity checks and existing lifecycle fences. Quota/manual pauses, missing/shadowed `dot` and nested host admission add no S11 upgrade refusal. The person's existing recovery-operation selection remains the confirmation; no separate receipt or agent upgrade authority is added. Release-cut host/quota gates remain unchanged.
+
+- Configured cut dates are positive safe UTC millisecond timestamps within the Date range; null, coercible values and invalid numbers refuse at the Tasks boundary before screening or board writes. The additive `release_trains` daemon feature is required of a recovery target while a configured train is active/frozen, before source holds/capture and again after awaits/before commit. Legacy and queued future release rows do not add this downgrade floor. Protocol 16 remains unchanged.
+
+- Release-cut deferrals name their applicable exits: stop or resume paused peers, adjust the relevant `ahub budget set` setting, or drop the train with `ahub release drop`. Missing or shadowed `dot` requires installing the resource controller or fixing PATH; nested admission requires retrying the cut outside the outer admission lease. These host/quota gates do not apply to upgrade.
+
+- S11 follow-up invariants: contiguous planning revisions changing exactly `["release"]` retain the S9 reviewed execution plan; other or missing planning history invalidates it. Cut-time CI cost reads are limited to the scoped PR ids (at most 16 in one repository); read errors or unbounded/mixed scope remain unknown and cannot abort a valid cut. Train history is capped at 256 events: configuration no-ops append nothing, meaningful configuration reserves cut/shipment slots, and capacity refusals are pre-effect.

package/docs/verification/2026-10-19-0.12.37.md

@@ -0,0 +1,60 @@
+# 0.12.37 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or native/live acceptance.
+
+## Candidate
+
+Version 0.12.37, control protocol 16 (unchanged; the daemon now advertises the `release_trains` and `reviewer_pool` features), from merged main `86693a2a`. The person directed the release on 2026-10-19.
+
+- #529 (PR #530): the Jcode adapter accepts any plain jcode release in `[0.98.0, 1.0.0)` instead of exactly 0.94.0; the owned daemon's private socket is named `j.sock` so jcode's derived debug socket no longer collides; every owned jcode process runs with `JCODE_NO_TELEMETRY=1`.
+- #481 S11 (PR #527): release trains through the board's release assignments, missed-work moves with a reason, admitted cuts through host resource admission and fresh peer quota checks.
+- agent-mem#15 T2 host prerequisite (PR #534, hub task #237): the hub opens a split agent-mem home through `openShardStore` at the canonical memory directory; an inactive split refuses with the resume remedy; the exact `@staix/agent-mem` pin rises to 0.4.0.
+- #519 (PR #535, hub task #229): reviews rotate across fresh Claude and Codex reviewer sessions; `review_mode: "fresh"` opt-in; Codex isolation (plugins, hooks, Apps and web search disabled, native read-only sandbox, credential-root denies); optional-pool exhaustion keeps the planner fallback, a required pool blocks for the person.
+- #237 review fixes (PR #537): the daemon and `ahub memory`/`ahub goal` bind the alias-resolved project key the `amem` CLI uses, a later alias latches a bound hub unavailable, and a dangling or unreadable `shards.json` counts as a split marker.
+- CI (PR #538): the macOS check gate gets a 960 s hang bound inside a 20-minute job ceiling (the test step ran 650-808 s).
+- First-party dependency: `@staix/agent-mem` 0.4.0 (agent-mem PRs #24, #25, #26), published by its tag workflow and read back from the registry (`latest` 0.4.0, integrity `sha512-JJCOm8Pq...`, matching `bun.lock`).
+- Still open (unchanged): live native clients, installed managed-Pi #418 AC8 (#142), #438 AC7, the native console settings leg (#439 AC5), real upgrades with reattach (#463) and with a managed terminal and cancelled rows (#478), the live advise cycle of #481 AC9, the installed #493 D3 leg, the live two-instance run (#450 I4, #138), a live headless Claude review (#223) and a live long session over 32 MiB (#517).
+- New open legs:
+  - A live fresh Codex review with a real account: `default_permissions` selecting the `ahub-review` profile is configured, not observed (docs/verification/2026-10-19-reviewer-isolation.md).
+  - A live split of a real memory home with `amem migrate --shards` after every sharing hub runs 0.12.37; `ahub memory profile-check` is not split-aware yet (#536).
+- Not in this release: the Kimi fresh reviewer (#533, task #234, in progress) and the agy implementer peer (#485, task #241).
