@staix/agent-hub 0.12.36 → 0.12.38

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.12.36 and control protocol 16. Live verification
+This guide describes ahub 0.12.37 and control protocol 16. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Agent-operated live verification
@@ -971,7 +971,7 @@ ahub memory forget 1a2b3c4d              # a person's; also promote, demote, sup
 
 `"memory": { "native": false }` in `.agenthub/config.json` turns it off for a project.
 
-The exact-pinned `@staix/agent-mem` 0.3.0 resolves `AMEM_HOME`, then `$AGENTHUB_HOME/memory`, then `~/.agenthub/memory`. An absent `M/profile.json` selects shared v1; an explicit generation selects `M/generations/G` with the package's readonly legacy bridge. All daemon memory consumers and the hub memory/goal CLI use that selected profile. Invalid metadata or a missing selected generation makes native memory unavailable while the bus and board continue; there is no fallback to legacy writes. Inspect the daemon's memory binding/availability before interpreting missing memory as an empty store.
+The exact-pinned `@staix/agent-mem` 0.4.0 resolves `AMEM_HOME`, then `$AGENTHUB_HOME/memory`, then `~/.agenthub/memory`. An absent `M/profile.json` selects shared v1; an explicit generation selects `M/generations/G` with the package's readonly legacy bridge. All daemon memory consumers and the hub memory/goal CLI use that selected profile. Invalid metadata or a missing selected generation makes native memory unavailable while the bus and board continue; there is no fallback to legacy writes. Inspect the daemon's memory binding/availability before interpreting missing memory as an empty store.
 
 The daemon checks its selector at hub operation entry and before candidate/counter writes. It does not hot-switch handles or provide an atomic fence against selection changes during an in-flight core call. Quiesce consumers and close their handles before migration or selection changes; reopen through the supported session-preserving lifecycle afterward. Candidate/counter storage remains `M/candidates.db`, independent of `G`; `amem review` on a generation is still refused. Every running hub using this home needs an authenticated receipt: a matching ready binding, or a generation-capable unbound receipt (`disabled` when native memory is off, `unavailable` when opening failed) proving it holds no memory handle. An unbound daemon and zero running hubs are quiesced for memory; a stale bound handle, unreadable registry or unknown runtime is not ready. Existing JSON memory/goal results remain unchanged; the additive binding receipt belongs to daemon status, profile-check and the decay object. This source integration does not authorize installing a new runtime, migrating real memory, restarting sessions or claiming real-machine sync/capture receipts. Migration/deactivation and their limits belong to [agent-mem](https://github.com/STAIxBWLB/agent-mem); see [the hub profile contract](memory.md#selected-memory-profile).
 
@@ -979,6 +979,8 @@ Run `ahub memory profile-check [--json]` from the person's terminal for the read
 
 Before real migration, first upgrade every hub sharing the home to 0.12.30 or later. Obtain positive ready or unbound/quiesced receipts in every relevant registry; then quiesce consumers and close bound handles before changing the selector. A matching ready handle proves compatibility but is still an open handle. Verify synthetic cross-writes before the separately approved real migration, then reopen through the supported session-preserving lifecycle afterward. Merely installing this release does not authorize migration or provide live capture/device-sync evidence.
 
+A curated split (`amem migrate --shards`) writes `M/shards.json`; from 0.12.37 the hub then opens this project's shard, with the user shard as its overlay, under the alias-resolved project key the `amem` CLI binds (#534, #537). Before splitting, upgrade or stop every hub using the home: a hub on 0.12.36 or earlier does not detect the split and keeps writing the old layout, which reaches the shards only through `amem migrate --shards --resume`. A split that is not active (captured, malformed, or a dangling or unreadable `shards.json`) makes native memory unavailable with that resume command as the remedy. An `amem alias add` that remaps a running hub's key latches its memory unavailable until a restart. `ahub memory profile-check` is not split-aware yet: on a split home it reports a mismatch for every correctly bound hub (#536). See [the shard binding](memory.md#selected-memory-profile).
+
 Managed agents read through `hub_memory_search`, `hub_memory_show` and `hub_memory_graph`, with the server's project identity, the `memory_read` capability and current privacy screening. They cannot supply another project; private turns are refused. The tools bound UTF-8 input/output, screen before counts and truncation, and exclude their arguments/results from hub-managed capture. `hub_memory_correct` has its own `memory_correct` capability and records a screened correction candidate, not a note change. See [the complete memory contract](memory.md) for caps and refusal semantics.
 
 Review candidates and rendered/delivered/cited counters stay in machine-local `M/candidates.db`, outside sync, import, recall, briefs, ask and graph evidence. Public changes-requested reviews with unmet items may propose a fail candidate; missing cause/retry details stay unknown. Shared-v1 acceptance is a person's `amem review` action with its TTY/policy checks; selected generations still refuse that command. Read-time `(stale?)` hints and plan-fail advice never change stored rows or task authority. Structured fail notes are validated against 4000 UTF-8 bytes before screening or writes, with no silent truncation.
@@ -1469,6 +1471,8 @@ ahub settings reload               # validate and apply the complete four-file c
 ahub ui --settings                 # dashboard with a 15-minute settings session
 ```
 
+A guarded file edit that the daemon keeps at its accepted value remains visible as `config retained: <keys>; run ahub settings reload` in status, the console and Settings. The entry clears when the file value is confirmed through the terminal reload or reverted. Starting a peer whose launch keys are retained first explains that it uses the running value; the pending file value is not applied merely by restarting that peer. Public status and notices show key names and reasons, never the retained setting values.
+
 | Group | Keys | Stored in | Applies |
 | --- | --- | --- | --- |
 | Permissions | `permission.<peer>` (the mode now) | the running hub only | at once |
@@ -1978,21 +1982,21 @@ section is what they run.
 
 Upgrade running projects with the target release's own coordinator. It accepts
 a running source on control protocol 9 (0.6.x), 10 (0.7.0 through 0.12.0),
-11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.36), and only
+11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.37), and only
 a target on its own protocol, so the target's coordinator fits every supported
 source and carries every recovery fix released up to it. Protocol 8 and older
 (0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.12.36 ahub upgrade --to 0.12.36 --dry-run
-bunx --package @staix/agent-hub@0.12.36 ahub upgrade --to 0.12.36 --yes
+bunx --package @staix/agent-hub@0.12.37 ahub upgrade --to 0.12.37 --dry-run
+bunx --package @staix/agent-hub@0.12.37 ahub upgrade --to 0.12.37 --yes
 ```
 
 | Running now | Coordinator to use |
 | --- | --- |
 | 0.6.x (protocol 9) | the target's, through `bunx` as above |
-| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.36 (protocol 16) | the target's, through `bunx` as above |
+| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.37 (protocol 16) | the target's, through `bunx` as above |
 | any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
 | 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
 
@@ -2024,14 +2028,14 @@ projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.12.36 --dry-run
+ahub upgrade --to 0.12.37 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.12.36 --yes
+ahub upgrade --to 0.12.37 --yes
 ahub recovery status [<operation-id>]
 ahub recovery resume [<operation-id>]
 ahub recovery abort [<operation-id>]
@@ -3063,7 +3067,7 @@ that the file is untracked; a dropped value is reported by the settings result.
 
 ## SDLC artifact receipts and gates
 
-The playbook lifecycle (#257, #481) is off without `.agenthub/sdlc.toml`. When enabled its stages are intent, spec, plan, build, test, review, merge, release and maintain, grouped as Plan, Design, Build, Test, Deploy and Maintain. Advise shows blockers; enforce checks implemented head-bound review and approval gates. Stored implement/verify receipts read as build/test; new enabled receipts use canonical ids. See [the SDLC contract](sdlc.md) for gates, required check names, local receipts, console-only readbacks and the S0-S8 delivery table. A person accepts a spec issue with `ahub sdlc accept <task> --issue <n>` (S1). The planner records plan reviews with review and CI scope (`hub_plan_review`, `ahub sdlc plan-review`) and grooms with `ahub backlog groom`; `ahub backlog return <task> <revision> <reason>` returns accepted, untouched work (S9). `ahub sdlc costs [owner/repo]` reports review rounds and CI runs of merged PRs without writing the board (S10). S2-S7, S11 and a full live advise/release cycle remain pending. Owners/reviewers record bounded identities through `hub_sdlc_record`; these grant no additional authority. Off output, receipt and schema shapes stay unchanged.
+The playbook lifecycle (#257, #481) is off without `.agenthub/sdlc.toml`. When enabled its stages are intent, spec, plan, build, test, review, merge, release and maintain, grouped as Plan, Design, Build, Test, Deploy and Maintain. Advise shows blockers; enforce checks implemented head-bound review and approval gates. Stored implement/verify receipts read as build/test; new enabled receipts use canonical ids. See [the SDLC contract](sdlc.md) for gates, required check names, local receipts, console-only readbacks and the S0-S8 delivery table. A person accepts a spec issue with `ahub sdlc accept <task> --issue <n>` (S1). The planner records plan reviews with review and CI scope (`hub_plan_review`, `ahub sdlc plan-review`) and grooms with `ahub backlog groom`; `ahub backlog return <task> <revision> <reason>` returns accepted, untouched work (S9). `ahub sdlc costs [owner/repo]` reports review rounds and CI runs of merged PRs without writing the board (S10). S11 release trains ship in 0.12.37 (see [release scheduling](#planner-release-scheduling)). S2-S7 and a full live advise/release cycle remain pending. Owners/reviewers record bounded identities through `hub_sdlc_record`; these grant no additional authority. Off output, receipt and schema shapes stay unchanged.
 ## Optional Qwen Code peer
 
 Select Qwen per project with `ahub roster add qwen`; it defaults off and is absent
@@ -3096,7 +3100,15 @@ Use ahub roster add jcode, then ahub jcode --mode headless [--model <alias>] [--
 After upgrading to the recipient-retry release, a Jcode project MCP entry written before `AGENTHUB_DELIVERY_ONLY` was added is intentionally stale. Once per project, the person runs `ahub jcode --mode headless` before using conductor/dashboard starts. The launcher rewrites only the owned entry with the delivery-only marker, preserving foreign entries and refusing collisions; recovery relaunches already use this CLI path. Readiness checks never rewrite the file, and an explicit false marker or any other drift remains refused. Until that rewrite, daemon starts keep their actionable stale-entry refusal rather than advertising a retry tool Jcode cannot use.
 
