@staix/agent-hub 0.12.41 → 0.12.43

package/docs/security.md

@@ -7,7 +7,7 @@ agent-hub connects agents that can each run commands. This page says what the hu
 - **Other agents' text is untrusted.** Every message that crosses from one peer to another is framed as untrusted input: a channel tag with `meta.source` for Claude started with `ahub claude`; otherwise a fixed header line (`frame()`, `[agent-hub message from ...]`) with an instruction that says it is untrusted, the plugin's server instructions for a tools-only Claude reading `hub_inbox` and a standing instruction for the others. A message body cannot forge the hub's own headers: such lines are quoted (`sanitize`). Replies inherit a hop count capped at 3, so agents cannot ping-pong forever; neither a digest nor a steer can reset it.
 - **The control link is loopback plus a secret.** The daemon and the Codex proxy bind 127.0.0.1 only. The control WebSocket requires a per-run token (`.agenthub/state/control-token`, mode 600), and both servers refuse any request that carries an `Origin` header: any web page can open a WebSocket to localhost, and browsers always send `Origin`. The bearer header a Codex TUI sends to the proxy carries only the terminal launch id (#586): it binds terminal ownership and is not a credential. External clients cannot claim the console user's id or a hub-managed peer's id.
 - **Permission prompts stay on unless an operator selects a permission mode.** `ask` leaves native decisions unchanged. `ask-when-needed` grants scoped Claude file tools or Pi/local writes and edits; Kimi and Codex use their own native policies. `never-ask` requires explicit runtime confirmation or a person's console `y` for a config default at hub start. Until that config confirmation the peer runs in `ask`. Kimi's and `local`'s permission requests are relayed to the console and cancelled after `approvals.timeout_s` (default 120 s) of silence; the macOS notification for a waiting request carries the peer and the tool name only. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They invoke hub-owned operations rather than arbitrary file or shell tools, and every call passes the hub's own checks. Identity comes from the exact permission title, or from the earlier tool-call title bound to the same call id and resolved against the configured MCP servers when the permission title contains argument JSON (Qwen). Payload text and unrelated display titles never establish identity. For ACP agents, a payload longer than the console shows is marked as cut and never offers a session-wide grant. Pi's write, edit, shell and git write requests are relayed the same way and can be answered `Always allow <tool> until Pi restarts`: later calls of that tool by the same Pi start skip the prompt but stay inside the path guard and sandbox. The grant covers every later call of that tool whatever its payload, is kept in memory only, cannot be given from the dashboard, and each call it allows is logged by tool name. A Pi or `local` request whose call was cancelled or whose turn ended is withdrawn at once: a later answer is refused and grants nothing, an `Always allow` included. One shell command runs without a hub approval: the `!command` a person types in the managed Pi TUI. It stays inside the same sandbox and denylist, and the hub takes it only from the verified owner process of a Pi in TUI mode, while Pi is idle, on a reservation that is used once; a model's own bash call never takes that path (issue #253). `--unattended` turns prompts off, says so loudly, and is never the default.
-- **A committed config cannot choose launch commands, credential files, data endpoints, permission modes or a wider sandbox.** The machine-local fields (`kimi_cmd`, `permission_modes`, `codex_bin`, `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`, `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`, `local.read_allow`, `local.bash_network`, `local.network_allow`, `terminal.open`, `instances`) apply only from a config file git confirms nobody committed (`instances` is read only from an untracked `.agenthub/config.local.json`; in `config.json` it is ignored even when untracked): `.agenthub/config.json` or `.agenthub/config.local.json`, matched by file identity so no other spelling the file system accepts slips past, and `.agenthub` itself not a committed symlink or submodule. Without a repository, or when git fails, they keep their defaults; an empty value always means