@staix/agent-hub 0.12.37 → 0.12.39

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.37
+bun add -g github:STAIxBWLB/agent-hub#v0.12.39
 ahub setup
 ```
 
@@ -30,15 +30,29 @@ and upgrade or crash recovery, see the [operations guide](operations.md). To
 move running projects to a newer release later, run `ahub upgrade` in a
 terminal: it reviews the plan with you, applies it and follows it.
 
-## Upgrading to 0.12.37
+## Upgrading to 0.12.39
 
-Restart Claude sessions after upgrading: each keeps the plugin server it started with, and the planner gets the release-train tools (`hub_release_new`, `hub_release_assign`, `hub_release_configure`, `hub_release_cut`, `hub_release_report`); the person uses `ahub sdlc train report|configure|cut` (#481 S11). A due date asks for a cut review and never clears unfinished work; a cut freezes scope and publishes nothing. See [release scheduling](operations.md#planner-release-scheduling).
+Restart Claude sessions after upgrading: each keeps the plugin server it started with until restarted, so a restart loads the 0.12.39 plugin.
 
-Reviews can rotate across fresh Claude and Codex reviewer sessions (#519). Declare headless reviewer-only instances in `.agenthub/config.local.json`; Codex joins only with `review_mode: "fresh"` and an installed Codex 0.146.0 (select it with `codex_bin` when PATH resolves another version). A headless reviewer instance without `review_mode` keeps its native behavior and stays out of the pool. Kimi has no fresh reviewer yet (#533). agy will not be a reviewer: it is planned as an implementer peer (#485) and is not in this release. Naming either in `review.pool` shows an unavailable skip in `ahub route explain`, never a review. Once a train is active or frozen, or `review.pool` is set or fresh reviewer instances are declared, `ahub upgrade` refuses a target release without that support, so an older release cannot take the project over. See [fresh reviewer pool](operations.md#fresh-reviewer-pool-519).
+`ahub jcode` now opens Jcode's native TUI on the hub-owned ACP session by default (#464). The TUI opens after Jcode's first hub turn saves the session; until then the launcher prints one waiting line, and Ctrl-C ends only the wait. Hub-made starts (the dashboard's Start control, the conductor's `hub_peer_start`) follow the start mode too, so they open a terminal for Jcode through a terminal provider. To keep the old headless default, run `ahub settings set peers.jcode.start_mode headless`, or pass `--mode headless`. See [Jcode operations](operations.md#optional-jcode-peer).
+
+Upgrading from 0.12.37 or earlier, the 0.12.38 notes below also apply.
+
+The 0.12.38 plugin reports a reply stopped by the hop cap as not delivered instead of as sent (#546); the restart above loads it.
+
+Antigravity (`agy`) can join as an optional pull-only implementer (#485). It is off roster by default: install the Antigravity CLI 1.4.2, run `ahub roster add agy`, then run `ahub agy` in a terminal. Its native permissions are unmanaged and it has no hub sandbox. See [Antigravity operations](operations.md#optional-antigravity-agy-peer).
+
+Reviews can rotate across fresh Claude, Codex and Kimi reviewer sessions (#519, #533). Declare headless reviewer-only instances in `.agenthub/config.local.json`; Codex and Kimi join only with `review_mode: "fresh"`. Codex also needs an installed Codex 0.146.0 (select it with `codex_bin` when PATH resolves another version), and Kimi needs Kimi Code 2.2.0 on PATH, signed in with its own OAuth login. A headless reviewer instance without `review_mode` keeps its native behavior and stays out of the pool. agy is not a reviewer: naming it in `review.pool` shows an unavailable skip in `ahub route explain`, never a review. Once a train is active or frozen, or `review.pool` is set or fresh reviewer instances are declared, `ahub upgrade` refuses a target release without that support, so an older release cannot take the project over. See [fresh reviewer pool](operations.md#fresh-reviewer-pool-519).
+
+A guarded config edit that the hub keeps at its running value now shows as `config retained: <keys>; run ahub settings reload` in status, the console and the dashboard's Settings, and starting a peer whose launch keys are retained says it uses the running value (#542). See [settings](operations.md#settings-from-the-dashboard-and-the-terminal).
+
+Upgrading from 0.12.36 or earlier, the 0.12.37 notes below also apply.
+
+The restarted Claude planner gets the release-train tools (`hub_release_new`, `hub_release_assign`, `hub_release_configure`, `hub_release_cut`, `hub_release_report`); the person uses `ahub sdlc train report|configure|cut` (#481 S11). A due date asks for a cut review and never clears unfinished work; a cut freezes scope and publishes nothing. See [release scheduling](operations.md#planner-release-scheduling).
 
 Jcode must be 0.98.0 or later, below 1.0.0; 0.94.0 is no longer accepted, so `ahub doctor` fails its Jcode row for an older install and the peer does not start (#529). Every owned jcode process runs with `JCODE_NO_TELEMETRY=1`.
 
-The hub now pins `@staix/agent-mem` 0.4.0 and opens a split memory home through its shards (#534). Before anyone runs `amem migrate --shards` on a memory home, every hub using that home must run 0.12.37 or later: an older hub does not see the split and keeps writing the old layout. `ahub memory profile-check` is not split-aware yet and reports a mismatch for every correctly bound hub on a split home (#536). See [memory profiles and rollout](memory.md#selected-memory-profile).
+Since 0.12.37 the hub pins `@staix/agent-mem` 0.4.0 and opens a split memory home through its shards (#534). Before anyone runs `amem migrate --shards` on a memory home, every hub using that home must run 0.12.37 or later: an older hub does not see the split and keeps writing the old layout. `ahub memory profile-check` is not split-aware yet and reports a mismatch for every correctly bound hub on a split home (#536). See [memory profiles and rollout](memory.md#selected-memory-profile).
 
 From 0.12.30 or earlier, existing Jcode project MCP entries need one refresh before conductor or dashboard starts. Once per project, the person runs:
 

package/docs/security.md

@@ -171,7 +171,7 @@ Please report vulnerabilities privately through GitHub's "Report a vulnerability
 - A settings session is as strong as the console for these settings and no stronger elsewhere. A mode change is the console's own request with the same refusals; tool approvals stay deny-only for Pi and local; there is still no shell, file, task-detail or launch-command API. `ahub ui --settings` and `ahub settings` pass the same identity gate as `ahub permission`, which is an operating policy, not authentication. The hostile-agent boundary above applies unchanged: an agent with an unrestricted shell as the same user can impersonate the console, and so can open a settings session.
 - Every change writes a `settings` event (the key, the value before and after, the source `dashboard` or `terminal`) and a line in `hub.log` and open consoles; opening a settings session is logged too. The unified dashboard (`ahub ui --all`) forwards settings actions as an ordinary session and opens no settings session.
 - Configuration reload (issue #439). The daemon watches `config.json`, `config.local.json`, `routing.toml` and `routing.local.toml` and re-reads the complete candidate after a change, as the dashboard's Reload configuration and `ahub settings reload` do; an invalid candidate applies nothing. Each changed key is then authorized on its own against its file's actual git provenance. A privacy tightening (local-only PII, the model screen on, added PII patterns, narrower roles or capability lists, unless it moves the planner or conductor) and a safe registered setting apply from any file. Every other change, machine-local fields included, keeps its running value when its file is tracked or git cannot answer. From an untracked file such a guarded change is adopted only by `ahub settings reload` in an interactive terminal, after it lists each guarded key with its full before and after values and the person types `y` within 30 seconds; the confirmation is bound to the file contents and accepted state it was shown for. File watches and dashboard reloads, a settings session's included, never confirm, and no reload changes the roster: membership moves only through the roster setting. Keys whose consumers are bound at start (memory, the gateway and MLX, checks, the privacy and sandbox policy of existing sessions, the terminal provider and others) stay pending until a restart.