 
-Native policy is unmanaged and has NO hub sandbox; no permission_modes.jcode or runtime mode mapping is invented. Quota and consumption remain unknown. Version 0.94.0 cannot prove native session/load identity, so attached Jcode blocks controlled recovery before effects and crash recovery asks for deliberate native reopening. A requested load without an echoed identity refuses; no fresh session is presented as restored. Provider/tool/native teardown receipts remain unverified in the pinned contract report.
+Native policy is unmanaged and has NO hub sandbox; no permission_modes.jcode or runtime mode mapping is invented. Quota and consumption remain unknown. Supported versions run from 0.98.0 up to, not including, 1.0.0 (#529). Every owned jcode process (version probe, daemon, ACP) runs with `JCODE_NO_TELEMETRY=1`. Native session/load (verified on 0.94.0 and 0.98.1) cannot prove identity, so attached Jcode blocks controlled recovery before effects and crash recovery asks for deliberate native reopening. A requested load without an echoed identity refuses; no fresh session is presented as restored. Provider/tool/native teardown receipts remain unverified in the pinned contract report.
+
+## Optional Antigravity (agy) peer
+
+Antigravity is optional and off roster by default. Use `ahub roster add agy`, then run `ahub agy` in a terminal: it runs the Antigravity CLI 1.4.2 as a fresh pull-only TUI in that terminal and refuses any other version. The running hub must advertise `native_hook_launch`; an older hub refuses before any write with an upgrade-or-restart remedy. Only the person's launcher starts it: conductor starts are refused, there is no controlled restore or resume, and extra agy instances are unavailable. Headless/print, resume (`--conversation`, `--continue`, `--new`), `--mode`, `--dangerously-skip-permissions` and `--unattended` are refused until their native mapping is verified; `--print-command` previews without writing.
+
+The launcher writes exactly `plugin.json`, `mcp_config.json` and `hooks.json` in `.agents/plugins/agent-hub/`, refusing linked or foreign entries before any write, and removes only its own matching files when the TUI ends. It never writes project-level `.agents/hooks.json` or the person's `~/.gemini` settings. Run `ahub init` afterwards to ignore the untracked plugin directory; a tracked plugin is written with a warning. The native model sees the hub tools under the server name `agent-hub_agent-hub`.
+
+Like Kimi's TUI, agy is pull-only: it reads `hub_inbox` and shares results with `hub_send`, messages do not interrupt it, and automatic routing never picks it. Its roles are capped at implementer and verifier; a plan or review assignment and PII work are refused. Native permissions are unmanaged, with no hub sandbox, hub permission mode, quota source or session resume. Plugin hooks bound to that launch carry the hub's turn facts and report each completed native turn. The live TUI/account leg is unverified ([T0 receipt](verification/2026-10-19-agy-p1-t0.md)).
 
 # Headless ACP watch (#286)
 
@@ -3547,6 +3559,35 @@ A missing
 `peer_instances` feature on an old daemon or upgrade target requires a supporting
 version before launching or restoring extras.
 
+### Fresh reviewer pool (#519)
+
+From 0.12.37 reviews can rotate across fresh headless Claude and Codex reviewers, and from 0.12.38 Kimi reviewers too. Declare reviewer-only instances with explicit headless mode and the Codex or Kimi fresh opt-in in `.agenthub/config.local.json`:
+
+```json
+{
+  "instances": {
+    "claude-review": { "kind": "claude", "roles": ["reviewer"], "start_mode": "headless" },
+    "codex-review": { "kind": "codex", "roles": ["reviewer"], "start_mode": "headless", "review_mode": "fresh" },
+    "kimi-review": { "kind": "kimi", "roles": ["reviewer"], "start_mode": "headless", "review_mode": "fresh" }
+  },
+  "review": { "pool": ["claude", "codex", "kimi"], "rerotate": false }
+}
+```
+
+Start them with `ahub claude --as claude-review`, `ahub codex --as codex-review` and `ahub kimi --as kimi-review`; stop with `ahub stop <id>`. Fresh Claude and Codex variants share the project checkout; the Kimi variant runs in a clean temporary working directory and reviews only the screened brief and host facts. All fresh variants refuse a custom worktree or permission mode. Codex and Kimi require `review_mode: "fresh"`; without it, an existing headless instance with the reviewer role keeps its native app-server/ACP behavior, worktree and permission options and does not join this pool. Claude retains its #223 automatic headless-reviewer declaration. The agy reviewer slot remains automatically unavailable (`agy is an implementer peer (#485)`). A failed or unsupported fresh start never downgrades to a native continuing session. Ordinary implementer instances retain their own adapters. The default logical pool order is Claude, Codex, Kimi. Only configured kinds with at least one declared reviewer count as slots, including declared ones that are offline, paused, quota-limited or failing, so availability never renumbers them; configured kinds with no declaration are listed after the walk as `no declared reviewer`. `review.rerotate` defaults to false. Pool selection starts at PR number modulo the number of declared kind slots, or task id when there is no PR, then skips the implementer's family and unavailable candidates. Delta review prefers the preceding eligible independent family in a fresh child. A preceding same-family fallback does not outrank a newly available independent family. `ahub route explain` shows the same pure walk.
+
+Codex requires an installed 0.146.0 executable and a passing bounded runtime receipt before its model child starts. Use the existing `codex_bin` setting to select a supported host executable when PATH resolves another version. PATH 0.163.0 has no receipt in this slice and remains unavailable. The producer checks native binary/config stability, configured MCP inventory with only the two hub tools, effective Apps/plugins/hooks disablement and a named filesystem profile. Apps needs separate feature readback because configured inventory omits runtime connectors. Web search is requested disabled; its effective turn mode is not read back and managed requirements can select Cached (see the verification ceiling). Each launch proves public-read, exact/glob/symlink private-denial, standard host credential denial and write-denial in temporary fixtures. Standard credential and configured tool-home/XDG subtrees are denied independently of project `local.deny`. Its sandboxed shell is filesystem read-only with private paths denied and network configured disabled; it is not Claude's Read/Grep/Glob-only tool whitelist. No credential home is copied.
+
+Kimi requires Kimi Code 2.2.0 on the hub's PATH, signed in through its managed OAuth provider, and a passing runtime preparation before each child; any other version or a failed preparation is unavailable with its reason. Each review runs a new `kimi -p` child without Seatbelt, in a private `KIMI_CODE_HOME` with managed-provider-only config, a clean temporary working directory and an empty skills directory. Its agent may call only `hub_review` and `hub_task_show`, through a task-bound loopback MCP session that never carries the hub's control token, and has no native read, file or shell tool: it reviews the screened brief and host facts only. Its `credentials/`, `oauth/` and `device_id` link to the person's native Kimi files, so it shares the native login, refresh lock and the Kimi account's budget; no token is copied. A stop revokes its verdict authority first, then waits briefly while an OAuth refresh holds the lock; a forced stop mid-refresh may require a native re-login. Kimi's print output carries no token counts, so its usage stays unknown. This is a native tool-authority boundary, not filesystem or network isolation.
+
+A dangling or unreadable standard/configured credential root makes the Codex reviewer unavailable with only its path class in the reason (for example `~/.docker` or `$DOCKER_CONFIG`, never an expanded path or contents); repair the root and start the reviewer again.
+
+agy is not a reviewer (person decision, 2026-10-19): it is an optional implementer peer (see [Optional Antigravity peer](#optional-antigravity-agy-peer)), and its retained reviewer slot is outside the default pool and always unavailable with `agy is an implementer peer (#485)`. A manual pool accepts only registered reviewer kinds (Claude, Codex, Kimi, agy), so local/Pi are refused. An explicit pool without declared candidates blocks for person action; an omitted pool retains legacy routing without declarations and falls back to an eligible planner when fresh candidates are exhausted. The exhausted pool walk remains recorded; without an eligible planner, the person reviews. A manual pool may name agy, or a Kimi reviewer whose preparation fails; the reason appears as an unavailable skip, and they never run or count as approval. Do not substitute plan mode for isolation.
+
+A failed start or any child ending without a saved verdict advances to the remaining eligible candidates; no quota meaning is guessed from text. A same-family fallback is a distinct fresh reviewer session. Exhaustion records `blocked: no reviewer can run`; with no explicit pool the eligible planner fallback is retained, while an explicit pool or absent eligible planner leaves person action. It never auto-approves. A per-review isolation preparation failure excludes that peer from later tasks until a verified restart. Recovery targets must advertise `reviewer_pool` when a pool is explicitly configured or fresh reviewer instances are declared. Verdict history retains `reviewContext` and adds `reviewerFamily` and `reviewerReason` from the host.
+
+Fake-CLI tests and CI cover these host contracts. [Offline isolation evidence](verification/2026-10-19-reviewer-isolation.md) and fake-CLI tests do not prove an account/model review or observed network denial. Native acceptance remains a separate [manual smoke leg](smoke.md#reviewer-pool-native-legs-519-2026-10-19); existing #223 Claude behavior has no new live proof here. Kimi's authenticated fresh-verdict receipts, and its still-open interactive-TUI coexistence and usage checks, are tracked in [Kimi smoke legs](smoke.md#kimi-reviewer-and-task-bound-mcp-533).
+
 An additional implementer must have an existing registered Git worktree and
 attached branch at `.worktrees/<instance-id>`, named explicitly by `worktree` in
 its declaration. The hub validates it and does not create it in this phase.
@@ -3569,3 +3610,9 @@ fields as unknown and cannot restore them into the main checkout. The supporting
 CLI checks the saved workspace against the current declaration again before any
 context change or file restoration. Removing the declaration intentionally
 blocks that undo until the identity and workspace can be reviewed.
+
+## Planner release scheduling
+
+Use `ahub sdlc train report <release-id>` for scope readiness and recorded release metrics. The planner creates future release rows, activates one train, and assigns tasks through the release-only hub tools. A due date requests a cut review; it never clears unfinished work. Move missed tasks to the next row with a reason, then use `ahub sdlc train cut <release-id> <revision>` from the person's terminal or `hub_release_cut` as the planner. The cut retains a short host admission lease through freeze and defers on held gate slots or unknown/quota-limited peer windows with a real quota source. Accounts without a quota reader (Kimi included when `kimi_tokens_5h` is zero) report `no quota source`; manual and budget-record pauses still defer. It does not run release preparation or publish anything. Schedule bundle/check/docs work under separate heavy admission and retain the person's native verification, authorization and upgrade window. A hotfix records its enumerated cause and keeps every gate.
+
+The per-release "gates run" record is deferred to S6/S7. Person ruling 2026-10-19 supersedes the earlier S11 upgrade-admission ruling: upgrades use pre-S11 recovery readiness (no busy peers, pending approvals resolved, completion checks settled) and retain the existing operation checks. S11 adds no host-admission, quota or all-idle requirement to upgrade. An active/frozen configured train still requires recovery-target `release_trains` compatibility. Release-cut admission remains unchanged: follow its refusal's applicable exit by stopping or resuming the paused peer, adjusting `ahub budget set`, or using `ahub release drop`. Missing/shadowed `dot` requires the resource controller or a PATH correction for the cut; nested admission requires retrying the cut outside the outer lease.