+
+## Reviews
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #530 (#529) | 4921ebe4 | planner via OCR delegation (read-only Claude subagent), approved | exact head, success |
+| #527 (#481 S11) | 18b96955 | planner: round 1 findings (quota for unread peers, receipt invalidation, cost-report paging, upgrade-gate scope ruled by the person), round 2 approved | exact head, success |
+| #534 (#237) | ba8e0755 | OCR delegation (read-only Claude subagent): I1 (symlinked home) fixed; the README warning updated after a bot P2, and the README and CHANGELOG older-hub wording corrected after the reviewer showed agent-mem 0.3.1 does not detect a split; approved. codex post-merge review: two findings, fixed in #537 | exact head, success |
+| #535 (#519) | ccb62a48 | planner with two read-only reviewers: round 1 two Important (planner fallback, ChatGPT Apps MCP), round 2 one Important (canonical credential roots on a symlinked TMPDIR), round 3 approved; 387/0 affected tests on macOS with the default TMPDIR | exact head, success |
+| #537 (#237 review) | 6b87d144 | OCR delegation (read-only Claude subagent) approved at a339848d after two bot P1s (daemon-start fallback, late-alias latch); only main merges followed. codex approved the merged commit 86693a2a | exact head, success (macOS after #538) |
+| #538 (CI) | 23f6fc2b | OCR delegation (read-only Claude subagent), approved | exact head, success |
+
+## Document review
+
+Eleven documents were stale against the 0.12.36 stamps. Two fresh-context reviewers read them against the six PRs above: one took the person-facing documents, the other the agent notes and `AGENTS.md`. The planner checked their edits and fixed `docs/sdlc.md`'s S11 status line.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.12.37 (protocol 16 unchanged); the jcode range 0.98.0 up to 1.0.0 (#529); the verification link; open legs add a live fresh Codex review (#519) and a live split of a real memory home (#536); shard rollout now says every sharing hub must run 0.12.37 or later. |
+| `docs/quickstart.md` | corrected | Install pin `v0.12.37`; "Upgrading to 0.12.37" covers restarting Claude sessions for the release-train tools (#481 S11), the reviewer pool and `review_mode: "fresh"` (Kimi not offered, agy planned as an implementer under #485), the upgrade refusal for targets without `release_trains` or `reviewer_pool`, the jcode range and telemetry opt-out, and agent-mem 0.4.0 with the split rollout rule (#536). |
+| `docs/operations.md` | corrected | Version and upgrade commands 0.12.37; the agent-mem pin was still 0.3.0 (already stale) and is now 0.4.0; a shard paragraph in Hub memory (#534, #537); S11 marked shipped; Jcode telemetry opt-out; the reviewer pool section dated to 0.12.37 with the agy decision and the native-acceptance caveat kept. |
+| `docs/security.md` | corrected | Shard binding (project shard plus user overlay, entry recheck, late-alias latch, inactive split never read as empty); the jcode version fence and telemetry opt-out; the fresh Codex reviewer's pinned policy, receipt, read-only shell and its configured-not-observed limits. |
+| `docs/sdlc.md` | corrected | S11 release-train governance ships in 0.12.37. |
+| `docs/agent-notes/adapters.md` | corrected | Registry `isSupportedPeer` answers from `ADAPTERS`; `reviewer` is a restricted builtin field; reviewer-variant selection needs headless, roles exactly `["reviewer"]`, and an automatic declaration or `review_mode: "fresh"`; `ReviewerPrintPeer` replaces `ClaudePrintPeer`; new rules for the jcode range, owned env and `.sock` name (#530), reviewer backends (receipt and `current()` before every spawn, bus admission after `start()`, failure reports after group exit, output caps), Codex isolation, and never passing the control token to a reviewer child. |
+| `docs/agent-notes/tasks.md` | corrected | Scope adds `reviewer-pool.ts`, `reviewer-pool-config.ts`, `release-admission.ts`; rules for pool selection inside `assign()`, required versus optional pool, `retryReviewer` fences, and S11 release trains. |
+| `docs/agent-notes/daemon.md` | corrected | Scope adds `memory-profile.ts` and `usage.ts`; rules for `memoryProjectFor` and the `projectKey` latch (#537), `lstat` marker detection and `openShardStore` (#534), recovery target-feature floors, and `review_mode`/`review.pool` validation. |
+| `docs/agent-notes/budget.md` | corrected | Reviewer variants keep their base kind's account; the release-cut quota rule. |
+| `docs/agent-notes/tests.md` | corrected | Raise the macOS job ceiling together with `AHUB_CHECK_HANG_S` (#538); the Codex reviewer fake never stands in for native isolation. |
+| `docs/agent-notes/bus.md` | no change | Only `envelope.ts` gained an optional `refs.reviewRevision`, whose rule lives in `tasks.md`. |
+| `docs/agent-notes/benchmarks.md` | no change | The `acp.ts` change (a version predicate) is Jcode-only. |
+| `docs/agent-notes/README.md` | no change | Stale only because `daemon.md`, a tracked path, changed; its index still matches the notes. |
+
+`AGENTS.md` lists `reviewer-pool.ts`, `reviewer-pool-config.ts` and `release-admission.ts` under tasks and `memory-profile.ts` under daemon.