-- Start modes. A start the hub makes itself (the dashboard's Start control, `peer_start` from a console child, the conductor's `hub_peer_start`, `pi.auto_start`) takes the peer's start mode. Through settings only a settings session or the terminal can set it to headless; a config file can also set `peers.<id>.start_mode`, the shared one included (it is not a machine-local field: headless was the only form for Pi, Kimi and the local worker before this change, a hub-made headless Codex start is the app-server the hub already ran for it, and a start mode grants nothing a permission mode or a capability controls). A declared extra instance accepts only `headless` from any surface; a Claude channel instance accepts no start mode, and a headless Claude instance must have roles exactly `["reviewer"]` and no worktree. For a TUI the hub opens a terminal running `<runtime> <its own entry point> --project <this project> <peer>` (and `--mode tui` for Pi): every word is the hub's own, the command line is those words each quoted for a POSIX shell, and no request field, tool argument or agent message is part of it. In a `terminal.open` template `{command}` is that quoted line and `{title}` and `{cwd}` are raw text for argv elements of their own; each placeholder is substituted once, so a project path that itself contains a placeholder, a quote or `$` stays one word. A provider's own error text goes to `hub.log`, not to the caller. The terminal comes from `terminal.open`, a machine-local command template that config trust refuses from a committed file and that no settings surface can write, or from Orca. The opened terminal's environment carries no agent marker, so `ahub` there has the console's identity. Without a provider the start is refused with the command to run by hand; it is never downgraded to headless. A conductor can start a peer but cannot choose its mode.
+- Start modes. A start the hub makes itself (the dashboard's Start control, `peer_start` from a console child, the conductor's `hub_peer_start`, `pi.auto_start`) takes the peer's start mode. Through settings only a settings session or the terminal can set it to headless; a config file can also set `peers.<id>.start_mode`, the shared one included (it is not a machine-local field: headless was the only form for Pi, Kimi and the local worker before this change, and for Jcode before 0.12.39, a hub-made headless Codex start is the app-server the hub already ran for it, and a start mode grants nothing a permission mode or a capability controls). A declared extra instance accepts only `headless` from any surface; a Claude channel instance accepts no start mode, and a headless Claude instance must have roles exactly `["reviewer"]` and no worktree. For a TUI the hub opens a terminal running `<runtime> <its own entry point> --project <this project> <peer>` (with `--mode tui` for Pi, Kimi and Jcode): every word is the hub's own, the command line is those words each quoted for a POSIX shell, and no request field, tool argument or agent message is part of it. In a `terminal.open` template `{command}` is that quoted line and `{title}` and `{cwd}` are raw text for argv elements of their own; each placeholder is substituted once, so a project path that itself contains a placeholder, a quote or `$` stays one word. A provider's own error text goes to `hub.log`, not to the caller. The terminal comes from `terminal.open`, a machine-local command template that config trust refuses from a committed file and that no settings surface can write, or from Orca. The opened terminal's environment carries no agent marker, so `ahub` there has the console's identity. Without a provider the start is refused with the command to run by hand; it is never downgraded to headless. A conductor can start a peer but cannot choose its mode.
 
 ## Multi-project manager (protocol 7)
 
@@ -240,7 +240,9 @@ never-ask still requires the person's confirmation. qwen_cmd is machine-local an
 never editable through settings. Legacy benchmark adapters remain unmanaged by
 this production table. Startup diagnostics withhold native host/payload details.
 
-Jcode is optional, source/version-fenced and runs native tools without a hub sandbox or hub permission-mode mapping. .jcode joins the scoped-grant exclusion, including lexical/resolved aliases. Only a person writes its unique project MCP entry; foreign/override/symlink entries refuse. The hub owns a private daemon/socket and ACP group, never the global daemon, and copies no credentials. It accepts only a plain jcode release from 0.98.0 up to, not including, 1.0.0 (#529), and runs every owned jcode process (version probe, daemon, ACP) with `JCODE_NO_TELEMETRY=1`, because jcode's telemetry can report the provider account's email. Native diagnostics withhold payloads/hosts. Unproved conversation loads refuse; no fresh replacement is called a restore.
+Jcode is optional, source/version-fenced and runs native tools without a hub sandbox or hub permission-mode mapping. .jcode joins the scoped-grant exclusion, including lexical/resolved aliases. Only a person writes its unique project MCP entry; foreign/override/symlink entries refuse. The hub owns a private daemon/socket and ACP group, never the global daemon, and copies no credentials. It accepts only a plain jcode release from 0.98.0 up to, not including, 1.0.0 (#529), and runs every owned jcode process (probe, serve, ACP and TUI) with `JCODE_NO_TELEMETRY=1`, because jcode's telemetry can report the provider account's email. Native diagnostics withhold payloads/hosts. Unproved conversation loads refuse; no fresh replacement is called a restore. Native TUI launch exposes its private socket/session tuple only to the authenticated console, bound to the same live owned socket and session after read-only native persistence proof. Tools/status do not receive it. The TUI has no single-writer guard: person input may interleave with ACP. Native policy remains unmanaged and closing the frontend does not stop ACP.
+
+Antigravity (`agy`, #485) is optional, cloud and off roster by default. It runs native tools under its own unmanaged permissions, without a hub sandbox or hub permission-mode mapping; headless, resume, unattended and native permission flags are refused. Its roles are capped at implementer and verifier, so it never plans, reviews or receives PII work. Only the person's `ahub agy` launcher writes its three plugin files in `.agents/plugins/agent-hub/` (`plugin.json`, `mcp_config.json`, `hooks.json`): linked or foreign entries refuse before any write, cleanup removes only that launch's matching files, and it never writes project-level `.agents/hooks.json` or the person's `~/.gemini` settings. Conductor starts are refused. Hook authority (`native_hook_launch`) comes only from that launcher, belongs to the console socket that began it and ends when that socket closes; hook input over 1 MiB is refused, and observations are bound to the daemon, launch, native session and project.
 
 # Transient ACP activity (#286)
 
@@ -345,7 +347,9 @@ Stall causes are persisted and deduplicated by cause and replanning revision. Pl
 
 A declared instance whose only role is reviewer gets review requests, task messages addressed to it and the person's messages; agent chat, digests and presence are discarded and journaled, and it gets no memory recall (#223). The headless Claude reviewer runs one new `claude -p` per review with `--setting-sources ""`, `--strict-mcp-config`, `--no-session-persistence`, tools limited to Read, Grep, Glob, `hub_review` and `hub_task_show`, and `dontAsk`. Its prompt holds hub facts and a bounded diff, never the builder's summary, and its `hub_task_show` drops the builder's notes. Changes touching `local.deny` or `pii.paths` are withheld and passed as `Read` deny rules, which Claude enforces, not the hub. Private tasks are never given to it. Its `hub_review` counts only while the child started for that task still runs; a stop or exit revokes it first, and surviving processes hold the delivery as `needs_review` and keep the reviewer busy.
 
-The fresh Codex reviewer (#519) needs `review_mode: "fresh"` and an installed Codex 0.146.0; any other version is unavailable. Before each review it requires a model-free isolation receipt: binary and config unchanged, only the two hub tools in the configured MCP inventory, plugins, hooks and Apps disabled (Apps by a separate feature readback), and a named filesystem profile whose fixtures prove public reads, private-path denial (exact, glob and symlink), standard host credential denial and write denial. Credential and tool-home roots are denied even with an empty `local.deny`; that list does not cover every personal file. Its shell is sandboxed read-only, not Claude's Read/Grep/Glob whitelist. Network and web search are configured disabled but not observed: managed requirements can still select cached web search, and no run has shown the review selecting the profile through `default_permissions`. A failed receipt or start never falls back to a continuing native session, and a child that ends without a saved verdict is never approval. Kimi and agy reviewers are unavailable placeholders and never run.