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.36
+bun add -g github:STAIxBWLB/agent-hub#v0.12.38
 ahub setup
 ```
 
@@ -30,15 +30,23 @@ and upgrade or crash recovery, see the [operations guide](operations.md). To
 move running projects to a newer release later, run `ahub upgrade` in a
 terminal: it reviews the plan with you, applies it and follows it.
 
-## Upgrading to 0.12.36
+## Upgrading to 0.12.38
 
-Restart Claude sessions after upgrading: each keeps the plugin server it started with, and `hub_review` now takes `coverage`. Every review request for a non-private task with a commit carries a review brief the hub builds from that commit: reviewable files, excluded ones (`linguist-generated` in `.gitattributes`, lockfiles, binaries) and rules from `REVIEW.md` or an `ahub-review-rules` attribute, read at the merge base. `ahub review brief <id>` prints it (#520).
+Restart Claude sessions after upgrading: each keeps the plugin server it started with, and the 0.12.38 plugin reports a reply stopped by the hop cap as not delivered instead of as sent (#546).
 
-WIP admission now applies in every lifecycle mode, `off` included: an owner at its WIP limit (default one open task per peer) cannot accept or claim another task, while a redo of its own sent-back work keeps its slot. Raise it with `ahub settings set tasks.wip_limits.<peer> N` (applies at the next admission); a limit of 0 refuses every new acceptance for that peer (#481 S9).
+Antigravity (`agy`) can join as an optional pull-only implementer (#485). It is off roster by default: install the Antigravity CLI 1.4.2, run `ahub roster add agy`, then run `ahub agy` in a terminal. Its native permissions are unmanaged and it has no hub sandbox. See [Antigravity operations](operations.md#optional-antigravity-agy-peer).
 
-Only in `enforce`: build work needs the person's `ahub sdlc accept <task> --issue <n>` and a current plan review (`hub_plan_review`, or `ahub sdlc plan-review`); an approval must account for every reviewable path of the brief; and a review request waits for the PR head, green required checks and answered bot threads. `advise` reports the same gaps; `off` adds none (#481, #520).
+Reviews can rotate across fresh Claude, Codex and Kimi reviewer sessions (#519, #533). Declare headless reviewer-only instances in `.agenthub/config.local.json`; Codex and Kimi join only with `review_mode: "fresh"`. Codex also needs an installed Codex 0.146.0 (select it with `codex_bin` when PATH resolves another version), and Kimi needs Kimi Code 2.2.0 on PATH, signed in with its own OAuth login. A headless reviewer instance without `review_mode` keeps its native behavior and stays out of the pool. agy is not a reviewer: naming it in `review.pool` shows an unavailable skip in `ahub route explain`, never a review. Once a train is active or frozen, or `review.pool` is set or fresh reviewer instances are declared, `ahub upgrade` refuses a target release without that support, so an older release cannot take the project over. See [fresh reviewer pool](operations.md#fresh-reviewer-pool-519).
 
-If the daemon refused a Jcode or Kimi TUI entry as stale because the CLI on PATH and the running hub came from different installs, run `ahub jcode --mode headless` or `ahub kimi` again (#502). For a second Claude session as reviewer or planner, or a headless Claude reviewer, see [instances](operations.md#additional-headless-peer-instances). A Claude session whose transcript passed 32 MiB no longer stays busy after its turns end (#517).
+A guarded config edit that the hub keeps at its running value now shows as `config retained: <keys>; run ahub settings reload` in status, the console and the dashboard's Settings, and starting a peer whose launch keys are retained says it uses the running value (#542). See [settings](operations.md#settings-from-the-dashboard-and-the-terminal).
+
+Upgrading from 0.12.36 or earlier, the 0.12.37 notes below also apply.
+
+The restarted Claude planner gets the release-train tools (`hub_release_new`, `hub_release_assign`, `hub_release_configure`, `hub_release_cut`, `hub_release_report`); the person uses `ahub sdlc train report|configure|cut` (#481 S11). A due date asks for a cut review and never clears unfinished work; a cut freezes scope and publishes nothing. See [release scheduling](operations.md#planner-release-scheduling).
+
+Jcode must be 0.98.0 or later, below 1.0.0; 0.94.0 is no longer accepted, so `ahub doctor` fails its Jcode row for an older install and the peer does not start (#529). Every owned jcode process runs with `JCODE_NO_TELEMETRY=1`.
+
+Since 0.12.37 the hub pins `@staix/agent-mem` 0.4.0 and opens a split memory home through its shards (#534). Before anyone runs `amem migrate --shards` on a memory home, every hub using that home must run 0.12.37 or later: an older hub does not see the split and keeps writing the old layout. `ahub memory profile-check` is not split-aware yet and reports a mismatch for every correctly bound hub on a split home (#536). See [memory profiles and rollout](memory.md#selected-memory-profile).
 
 From 0.12.30 or earlier, existing Jcode project MCP entries need one refresh before conductor or dashboard starts. Once per project, the person runs:
 
@@ -102,7 +110,7 @@ More: `ahub help`. How it is built and why: [`docs/specs/2026-09-19-agent-hub-de
 
 ## Shared memory
 
-The hub exact-pins the first-party `@staix/agent-mem` 0.3.1 core. Existing shared-v1 memory remains the default; upgrading does not migrate it. Managed agents use screened `hub_memory_search`, `hub_memory_show` and `hub_memory_graph` tools, or propose a correction with `hub_memory_correct`; only a person accepts candidates through the supported `amem review` path. Generation candidate acceptance is still refused.
+The hub exact-pins the first-party `@staix/agent-mem` 0.4.0 core. Existing shared-v1 memory remains the default; upgrading does not migrate it. Managed agents use screened `hub_memory_search`, `hub_memory_show` and `hub_memory_graph` tools, or propose a correction with `hub_memory_correct`; only a person accepts candidates through the supported `amem review` path. Generation candidate acceptance is still refused.
 
 Before any real generation migration, upgrade every hub sharing that memory home to 0.12.30 or later and check its authenticated binding with `ahub memory profile-check` in each custom registry. Ready bindings prove compatibility, not an atomic live cutover: quiesce consumers and close their handles before migrating, then reopen through the supported session-preserving lifecycle. Invalid or changed profiles disable native memory without falling back to legacy writes; the bus and board continue. See [memory operations](operations.md#hub-memory) for the remaining rollout gates.
 

package/docs/sdlc.md

@@ -64,7 +64,7 @@ The acceptance-criteria checklist belongs to the Compliance pass over the same b
 
 ## Delivery and verification state
 
-Head-bound review/approval gates, bounded custom definitions, read-only merge/release reports, S0/S8 vocabulary/checklist migration, S1 spec acceptance and S9 planner admission and S10 cost governance are implemented in source. S2-S7 and S11 and the native advise-through-merge/release cycle remain pending. Installation, native acceptance and release authorization require separate receipts.
+Head-bound review/approval gates, bounded custom definitions, read-only merge/release reports, S0/S8 vocabulary/checklist migration, S1 spec acceptance and S9 planner admission and S10 cost governance are implemented in source. S11 release-train governance ships in 0.12.37. S2-S7 and the native advise-through-merge/release cycle remain pending. Installation, native acceptance and release authorization require separate receipts.
 
 ## Initial commands
 
@@ -206,7 +206,7 @@ The connection idle setting is not a guaranteed 10-second deadline for an active
 
 A configured planner reads `hub_planner_groom` (or the person runs `ahub backlog groom`) before choosing build work. The digest reports missing text-only dependencies, repository-scoped duplicate issues and path/symbol overlaps, over-WIP owners, recorded supersession, issue edit/closed-state evidence and capability, queue or offline blockers. It proposes no board mutation. Missing repository or issue evidence stays unknown; the planner still evaluates issue rulings and the person's priorities. Private task text and references are withheld.
 
-The planner records `hub_plan_review` with the task id, current `planningRevision` and a reason. The person's CLI is `ahub sdlc plan-review <task> <revision> <reason...>`. Tasks records the actor, planning revision, observation time and host-read issue identity/edit time. The fixed GraphQL query requests metadata only, never an issue body or comments; comment-only activity does not invalidate the body-edit receipt. Caller-supplied timestamps are refused. A changed revision or issue edit requires another review; unavailable metadata never counts as a current review. The native CLI cannot delegate this person-attributed write through `--live-test`.
+The planner records `hub_plan_review` with the task id, current `planningRevision` and a reason. The person's CLI is `ahub sdlc plan-review <task> <revision> <reason...>`. Tasks records the actor, planning revision, observation time and host-read issue identity/edit time. The fixed GraphQL query requests metadata only, never an issue body or comments; comment-only activity does not invalidate the body-edit receipt. Caller-supplied timestamps are refused. A changed revision requires another review except for the complete contiguous release-only history described under S11; issue identity/edit and cost-scope checks still apply. An issue edit requires another review; unavailable metadata never counts as a current review. The native CLI cannot delegate this person-attributed write through `--live-test`.
 
 For implementation/bulk-edit tasks and an explicit build-base stage, enforce refuses an offer or acceptance without a current receipt. Advise reports the gap and off performs no lifecycle gate. Spec acceptance and planner review are independent readbacks bound to one task snapshot before acceptance. The ordinary synchronous acceptance path cannot bypass the enforce readback. A self-claim can remain assigned and proposed while its prerequisites are missing, with no offer or accepted event. A saved planner review can release previously held proposed work; delivery failure leaves that saved receipt intact.
 
@@ -225,7 +225,7 @@ S9 ceilings: a private build task with an issue reference cannot satisfy enforce
 
 At plan review, batch small related fixes into one area branch and PR; keep release preparation separate from feature work. A plan can name `review: {scope: "none" | "delta" | "full", reviewers: N}` and `ci: "focused" | "full" | "reuse"`. None requires zero reviewers; delta/full require one to eight. These are expected costs, not permission to bypass the task's reviewer, CI or privacy gates. Use one reviewer for a small change; split a large review by area with one receipt owner. After a fix, review the delta against the previous findings. S2 will compare planned scope with completed coverage.
 
-The planner can provide scope with `hub_plan_review`; the person can run `ahub sdlc plan-review <task> <revision> <reason...> --review full --reviewers 1 --ci full`. Tasks records the explicit scope on the plan and its revision-bound receipt. A file-list update retains omitted cost fields; an explicit scope change cannot replace a reviewed scope during enforce acceptance. Old plans and receipts remain unspecified and are never filled by guessing. Advise reports missing scope. In enforce, every newly recorded receipt needs both scopes; an existing scope-less receipt remains valid until its planning revision changes. Enforce acceptance cannot add owner-supplied cost keys to that legacy receipt; the planner must record an explicit scope first.