the default. "Untracked" is answered by the repository that contains the project: a checkout copied or extracted into an unrelated repository, or into an ignored directory of one, is trusted like your own files. So a cloned repository cannot choose a launch command, a completion check, a gateway to send a key file to, a memory endpoint, a permission mode, the command that opens a terminal, or a wider sandbox. A command in `checks` runs as you, outside the local worker's sandbox, like a git hook. So do the `setup` and `verify` commands of a benchmark suite (issue #251): `ahub bench run <suite.json>` is a person's command, refused from an agent session, and it resets the work tree for each attempt, so it runs only with `bench.enabled`, at the root of a clean repository that tracks nothing under `.agenthub/`. Nothing in `routing.toml` or in task text is ever run. `routing.toml` and the other shared fields still come from the checkout, and they matter: `routing.toml` picks the models the local worker and the hub's inference use at your gateway and can turn the PII constraint off, and roles and budget shape who does what. Review them in a repository you do not trust. The hub's own git calls outside the sandbox (snapshots, facts, config trust, project discovery, memory recall, the bench runner) all use the single hardened implementation in the exact-pinned first-party `@staix/agent-mem/platform` package, re-exported by `src/hub/git.ts`, which disables the programs a repository's configuration can name — the file-system monitor, hooks, external diff, the pager, and the credential and askpass helpers, with prompts failing closed — so a config that ever does get written cannot run code with the hub's rights. Of those, the monitor, hooks and external diff are reachable by commands the hub issues (the planted-program test exercises all three; a `diff --no-index` reads the repo's config, so that call also passes `--no-ext-diff` and `--no-textconv`); the pager is not (every call pipes stdout). Credential and askpass helpers are disabled for project repositories; memory sync alone may use credentials for its own memory repository, without prompts. The cost: `core.fsmonitor=false` also turns off a person's enabled built-in monitor for the hub's own calls, so the per-turn snapshot's `add -A` scans the whole tree (the snapshot has a 10 s cap). git has no global switch for filter drivers, and of the hub's commands only the snapshot's `add`/`restore` would run one (its driver command lives in the protected `.git/config`).
+- **A committed config cannot choose launch commands, credential files, data endpoints, permission modes or a wider sandbox.** The machine-local fields (`kimi_cmd`, `permission_modes`, `codex_bin`, `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`, `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`, `local.read_allow`, `local.bash_network`, `local.network_allow`, `terminal.open`, `instances`) apply only from a config file git confirms nobody committed (`instances` is read only from an untracked `.agenthub/config.local.json`; in `config.json` it is ignored even when untracked): `.agenthub/config.json` or `.agenthub/config.local.json`, matched by file identity so no other spelling the file system accepts slips past, and `.agenthub` itself not a committed symlink or submodule. Without a repository, or when git fails, they keep their defaults; an empty value always means the default. "Untracked" is answered by the repository that contains the project: a checkout copied or extracted into an unrelated repository, or into an ignored directory of one, is trusted like your own files. So a cloned repository cannot choose a launch command, a completion check, a gateway to send a key file to, a memory endpoint, a permission mode, the command that opens a terminal, or a wider sandbox. A command in `checks` runs as you, outside the local worker's sandbox, like a git hook. So do the `setup` and `verify` commands of a benchmark suite (issue #251): `ahub bench run <suite.json>` is a person's command, refused from an agent session, and it resets the work tree for each attempt, so it runs only with `bench.enabled`, at the root of a clean repository that tracks nothing under `.agenthub/`. Nothing in `routing.toml` or in task text is ever run. `routing.toml` and the other shared fields still come from the checkout, and they matter: `routing.toml` picks the models the local worker and the