+The fresh Codex reviewer (#519) needs `review_mode: "fresh"` and an installed Codex 0.146.0; any other version is unavailable. Before each review it requires a model-free isolation receipt: binary and config unchanged, only the two hub tools in the configured MCP inventory, plugins, hooks and Apps disabled (Apps by a separate feature readback), and a named filesystem profile whose fixtures prove public reads, private-path denial (exact, glob and symlink), standard host credential denial and write denial. Credential and tool-home roots are denied even with an empty `local.deny`; that list does not cover every personal file. A dangling or unreadable credential root refuses the reviewer, and the reason names only its path class (`~/.docker`, `$DOCKER_CONFIG`), never the path or its contents. Its shell is sandboxed read-only, not Claude's Read/Grep/Glob whitelist. Network and web search are configured disabled but not observed: managed requirements can still select cached web search, and no run has shown the review selecting the profile through `default_permissions`. A failed receipt or start never falls back to a continuing native session, and a child that ends without a saved verdict is never approval. The agy reviewer slot is an unavailable placeholder and never runs.
+
+The fresh Kimi reviewer (#533) needs `review_mode: "fresh"` and Kimi Code 2.2.0 with its native OAuth login; any other version, or a failed preparation, is unavailable. It is a native tool-authority boundary, not a sandbox: no Seatbelt wraps it, and same-user native code is not isolated from the filesystem or network. Each review starts a new child in a private `KIMI_CODE_HOME` with managed-provider-only config, a clean temporary working directory and an empty skills directory. Its agent may use only `hub_review` and `hub_task_show`, served by a loopback MCP session bound to the task, head and review revision that never carries the hub's control token; it has no native read, file or shell tool and sees only the screened review brief and host facts. Its `credentials/` and `oauth/` directories and `device_id` link to the person's native ones, so refresh keeps Kimi's own lock and atomic rename; no token is copied and `KIMI_DISABLE_OAUTH_LOCK` is never set. A stop revokes its verdict authority before termination; killing it mid-refresh may require a native re-login. Private tasks are never given to it, and a child that ends without a saved verdict is never approval.
 
 The review brief (#520) withholds private changes whole (both sides of a move) and counts them; a rule file that fails the private-data screen is named, not shown. Attributes and rules are read at the merge base, so a change cannot loosen its own review. Spec acceptance, plan review, premature-review and cost reads fetch GitHub metadata only (edit times, check states, thread authorship and resolution), never issue bodies or comments. The CI workflow keeps `contents: read` and `actions: read`.
 

package/docs/smoke.md

@@ -1939,7 +1939,7 @@ For the guarded CLI leg, edit a disposable untracked WIP limit, run `ahub settin
 
 ## Reviewer pool native legs (#519, 2026-10-19)
 
-Native account/model acceptance is **UNVERIFIED**. See [reviewer isolation evidence](verification/2026-10-19-reviewer-isolation.md) for the exact source/version pins and offline probes. Those probes used temporary fixtures and no model prompt, account login or credential copy. Fake-CLI tests and CI are separate host-contract evidence. Existing #223 Claude behavior is retained without a new live Claude claim.
+Claude/Codex native account/model acceptance remains **UNVERIFIED** in this pool report; Kimi's completed authenticated fresh-verdict and account-free receipts are recorded separately below and in its R0/live report. See [reviewer isolation evidence](verification/2026-10-19-reviewer-isolation.md) for the exact source/version pins and offline probes. Those probes used temporary fixtures and no model prompt, account login or credential copy. Fake-CLI tests and CI are separate host-contract evidence. Existing #223 Claude behavior is retained without a new live Claude claim.
 
 Complete these legs in a disposable project with authorized accounts after source integration and exact-head CI:
 
@@ -1948,6 +1948,26 @@ Complete these legs in a disposable project with authorized accounts after sourc
 - Request a delta review and confirm the same eligible independent reviewing family receives a new session with prior findings. After an earlier same-family fallback, a newly available independent family still takes precedence. Exercise configured re-rotation separately. Stop or exhaust one reviewer and confirm the pure routing walk chooses the next eligible candidate; no failed start or child ending without a saved verdict becomes approval. Check the next candidate even when the missing verdict followed a vendor quota error; no text-based quota classifier is assumed.
 - Make all pool candidates unavailable and confirm a blocked review awaiting planner/person action. Then test a different fresh session in same-family fallback only when no other family can run. Verify stale-child, changed-head and private-review verdict refusals.
 - Verify compatibility separately: a Codex/Kimi headless reviewer-role declaration without `review_mode` keeps its native app-server/ACP behavior and existing worktree/permission options, and stays outside the fresh pool. An explicit fresh declaration must refuse an unsupported backend without downgrading.
-- Keep Kimi and agy out of the default pool. Explicitly requesting either currently yields unavailable and a skip, not a model launch or pass. No Kimi/agy launch code is included in #229. Their follow-up #533 (hub task #234) needs strict MCP/config, private-read, write-denial and fresh-session receipts before native smoke can count; the future agy launcher belongs in `src/adapters/agy/`.
+- The default logical pool is Claude, Codex, Kimi. Kimi is runnable only for covered 2.2.0 when runtime preparation passes; unsupported or failed preparation is unavailable with its reason. Seed modulo includes only kinds with a declared candidate, even when blocked; undeclared kinds remain trailing trace entries. Verify seeds 0..5 with only Claude/Codex declared alternate 3/3, and an offline declared kind still retains its slot. Agy stays unavailable as a reviewer with exact reason `agy is an implementer peer (#485)`, including explicit pool requests. #234 adds no agy reviewer launch or live leg.
 
 Record source head, exact executable version/hash, isolation receipt, task/head identities, route walk, distinct native session evidence and persisted verdict separately. Do not record credentials or raw transport environments. Codex sandboxed shell must not be described as Claude's Read/Grep/Glob-only whitelist. Network policy is configured disabled; no network-denial probe or native LLM isolation result has been recorded by this investigation.
+
+## Kimi reviewer and task-bound MCP (#533)
+
+Kimi 2.2.0 is available when runtime preparation passes; a failed or unsupported preparation remains unavailable. Completed evidence includes account-free two-tool/native OAuth race checks, host/fake lifecycle refusals and authenticated fresh `changes_requested` verdicts. The complete-collector live run observed project parity/canary absence, authenticated exact-two hub inventory/calls, zero decoy requests, cleanup and unchanged real config hashes. Its original aggregate receipt remains failed because of an unattributed extra observer error; the later account-free GET reproduction/correction is not a new live pass. These separate outcomes are preserved in the R0/live report. The remaining actual interactive-TUI/coexistence and usage-observation checks are **UNVERIFIED**; they do not turn completed live/fake evidence into an unrun test. Person ruling 2026-10-19 (8281ec35) limits #234 to Kimi and task-bound MCP and supersedes all earlier agy reviewer implementation/admission/live-leg rulings. Agy is an implementer under #485; its retained reviewer slot remains unavailable with exact reason `agy is an implementer peer (#485)`. Earlier agy probes and unresolved meta-tool/resource findings remain historical in the [R0 report](verification/2026-10-19-kimi-agy-reviewer-isolation.md), not active smoke requirements here. Kimi's native-permission/shared-account ruling supersedes its earlier R0-only hold and Seatbelt requirement. The [spec amendment](specs/2026-09-19-agent-hub-design.md#kimi-reviewer-and-task-bound-mcp-amendment-533-hub-task-234) defines the active contract and residuals.
+
+- For Kimi regression smoke, confirm a fresh child per review, no resume, source evidence supplied only by screened `hub_task_show`/review brief and host facts, and no native Read/file/shell tool. Confirm the in-process host MCP exposes only the task-bound `hub_review` and `hub_task_show` capability, without the full hub control token. Exercise wrong task/head/review revision, stale/replaced child, private review, malformed arguments, unknown tool and stopped-child refusals; verify no saved approval on any failure.