+The planner can provide scope with `hub_plan_review`; the person can run `ahub sdlc plan-review <task> <revision> <reason...> --review full --reviewers 1 --ci full`. Tasks records the explicit scope on the plan and its revision-bound receipt. A file-list update retains omitted cost fields; an explicit scope change cannot replace a reviewed scope during enforce acceptance. Old plans and receipts remain unspecified and are never filled by guessing. Advise reports missing scope. In enforce, every newly recorded receipt needs both scopes; an existing scope-less receipt remains valid until a non-release planning revision changes, with the same complete-history exception under S11. Enforce acceptance cannot add owner-supplied cost keys to that legacy receipt; the planner must record an explicit scope first.
 
 A review request is premature if its task head does not match the PR head, configured required checks are not green, or a pending bot thread is unanswered. A resolved thread is settled; an unresolved one needs a user reply after its last bot comment. The hub reads identity, timestamps, authorship type and resolution only, never comment bodies. Without explicit required checks the native floor is both OS checks plus `seeded guards`. Advise reports the gap; enforce refuses before the requesting done/cohort writes. A private turn may finish its own PII task in advise with a generic unknown-readiness notice and no remote metadata read; the private-turn refusal for ordinary work remains. Delayed checks revalidate before completing. Background roster/quota role changes remain fact, but enforce holds a new review envelope without an admission readback; refresh it through a manual reviewer assignment after CI and replies are ready. The brief and verdict coverage belong to #520, separate from this admission.
 
@@ -234,3 +234,29 @@ CI controllers are serialized across the repository for the entire workflow, wit
 `hub_sdlc_costs` and the person's `ahub sdlc costs [owner/repo]` report linked merged PRs without changing the board. A review round is a board done-to-verdict handoff, not each reviewer in a multi-reviewer round. An observed handoff still counts when its declared scope was none. The report counts distinct check-workflow run ids, extra attempts (`run_attempt - 1`), full re-reviews, delta rounds and summed review intervals, with GitHub review counts alongside them. Unspecified scope and unavailable evidence stay unknown/incomplete. Only current public links are projected; a private counterpart withholds the whole PR. Up to 16 linked PR reads share 20 seconds; each PR covers at most 100 commits, reviews and recent check-workflow runs, and the pure aggregator bounds 500 tasks, 200 PRs and 10,000 history entries. Truncation is explicit. S10 exposes pure band-breach proposal data; S7 owns rolling baselines, band configuration, automatic scheduling and board-card creation.
 
 S10 policy ceilings are tracked in hub task #230: metadata failures remain fail-closed; the repository-wide queue can delay newer heads and releases; unknown thread author kinds remain unknown in enforce; and advise still retries concurrent state/authority changes. These policies are deferred, with no silent relaxation in this slice.
+
+# Planner release trains (S11)
+
+Release scope stays on each task's existing `release` planning field. `hub_release_new` creates a future planning row; `hub_release_configure` activates it, sets its planned cut date, or records an enumerated hotfix cause. Only one train may be active or frozen. Future planning rows remain available so unfinished work has a next-train destination.
+
+`hub_release_assign` changes only a task's release, including approved or in-flight work. It retains execution state, owner, reservations and dependencies. It requires the current planning revision and a reason. Public reasons are screened; private or pinned work requires the person. A private reason stays on the board with a withheld history marker and never goes to the model screen, including when approved work is rolled out of a train. Public readiness/cut still refuses a scope containing private work; frozen or settled scope cannot move through this operation. Release-only planning revisions retain the S9 plan review only when the complete intervening planning history changes exactly the release field; other planning changes still invalidate it. The existing general backlog planning rules remain unchanged.
+
+Use `ahub sdlc train report <release-id>` to see planned task identities, approval readiness, due trigger and recorded release metrics. `ahub sdlc release-assign <task> <revision> <release-id|none> <reason...>` is the person's CLI for assignment. A planner uses the corresponding hub tools under its own identity. `ahub sdlc train configure <release-id> <revision> '{"state":"active","cut":1792500000000}'` activates a future train and optionally sets the UTC epoch-millisecond cut date.
+
+A train becomes due when its tasks are approved or its cut date arrives. A date never clears an unfinished task: move it to the next planning row with a reason before cutting. `hub_release_cut`, or the person's `ahub sdlc train cut <release-id> <revision>`, freezes a nonempty, fully approved scope. Scope and authority are checked again after cost/admission reads and in the final database transaction. Cancellation does not count as approval.
+
+The cut obtains a short repository lease through the installed host `dot admit` controller, checks the shared gate lock, and retains the lease until scope freeze. The controller is resolved outside the project, its command is fixed, and missing/expired/unknown admission defers. The daemon checks fresh account quota headroom for attached peers with a real source (a registered `budget.reader`, or an enabled soft-token limit), including shared instance accounts; unknown/stale readings from those sources defer. Registered accounts without a configured source report `no quota source` rather than deferring on absent readings; an unknown external account still requires evidence. Budget-record and manual pauses still defer for every attached peer. This metadata lease does not authorize a build. Each later heavy preparation step needs its own admission. The cut neither publishes nor tags, and it never substitutes for S6's person authorization or native verification.
+
+A hotfix records one cause and why it cannot wait: `loss`, `security_privacy`, `upgrade_start_blocked`, or `core_flow_no_workaround`. These mean data/message loss, a security/privacy defect, blocked upgrade/start, or a broken core flow without a workaround. Hotfixes keep every scope, quota, resource, review and CI gate. Their branch starts at main and contains the fix and regression only; unrelated work belongs in a future train.
+
+Release history records the frozen task ids and actual cut/shipment times. CI resource counts read only the planned scope's PRs at cut (at most 16 distinct PRs in one repository, run attempts included); failed reads or a larger/mixed-repository scope leave the count unknown; board review verdict counts are recorded separately. Missing PR links, incomplete reads and legacy history remain unknown. Metrics derive shipment intervals, approval-to-shipment lead time, hotfix fraction among shipped releases, and recorded resource counts. They do not infer success from an absent record. Release-preparation PR costs and future S7 band automation are separate evidence, not guessed counts. The per-release "gates run" record is deferred to S6/S7; frozen scope and resource counts do not prove that gates ran.
+
+Legacy release rows omit train metadata. The old off-mode planning APIs keep their shape; explicit train operations always enforce their stated board/resource rules. Enabled lifecycle freeze, and any configured train freeze, must use the admitted cut path. Ship/drop remain person-only. The existing person-selected upgrade/recovery operation and its readiness/completion checks remain separate from a cut; a source gate is not an upgrade receipt.
+
+Person ruling 2026-10-19 supersedes the earlier S11 upgrade-admission ruling: upgrades remain outside S11 host-admission, quota and additional all-idle gates. Recovery uses its pre-S11 `recoveryReady()` checks: no busy peers, pending approvals resolved and completion checks settled, with the existing operation-identity and lifecycle fences. A quota/manual pause, missing or shadowed `dot`, or an outer same-repository admission lease adds no S11 upgrade refusal. The person-selected operation remains the confirmation; no extra receipt or agent upgrade authority is added. Release-cut host and quota admission remains unchanged.
+
+Configured cut dates must be positive safe UTC millisecond timestamps; the train tool does not accept null to clear a date. A configured active/frozen train also requires a recovery target advertising `release_trains`, so an older daemon cannot silently drop the safeguards after restart. Target proof is checked before preparation and again before commit; queued future planning rows and legacy rows retain their existing compatibility.
+
+Release-cut refusals name the applicable exits: stop or resume a paused peer, adjust `ahub budget set`, or drop the train with `ahub release drop`. Install the resource controller or fix PATH when `dot` is unavailable or shadowed; retry the cut outside an outer admission lease when nested admission is refused.
+
+Train history retains at most 256 events. Configuration no-ops retain the revision and history; meaningful configuration reserves the final two slots for cut and shipment. Capacity refusals occur before effects; an already exhausted legacy train requires a person-selected replacement.

package/docs/security.md

@@ -23,7 +23,7 @@ agent-hub connects agents that can each run commands. This page says what the hu
 
 ## Native memory authority and profile selection
 
-The portable core is the exact-pinned first-party `@staix/agent-mem` 0.3.1 package; it does not replace the hub's caller identity, PII policy or task-write authority. Deny, hardened git, real paths and process identity are single-sourced in its Node-safe platform entry. Current project privacy is applied by the hub before promotion and again before model-facing reads. Standalone person reads are unscreened, and the standalone `--policy-free` acknowledgement grants no hub or peer authority.
+The portable core is the exact-pinned first-party `@staix/agent-mem` 0.4.0 package; it does not replace the hub's caller identity, PII policy or task-write authority. Deny, hardened git, real paths and process identity are single-sourced in its Node-safe platform entry. Current project privacy is applied by the hub before promotion and again before model-facing reads. Standalone person reads are unscreened, and the standalone `--policy-free` acknowledgement grants no hub or peer authority.
 
 `hub_memory_search`, `hub_memory_show` and `hub_memory_graph` take the project from the daemon, require `memory_read`, refuse private turns and validate UTF-8 input before logs or storage work. Complete records and graph metadata are screened before counts and truncation. Search is at most 20 lines/4 KiB (default 8); show accepts at most 8 ids and returns at most 8 KiB; graph is at most 120 nodes/240 edges/6 KiB (default 60 nodes), with no edge lacking an endpoint. Unknown, ambiguous and withheld ids share one neutral refusal. Arguments and results are excluded from hub-managed capture; this does not govern a vendor's independent transcript or memory hooks.
 
@@ -33,6 +33,8 @@ The hub binds the selected root/profile at open. Invalid/missing generation meta
 
 Before migrating any real home, every hub sharing it must first be on 0.12.30 or later with positive authenticated binding or unbound/quiesced proof from `ahub memory profile-check` in each relevant registry. An unknown or unreadable runtime is not proof of absence, and a matching ready binding still holds a handle that must be closed. Profile-check reports only its named registry inventory. Root paths, selector receipts and malformed-legacy counts are person-local diagnostics, excluded from ordinary peer status and allowed agent CLI reads. Source/fixture checks do not establish native capture, real migration or account/device-sync success.
 