hub's inference use at your gateway and can turn the PII constraint off, and roles and budget shape who does what. Review them in a repository you do not trust. The hub's own git calls outside the sandbox (snapshots, facts, config trust, project discovery, memory recall, the bench runner) all use the single hardened implementation in the exact-pinned first-party `@staix/agent-mem/platform` package, re-exported by `src/hub/git.ts`, which disables the programs a repository's configuration can name — the file-system monitor, hooks, external diff, the pager, and the credential and askpass helpers, with prompts failing closed — so a config that ever does get written cannot run code with the hub's rights. Of those, the monitor, hooks and external diff are reachable by commands the hub issues (the planted-program test exercises all three; a `diff --no-index` reads the repo's config, so that call also passes `--no-ext-diff` and `--no-textconv`); the pager is not (every call pipes stdout). Credential and askpass helpers are disabled for project repositories; memory sync alone may use credentials for its own memory repository, without prompts. The cost: `core.fsmonitor=false` also turns off a person's enabled built-in monitor for the hub's own calls, so the per-turn snapshot's `add -A` scans the whole tree (the snapshot Git calls of one burst share a 250 ms budget, each call at most 10 s; a boundary that runs out is recorded as unknown, never as a stale baseline) (#576). git has no global switch for filter drivers, and of the hub's commands only the snapshot's `add`/`restore` would run one (its driver command lives in the protected `.git/config`).
 - **Telemetry holds no bodies.** `.agenthub/state/events.jsonl` (issue #40) records envelope ids, routing and sizes, task ids and states, overlapping paths and token counts, and the task id (with a PII flag) that each usage and token record is attributed to. It never records a message body, a task title or detail, and marks private (PII) envelopes and tasks as such. It stays on the machine; `ahub export` only prints it. Two opt-in stores copy numbers from it into your home directory, shared by every project on the machine (directories mode 700, files 600): research records (issue #247, `research.enabled`) in `~/.agenthub/research/` hold per approved task the ids, states, counts, tokens, times and PII flag the events hold, a person's label from a closed list, and a hash in place of the project id; benchmark runs (issue #251) in `~/.agenthub/bench/` hold suite name and hash, arm label, the attached peers' ids, models and permission modes, task ids, outcomes, exit codes, counts, tokens and times, never suite text or a command's output.
 - **Snapshots stay in your repository.** Per-turn snapshots (issue #33) are git objects in the project's own object store, written through a temporary index; nothing is referenced, pushed or copied elsewhere, and `git gc` prunes them. They hold what the work tree held, including untracked files that are not ignored, so keep secrets in ignored files. They carry the repository's own permissions, and nothing caps their disk use but `git gc`. A turn of a peer holding an open PII task is not snapshotted; a PII file left in the project is snapshotted by later turns like any other file. `ahub undo` restores only files whose current content is exactly what the turn left.
 - **The edit hook reads, never decides.** `ahub check-path --hook` (issue #32) reads hub.db and returns context for Claude and a line for you; it sets no permission decision, so your permission rules stay in charge. It names other owners' task ids, titles and states, which then reach Claude's model; PII tasks are left out.
@@ -196,7 +196,7 @@ page. It cannot expose private task history or allow local-worker tools.
 Per-project control handshakes verify project, root and instance against the
 runtime manifest. Shutdown removes only the owning instance's runtime files and
 waits for owned child processes. Registry and manager startup claims serialize
-concurrent starts; uncertain ownership is reported, not forcibly reclaimed.
+concurrent starts; uncertain ownership is reported, not forcibly reclaimed. An open whose spawned manager lost to another one stops the process it started, so no unowned manager keeps running (#584).
 A stale browser action against a restarted daemon is rejected, and mutations are
 never automatically replayed after a connection failure.
 