+- Kimi 2.2.0: confirm no Seatbelt wrapper, a private `KIMI_CODE_HOME` with managed-provider-only config, clean temporary cwd and explicit empty skills directory. Verify exactly the two `mcp__agent-hub__...` tools in model disclosure and invocation; reject native read/write/command and extra MCP calls. Confirm `credentials/` and `oauth/` are directory symlinks to the native locations, `device_id` links the native identity, no token copy/extraction/static provider is used, and `KIMI_DISABLE_OAUTH_LOCK` is absent. The concurrent account-free OAuth print stand-in proved two expired generations serialize refresh through shared directory links, but it was not an attached interactive TUI. Actual TUI refresh/atomic rename/lock coordination and shared-account quota/pause fanout remain separate live legs. Existing project MCP/config byte-parity observations remain recorded in the R0/live report. Record identities/metadata without token values.
+- Kimi cancellation: revoke review authority before TERM, observe bounded grace while the OAuth lock is held, then confirm owned-group teardown and temporary-state cleanup. Use synthetic auth for forced mid-refresh kill checks; report the accepted possibility of re-login rather than repair auth or count an interrupted turn as approval. Keep real-account refresh/coexistence evidence separate from synthetic cancellation evidence.
+- Recheck common routing, independent-family preference, recorded same-family fallback, no-verdict retry/exhaustion, head-bound persisted verdict, person-stop hold and shared-account budgets. Keep Kimi unavailable on a failed or missing receipt; agy remains unavailable under #485 regardless of historical reviewer probe results. Record executable version/hash, source head, tool/permission evidence and actual account/model results separately; source/configuration alone is not a live pass.
+
+
+Kimi usage ceiling: 2.2.0 print stream-json exposes no token counts. Keep unobserved usage unknown; native account quota/manual pauses still apply to the shared account. The fake OAuth race and authenticated verdict do not prove token metering or a new soft-token reading. Actual interactive-TUI coexistence and usage-source coverage remain separate from the completed fresh invocation and host MCP receipts.
+
+## Antigravity P1 (#485)
+
+- Pin agy 1.4.2; verify its executable/version and keep the actual TUI/IDE leg separate from the account-free [T0 transport receipt](verification/2026-10-19-agy-p1-t0.md).
+- With a reviewed compatible daemon running and agy explicitly on roster, the person runs `ahub agy` in a terminal. Confirm peer `agy` is pull-only, native permissions unmanaged and no hub sandbox/budget source is claimed.
+- In the native TUI call `hub_inbox`, `hub_send`, and a permitted board read/proposal within a non-PII task. Confirm the tool audience and actor remain `agy`, the native model consumes the tool results, and no unsolicited push or PII task text reaches it.
+- End the TUI normally. Confirm its group/socket detaches and only its matching managed three-file plugin is cleaned up; unrelated project/global settings remain unchanged.
+- This live project/account leg is pending until actually run. An older daemon's missing `native_hook_launch` refusal is not a successful TUI launch or grounds for an automatic restart of other active peers.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -253,7 +253,10 @@ durable delivery goes offline with `needs_review`; on a bus without a journal, t
 stays busy until the cancelled prompt reports, then drains on idle. After the 30 s bound
 without a report it goes offline with queued work retained, never idle. Cancelled results
 and errors are discarded; an error during that wait leaves one log line. Other adapters
-keep their cancellation rules (`turn/interrupt` for Codex). Queues drain in order only
+keep their cancellation rules (`turn/interrupt` for Codex). An ACP tool call announced
+and not yet `completed` or `failed` is running work, not silence: it keeps the turn alive
+up to a 30 min tool ceiling (never below `watchdog_ms`), past which the cancel above runs
+with a log line naming the open tool (#542 D4). Queues drain in order only
 when the adapter is idle. Delivery is at-least-once with
 idempotency by `id`: a failed delivery returns to the queue head and is retried after 1 s, and
 after 3 failures it is reported as undeliverable on the console so one envelope cannot block a
@@ -2325,13 +2328,13 @@ acts on the stopped state directory.
 
 ## Amendment: TUI by default, headless as opt-in (issue #269, part 2)
 
-- `peers.<id>.start_mode` (`tui` or `headless`, for pi, codex and kimi; `tui` when unset) is the mode a start takes when nothing more specific was asked. Claude has only a TUI; Kimi defaults to its own pull-only TUI, with ACP selectable; local stays headless. The loader refuses a malformed `peers` block.
+- `peers.<id>.start_mode` (`tui` or `headless`, for pi, codex, kimi and jcode; `tui` when unset) is the mode a start takes when nothing more specific was asked. Claude has only a TUI; Kimi defaults to its own pull-only TUI, with ACP selectable; local stays headless. The loader refuses a malformed `peers` block.
 - A person typing `ahub pi` gets that mode: the TUI in their terminal by default. `--mode headless` or `--headless` asks for headless. Without a terminal (the console's command line, a script) and with the default asking for the TUI, the CLI sends the console-role `peer_start` request and the hub opens a terminal, or refuses with the command; an option given then is refused, because the fixed command carries none. An explicit `--mode tui` is taken at its word. `ahub codex` and `ahub claude` typed by a person are unchanged.
 - A start the hub makes itself is `hubStart(peer)`: the dashboard's `start_peer` action, `peer_start`, the conductor's `hub_peer_start` and `pi.auto_start` at hub start. With `headless` it starts the peer as before (for Codex: the app-server only). With `tui` it opens a terminal running `<runtime> <CLI entry> --project <root> <peer>` (`--mode tui` for Pi), assembled from the hub's own words and quoted word by word; no caller text is part of it. The peer is reserved before the provider is asked, so starts that arrive together open one terminal, and a second start within 30 seconds of an opened terminal is refused instead of opening another (a failed open frees it at once). A start mode of headless never takes over a Pi that runs in a terminal.
 - Terminal providers, in order: `terminal.open`, a machine-local argv template (`{command}` in exactly one element, plus `{title}` and `{cwd}`; a `MACHINE_LOCAL` field under config trust and on the never-editable list), then Orca (`orca terminal create --worktree id:<id> --command ...`) when the hub runs in an Orca worktree or a recorded launch of the project names one. Each template placeholder is substituted once; only `{command}` is shell-quoted. The opened terminal's environment carries no agent marker and no Orca terminal identity of the hub's own. A provider's error text is logged, not returned. With no provider the start is refused with the manual command; it never falls back to headless. Only the running product wires the real providers; a daemon constructed without them opens nothing.
 - The conductor's `hub_peer_start` no longer takes a mode: it takes the peer's start mode, and a `mode` argument that differs is refused. It may now start claude and codex through the provider, and codex headless when a person set that.
 - Recovery restores each peer in the mode its recorded session had. After an unplanned stop, `pi.auto_start` no longer starts a fresh headless Pi in place of one that ran in a terminal (with or without a recorded session file), unless headless is Pi's start mode. `peers.<id>.start_mode` may be set in the shared config file too: it is not a machine-local field.
-- Settings: `peers.pi.start_mode`, `peers.codex.start_mode` and `peers.kimi.start_mode` join the registry (group Start, stored in `config.local.json`, raising except to `tui`). They are the one stored setting a running hub takes up: after a settings write the hub re-reads the block, so the mode applies at that peer's next start. The dashboard gains a Start control per peer that is not attached, saying the mode and the provider (or why there is none); it offers no button when the start would be refused. An ordinary session may press it: it runs only the fixed start. The page blocks repeat starts while the request is in flight and unlocks after a confirmed answer, leaving the hub's terminal reopen guard authoritative. The manager waits 35 seconds (the terminal provider cap plus its margin); a slower headless start can end unconfirmed. After an unconfirmed manager result the page holds that project/instance/peer control for `PEER_START_RETRY_MS` (the same 30-second bound as the hub's reopen guard), or until the `starts` snapshot confirms attachment, and names the retry bound. A confirmed project-local dashboard start behaves as before; no manager or settings authority changes.