+On a home split by `amem migrate --shards`, the hub opens only its own project's shard, with the user shard as overlay, under the alias-resolved project key (#534, #537); other projects' private notes are not in that store. Each memory entry rechecks the shard identity, and an alias that later remaps the key latches the binding unavailable. A split that is not active refuses and is never read as an empty or legacy store. A hub on 0.12.36 or earlier does not detect a split and keeps writing the old layout, so every hub on the home must run 0.12.37 or later, or be stopped, before splitting. `ahub memory profile-check` is not split-aware yet (#536): on a split home its mismatch reports are not evidence either way.
+
 ## What is not defended
 
 - **A malicious local process running as you.** It can read the control token, `hub.db`, the project and your home directory without the hub's help. The token keeps web pages and other users out, not your own processes.
@@ -238,7 +240,9 @@ never-ask still requires the person's confirmation. qwen_cmd is machine-local an
 never editable through settings. Legacy benchmark adapters remain unmanaged by
 this production table. Startup diagnostics withhold native host/payload details.
 
-Jcode is optional, source/version-fenced and runs native tools without a hub sandbox or hub permission-mode mapping. .jcode joins the scoped-grant exclusion, including lexical/resolved aliases. Only a person writes its unique project MCP entry; foreign/override/symlink entries refuse. The hub owns a private daemon/socket and ACP group, never the global daemon, and copies no credentials. Native diagnostics withhold payloads/hosts. Unproved conversation loads refuse; no fresh replacement is called a restore.
+Jcode is optional, source/version-fenced and runs native tools without a hub sandbox or hub permission-mode mapping. .jcode joins the scoped-grant exclusion, including lexical/resolved aliases. Only a person writes its unique project MCP entry; foreign/override/symlink entries refuse. The hub owns a private daemon/socket and ACP group, never the global daemon, and copies no credentials. It accepts only a plain jcode release from 0.98.0 up to, not including, 1.0.0 (#529), and runs every owned jcode process (version probe, daemon, ACP) with `JCODE_NO_TELEMETRY=1`, because jcode's telemetry can report the provider account's email. Native diagnostics withhold payloads/hosts. Unproved conversation loads refuse; no fresh replacement is called a restore.
+
+Antigravity (`agy`, #485) is optional, cloud and off roster by default. It runs native tools under its own unmanaged permissions, without a hub sandbox or hub permission-mode mapping; headless, resume, unattended and native permission flags are refused. Its roles are capped at implementer and verifier, so it never plans, reviews or receives PII work. Only the person's `ahub agy` launcher writes its three plugin files in `.agents/plugins/agent-hub/` (`plugin.json`, `mcp_config.json`, `hooks.json`): linked or foreign entries refuse before any write, cleanup removes only that launch's matching files, and it never writes project-level `.agents/hooks.json` or the person's `~/.gemini` settings. Conductor starts are refused. Hook authority (`native_hook_launch`) comes only from that launcher, belongs to the console socket that began it and ends when that socket closes; hook input over 1 MiB is refused, and observations are bound to the daemon, launch, native session and project.
 
 # Transient ACP activity (#286)
 
@@ -343,6 +347,10 @@ Stall causes are persisted and deduplicated by cause and replanning revision. Pl
 
 A declared instance whose only role is reviewer gets review requests, task messages addressed to it and the person's messages; agent chat, digests and presence are discarded and journaled, and it gets no memory recall (#223). The headless Claude reviewer runs one new `claude -p` per review with `--setting-sources ""`, `--strict-mcp-config`, `--no-session-persistence`, tools limited to Read, Grep, Glob, `hub_review` and `hub_task_show`, and `dontAsk`. Its prompt holds hub facts and a bounded diff, never the builder's summary, and its `hub_task_show` drops the builder's notes. Changes touching `local.deny` or `pii.paths` are withheld and passed as `Read` deny rules, which Claude enforces, not the hub. Private tasks are never given to it. Its `hub_review` counts only while the child started for that task still runs; a stop or exit revokes it first, and surviving processes hold the delivery as `needs_review` and keep the reviewer busy.
 
+The fresh Codex reviewer (#519) needs `review_mode: "fresh"` and an installed Codex 0.146.0; any other version is unavailable. Before each review it requires a model-free isolation receipt: binary and config unchanged, only the two hub tools in the configured MCP inventory, plugins, hooks and Apps disabled (Apps by a separate feature readback), and a named filesystem profile whose fixtures prove public reads, private-path denial (exact, glob and symlink), standard host credential denial and write denial. Credential and tool-home roots are denied even with an empty `local.deny`; that list does not cover every personal file. A dangling or unreadable credential root refuses the reviewer, and the reason names only its path class (`~/.docker`, `$DOCKER_CONFIG`), never the path or its contents. Its shell is sandboxed read-only, not Claude's Read/Grep/Glob whitelist. Network and web search are configured disabled but not observed: managed requirements can still select cached web search, and no run has shown the review selecting the profile through `default_permissions`. A failed receipt or start never falls back to a continuing native session, and a child that ends without a saved verdict is never approval. The agy reviewer slot is an unavailable placeholder and never runs.
+
+The fresh Kimi reviewer (#533) needs `review_mode: "fresh"` and Kimi Code 2.2.0 with its native OAuth login; any other version, or a failed preparation, is unavailable. It is a native tool-authority boundary, not a sandbox: no Seatbelt wraps it, and same-user native code is not isolated from the filesystem or network. Each review starts a new child in a private `KIMI_CODE_HOME` with managed-provider-only config, a clean temporary working directory and an empty skills directory. Its agent may use only `hub_review` and `hub_task_show`, served by a loopback MCP session bound to the task, head and review revision that never carries the hub's control token; it has no native read, file or shell tool and sees only the screened review brief and host facts. Its `credentials/` and `oauth/` directories and `device_id` link to the person's native ones, so refresh keeps Kimi's own lock and atomic rename; no token is copied and `KIMI_DISABLE_OAUTH_LOCK` is never set. A stop revokes its verdict authority before termination; killing it mid-refresh may require a native re-login. Private tasks are never given to it, and a child that ends without a saved verdict is never approval.
+
 The review brief (#520) withholds private changes whole (both sides of a move) and counts them; a rule file that fails the private-data screen is named, not shown. Attributes and rules are read at the merge base, so a change cannot loosen its own review. Spec acceptance, plan review, premature-review and cost reads fetch GitHub metadata only (edit times, check states, thread authorship and resolution), never issue bodies or comments. The CI workflow keeps `contents: read` and `actions: read`.
 
 ## Bounded task specs and isolated checks (#418)

package/docs/smoke.md

@@ -1709,9 +1709,9 @@ the native version and observed outcome here. No hub-driven Qwen TUI is offered.
 
 Qwen recovery source/fake proof: saved ids pass through the driver and CLI to ACP session/load, and the crash loader restores the recorded id/model. Actual native/provider recovery remains unverified.
 
-## Jcode 0.94.0 peer (#332)
+## Jcode peer, 0.98.0 to 1.0.0 (#332, #529)
 
-Source/fixture proof is recorded in verification/2026-10-11-jcode-peer-contract.md. Unverified: real provider/model, native project MCP discovery and hub-tool receipt, native tool policy and stop/child teardown. Native automatic restoration is withheld because the pinned ACP load does not prove the id. No benchmark comparison or default replacement ran.
+Source/fixture proof is recorded in verification/2026-10-11-jcode-peer-contract.md; the live owned-daemon and ACP handshake on 0.94.0 and 0.98.1 in verification/2026-10-19-jcode-0.98.1.md. Unverified: real provider/model, native project MCP discovery and hub-tool receipt, native tool policy and stop/child teardown. Native automatic restoration is withheld because the pinned ACP load does not prove the id. No benchmark comparison or default replacement ran.
 
 
 ## Project board (#263)
@@ -1935,3 +1935,39 @@ hub instance stays running with its queue and pauses intact. Record the source
 head, terminal and daemon readbacks separately before claiming AC5 native smoke.
 
 For the guarded CLI leg, edit a disposable untracked WIP limit, run `ahub settings reload`, inspect its complete before -> after preview, decline and verify the running limit is retained. Repeat and confirm y, then verify the same instance and queue/pause state. Record this separately from the scripted CLI fixture; the token proves freshness within console authority, and the CLI supplies the person-presence checks.
+
+
+## Reviewer pool native legs (#519, 2026-10-19)
+
+Claude/Codex native account/model acceptance remains **UNVERIFIED** in this pool report; Kimi's completed authenticated fresh-verdict and account-free receipts are recorded separately below and in its R0/live report. See [reviewer isolation evidence](verification/2026-10-19-reviewer-isolation.md) for the exact source/version pins and offline probes. Those probes used temporary fixtures and no model prompt, account login or credential copy. Fake-CLI tests and CI are separate host-contract evidence. Existing #223 Claude behavior is retained without a new live Claude claim.
+
+Complete these legs in a disposable project with authorized accounts after source integration and exact-head CI:
+
+- Declare headless Claude and Codex reviewer-only instances, adding `review_mode: "fresh"` to Codex. Claude retains the automatic #223 declaration. For Codex, select the proved 0.146.0 binary and verify its runtime isolation receipt before a model turn; a 0.163.0 PATH executable must remain unavailable.
+- Submit a small public change with a pinned reviewed head. Confirm a different-family reviewer, fresh native session, expected read-only policy, the fixed two hub tools and a verdict carrying `reviewContext: fresh`, `reviewerFamily` and `reviewerReason`. Confirm builder done narrative is absent from both prompt and `hub_task_show`.
+- Request a delta review and confirm the same eligible independent reviewing family receives a new session with prior findings. After an earlier same-family fallback, a newly available independent family still takes precedence. Exercise configured re-rotation separately. Stop or exhaust one reviewer and confirm the pure routing walk chooses the next eligible candidate; no failed start or child ending without a saved verdict becomes approval. Check the next candidate even when the missing verdict followed a vendor quota error; no text-based quota classifier is assumed.
+- Make all pool candidates unavailable and confirm a blocked review awaiting planner/person action. Then test a different fresh session in same-family fallback only when no other family can run. Verify stale-child, changed-head and private-review verdict refusals.
+- Verify compatibility separately: a Codex/Kimi headless reviewer-role declaration without `review_mode` keeps its native app-server/ACP behavior and existing worktree/permission options, and stays outside the fresh pool. An explicit fresh declaration must refuse an unsupported backend without downgrading.
+- The default logical pool is Claude, Codex, Kimi. Kimi is runnable only for covered 2.2.0 when runtime preparation passes; unsupported or failed preparation is unavailable with its reason. Seed modulo includes only kinds with a declared candidate, even when blocked; undeclared kinds remain trailing trace entries. Verify seeds 0..5 with only Claude/Codex declared alternate 3/3, and an offline declared kind still retains its slot. Agy stays unavailable as a reviewer with exact reason `agy is an implementer peer (#485)`, including explicit pool requests. #234 adds no agy reviewer launch or live leg.