+
+Found during the review, not changed here: `src/hub/peer-catalog.ts` and the daemon's local `isSupportedPeer` (`daemon.ts:645`) still answer from `definitionOf`, so the declaration-only `agy` passes the person-only `ahub permission` peer check (`daemon.ts:4887`). agy cannot start in this release, so the effect is a stored, unused mode; it is handed to the agy implementer task (#485, hub task #241).
+
+## Checks
+
+- Each merged PR's exact-head CI passed (table above). The release branch is main `86693a2a` plus the version, release notes and document corrections; the bundle is rebuilt with the pinned Bun 1.4.2 and is fresh; `tsc` is clean.
+- The twelve stale stamps are restamped to the reviewed commit `9a4869c5`; `node scripts/check-docs.mjs` reports 0 stale documents. `--require-fresh` runs again on the merged main before the tag.

package/docs/verification/2026-10-19-jcode-0.98.1.md

@@ -0,0 +1,30 @@
+# Jcode 0.98.1 and the version range (#529)
+
+Installed release builds, read through `--quiet version --json`: 0.94.0 (b6c63ff04, the pinned contract in 2026-10-11-jcode-peer-contract.md), 0.95.0 (6487bbd7e) and 0.98.1 (1c7426eb1, installed by jcode's own updater on 2026-10-17), all kept side by side by jcode's updater. All three are [1jehuang/jcode](https://github.com/1jehuang/jcode). The full probe ran on 0.94.0 and 0.98.1; 0.95.0 ran only the old-socket `serve` check below.
+
+## Live probe
+
+A probe spawned the owned daemon and the ACP client with the adapter's own argv (`jcodeCommand`), under an isolated `HOME` and `JCODE_HOME` (an empty `mcp.json`, no credentials), `JCODE_SOCKET` and `JCODE_READY_FD` set as the adapter sets them. A before/after hash of the person's real Jcode config files showed no change.
+
+- With the adapter's socket name `s`, `serve` exits 1 with `Address already in use (os error 48)` on 0.94.0, 0.95.0 and 0.98.1 alike. Source: `debug_socket_path()` (`crates/jcode-app-core/src/server/socket.rs`, unchanged between the tags) names the debug socket `file_name.replace(".sock", "-debug.sock")`, so a name without `.sock` binds the main path twice. The owned peer could never start natively before this fix; the fake did not bind a debug socket, so tests passed.
+- With `j.sock` (the fix), on both 0.94.0 and 0.98.1:
+  - `serve` signals readiness on the private socket within about 100 ms and leaves `j-debug.sock`, `j.sock.hash` and `j.sock.server.json` beside it (0.98.1 adds `j.sock.daemon.lock`). The process group is gone after SIGTERM.
+  - `initialize`: `protocolVersion` 1, `agentInfo` `{ name: "jcode", title: "Jcode", version: <semver> }`, `loadSession: true`, `authMethods: []`.
+  - `session/new` returns `sessionId` with `configOptions` and `models`.
+  - `session/load` returns `configOptions` and `models` only, with no `sessionId`. The restored identity stays unproven, so `requireLoadSessionEcho` and the withheld automatic recovery are unchanged.
+
+Telemetry: without an opt-out, the first 0.98.1 `serve` wrote `telemetry_id` and milestone files into `JCODE_HOME` and tried to send an event (`telemetry payload send failed` in its log, the probe host being offline for that endpoint). With the adapter's `JCODE_NO_TELEMETRY=1` (and none in the caller's environment), the patched `JcodePeer` start and stop on 0.98.1 left no telemetry file and logged no send. Source: `is_truthy("JCODE_NO_TELEMETRY") || is_truthy("DO_NOT_TRACK")` in `crates/jcode-telemetry-core/src/lib.rs`.
+
+No prompt was sent: provider/model serving, a real hub-tool call through the project MCP entry, native tool policy and child teardown under load stay unverified, as in the 0.94.0 record.