+- Settings: `peers.pi.start_mode`, `peers.codex.start_mode` and `peers.kimi.start_mode` and `peers.jcode.start_mode` join the registry (group Start, stored in `config.local.json`, raising except to `tui`). They are the one stored setting a running hub takes up: after a settings write the hub re-reads the block, so the mode applies at that peer's next start. The dashboard gains a Start control per peer that is not attached, saying the mode and the provider (or why there is none); it offers no button when the start would be refused. An ordinary session may press it: it runs only the fixed start. The page blocks repeat starts while the request is in flight and unlocks after a confirmed answer, leaving the hub's terminal reopen guard authoritative. The manager waits 35 seconds (the terminal provider cap plus its margin); a slower headless start can end unconfirmed. After an unconfirmed manager result the page holds that project/instance/peer control for `PEER_START_RETRY_MS` (the same 30-second bound as the hub's reopen guard), or until the `starts` snapshot confirms attachment, and names the retry bound. A confirmed project-local dashboard start behaves as before; no manager or settings authority changes.
 - Control protocol stays 16: `peer_start` is a new console-role request an older hub answers as unknown, and `ui_snapshot` gains the optional `starts` list.
 - Migration: Pi's default changes from headless to its TUI. `ahub settings set peers.pi.start_mode headless` (or the same key in `config.local.json`) keeps a headless auto-started Pi; scripts add `--headless`.
 
@@ -2458,6 +2461,10 @@ the queue.
 - A private foreground daemon/socket and ACP client belong to this peer. The global daemon is never adopted or stopped. No automatic update, self-dev or credential copy. The native MCP store must already exist to avoid implicit Codex import.
 - ACP session MCP arrays are ignored natively, so the person launcher manages only agent-hub-jcode, shared:false, in project .jcode/mcp.json. Later override layers, foreign names and links refuse. Daemon starts verify read-only. .jcode is outside scoped grants.
 - Native policy is unmanaged and has no hub sandbox. Hub permission mappings refuse; native quota/consumption are not inferred. Every task mutation stays in Tasks and PII remains at existing redaction/routing boundaries.
+- Jcode's default start mode is `tui`; `--mode headless` and `peers.jcode.start_mode: headless` retain the owned headless driver. Mode precedence is the explicit flag, the running hub's accepted mode, then the file/default. A console/conductor start opens the same waiting launcher through the terminal provider, including when ACP is already running; no provider means an actionable terminal command, never a headless downgrade.
+- J1.4 (#464): the 0.98.1 native receipt disproved persistence after `session/new`. A person launcher opens the top-level `jcode --socket S --resume ID` only after bounded native saved-session evidence for the same launch, socket and session. Until then it prints once: `jcode's TUI opens after its first hub turn; send it work, or Ctrl-C`. Ctrl-C ends that wait without stopping or cancelling ACP. No artificial production prompt or hub-created native session JSON is allowed. The native prerequisite and account limits are recorded in `docs/verification/2026-10-20-jcode-tui-0.98.1.md`.
+- The actual private tuple is available only through the authenticated console-only, feature-negotiated `native_tui_launch` request, never status, tools replies or generic start replies. Pure dry previews remain redacted and start nothing; a person's print-command may resolve an already-saved running session. TUI argv preserves the owned command prefix, model and provider profile; its environment selects the same native home/socket and telemetry opt-out. No `jcode connect` path or external/global daemon is adopted.
+- J3's lack of a single-writer guard is accepted: a person's TUI input may interleave with a hub ACP turn. Closing the TUI keeps the owned ACP runtime alive. Owned ACP recovery metadata remains headless, and the terminal is recorded separately; native session/load identity refusal is unchanged.
 - The private socket name ends in `.sock`: jcode names its debug socket by replacing that suffix. Every owned jcode process runs with `JCODE_NO_TELEMETRY=1` (#529).
 - Native ACP load (verified on 0.94.0 and 0.98.1) lacks identity proof. Controlled recovery refuses before effects, crash recovery is manual and a load without an exact echoed id refuses before a prompt or restored claim. Real provider/tool/teardown evidence and comparative measurement remain unverified.
 
@@ -3329,7 +3336,7 @@ A2 preserves literal `KNOWN_PEERS` and `OPTIONAL_PEERS` exports in
 `peer-catalog.ts` for released coordinators that inspect their source. The guard
 records these exact file/symbol exceptions separately with the reason
 "cross-release source probe", and tests their values against the typed registry
-catalog. The same exception preserves `start-mode.ts`'s literal `START_MODE_PEERS`, which released coordinators inspect before restoring Kimi headlessly. The three probes are counted separately (5 + 2 + 3 sites). The native vendor baseline is otherwise empty. A retained coordinator's
+catalog. The same exception preserves `start-mode.ts`'s literal `START_MODE_PEERS`, which released coordinators inspect before restoring Kimi headlessly. The three probes are counted separately (5 + 3 + 4 sites). The native vendor baseline is otherwise empty. A retained coordinator's
 existing source probe must accept the A2 target; no unsupported-target ceiling is
 introduced. ponytail: retire these compatibility literals only after a separately
 approved minimum supported upgrade source no longer reads them.
@@ -3578,16 +3585,28 @@ Owner decision 2026-10-18 (#450 comment 6248184754), R1-R5. R3's mechanism, chos
 
 ## Reviewer pool amendment (#519, hub task #229)
 
-Planner ruling, 2026-10-19: #229 implements R3-R6 for Claude and Codex; admission is receipt-gated. Only proved reviewer profiles ship as runnable variants. The existing #223 Claude variant is retained; Codex is restricted to its verified 0.146.0 profile and a passing runtime receipt. Kimi and agy remain unavailable with metadata reasons and outside the default pool; #229 adds no launch code for either. All Kimi/agy launch, isolation and receipt work is in #533 (hub task #234), with the future agy launcher in `src/adapters/agy/`. The [isolation evidence report](../verification/2026-10-19-reviewer-isolation.md) records primary sources, offline probes and untested native legs. Source integration and model-free admission are verified; final-head verification remains the required PR gate.
+Historical planner ruling, 2026-10-19 (#229 scope; Kimi follow-up and agy scope superseded by the person ruling below): #229 implements R3-R6 for Claude and Codex; admission is receipt-gated. Only proved reviewer profiles ship as runnable variants. The existing #223 Claude variant is retained; Codex is restricted to its verified 0.146.0 profile and a passing runtime receipt. Kimi and agy remain unavailable with metadata reasons and outside the default pool; #229 adds no launch code for either. Kimi launch and task-bound MCP work continues in #533 (hub task #234). The person reassigned agy to the implementer peer work in #485; its retained reviewer slot is unavailable with reason `agy is an implementer peer (#485)`. The [isolation evidence report](../verification/2026-10-19-reviewer-isolation.md) records primary sources, offline probes and untested native legs. Source integration and model-free admission are verified; final-head verification remains the required PR gate.
 
-- **Pool and routing.** The default logical kind order is Claude, Codex as fixed configured kind slots; undeclared/unavailable slots are skipped after modulo without renumbering. `review.pool` accepts registered reviewer kinds (Claude, Codex, Kimi and agy), including the unavailable placeholders; local/Pi are refused. An explicit pool with no declared candidates blocks for the person. An omitted pool with no fresh reviewer declaration retains legacy routing. With an omitted pool, exhaustion retains the #223 R5 eligible-planner fallback, preserving the exhausted pool walk and reason in trace/history; absent an eligible planner, the person reviews with a blocked result. This applies also to unavailable-only declarations outside the default pool. An explicit required pool remains blocked for the person on exhaustion; explicit nominations cannot bypass backend unavailability. Unavailable never means pass. Pure `assign()` starts at PR number modulo the fixed configured kind count when linked, otherwise task id modulo that count, walks unavailable/paused/quota/failing candidates and skips the implementer's family while another can run. Delta review keeps the preceding reviewing family by default when it remains eligible and independent, with configurable re-rotation. Family independence still takes precedence over continuity after an earlier same-family fallback. A start failure or any child ending without a saved verdict walks the remaining candidates for that review; no quota category is inferred from vendor text. Explicit named reviewer choices remain outside automatic pool replacement; a failed pinned review stays held for the person. Board transitions still go through Tasks. A same-family fallback uses a different fresh child and is recorded. Exhaustion records `blocked: no reviewer can run` and leaves planner/person review available; it never auto-approves.