+
+Record source head, exact executable version/hash, isolation receipt, task/head identities, route walk, distinct native session evidence and persisted verdict separately. Do not record credentials or raw transport environments. Codex sandboxed shell must not be described as Claude's Read/Grep/Glob-only whitelist. Network policy is configured disabled; no network-denial probe or native LLM isolation result has been recorded by this investigation.
+
+## Kimi reviewer and task-bound MCP (#533)
+
+Kimi 2.2.0 is available when runtime preparation passes; a failed or unsupported preparation remains unavailable. Completed evidence includes account-free two-tool/native OAuth race checks, host/fake lifecycle refusals and authenticated fresh `changes_requested` verdicts. The complete-collector live run observed project parity/canary absence, authenticated exact-two hub inventory/calls, zero decoy requests, cleanup and unchanged real config hashes. Its original aggregate receipt remains failed because of an unattributed extra observer error; the later account-free GET reproduction/correction is not a new live pass. These separate outcomes are preserved in the R0/live report. The remaining actual interactive-TUI/coexistence and usage-observation checks are **UNVERIFIED**; they do not turn completed live/fake evidence into an unrun test. Person ruling 2026-10-19 (8281ec35) limits #234 to Kimi and task-bound MCP and supersedes all earlier agy reviewer implementation/admission/live-leg rulings. Agy is an implementer under #485; its retained reviewer slot remains unavailable with exact reason `agy is an implementer peer (#485)`. Earlier agy probes and unresolved meta-tool/resource findings remain historical in the [R0 report](verification/2026-10-19-kimi-agy-reviewer-isolation.md), not active smoke requirements here. Kimi's native-permission/shared-account ruling supersedes its earlier R0-only hold and Seatbelt requirement. The [spec amendment](specs/2026-09-19-agent-hub-design.md#kimi-reviewer-and-task-bound-mcp-amendment-533-hub-task-234) defines the active contract and residuals.
+
+- For Kimi regression smoke, confirm a fresh child per review, no resume, source evidence supplied only by screened `hub_task_show`/review brief and host facts, and no native Read/file/shell tool. Confirm the in-process host MCP exposes only the task-bound `hub_review` and `hub_task_show` capability, without the full hub control token. Exercise wrong task/head/review revision, stale/replaced child, private review, malformed arguments, unknown tool and stopped-child refusals; verify no saved approval on any failure.
+- Kimi 2.2.0: confirm no Seatbelt wrapper, a private `KIMI_CODE_HOME` with managed-provider-only config, clean temporary cwd and explicit empty skills directory. Verify exactly the two `mcp__agent-hub__...` tools in model disclosure and invocation; reject native read/write/command and extra MCP calls. Confirm `credentials/` and `oauth/` are directory symlinks to the native locations, `device_id` links the native identity, no token copy/extraction/static provider is used, and `KIMI_DISABLE_OAUTH_LOCK` is absent. The concurrent account-free OAuth print stand-in proved two expired generations serialize refresh through shared directory links, but it was not an attached interactive TUI. Actual TUI refresh/atomic rename/lock coordination and shared-account quota/pause fanout remain separate live legs. Existing project MCP/config byte-parity observations remain recorded in the R0/live report. Record identities/metadata without token values.
+- Kimi cancellation: revoke review authority before TERM, observe bounded grace while the OAuth lock is held, then confirm owned-group teardown and temporary-state cleanup. Use synthetic auth for forced mid-refresh kill checks; report the accepted possibility of re-login rather than repair auth or count an interrupted turn as approval. Keep real-account refresh/coexistence evidence separate from synthetic cancellation evidence.
+- Recheck common routing, independent-family preference, recorded same-family fallback, no-verdict retry/exhaustion, head-bound persisted verdict, person-stop hold and shared-account budgets. Keep Kimi unavailable on a failed or missing receipt; agy remains unavailable under #485 regardless of historical reviewer probe results. Record executable version/hash, source head, tool/permission evidence and actual account/model results separately; source/configuration alone is not a live pass.
+
+
+Kimi usage ceiling: 2.2.0 print stream-json exposes no token counts. Keep unobserved usage unknown; native account quota/manual pauses still apply to the shared account. The fake OAuth race and authenticated verdict do not prove token metering or a new soft-token reading. Actual interactive-TUI coexistence and usage-source coverage remain separate from the completed fresh invocation and host MCP receipts.
+
+## Antigravity P1 (#485)
+
+- Pin agy 1.4.2; verify its executable/version and keep the actual TUI/IDE leg separate from the account-free [T0 transport receipt](verification/2026-10-19-agy-p1-t0.md).
+- With a reviewed compatible daemon running and agy explicitly on roster, the person runs `ahub agy` in a terminal. Confirm peer `agy` is pull-only, native permissions unmanaged and no hub sandbox/budget source is claimed.
+- In the native TUI call `hub_inbox`, `hub_send`, and a permitted board read/proposal within a non-PII task. Confirm the tool audience and actor remain `agy`, the native model consumes the tool results, and no unsolicited push or PII task text reaches it.
+- End the TUI normally. Confirm its group/socket detaches and only its matching managed three-file plugin is cleaned up; unrelated project/global settings remain unchanged.
+- This live project/account leg is pending until actually run. An older daemon's missing `native_hook_launch` refusal is not a successful TUI launch or grounds for an automatic restart of other active peers.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -2454,11 +2454,12 @@ the queue.
 
 ## Amendment: optional owned Jcode peer (#332)
 
-- jcode is optional on the roster, default off, with implementer/verifier guidance and no default routing replacement. Its source-pinned native identity is jcode 0.94.0.
+- jcode is optional on the roster, default off, with implementer/verifier guidance and no default routing replacement. Its native identity is jcode from 0.98.0 (the minimum; verified live on 0.98.1) up to, not including, 1.0.0 (the assumed breaking version); the minor is not pinned. Lower the breaking version when a release is shown to break the contract (#529).
 - A private foreground daemon/socket and ACP client belong to this peer. The global daemon is never adopted or stopped. No automatic update, self-dev or credential copy. The native MCP store must already exist to avoid implicit Codex import.
 - ACP session MCP arrays are ignored natively, so the person launcher manages only agent-hub-jcode, shared:false, in project .jcode/mcp.json. Later override layers, foreign names and links refuse. Daemon starts verify read-only. .jcode is outside scoped grants.
 - Native policy is unmanaged and has no hub sandbox. Hub permission mappings refuse; native quota/consumption are not inferred. Every task mutation stays in Tasks and PII remains at existing redaction/routing boundaries.
-- Native 0.94.0 load lacks identity proof. Controlled recovery refuses before effects, crash recovery is manual and a load without an exact echoed id refuses before a prompt or restored claim. Real provider/tool/teardown evidence and comparative measurement remain unverified.
+- The private socket name ends in `.sock`: jcode names its debug socket by replacing that suffix. Every owned jcode process runs with `JCODE_NO_TELEMETRY=1` (#529).
+- Native ACP load (verified on 0.94.0 and 0.98.1) lacks identity proof. Controlled recovery refuses before effects, crash recovery is manual and a load without an exact echoed id refuses before a prompt or restored claim. Real provider/tool/teardown evidence and comparative measurement remain unverified.
 
 # ACP watch amendment, 2026-10-11 (#286)
 
@@ -3575,6 +3576,30 @@ Owner decision 2026-10-18 (#450 comment 6248184754), R1-R5. R3's mechanism, chos
 - **Settlement.** A start failure before any review in a delivery ran is `failed_safe`; after one ran, the delivery is held as `needs_review`. A failing facts or verdict-check callback is logged, and the review counts as without a recorded verdict.
 - **Never an owner.** The reviewer variant carries `routing.reviewOnly`; assignment refuses it as an owner for every task class and when named.
 
+## Reviewer pool amendment (#519, hub task #229)
+
+Historical planner ruling, 2026-10-19 (#229 scope; Kimi follow-up and agy scope superseded by the person ruling below): #229 implements R3-R6 for Claude and Codex; admission is receipt-gated. Only proved reviewer profiles ship as runnable variants. The existing #223 Claude variant is retained; Codex is restricted to its verified 0.146.0 profile and a passing runtime receipt. Kimi and agy remain unavailable with metadata reasons and outside the default pool; #229 adds no launch code for either. Kimi launch and task-bound MCP work continues in #533 (hub task #234). The person reassigned agy to the implementer peer work in #485; its retained reviewer slot is unavailable with reason `agy is an implementer peer (#485)`. The [isolation evidence report](../verification/2026-10-19-reviewer-isolation.md) records primary sources, offline probes and untested native legs. Source integration and model-free admission are verified; final-head verification remains the required PR gate.
+
+- **Pool and routing.** Planner ruling 2026-10-19 (#234 M5/M6) supersedes the earlier fixed configured-slot denominator. The default logical kind order is Claude, Codex, Kimi. Modulo uses only configured kinds with at least one declared reviewer candidate, including blocked/offline/paused/quota/failing candidates; availability does not renumber these declared kind slots. Configured undeclared kinds are appended as `no declared reviewer` trace entries after the declared-candidate walk and do not bias the seed denominator. `review.pool` accepts registered reviewer kinds (Claude, Codex, Kimi and the retained unavailable agy slot); agy is excluded from runnable reviewer candidates with reason `agy is an implementer peer (#485)`; local/Pi are refused. An explicit pool with no declared candidates blocks for the person. An omitted pool with no fresh reviewer declaration retains legacy routing. With an omitted pool, exhaustion retains the #223 R5 eligible-planner fallback, preserving the exhausted pool walk and reason in trace/history; absent an eligible planner, the person reviews with a blocked result. This applies also to unavailable-only declarations outside the default pool. An explicit required pool remains blocked for the person on exhaustion; explicit nominations cannot bypass backend unavailability. Unavailable never means pass. Pure `assign()` starts at PR number modulo the declared kind-slot count when linked, otherwise task id modulo that count, walks unavailable/paused/quota/failing candidates and skips the implementer's family while another can run. Delta review keeps the preceding reviewing family by default when it remains eligible and independent, with configurable re-rotation. Family independence still takes precedence over continuity after an earlier same-family fallback. A start failure or any child ending without a saved verdict walks the remaining candidates for that review; no quota category is inferred from vendor text. Explicit named reviewer choices remain outside automatic pool replacement; a failed pinned review stays held for the person. Board transitions still go through Tasks. A same-family fallback uses a different fresh child and is recorded. Exhaustion records `blocked: no reviewer can run` and leaves planner/person review available; it never auto-approves.