@@ -254,7 +254,7 @@ this production table. Startup diagnostics withhold native host/payload details.
 
 Jcode is optional, source/version-fenced and runs native tools without a hub sandbox or hub permission-mode mapping. .jcode joins the scoped-grant exclusion, including lexical/resolved aliases. Only a person writes its unique project MCP entry; foreign/override/symlink entries refuse. The hub owns a private daemon/socket and ACP group, never the global daemon, and copies no credentials. It accepts only a plain jcode release from 0.98.0 up to, not including, 1.0.0 (#529), and runs every owned jcode process (probe, serve, ACP and TUI) with `JCODE_NO_TELEMETRY=1`, because jcode's telemetry can report the provider account's email. Native diagnostics withhold payloads/hosts. Unproved conversation loads refuse; no fresh replacement is called a restore. A finished task's advisory about the project root checkout names the branch only after the hub's whole public-text screen (`Tasks.publicMetadataText`: a PII pattern, a secret shape and a project-private path) passes it and it is a plain ref name; otherwise a generic sentence carries no part of it (#572). Native TUI launch exposes its private socket/session tuple only to the authenticated console, bound to the same live owned socket and session after read-only native persistence proof. Tools/status do not receive it. The TUI has no single-writer guard: person input may interleave with ACP. Native policy remains unmanaged and closing the frontend does not stop ACP. An `important` message reaches a busy Jcode as a soft interrupt written to the hub's own private server socket for the owned session (#572); the hub never cancels a turn to deliver, and a steer that was sent but not acknowledged, or whose turn ended first, is held as `needs_review`, never replayed. Jcode has no switch to choose its MCP servers, so the owned serve and ACP processes load every server named in `<JCODE_HOME>/mcp.json` and the project's `.jcode/mcp.json`, `.mcp.json` and `.claude/mcp.json`, besides the hub's own; `ahub doctor` lists their names only. Point `jcode_home` at a separate home, or remove a server from those files, to keep it out.
 
-Antigravity (`agy`, #485) is optional, cloud and off roster by default. It runs native tools under its own unmanaged permissions, without a hub sandbox or hub permission-mode mapping; headless, resume, unattended and native permission flags are refused. Its roles are capped at implementer and verifier, so it never plans, reviews or receives PII work. Only the person's `ahub agy` launcher writes its three plugin files in `.agents/plugins/agent-hub/` (`plugin.json`, `mcp_config.json`, `hooks.json`): linked or foreign entries refuse before any write, cleanup removes only that launch's matching files, and it never writes project-level `.agents/hooks.json` or the person's `~/.gemini` settings. Conductor starts are refused. Hook authority (`native_hook_launch`) comes only from that launcher, belongs to the console socket that began it and ends when that socket closes; hook input over 1 MiB is refused, and observations are bound to the daemon, launch, native session and project.
+Antigravity (`agy`, #485) is optional, cloud and off roster by default. The launcher accepts the Antigravity CLI 1.4.x line; only 1.4.2 has a native receipt, so another 1.4.x patch launches with a warning that it is unverified, and every other version is refused before a hub connection or plugin write (#589). It runs native tools under its own unmanaged permissions, without a hub sandbox or hub permission-mode mapping; headless, resume, unattended and native permission flags are refused. Its roles are capped at implementer and verifier, so it never plans, reviews or receives PII work. Only the person's `ahub agy` launcher writes its three plugin files in `.agents/plugins/agent-hub/` (`plugin.json`, `mcp_config.json`, `hooks.json`): linked or foreign entries refuse before any write, cleanup removes only that launch's matching files, and it never writes project-level `.agents/hooks.json` or the person's `~/.gemini` settings. Conductor starts are refused. Hook authority (`native_hook_launch`) comes only from that launcher, belongs to the console socket that began it and ends when that socket closes; hook input over 1 MiB is refused, and observations are bound to the daemon, launch, native session and project.
 
 # Transient ACP activity (#286)
 

package/docs/smoke.md

@@ -1966,7 +1966,7 @@ Kimi usage ceiling: 2.2.0 print stream-json exposes no token counts. Keep unobse
 