-- **Variants and authority.** Fresh variants require a declared headless instance with roles exactly `["reviewer"]`. Codex and Kimi additionally require `review_mode: "fresh"`; without that opt-in, existing headless reviewer-role instances retain their native app-server/ACP transport, worktree and permission semantics and do not join the fresh pool. Claude retains #223 automatic selection for its headless reviewer-only declaration; agy remains an automatically unavailable metadata-only declaration. An unsupported fresh backend refuses without falling back to a native continuing session. Ordinary implementer instances retain their native adapters. The common lifecycle starts a fresh child per review, never resumes, filters builder narrative/shared memory, retains private-diff/read/verdict fences and permits only `hub_review` and `hub_task_show` from the hub. Process-group cleanup and the per-child verdict token retain #223 semantics. A missing receipt refuses before a model starts.
+- **Pool and routing.** Planner ruling 2026-10-19 (#234 M5/M6) supersedes the earlier fixed configured-slot denominator. The default logical kind order is Claude, Codex, Kimi. Modulo uses only configured kinds with at least one declared reviewer candidate, including blocked/offline/paused/quota/failing candidates; availability does not renumber these declared kind slots. Configured undeclared kinds are appended as `no declared reviewer` trace entries after the declared-candidate walk and do not bias the seed denominator. `review.pool` accepts registered reviewer kinds (Claude, Codex, Kimi and the retained unavailable agy slot); agy is excluded from runnable reviewer candidates with reason `agy is an implementer peer (#485)`; local/Pi are refused. An explicit pool with no declared candidates blocks for the person. An omitted pool with no fresh reviewer declaration retains legacy routing. With an omitted pool, exhaustion retains the #223 R5 eligible-planner fallback, preserving the exhausted pool walk and reason in trace/history; absent an eligible planner, the person reviews with a blocked result. This applies also to unavailable-only declarations outside the default pool. An explicit required pool remains blocked for the person on exhaustion; explicit nominations cannot bypass backend unavailability. Unavailable never means pass. Pure `assign()` starts at PR number modulo the declared kind-slot count when linked, otherwise task id modulo that count, walks unavailable/paused/quota/failing candidates and skips the implementer's family while another can run. Delta review keeps the preceding reviewing family by default when it remains eligible and independent, with configurable re-rotation. Family independence still takes precedence over continuity after an earlier same-family fallback. A start failure or any child ending without a saved verdict walks the remaining candidates for that review; no quota category is inferred from vendor text. Explicit named reviewer choices remain outside automatic pool replacement; a failed pinned review stays held for the person. Board transitions still go through Tasks. A same-family fallback uses a different fresh child and is recorded. Exhaustion records `blocked: no reviewer can run` and leaves planner/person review available; it never auto-approves.
+- **Variants and authority.** Fresh variants require a declared headless instance with roles exactly `["reviewer"]`. Codex and Kimi additionally require `review_mode: "fresh"`; without that opt-in, existing headless reviewer-role instances retain their native app-server/ACP transport, worktree and permission semantics and do not join the fresh pool. Claude retains #223 automatic selection for its headless reviewer-only declaration; agy remains an unavailable metadata-only reviewer declaration with reason `agy is an implementer peer (#485)`, and #533 adds no agy reviewer launch contract. An unsupported fresh backend refuses without falling back to a native continuing session. Ordinary implementer instances retain their native adapters. The common lifecycle starts a fresh child per review, never resumes, filters builder narrative/shared memory, retains private-diff/read/verdict fences and permits only `hub_review` and `hub_task_show` from the hub. Process-group cleanup and the per-child verdict token retain #223 semantics. A missing receipt refuses before a model starts.
 - **Codex receipt.** The producer resolves a host executable outside the project and binds its native binary hash and config metadata. It checks the exact supported version, performs bounded model-free MCP inventory/readback, disables ambient stdio/HTTP servers with self-contained stubs and verifies the fixed hub's two-tool allowlist. Plugins, hooks and Apps are disabled and the physical project is untrusted. Because `mcp list` omits runtime ChatGPT Apps contributions, a separate bounded `features list` readback must prove Apps disabled; inventory alone is not a strict-MCP receipt. The policy requests disabled web search and is passed to exec. There is no effective-turn web-search readback; managed requirements can override this request to Cached at the pin, as recorded in the verification ceiling. A named filesystem profile is read-only with portable core deny rules, explicit private-path/subtree rules, standard host credential directories/files (including configured XDG/tool-home overrides, deepest-existing-ancestor canonical paths for absent descendants and existing real-path aliases), the hub state directory and network disabled; a native temp-fixture proof, including synthetic gh/kube/docker credential reads, precedes the ephemeral exec launch. These standard credential denies supplement the portable core and project policy; they do not classify arbitrary personal files elsewhere on the host. The binary is hashed once during preparation, with dev/ino/size/mtime/ctime rechecked before spawn along with config metadata. PATH Codex 0.163.0 is unsupported, not an inferred pass. No credential copy or blanket approval bypass is added.
-- **Read-only meaning.** Codex retains sandboxed shell under that filesystem/network policy; it does not have Claude's Read/Grep/Glob-only whitelist. The offline fixture measured filesystem denial, not a model turn or network-denial result. No recorded run shows exec selecting `ahub-review` through `default_permissions`; the configured exec argument and explicit-profile sandbox proof remain separate evidence. Post-check same-user mutation remains a documented ceiling. Kimi plan mode and agy plan mode alone are not isolation receipts.
-- **Registry contract.** The data-only agy declaration is separate from the native runtime catalog and does not extend the legacy supported-peer or optional-peer lists. Their existing pinned expectations and the empty registry-guard baseline stay intact. Only declared unavailable reviewer instances can name that metadata; it adds no agy native adapter or launcher.
+- **Read-only meaning.** Codex retains sandboxed shell under that filesystem/network policy; it does not have Claude's Read/Grep/Glob-only whitelist. The offline fixture measured filesystem denial, not a model turn or network-denial result. No recorded run shows exec selecting `ahub-review` through `default_permissions`; the configured exec argument and explicit-profile sandbox proof remain separate evidence. Post-check same-user mutation remains a documented ceiling. Kimi plan mode alone is not an isolation receipt.
+- **Registry contract.** The #229 data-only agy declaration is separate from the native runtime catalog and does not extend the legacy supported-peer or optional-peer lists. Their existing pinned expectations and the empty registry-guard baseline stay intact. Only declared unavailable reviewer instances can name that metadata, with reason `agy is an implementer peer (#485)`; it adds no agy reviewer adapter or launcher. Native implementer work belongs to #485.
+- **Selector contract regression amendment (#234 M5).** `test/reviewer-pool.test.ts` intentionally changes the three old undeclared-slot expectations: mixed declared/undeclared seed selection, the missing-kind denominator case, and missing-kind trace-before-selection. New seeds 0..5 with Claude/Codex declared and Kimi undeclared require three selections per actual kind; a blocked declared Codex retains its slot. Availability, family-independence, continuity, exhaustion and registry guards are not loosened.
 - **Recovery compatibility.** A configured pool or declared fresh reviewer requires target feature `reviewer_pool`; an older target cannot drop `review_mode: "fresh"` or silently restore it under ordinary adapter policy.
 - **History compatibility.** Keep `reviewContext` as its existing `fresh`/`continuing` string. Add host-recorded `reviewerFamily` and `reviewerReason` fields for rotation, implementer skip, unavailable skip and same-family fallback. `ahub route explain` renders the same pure routing walk; agent prose never supplies routing authority or a passing receipt.