+
+## Source comparison v0.94.0..v0.98.1
+
+234 commits, read only (nothing built from the clone).
+
+- ACP (`src/cli/acp.rs`): protocol pinned to 1, the same methods, still no `session/set_mode` or `request_permission`, session `mcpServers` still ignored. Additions: `Subscribe` sends `supports_user_response: false`, and a corrected trailing text piece arrives as an extra `agent_message_chunk`.
+- CLI and socket: every flag the adapter passes is still defined; `JCODE_SOCKET` wins, `JCODE_READY_FD` gets one byte; the update check is still skipped for `serve` and `acp`. The daemon lock now follows a custom socket (`<socket>.daemon.lock`) instead of one runtime-wide lock, so an owned `serve` no longer collides with the person's own jcode daemon.
+- MCP: project file order, the `mcpServers` alias, `shared: false`, the first-use Codex import and `JCODE_DISABLE_CLAUDE_MCP` are unchanged. New: http, streamable-http and sse entries in project MCP files are now connected instead of skipped (OAuth only through `jcode mcp login`).
+
+## Decision
+
+The adapter accepts a plain release from 0.98.0 (the minimum, set by the owner; 0.98.1 is the release verified live) up to, not including, 1.0.0 (the assumed breaking version); the minor is not pinned. Releases before 0.98.0 are refused, 0.94.0 included, although the probe above also passed on it. A release shown to break the contract lowers `JCODE_BREAKING_VERSION` (`src/adapters/jcode.ts`).

package/docs/verification/2026-10-19-reviewer-isolation.md

@@ -0,0 +1,119 @@
+# Reviewer isolation evidence (#519)
+
+Status: source integration and model-free production-backend admission are verified. Exact-head CI is a separate required PR gate. This report separates offline native evidence, fake-CLI regressions and unverified account/model behavior. No live review prompt, account login or credential copy was performed for this investigation.
+
+## Admission ruling
+
+- Planner ruling, 2026-10-19: #229 ships #519 R3-R6 for Claude and Codex only; ship only reviewer profiles with demonstrated isolation. Kimi and agy remain unavailable and outside the default pool until they have a passing isolation receipt. #229 adds unavailable-reason metadata for them and no launch code. All of their launch/isolation/receipt work belongs to [#533](https://github.com/STAIxBWLB/agent-hub/issues/533), hub task #234; the future agy launcher belongs in `src/adapters/agy/`. Failure, missing evidence and quota exhaustion never count as a verdict.
+- The default logical kind order is Claude, Codex, fixed before modulo; undeclared or unavailable slots are skipped without renumbering. An explicit pool may name the registered unavailable Kimi/agy placeholders; local/Pi are refused. An explicit pool with no declarations blocks, while an omitted pool without declarations preserves legacy routing. An unavailable result must be skipped, never treated as approval. With no explicit required pool, exhausted fresh candidates retain #223 R5 eligible-planner fallback; without one the person reviews. The exhausted walk remains in trace/history. Required explicit-pool exhaustion remains blocked for the person.
+- Existing #223 Claude behavior is retained. This work adds no new live Claude acceptance proof.
+- Codex/Kimi fresh reviewer declarations require `review_mode: "fresh"`. Existing headless instances with roles `["reviewer"]` but no opt-in retain native transport/worktree/permission behavior and stay outside the fresh pool. Claude keeps #223 automatic selection; agy remains metadata-only unavailable. A failed fresh start never downgrades to a continuing native session.
+
+## Codex native evidence
+
+- Exact executable used for offline probes: `/opt/homebrew/bin/codex`, reporting `codex-cli 0.146.0`. Its npm package resolves to a native binary. A separate fnm executable on PATH reports 0.163.0; that version has no receipt in this slice and must be unavailable.
+- Primary source pin: `openai/codex`, tag `rust-v0.146.0`, commit `e363b08c9175ac1cbe5893615dd2cb9ddf95043b`.