+- **Variants and authority.** Fresh variants require a declared headless instance with roles exactly `["reviewer"]`. Codex and Kimi additionally require `review_mode: "fresh"`; without that opt-in, existing headless reviewer-role instances retain their native app-server/ACP transport, worktree and permission semantics and do not join the fresh pool. Claude retains #223 automatic selection for its headless reviewer-only declaration; agy remains an unavailable metadata-only reviewer declaration with reason `agy is an implementer peer (#485)`, and #533 adds no agy reviewer launch contract. An unsupported fresh backend refuses without falling back to a native continuing session. Ordinary implementer instances retain their native adapters. The common lifecycle starts a fresh child per review, never resumes, filters builder narrative/shared memory, retains private-diff/read/verdict fences and permits only `hub_review` and `hub_task_show` from the hub. Process-group cleanup and the per-child verdict token retain #223 semantics. A missing receipt refuses before a model starts.
+- **Codex receipt.** The producer resolves a host executable outside the project and binds its native binary hash and config metadata. It checks the exact supported version, performs bounded model-free MCP inventory/readback, disables ambient stdio/HTTP servers with self-contained stubs and verifies the fixed hub's two-tool allowlist. Plugins, hooks and Apps are disabled and the physical project is untrusted. Because `mcp list` omits runtime ChatGPT Apps contributions, a separate bounded `features list` readback must prove Apps disabled; inventory alone is not a strict-MCP receipt. The policy requests disabled web search and is passed to exec. There is no effective-turn web-search readback; managed requirements can override this request to Cached at the pin, as recorded in the verification ceiling. A named filesystem profile is read-only with portable core deny rules, explicit private-path/subtree rules, standard host credential directories/files (including configured XDG/tool-home overrides, deepest-existing-ancestor canonical paths for absent descendants and existing real-path aliases), the hub state directory and network disabled; a native temp-fixture proof, including synthetic gh/kube/docker credential reads, precedes the ephemeral exec launch. These standard credential denies supplement the portable core and project policy; they do not classify arbitrary personal files elsewhere on the host. The binary is hashed once during preparation, with dev/ino/size/mtime/ctime rechecked before spawn along with config metadata. PATH Codex 0.163.0 is unsupported, not an inferred pass. No credential copy or blanket approval bypass is added.
+- **Read-only meaning.** Codex retains sandboxed shell under that filesystem/network policy; it does not have Claude's Read/Grep/Glob-only whitelist. The offline fixture measured filesystem denial, not a model turn or network-denial result. No recorded run shows exec selecting `ahub-review` through `default_permissions`; the configured exec argument and explicit-profile sandbox proof remain separate evidence. Post-check same-user mutation remains a documented ceiling. Kimi plan mode alone is not an isolation receipt.
+- **Registry contract.** The #229 data-only agy declaration is separate from the native runtime catalog and does not extend the legacy supported-peer or optional-peer lists. Their existing pinned expectations and the empty registry-guard baseline stay intact. Only declared unavailable reviewer instances can name that metadata, with reason `agy is an implementer peer (#485)`; it adds no agy reviewer adapter or launcher. Native implementer work belongs to #485.
+- **Selector contract regression amendment (#234 M5).** `test/reviewer-pool.test.ts` intentionally changes the three old undeclared-slot expectations: mixed declared/undeclared seed selection, the missing-kind denominator case, and missing-kind trace-before-selection. New seeds 0..5 with Claude/Codex declared and Kimi undeclared require three selections per actual kind; a blocked declared Codex retains its slot. Availability, family-independence, continuity, exhaustion and registry guards are not loosened.
+- **Recovery compatibility.** A configured pool or declared fresh reviewer requires target feature `reviewer_pool`; an older target cannot drop `review_mode: "fresh"` or silently restore it under ordinary adapter policy.
+- **History compatibility.** Keep `reviewContext` as its existing `fresh`/`continuing` string. Add host-recorded `reviewerFamily` and `reviewerReason` fields for rotation, implementer skip, unavailable skip and same-family fallback. `ahub route explain` renders the same pure routing walk; agent prose never supplies routing authority or a passing receipt.
+
+## Kimi reviewer and task-bound MCP amendment (#533, hub task #234)
+
+Person ruling, 2026-10-19 (8281ec35), supersedes the earlier agy reviewer implementation, global-admission, project-permission and live-check rulings: #234 includes only Kimi and task-bound MCP. Agy becomes an implementer peer under #485; its retained reviewer slot is unavailable with exact reason `agy is an implementer peer (#485)`, including explicit pool requests. No agy reviewer code, admission, personal configuration write or live leg is authorized by #234. Earlier agy OAuth/listener, permission and meta-tool findings remain historical evidence in the [R0 report](../verification/2026-10-19-kimi-agy-reviewer-isolation.md), not an active reviewer contract. Kimi retains the native permission/shared-account contract below, superseding its earlier R0-only hold and kernel-isolation prerequisites. Kimi 2.2.0 is runnable when runtime `prepare` passes; an unsupported version or failed preparation remains unavailable with its refusal reason. The default logical pool is Claude, Codex, Kimi with declared-kind modulo as specified above; agy stays outside it. Completed account-free and authenticated fresh-verdict receipts are distinguished from actual interactive-TUI and usage-observation ceilings in the R0/live report, including the original complete-collector aggregate failure and its later account-free observer reproduction. Availability is not inferred from version metadata alone.
+
+- **Common authority and evidence.** Each review uses a fresh child and a host in-process, revocable, task/head/review-revision-bound two-tool MCP capability. The child receives only `hub_review` and `hub_task_show`, never the full hub control token. The reviewer obtains source evidence through the screened `hub_task_show` review brief and host facts, with no native Read/file/shell tool. Builder narrative/shared memory filtering, private-review refusal, current-child/generation/head checks, verdict authority, cleanup-before-settlement, same-family exclusion/fallback and existing approval gates remain in force. Native permissions replace the earlier kernel boundary for Kimi; this is not a claim of filesystem or network isolation from same-user native code.
+- **Kimi 2.2.0.** No Seatbelt wrapper. A private `KIMI_CODE_HOME` is initialized with host-produced managed-provider configuration and MCP/profile data; its `credentials/` and `oauth/` are directory symlinks to the person's native locations, and `device_id` points to the person's native device identity. Directory links preserve native atomic credential rename and the same `proper-lockfile` refresh lock as the attached TUI; no token extraction, snapshot copy or static-API-key provider is introduced. Native OAuth owns refresh on the shared account. `KIMI_DISABLE_OAUTH_LOCK` is never set. The child uses a clean temporary cwd, an explicit empty skills directory and an agent tools list exactly `mcp__agent-hub__hub_review` and `mcp__agent-hub__hub_task_show`, without native read/subagent tools. It never edits the real project's `.kimi-code/mcp.json`. Shutdown revokes verdict authority first and allows bounded TERM grace during OAuth lock ownership before verified process-group teardown. The person accepts that interruption during refresh may require re-login; it cannot become a verdict or a hidden auth repair. Kimi quota remains the existing shared account, not a separate reviewer allowance.
+- **Residuals and verification.** This is a native tool-authority boundary, not a kernel read-only or universal private-home guarantee. Completed account-free native OAuth-race and two-tool disclosure checks and authenticated fresh-verdict/host-MCP observations retain their individual receipts and limits. Actual attached interactive-TUI refresh/lock coexistence and usage-source coverage remain unverified. End-state project/config parity does not prove write-then-restore absence or every native model schema, and the failed original complete-collector aggregate is not relabelled a full pass. The [R0 report](../verification/2026-10-19-kimi-agy-reviewer-isolation.md) preserves historical findings and their limits; [Kimi smoke legs](../smoke.md#kimi-reviewer-and-task-bound-mcp-533) track the active checks without counting earlier probes as passes. Agy's historical meta-tool/resource and broad-global permission findings do not become Kimi evidence or an agy reviewer acceptance criterion.
+
+Kimi 2.2.0 print stream-json does not expose token counts. Shared account quota/manual pauses still apply through the registry budget account and fan out to the TUI/reviewer instances; print output is not counted as zero usage or parsed into invented token measurements. The optional soft-token ledger can only include actual readings from other supported account sources. This is an observation ceiling, not a separate account or quota bypass.
+
+
 ## Review brief amendment (#520, hub task #228)
 
 ahub builds the review brief that the workspace gate used to take from `ocr delegate preview` and `rule`, and gives the same brief to every reviewer.
@@ -3702,7 +3727,7 @@ and mutant result, per the reviewer's explicit ruling.
 ## Amendment: planner plan review and board governance, 2026-10-18 (#481 S9)
 
 - The person's mode-boundary ruling separates board governance from lifecycle enforcement. WIP-at-accept and planner/person return of accepted work without work evidence apply in every `sdlc.mode`; only the current plan-review receipt gate uses enforce/refuse, advise/report and off/no gate. Existing lifecycle schema aliases and ordinary off-mode receipts are unchanged.
-- Tasks owns plan-review receipts, accepted-untouched returns and all offers/acceptances. Review evidence contains the planner, planning revision, recorded time and fixed-query GitHub issue metadata. An issue body or comments are never fetched or stored by this readback. A changed body edit time or planning revision invalidates the receipt; missing evidence remains unknown. The synchronous acceptance API cannot bypass the fresh enforce readback.
+- Tasks owns plan-review receipts, accepted-untouched returns and all offers/acceptances. Review evidence contains the planner, planning revision, recorded time and fixed-query GitHub issue metadata. An issue body or comments are never fetched or stored by this readback. A changed body edit time or planning revision invalidates the receipt, except the complete contiguous release-only revision history defined by S11; issue identity/edit and cost-scope checks still apply; missing evidence remains unknown. The synchronous acceptance API cannot bypass the fresh enforce readback.
 - S1 person spec acceptance and S9 planner review remain independent. `acceptReviewed` reads both against one task snapshot before the acceptance write. A `done` that implicitly accepts proposed work checks WIP and both readbacks before any cohort or board write; the missing-spec refusal retains precedence over missing-plan admission. Off keeps its synchronous ungated acceptance path apart from the all-mode WIP rule.
 - The accepted-untouched exception is a distinct, revision-bound return transition with a screened reason. It preserves history and planning fields, withdraws former role requests and enables replanning. Historical acceptance still protects cancellation and undo. Done/check/review/integration evidence or branch/commit/PR/local/review artifacts refuses this exception; it does not grant a general planner unassign permission.