 
+## Kimi reviewer and task-bound MCP amendment (#533, hub task #234)
+
+Person ruling, 2026-10-19 (8281ec35), supersedes the earlier agy reviewer implementation, global-admission, project-permission and live-check rulings: #234 includes only Kimi and task-bound MCP. Agy becomes an implementer peer under #485; its retained reviewer slot is unavailable with exact reason `agy is an implementer peer (#485)`, including explicit pool requests. No agy reviewer code, admission, personal configuration write or live leg is authorized by #234. Earlier agy OAuth/listener, permission and meta-tool findings remain historical evidence in the [R0 report](../verification/2026-10-19-kimi-agy-reviewer-isolation.md), not an active reviewer contract. Kimi retains the native permission/shared-account contract below, superseding its earlier R0-only hold and kernel-isolation prerequisites. Kimi 2.2.0 is runnable when runtime `prepare` passes; an unsupported version or failed preparation remains unavailable with its refusal reason. The default logical pool is Claude, Codex, Kimi with declared-kind modulo as specified above; agy stays outside it. Completed account-free and authenticated fresh-verdict receipts are distinguished from actual interactive-TUI and usage-observation ceilings in the R0/live report, including the original complete-collector aggregate failure and its later account-free observer reproduction. Availability is not inferred from version metadata alone.
+
+- **Common authority and evidence.** Each review uses a fresh child and a host in-process, revocable, task/head/review-revision-bound two-tool MCP capability. The child receives only `hub_review` and `hub_task_show`, never the full hub control token. The reviewer obtains source evidence through the screened `hub_task_show` review brief and host facts, with no native Read/file/shell tool. Builder narrative/shared memory filtering, private-review refusal, current-child/generation/head checks, verdict authority, cleanup-before-settlement, same-family exclusion/fallback and existing approval gates remain in force. Native permissions replace the earlier kernel boundary for Kimi; this is not a claim of filesystem or network isolation from same-user native code.
+- **Kimi 2.2.0.** No Seatbelt wrapper. A private `KIMI_CODE_HOME` is initialized with host-produced managed-provider configuration and MCP/profile data; its `credentials/` and `oauth/` are directory symlinks to the person's native locations, and `device_id` points to the person's native device identity. Directory links preserve native atomic credential rename and the same `proper-lockfile` refresh lock as the attached TUI; no token extraction, snapshot copy or static-API-key provider is introduced. Native OAuth owns refresh on the shared account. `KIMI_DISABLE_OAUTH_LOCK` is never set. The child uses a clean temporary cwd, an explicit empty skills directory and an agent tools list exactly `mcp__agent-hub__hub_review` and `mcp__agent-hub__hub_task_show`, without native read/subagent tools. It never edits the real project's `.kimi-code/mcp.json`. Shutdown revokes verdict authority first and allows bounded TERM grace during OAuth lock ownership before verified process-group teardown. The person accepts that interruption during refresh may require re-login; it cannot become a verdict or a hidden auth repair. Kimi quota remains the existing shared account, not a separate reviewer allowance.
+- **Residuals and verification.** This is a native tool-authority boundary, not a kernel read-only or universal private-home guarantee. Completed account-free native OAuth-race and two-tool disclosure checks and authenticated fresh-verdict/host-MCP observations retain their individual receipts and limits. Actual attached interactive-TUI refresh/lock coexistence and usage-source coverage remain unverified. End-state project/config parity does not prove write-then-restore absence or every native model schema, and the failed original complete-collector aggregate is not relabelled a full pass. The [R0 report](../verification/2026-10-19-kimi-agy-reviewer-isolation.md) preserves historical findings and their limits; [Kimi smoke legs](../smoke.md#kimi-reviewer-and-task-bound-mcp-533) track the active checks without counting earlier probes as passes. Agy's historical meta-tool/resource and broad-global permission findings do not become Kimi evidence or an agy reviewer acceptance criterion.
+
+Kimi 2.2.0 print stream-json does not expose token counts. Shared account quota/manual pauses still apply through the registry budget account and fan out to the TUI/reviewer instances; print output is not counted as zero usage or parsed into invented token measurements. The optional soft-token ledger can only include actual readings from other supported account sources. This is an observation ceiling, not a separate account or quota bypass.
+
+
 ## Review brief amendment (#520, hub task #228)
 
 ahub builds the review brief that the workspace gate used to take from `ocr delegate preview` and `rule`, and gives the same brief to every reviewer.
@@ -3762,3 +3781,15 @@ S9 privacy and notice ceilings: private build work with an issue ref remains ina
 - Release-cut deferrals name their applicable exits: stop or resume paused peers, adjust the relevant `ahub budget set` setting, or drop the train with `ahub release drop`. Missing or shadowed `dot` requires installing the resource controller or fixing PATH; nested admission requires retrying the cut outside the outer admission lease. These host/quota gates do not apply to upgrade.
 
 - S11 follow-up invariants: contiguous planning revisions changing exactly `["release"]` retain the S9 reviewed execution plan; other or missing planning history invalidates it. Cut-time CI cost reads are limited to the scoped PR ids (at most 16 in one repository); read errors or unbounded/mixed scope remain unknown and cannot abort a valid cut. Train history is capped at 256 events: configuration no-ops append nothing, meaningful configuration reserves cut/shipment slots, and capacity refusals are pre-effect.
+
+## Antigravity optional implementer peer (#485 P1)
+
+Planner ownership ruling, 2026-10-19: the person-only `ahub agy` launcher owns exactly `plugin.json`, `mcp_config.json` and `hooks.json` inside `.agents/plugins/agent-hub/`. Apply symlink, hard-link and foreign-entry refusal and managed cleanup to all three files. Never write project-level `.agents/hooks.json`, another `.agents/` path or the person's `~/.gemini` settings. This amends the earlier two-file list in #485 AC3. AC0 must prove plugin-local hooks load without a global setting; failure stops implementation rather than falling back to manual configuration.
+
+The first-party module lives under `src/adapters/agy/`. It is optional, off roster by default, cloud and unmanaged (`trust: { onPrem: false, hubSandboxed: false }`), with implementer/verifier roles only and no budget source until observed. It never admits PII work or runs as a planner or reviewer. Keep the retained reviewer placeholder unavailable with its existing reason. S0 and A2 are complete; the previous A4 ordering preference is waived.
+
+The pinned agy 1.4.2 T0 receipt precedes implementation: isolated HOME/`.gemini`, real-config parity, hook stdin/stdout and plugin discovery, CLI flags/ACP and a native call to an actual scratch hub through the workspace plugin. Distinguish native transport driven by a fixture provider from a real account/model or interactive TUI/IDE observation. Map a permission mode only after its behavior is proved; unverified modes remain unmanaged. The observed plugin MCP namespace is `agent-hub_agent-hub`; do not assume the configured server name survives plugin loading unchanged. [T0 receipt](../verification/2026-10-19-agy-p1-t0.md).
+
+The P1 host introduces additive `native_hook_launch` and `native_facts` control requests. Only the person begins/ends a launch; hook tools cannot grant themselves launcher authority, and conductor starts are refused. The interactive child remains in the launcher's foreground process group. Launch authority belongs to the console socket that began it and is revoked on that socket's close; an old socket cannot revoke a replacement launch. The managed launcher embeds its daemon/launch identity in the plugin hooks, and the host binds observations to one native conversation and socket generation. It acknowledges a normal fully-idle Stop only after a fresh native completion row. Turn-free facts are injected at the observed model boundary and acknowledged only from SDK transcript rows; unobserved native file effects receive no attribution. Hook input over one MiB is refused before decoding or forwarding. Out-of-ceiling agy roles are dropped with a config log notice before conductor validation, preserving other peers' admission.
+
+The collected T0 proves the plugin, hook codec and read transport, not a native prompt override. P1 therefore keeps all runtime modes unmanaged and refuses unattended/headless/resume selectors until those individual mappings are proved. The old daemon refuses the additive launch request rather than silently weakening hook identity. An actual project TUI launch requires a running daemon with this feature; source/fixture verification does not claim that live rollout.