+- `exec --ephemeral --ignore-user-config --ignore-rules` is accepted by the installed help. These switches respectively remove session persistence, the user config layer and user/project execpolicy rules. They do not remove every config layer. [Pinned exec implementation](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/exec/src/lib.rs)
+- Native `mcp list --json` in temporary homes showed that a CLI `mcp_servers={agent-hub={...}}` table merges with user/project servers. Self-contained disabled stdio/HTTP stubs retained valid configuration both with and without the original user layer. Only the fixed hub remained enabled among configured servers. This inventory does not enumerate runtime ChatGPT Apps contributions and cannot alone prove strict MCP isolation. Native `mcp get agent-hub --json` exposes the exact `enabled_tools` allowlist. The schema specifies that disabled servers are not initialized and only listed enabled tools are registered. [Pinned MCP schema](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/config/src/mcp_types.rs)
+- The original inventory probes included `--disable plugins --disable hooks` and a CLI override marking the physical project root untrusted. The review correction adds `--disable apps` and `web_search="disabled"`, with separate effective-feature proof (see below). Plugin loading has an explicit disabled return path; `--ignore-user-config` alone is insufficient. [Pinned plugin manager](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/core-plugins/src/manager.rs), [config loader](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/config/src/loader/mod.rs)
+
+The named profile used filesystem `/ = read`, private entries `= deny` and `network.enabled = false`. Native `sandbox -P <profile>` fixtures produced:
+
+```text
+nested/secret.env READ_DENIED
+alias.env READ_DENIED
+nested/SECRET.ENV READ_DENIED
+public.txt READ_ALLOWED
+WRITE_DENIED
+```
+
+Both exact and glob deny entries passed; the symlink and case alias existed. No write file appeared. A plain read-only profile without a deny entry could read the private fixture. `debug models --bundled` accepted the CLI profile configuration offline. [Pinned permission schema](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/config/src/permissions_toml.rs)
+
+The source receipt producer repeats bounded model-free inventory and sandbox checks before a review, including nested glob and symlink private-read denial. It hashes the native executable/prefix once per preparation and binds the profile and config metadata, then checks dev/ino/size/mtime/ctime through `current()` immediately before model spawn. Repeated current checks do not synchronously reread the native binary. A bare deny name is compiled at the project root and at nested segment depth; `~/` is resolved against the home directory. Raw MCP output, transport environments and config contents are not receipt evidence. Unsupported version, changed/unknown inventory, own-server collision, failed sandbox proof, abort or changed metadata makes the backend unavailable.
+
+Codex "read-only tools" means sandboxed shell with filesystem read-only/private-deny policy and network disabled. It does not mean Claude's Read/Grep/Glob tool whitelist. No native LLM review, network-denial probe, post-start glob mutation or concurrent filesystem/config swap was tested. No recorded run shows exec selecting `ahub-review` through `default_permissions`; argv pinning and `sandbox -P ahub-review` test different paths. The profile declares the network boundary; it is not a measured network result. Same-user concurrent changes after the final check remain a ceiling, not a claimed atomic filesystem snapshot.
+
+## Kimi evidence and gap
+
+- Installed version: 2.2.0. Primary source pin: `MoonshotAI/kimi-code`, tag `@moonshot-ai/kimi-code@2.2.0`, commit `472192c34c1efad89a369870eff0da0b708ce9bb`.
+- An explicit `--agent-file` profile can allow only Read/Grep/Glob and the two hub MCP tools, with `subagents: []`. The runtime executor registers a tool-policy guard; the allowlist is more than prompt text. [Pinned policy guard](https://github.com/MoonshotAI/kimi-code/blob/472192c34c1efad89a369870eff0da0b708ce9bb/packages/agent-core-v2/src/agent/toolPolicy/toolPolicyService.ts)
+- `KIMI_CODE_HOME` separates config, sessions and credentials. ACP session MCP servers are additive: trusted project/user/plugin servers can still load. No strict-MCP or no-persistence CLI profile was demonstrated. Reusing ordinary authentication through an isolated home was not tested or authorized by this investigation. Kimi remains unavailable. [Pinned MCP loader](https://github.com/MoonshotAI/kimi-code/blob/472192c34c1efad89a369870eff0da0b708ce9bb/packages/agent-core-v2/src/workspace/workspaceMcpConfig/workspaceMcpConfigService.ts), [bootstrap paths](https://github.com/MoonshotAI/kimi-code/blob/472192c34c1efad89a369870eff0da0b708ce9bb/packages/agent-core-v2/src/app/bootstrap/bootstrapService.ts)
+
+## agy evidence and gap
+
+- Installed version: 1.4.2. Help exposes `-p`, `--output-format stream-json`, `--mode plan`, `--sandbox` and `--agent`; no isolation receipt was produced.