 - Grooming is an ids/codes-only read projection with repository-scoped comparisons, explicit unknown/truncated evidence and person-only actions rendered as commands. It does not infer a ruling from arbitrary task prose, fetch issue bodies, mutate dependencies or invoke a model. Limits are 500 task rows, 256 findings and eight metadata reads within four seconds; a future paginated repository resolver supplies exhaustive coverage.
@@ -3727,8 +3752,37 @@ S9 privacy and notice ceilings: private build work with an issue ref remains ina
 
 ### S10 cost governance amendment (#481, hub task #215)
 
-- Task plans carry explicit review scope (none/delta/full, bounded reviewer count) and CI scope (focused/full/reuse); S9 receipts copy the planner-selected values. None uses zero reviewers; other scopes use one to eight. Legacy scope is unspecified, readable and never guessed. Advise reports the gap; new enforce receipts require both scopes, while old scope-less receipts remain valid to their next planning revision. Omitted cost keys on an owner file-list update retain the reviewed scope; explicit prospective drift refuses enforce acceptance. Scope does not change reviewer authority or bypass CI; S2 owns actual conformance comparison.
+- Task plans carry explicit review scope (none/delta/full, bounded reviewer count) and CI scope (focused/full/reuse); S9 receipts copy the planner-selected values. None uses zero reviewers; other scopes use one to eight. Legacy scope is unspecified, readable and never guessed. Advise reports the gap; new enforce receipts require both scopes, while old scope-less receipts remain valid to their next non-release planning revision under the complete-history S11 exception. Omitted cost keys on an owner file-list update retain the reviewed scope; explicit prospective drift refuses enforce acceptance. Scope does not change reviewer authority or bypass CI; S2 owns actual conformance comparison.
 - Review admission is separate from #520 brief/coverage. Before done/cohort writes, enforce requires the task's exact PR head, successful configured checks (native default: both OS checks and seeded guards), and no unanswered pending bot thread. Resolution settles a thread; an unresolved thread needs a user reply after the last bot comment. Only metadata is fetched. Advise reports gaps, including a generic unknown-readiness notice when a private turn finishes its own PII task without remote metadata; ordinary work remains refused during a private turn. Off adds no readback. Identity/privacy/owner and runtime authority are rechecked across awaits and each external read. Background role maintenance may retain a saved role while holding an unadmitted review envelope; a manual reviewer resend performs fresh admission.
 - Whole-workflow repository serialization closes the admission race, keeping required check names and read-only permissions; queue:max retains up to 100 pending controllers instead of canceling the previous pending one. Identical-tree successful full proof is reused for PR and push. Reuse expands both OS matrix names and reports the required seeded aggregate, using only a `Reuse verified identical-tree full gate` marker step with the original run id. These successful reporting jobs and skipped jobs are not fresh full proof; duplicate active full gates and unknown active coverage refuse admission. Pending controllers do not run gates. CI proof searches are bounded; missed older success can require a new gate, never invent green evidence.
 - Cost reporting is read-only over bounded current public board links plus merged-PR/check metadata: review handoff rounds and elapsed time, CI run ids and extra attempts, full re-reviews versus deltas, and unknown scope. Private/relinked counterparts are excluded at each read and projection. Pure band-breach proposal data is delivered here; the S7 baseline/configuration/automatic board-card scheduler is deliberately not implemented in S10.
 - Nonblocking policy ceilings stay unchanged and are recorded in hub task #230: fail-closed metadata errors, repository-wide queue fairness, unknown thread author kinds, and strict advise readback races. Their planner-reviewed alternatives are deferred.
+
+### S11 release-train amendment (#481, hub task #216)
+
+- The existing `release` task field and release planning table remain authoritative. Additive optional train metadata records enumerated hotfix cause/reason, frozen task ids, and bounded actor/time/resource history. Legacy rows omit it.
+- "One open release" means one active/frozen train. Future planning rows are permitted as rollover destinations. A dedicated release-only assignment may move approved/in-flight tasks without modifying their execution state, owner, reservation, dependencies or person pins; every move needs a reason and current revision. Public reasons are screened; private scope moves are person-only and retain the reason solely in withheld board history without model screening. Public readiness/cut still refuses private scope. General backlog planning authority is unchanged.
+- The planned date is a due trigger, not a waiver. A cut requires nonempty approved scope; unfinished/cancelled tasks move out with a reason before cut. It pins the complete scope and release revision through all awaits and the final transaction. Planner cut is a dedicated operation; legacy planner freeze refusal stays intact. Enabled or configured-train freezes cannot bypass the admitted cut API. Ship/drop remain person-only; a changed frozen scope blocks shipment.
+- Cut admission holds a bounded five-second host-controller repository lease through the metadata freeze. The controller executable is host-resolved, its child command is fixed, and the shared gate lock is checked before and at freeze. Unknown admission or unknown/stale attached-peer account quota windows with a real quota source defer. A real source means the adapter definition supplies `budget.reader`, or it uses soft-token accounting with an enabled limit (Kimi: `kimi_tokens_5h > 0`); registered accounts without a configured source are reported as `no quota source` and do not defer for missing readings; unknown external accounts still require evidence. Budget-record and manual pauses still defer for every attached peer. Every later heavy step still needs its own admission.
+- Hotfix causes are closed: data/message loss, security/privacy defect, blocked upgrade/start, core flow without workaround. Reason is bounded and screened. No hotfix waives a gate, grants publish authority or starts an upgrade.
+- Actual cut/shipment event timestamps and frozen scope drive interval/approval lead-time metrics. Hotfix rate uses shipped releases. Bounded CI counts refer to planned-task PR metadata at cut, including attempts; review counts refer to board verdict history. Unavailable/legacy evidence remains unknown, and release-preparation PR costs require separate receipts. S7 owns bands/proposals; S6 owns authorization. The per-release "gates run" record is explicitly deferred to S6/S7; a cut record is not gate-execution evidence. No GitHub body, publish, merge or tag write is added.
+
+- Person ruling 2026-10-19 supersedes the earlier planner ruling on S11 upgrade admission: upgrade is excluded from S11 host-admission, quota and additional all-idle gates. Recovery retains the pre-S11 `recoveryReady()` requirement (no busy peers, pending approvals resolved and completion checks settled), operation-identity checks and existing lifecycle fences. Quota/manual pauses, missing/shadowed `dot` and nested host admission add no S11 upgrade refusal. The person's existing recovery-operation selection remains the confirmation; no separate receipt or agent upgrade authority is added. Release-cut host/quota gates remain unchanged.
+
+- Configured cut dates are positive safe UTC millisecond timestamps within the Date range; null, coercible values and invalid numbers refuse at the Tasks boundary before screening or board writes. The additive `release_trains` daemon feature is required of a recovery target while a configured train is active/frozen, before source holds/capture and again after awaits/before commit. Legacy and queued future release rows do not add this downgrade floor. Protocol 16 remains unchanged.
+
+- Release-cut deferrals name their applicable exits: stop or resume paused peers, adjust the relevant `ahub budget set` setting, or drop the train with `ahub release drop`. Missing or shadowed `dot` requires installing the resource controller or fixing PATH; nested admission requires retrying the cut outside the outer admission lease. These host/quota gates do not apply to upgrade.
+
+- S11 follow-up invariants: contiguous planning revisions changing exactly `["release"]` retain the S9 reviewed execution plan; other or missing planning history invalidates it. Cut-time CI cost reads are limited to the scoped PR ids (at most 16 in one repository); read errors or unbounded/mixed scope remain unknown and cannot abort a valid cut. Train history is capped at 256 events: configuration no-ops append nothing, meaningful configuration reserves cut/shipment slots, and capacity refusals are pre-effect.
+
+## Antigravity optional implementer peer (#485 P1)
+
+Planner ownership ruling, 2026-10-19: the person-only `ahub agy` launcher owns exactly `plugin.json`, `mcp_config.json` and `hooks.json` inside `.agents/plugins/agent-hub/`. Apply symlink, hard-link and foreign-entry refusal and managed cleanup to all three files. Never write project-level `.agents/hooks.json`, another `.agents/` path or the person's `~/.gemini` settings. This amends the earlier two-file list in #485 AC3. AC0 must prove plugin-local hooks load without a global setting; failure stops implementation rather than falling back to manual configuration.
+
+The first-party module lives under `src/adapters/agy/`. It is optional, off roster by default, cloud and unmanaged (`trust: { onPrem: false, hubSandboxed: false }`), with implementer/verifier roles only and no budget source until observed. It never admits PII work or runs as a planner or reviewer. Keep the retained reviewer placeholder unavailable with its existing reason. S0 and A2 are complete; the previous A4 ordering preference is waived.
+
+The pinned agy 1.4.2 T0 receipt precedes implementation: isolated HOME/`.gemini`, real-config parity, hook stdin/stdout and plugin discovery, CLI flags/ACP and a native call to an actual scratch hub through the workspace plugin. Distinguish native transport driven by a fixture provider from a real account/model or interactive TUI/IDE observation. Map a permission mode only after its behavior is proved; unverified modes remain unmanaged. The observed plugin MCP namespace is `agent-hub_agent-hub`; do not assume the configured server name survives plugin loading unchanged. [T0 receipt](../verification/2026-10-19-agy-p1-t0.md).
+
+The P1 host introduces additive `native_hook_launch` and `native_facts` control requests. Only the person begins/ends a launch; hook tools cannot grant themselves launcher authority, and conductor starts are refused. The interactive child remains in the launcher's foreground process group. Launch authority belongs to the console socket that began it and is revoked on that socket's close; an old socket cannot revoke a replacement launch. The managed launcher embeds its daemon/launch identity in the plugin hooks, and the host binds observations to one native conversation and socket generation. It acknowledges a normal fully-idle Stop only after a fresh native completion row. Turn-free facts are injected at the observed model boundary and acknowledged only from SDK transcript rows; unobserved native file effects receive no attribution. Hook input over one MiB is refused before decoding or forwarding. Out-of-ceiling agy roles are dropped with a config log notice before conductor validation, preserving other peers' admission.
+
+The collected T0 proves the plugin, hook codec and read transport, not a native prompt override. P1 therefore keeps all runtime modes unmanaged and refuses unattended/headless/resume selectors until those individual mappings are proved. The old daemon refuses the additive launch request rather than silently weakening hook identity. An actual project TUI launch requires a running daemon with this feature; source/fixture verification does not claim that live rollout.