package/docs/verification/2026-10-19-agy-p1-t0.md

@@ -0,0 +1,55 @@
+# Antigravity P1 T0 receipt
+
+Status: pinned native plugin/hook and actual scratch-hub transport receipt collected on 2026-10-19. Permission prompt mappings and interactive TUI/IDE behavior remain separate gates.
+
+## Environment and isolation
+
+- Observed CLI version: `agy 1.4.2`.
+- Executable SHA-256: `74935642426b5bb1fcf07a5555f847c478f4517dd002c72b9c98159cb773b932`.
+- Each invocation uses a new temporary HOME, isolated `.gemini`, workspace and temporary directory. The native binary runs with an explicit environment and a Seatbelt profile denying the person's home except the executable. This is probe isolation, not a sandbox claim for the proposed agy peer.
+- Generation is supplied by a loopback Gemini protocol fixture. No real account or cloud model call is part of this receipt.
+- Before/after hashes of the person's Gemini CLI settings, config, MCP config, import manifest and legacy settings are equal for completed probes. Owned process groups are stopped and temporary roots removed.
+- Raw bounded receipts and scripts remain in the local scratch workspace; they are not public artifacts.
+
+## Observed native behavior
+
+- `--version` returns `1.4.2`.
+- `--help` advertises `--conversation`, `--continue`, `--dangerously-skip-permissions`, `--mode`, `--new-project` and stream JSON print input/output. It does not advertise `--new`.
+- `--acp` exits 2 with an unknown-flag error. No ACP command appears in the advertised subcommands. This establishes the tested flag's refusal; it does not prove the absence of every undocumented transport.
+- A workspace `.agents/plugins/agent-hub/plugin.json` and adjacent `mcp_config.json` are discovered without a plugin install or global settings write. The native model's MCP inventory names that server `agent-hub_agent-hub` (plugin name plus configured server name).
+- Calling the unprefixed server name fails before execution. Using the observed prefixed name reaches the fixture MCP's `tools/call`; the fixture calls are not an actual hub-tool receipt.
+- Workspace `.agents/hooks.json` is loaded. `SessionStart`, `PreInvocation`, `PostInvocation`, `Stop`, `PreToolUse` and `PostToolUse` run. Tool hooks require an entry with `matcher: ".*"` and a nested `hooks` array in the tested configuration.
+- Shared hook stdin fields include `conversationId`, `workspacePaths`, `transcriptPath`, `artifactDirectoryPath`, and `modelName`. The observed transcript is named `transcript_full.jsonl`.
+- Tool hooks include `toolCall: { name, args }` and `stepIdx`; the tested native read is `view_file` with `AbsolutePath`, `StartLine` and `EndLine`. Post-tool input includes an empty `error` on success.
+- `SessionStart` and `PreInvocation` accept `injectSteps` containing an `ephemeralMessage`. Pre-tool `{ "decision": "allow" }` allows the tested calls under the native rules. This does not demonstrate that `allow` overrides a native approval prompt.
+- `Stop` reports `executionNum`, `terminationReason`, `error` and `fullyIdle`. The observed normal termination reason is `NO_TOOL_CALL`. Stop continuation and post-invocation termination overrides remain unverified.
+
+## Actual hub transport and ownership amendment
+
+- The corrected native run exited 0 with no stderr. It invoked actual `hub_inbox` once through the shipped hub MCP bundle and the workspace plugin. A random nonce, held only in the scratch bus preface, appeared in the following fixture-provider request. The temporary hub had memory, inference, snapshots and auto-start disabled and explicit agy roster admission. Native output SHA-256: `51dc9c1ba7cde9524b15a6bb07207b5cbfec8e8983475d49e48319a84bb58a3f`.
+- Interactive TUI/IDE attach and permission prompt behavior are separate from print-mode plugin discovery.
+- Keep the peer unmanaged until each permission mapping is independently observed. In particular, do not equate native `allow` with `auto_approve`.
+- Planner ruling on 2026-10-19 amends ownership to three files: `plugin.json`, `mcp_config.json` and `hooks.json` inside `.agents/plugins/agent-hub/`, with the same person-only launcher, link/foreign-entry refusal and cleanup rules. It never writes project-level `.agents/hooks.json` or global settings. The successful actual-hub run loaded all six hooks from that plugin-local file with no global hook setting. No manual-setup fallback is needed or authorized.
+
+Official documentation was refreshed on 2026-10-19: [hooks](https://antigravity.google/docs/hooks/) and [plugins](https://antigravity.google/docs/plugins/). Documentation alone is not native proof.
+
+## Probe failures retained separately
+
+- Admission deferrals (exit 75) launched no native process and are not execution evidence.
+- The initial actual-hub source import failed on an absent worktree-local dependency; a frozen Bun 1.4.2 install supplied the exact agent-mem 0.4.0 pin.
+- A first sandbox profile was refused before any model request. The corrected profile uses the supported localhost port filter and passes an inert sandbox validation before native execution.
+- The first admitted native tool call reached the scratch hub but the provider fixture then emitted an OpenAI `[DONE]` marker in a Gemini SSE stream. That run exited 3; its successful readback does not make the run pass. Removing the invalid fixture marker produced the passing run above.
+
+## Implementation and live boundary
+
+- Test-only commit `1db64b15` fails both new peer/admission regressions against its source tree (0 pass, 2 fail); the implementation passes the same checks. A temporary detached verification worktree was removed after the red run.
+- Native permission prompts, unattended and resume mappings remain unsupported. P1 observes native hooks and injects verified advisory facts while preserving unmanaged native permission policy. The definition enforces an implementer/verifier role ceiling, including explicit plan/review nominations.
+- Audited source CLI preview against the current project succeeded without writes. The actual person-authorized launch attempt refused before plugin writes because the running daemon lacks `native_hook_launch`. No active peer was restarted or upgraded. The actual project TUI/account participation leg remains pending a compatible runtime rollout.
+
+## Early review regressions
+
+- The foreground spawn-options regression fails with the previous `detached: true` behavior restored, and passes without detachment or process-group tracking. This is a fixture assertion, not an interactive controlling-terminal receipt.
+- A real fixture daemon refuses every later launch after its original console socket closes on the pre-fix source. Socket-owned authority now releases on close, while closing an old owner cannot revoke a replacement launch.
+- A real conductor tool request now receives the person-only policy refusal and never calls the fixture terminal provider. Before the fix the definition allowed conductor starts; an unrelated missing preview blocked the tested request later.
+- A config assigning agy reviewer, planner and conductor alongside Claude conductor fails before startup on the pre-fix source. Filtering agy's out-of-ceiling roles before conductor validation preserves its implementer/verifier roles, logs the refusal, and lets console and ordinary-peer hellos succeed.
+- A valid native hook envelope over one MiB is refused before connecting to a hub or forwarding its unused fields. The regression fails on the unbounded hook path.

package/docs/verification/2026-10-19-bus-defer-reset.md

@@ -0,0 +1,9 @@
+# Recovery deferral reset
+
+- Scope: hub task #192, follow-up to #479.
+- Regression: a deferring recovery hold is released, then a bare `fenceRecovery` is taken. A subsequent hub notice must enter the recipient queue rather than `deferredHub`.
+- Test-only commit `872df66f`: the new regression failed because the later notice stayed deferred.
+- Fix commit `2d24a919`: clear `deferHub` after `flushDeferredHub()` succeeds and before releasing `recoveryHeld`. A failed flush retains both the hold and deferral mode.
+- Focused checks: the new regression passed (1 test); the existing `fenceRecovery` cases passed (3 tests); `git diff --check` passed.
+- Bundle: rebuilt using Bun 1.4.2 with worktree-local frozen dependencies; the generated artifacts are unchanged.
+- Initial remote `scripts/check.sh` attempt stopped at `docs: ERROR HEAD does not resolve`: the remote mirror excludes git metadata. This is setup failure, not a full-gate pass. Exact-head CI and a git-backed remote gate remain separate evidence.