+- Official documentation describes plan mode as a `/plan` prompt prefix. Headless mode auto-allows workspace reads and writes; the terminal sandbox mounts project folders read-write. These are insufficient for a read-only reviewer. [Execution modes](https://www.agy.dev/docs/cli/modes/), [headless permissions](https://www.agy.dev/docs/cli/headless/), [terminal sandbox](https://www.agy.dev/docs/sandbox/)
+- Custom-agent documentation lists tool limits and MCP settings, but this investigation did not establish a CLI-only, host-owned profile path with strict config/MCP isolation. agy remains unavailable. No profile, account or model execution was attempted. [Custom agents](https://www.agy.dev/docs/subagents?tab=cli)
+
+## Remaining verification
+
+- Final integration tests and exact-head CI must validate pure rotation, delta continuity, start-failure/no-verdict walking, blocked exhaustion, fresh child authority and additive family/reason metadata. Any child ending without a saved verdict retries the remaining eligible walk; no quota classification is inferred from vendor text.
+- Native account/model smoke remains manual, as listed in [smoke.md](../smoke.md#reviewer-pool-native-legs-519-2026-10-19). Fake CLI tests prove the host contract and refusal paths, not vendor model behavior.
+
+## Production admission readback
+
+On 2026-10-19 the actual `codexReviewerBackend.prepare` ran against `/opt/homebrew/bin/codex` 0.146.0 in a new temporary repository directory, with empty temporary HOME and CODEX_HOME and a fixed inert hub transport. It returned `readOnly: true`, `strictMcp: true`, `ephemeral: true` and `current: true` after the native MCP, exact/glob/symlink denial, public read and write-denial probes. The temporary home and fixtures were removed. This did not execute `codex exec`, initialize an account, copy credentials or issue a model request. Network blocking remains a configured restriction, not a separately observed network probe.
+
+The first correctly initialized native run exposed an admission bug: the pinned bundled model catalog exceeds the 128 KiB inventory-output cap. Configuration validation now drains that one command without retaining its output, with a separate 4 MiB ceiling; MCP/version/sandbox metadata retain the 128 KiB ceiling. A red-first regression covers a larger valid catalog and refuses a catalog above the ceiling. The production-backend admission then passed.
+
+The shared review child also bounds a stream frame to 256 KiB and total stdout to 4 MiB. Overflow revokes verdict authority before process-group teardown and only then reports head/revision-bound `no_verdict` failures for the current and unprocessed requests. A person's stop suppresses automatic fallback. Fake-CLI regressions cover both limits, batch failure, watchdog cleanup and stop-generation revocation.
+
+Agy declaration metadata is separate from the native runtime catalog. Existing supported/optional peer projections, exact legacy catalog tests, registry-guard expectations and the empty baseline are unchanged. An unavailable-only declaration set cannot fall through to automatic approval; an omitted pool may select an eligible planner under #223 R5; its static #533 reason remains in routing explanations, including explicit nominations.
+
+## Core deny policy
+
+Codex imports the exact-pinned portable core's `DENY_NAMES` and `DENY_SEGMENTS` and translates the supported literal-prefix/suffix regex forms into conservative native deny globs. Unknown syntax refuses admission. The profile includes each subtree explicitly, and the daemon also supplies its concrete state directory. Runtime fixtures now require both `.env` and `.agenthub/state/private.txt` to be unreadable. The production backend passed again with these global core rules on 2026-10-19, with `portable-core-name-and-state-deny` in its evidence. Explicit private paths protect lexical and existing real paths and include descendants; plain relative substring entries are conservatively broadened.
+
+This global policy does not enumerate the filesystem on the verified macOS path: the pinned native implementation translates unreadable globs into anchored Seatbelt regular expressions, including `**/`, at read time. A glob containing `**` does not automatically protect descendants, which is why the explicit `/**` rules are required. [Pinned Seatbelt compiler](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/sandboxing/src/seatbelt.rs#L441-L581), [policy-level glob semantics](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/protocol/src/permissions.rs#L306). Other native platforms must pass their runtime proof; no native Linux account/model success is claimed.
+
+## Focused verification
+
+Pinned Bun 1.4.2 on the remote Linux runner passed TypeScript, plugin-bundle freshness and 365 tests in 20 affected files (2,883 assertions). The actual macOS Codex 0.146.0 preparation passed again with core deny, explicit paths and nested substring rules. All 421 existing seed anchors remain unique; this static check is not a seeded-runtime result. These focused results predate the compatibility repair and do not establish a successful final-head full gate. Existing catalog/guard tests, the registry baseline and seed manifest are byte-unchanged.
+
+
+## Compatibility repair checkpoint
+
+The full CI run at historical head `4aa64c12` exposed nine failures in unchanged I2 compatibility tests: the original headless Codex/Kimi reviewer-role declaration had been reinterpreted as a fresh variant. That head's 421 seeded guards passed; seed success did not waive the compatibility failures. The repair adds explicit `review_mode: "fresh"` opt-in for Codex/Kimi, preserves existing Claude selection and keeps legacy native reviewer-role instances outside the fresh pool. The native production privacy-profile proof is unchanged by this declaration repair. The repaired head's final full CI gate is pending.
+
+After the explicit-fresh declaration correction, pinned Bun 1.4.2 passed TypeScript, bundle freshness and 381 tests in 24 affected files (3,052 assertions), including every previously failing I2/reload/worktree/revert test. The isolation producer and common child lifecycle are byte-identical to the native-probed implementation. All 421 existing source anchors remain unique. Final full CI for the corrected head remains a separate PR gate.
+
+
+## Review correction: runtime Apps contribution
+
+Independent review found that the original `strictMcp` claim exceeded its evidence. In the pinned source, Apps is stable and enabled by default; the runtime MCP projection adds the ChatGPT Apps compatibility server independently of plugin loading. `mcp list` calls `configured_servers`, which intentionally omits those runtime contributions. The earlier empty-home admission did not exercise ChatGPT-authenticated connectors and is not proof that they were excluded. [Feature defaults](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/features/src/lib.rs), [runtime/configured MCP projections](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/core/src/mcp.rs), [CLI inventory](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/cli/src/mcp_cmd.rs).
+
+The corrected policy explicitly disables Apps and requires a bounded, unique effective-feature readback of `apps` as false, as well as plugins/hooks false, before granting a receipt. The fixed exec argv carries the same switches and disables web search, whose cached mode is served remotely. Missing, duplicate, malformed or enabled Apps readbacks refuse admission even if configured MCP inventory looks strict. Fake producer regressions and daemon argv assertions cover this distinction. On 2026-10-19 the corrected production backend passed again with empty temporary HOME and CODEX_HOME, using Codex 0.146.0 and an inert `/usr/bin/false` hub transport. It returned `apps-disabled-effective-feature-readback`, `web-search-disabled`, the existing filesystem/MCP evidence and `current: true`; no exec/model/account call ran. This verifies the effective Apps feature gate in addition to configured-server inventory, with the pinned source proving that the disabled gate removes the runtime compatibility server. The daemon argv regression pins Apps/plugins/hooks disable switches, project trust, named default permissions and disabled web search. Final-head CI remains a separate gate; account/model execution remains unverified.
+
+
+## Review correction: standard host credentials
+
+The PR bot identified a second privacy gap: portable core filename/state rules do not cover ordinary files such as `.config/gh/hosts.yml`, `.kube/config` and `.docker/config.json` under the host home. With `/ = read`, configured project-private patterns alone are insufficient. The correction adds fixed standard host credential directory/file denies, configured XDG/tool-home roots, existing real-path aliases and descendants. Credential protection does not depend on a person configuring `local.deny`.
+
+Regressions use a synthetic HOME and configured roots, never real credential contents. The native admission fixture also requires synthetic gh/kube/docker credential reads to fail. This is a bounded standard credential list, not a claim to discover or classify every personal/private file on the host; projects must continue to declare additional private paths. On 2026-10-19 the actual corrected production backend passed with Codex 0.146.0 in empty temporary HOME/CODEX_HOME. Its native sandbox denied synthetic gh/kube/docker credential files and a symlink alias, returning `standard-host-credential-roots-denied` alongside Apps-effective-state and existing filesystem evidence, with `current: true`. These fixtures contained only canary text; no account/model/exec call or credential copy was involved. Final-head CI remains the PR gate.
+
+
+## Review-fix focused gate
+
+After both Important fixes, the related nits and the host-credential correction, pinned Bun 1.4.2 on the remote Linux runner passed 445 tests in 29 affected files (3,164 assertions), TypeScript and generated-bundle freshness. The final native model-free preparation also passed on macOS as described above. All 421 existing seed anchors are unique; runtime seed success is a separate exact-head CI gate. Legacy/frozen tests, the registry baseline and seed manifest remain unchanged. These results do not supply independent approval or native account/model acceptance.
+
+
+## Review correction: canonical credential ancestors
+
+The prior Linux and CI evidence did not expose the developer Mac's default `/var` to `/private/var` TMPDIR alias. Local pinned Bun 1.4.2 reproduced both the existing synthetic-HOME failure and an explicit symlinked-HOME/missing-descendant regression before the fix. Standard names are now joined under both lexical HOME and its canonical deepest existing ancestor; every credential root also resolves its deepest existing ancestor before appending absent components. Both spellings and existing final symlink targets remain denied. Dangling links and unreadable ancestors refuse admission. The adapter keeps this short strict ancestor walk local because importing `path-policy` would introduce a registry cycle.
+
+Privacy ceilings remain explicit: credential roots are derived from the child environment's HOME and configured overrides. If HOME is overridden, the separate account home returned by `os.userInfo().homedir` is not automatically included. The bounded list also does not include shell history/rc files (`.zsh_history`, `.bash_history`, `.zshrc`), `Library/Application Support`, `.pgpass`, `.m2/settings.xml`, `.gradle/gradle.properties` or `.oci`; additional private paths must be declared. This is not a universal private-home sandbox.
+
+`web_search="disabled"` is a requested config value, without effective-turn readback. At the pinned source, managed requirements that prohibit Disabled can make `resolve_web_search_mode_for_turn` select Cached instead. The receipt evidence label `web-search-disabled` records only that configured value. Therefore the flag is not proof that remote cached search is unavailable; the effective Apps feature proof and native filesystem denial evidence do not establish that separate boundary. [Pinned web-search resolution](https://github.com/openai/codex/blob/e363b08c9175ac1cbe5893615dd2cb9ddf95043b/codex-rs/core/src/config/mod.rs#L2979-L3005).
+
+
+Local verification after this correction used pinned Bun 1.4.2 and the unmodified default macOS TMPDIR: 40 tests across `codex-review-isolation` and `reviewer-pool-tasks` passed (166 assertions). A model-free native Codex 0.146.0 preparation also passed under a synthetic symlinked HOME; after the returned profile was built, a new synthetic `.kube/config` was created under the physical HOME and a direct native sandbox cat of that canonical path was denied. The fixture was removed. No account, credential copy, model request or `codex exec` was involved. The named exec-profile-selection and effective web-search ceilings remain unverified as described above.
+
+
+The corrected source then passed the remote Linux focused gate: 447 tests in 29 files (3,176 assertions), TypeScript and pinned Bun 1.4.2 bundle freshness. All 421 existing seed anchors remain unique. Final-head CI is required separately; the local default-TMPDIR result is the developer-Mac regression evidence, not inferred from CI.
+
+
+## Main rebase after shard-store merge
+
+The reviewer-pool branch was rebased onto main `29719a78` after #534 merged, retaining the memory-open changes and exact agent-mem 0.4.0 pin. The only rebase conflict was the generated plugin bundle; it was regenerated with pinned Bun 1.4.2 and the installed 0.4.0 dependency. Reviewer source/tests, including the canonical credential fix and same-family reason, are byte-identical to the locally verified pre-rebase versions. The imported platform helper file is also byte-identical between published 0.3.1 source and installed 0.4.0 (SHA-256 `2ab3908eb317833e000616760ad04c1dffe7befadea542535d8d9dba330411eb`).
+
+I separately ran the exact merged main's memory tests: 220 pass, 1 environment skip, 0 fail in 25 files (1,584 assertions), plus TypeScript. Further local integration/native reruns after rebase were deferred by host resource admission; no bypass was used. The new final-head CI must establish the combined tree's full gate. No new native-account/model result is claimed.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -64,7 +64,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "03209040585a57c7c0a1f2b81f6be814df88267c",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -76,7 +76,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -93,7 +93,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -107,7 +107,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -154,7 +154,8 @@
         "src/hub/instance-config.ts",
         "src/hub/instance-execution.ts",
         "src/hub/usage.ts",
-        "src/hub/claude-state.ts"
+        "src/hub/claude-state.ts",
+        "src/hub/memory-profile.ts"
       ]
     },
     "docs/agent-notes/local-worker.md": {
@@ -179,7 +180,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -196,11 +197,14 @@
         "src/hub/settled-roles.ts",
         "src/adapters/definitions/builtin-metadata.ts",
         "src/hub/bus.ts",
-        "src/hub/review-brief.ts"
+        "src/hub/review-brief.ts",
+        "src/hub/reviewer-pool.ts",
+        "src/hub/reviewer-pool-config.ts",
+        "src/hub/release-admission.ts"
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -219,7 +223,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "24b1637b6d6a964bd53708b3330ff442afe63f4e",
+      "verifiedAgainst": "9a4869c56dab869f4dfed57884a4a3dd06027825",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.36",
+  "version": "0.12.37",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",
@@ -17,7 +17,7 @@
     "bun": ">=1.4.2"
   },
   "dependencies": {
-    "@staix/agent-mem": "0.3.1"
+    "@staix/agent-mem": "0.4.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.36",
+  "version": "0.12.37",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",