 ## Antigravity P1 (#485)
 
-- Pin agy 1.4.2; verify its executable/version and keep the actual TUI/IDE leg separate from the account-free [T0 transport receipt](verification/2026-10-19-agy-p1-t0.md).
+- Run agy on the 1.4.x line (1.4.2 verified; other patches warn, #589); verify its executable/version and keep the actual TUI/IDE leg separate from the account-free [T0 transport receipt](verification/2026-10-19-agy-p1-t0.md).
 - With a reviewed compatible daemon running and agy explicitly on roster, the person runs `ahub agy` in a terminal. Confirm peer `agy` is pull-only, native permissions unmanaged and no hub sandbox/budget source is claimed.
 - In the native TUI call `hub_inbox`, `hub_send`, and a permitted board read/proposal within a non-PII task. Confirm the tool audience and actor remain `agy`, the native model consumes the tool results, and no unsolicited push or PII task text reaches it.
 - End the TUI normally. Confirm its group/socket detaches and only its matching managed three-file plugin is cleaned up; unrelated project/global settings remain unchanged.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1045,7 +1045,11 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
 - Snapshots are taken inside the state transition, before the peer is handed its
   prompt. Turn records (`turns` table in hub.db) keep the last `snapshots.keep`
   per peer. `DEFAULT_CONFIG` has snapshots off, like approvals.notify; a project
-  config turns them on.
+  config turns them on. The daemon shares a monotonic 250 ms Git budget across a
+  synchronous boundary burst, including repository/HEAD probes and end diffs. Each
+  subprocess timeout uses only the remaining budget. Exhaustion or failed diff
+  evidence records an unknown boundary, emits a diagnostic once per burst and
+  grants no undo/attribution; I/O gets a turn before a new budget is available (#576).
 - `ahub undo` refuses the whole turn when any of its files changed since it
   ended (a file-by-file partial undo would leave a mixed state).
 - Codex: the method is `thread/revert {threadId, beforeTurnId}` (codex-cli
@@ -1332,7 +1336,7 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
 - `hub_delivery_retry { delivery_id }` lets an authenticated recipient retry only its own current `needs_review` row. This option is offered only to transports with an independent tool turn (Claude channel/pull, Codex and Pi). The delivery-only local worker and headless ACP peers cannot start a tool turn through their own hold, so they do not advertise this tool and the daemon refuses a manual call before mutation. Their held hints ask the person to resolve the row; ordinary messages never bypass the hold. Kimi TUI remains pull-only and keeps the recipient option. An ephemeral delivery-only MCP marker controls exposure and hint copy only; the current adapter class is the authority. There is no action or reason input: `completed` and `discard` remain person-only. Any explicit retry in that recipient's lineage, including a person's retry, consumes this allowance; a redelivery held again stays for the person. The existing resolution transaction records `peer:<id>` and a fixed reason, keeps original envelopes unchanged and requeues them through the existing put-back path. A busy recipient may consent to this queue-only operation, but delivery waits for idle and all pause/recovery and active-delivery fences remain. The rendered clone reserves the existing journal body cap for the warning, clipping only the clone at a Unicode character boundary with an explicit cut marker when needed; originals remain unchanged. Jcode project MCP entries carry the same delivery-only exposure marker as other headless ACP peers, preserving their own configuration and peer identity rules. Final rendered output, after condensation and on pull or steer, starts with the fixed sanitized header `Hub redelivery warning: An earlier attempt of this delivery is uncertain; check for its effects before acting.` Explicit retry history is scoped by recipient and original envelope ids. A separate monotone consumed-proof projection records one proof id and warning provenance per original, leaving resolution audit rows unchanged. Explicit resolution and coalesced handoff inherit that proof atomically for every grouped non-context original; a rejected checkpoint consumes no fresh allowance. Hub presence originals carry mutable recall/shared context whose id survives merging, so their ids never participate in retry proof lookup, inheritance, warnings or unknown marking. A preface shared with earlier work cannot consume an unrelated new message's retry allowance; actual task/chat originals retain their consumed lineage. Safe-failure requeue, withdrawal of an earlier original, terminal-state changes, pruning, restart or older-writer audit replacement cannot renew the allowance. Older attempt-bearing rows backfill this projection on return. Recovery snapshots without history and unmappable pruned pre-feature retry records mark only their affected recipient/original ids unknown: those lineages require a person, while unrelated new messages keep their allowance. Tool results expose held metadata only (total count, ids, senders, kinds and age), at most 32 rows/4 KiB with explicit truncation; no body or task text enters the hint. These hints work independently of channel mode and do not wait behind the held queue (#434).
 - Local attach and idle model/route replacement require a reachable authenticated gateway, served models and successful minimal availability calls. Busy workers refuse replacement; validation failure leaves the current worker intact. Controlled recovery can reconstruct a manually paused local worker without gateway availability, but manual resume validates its restored choice before lifting the pause. Doctor checks the fixed model against the inventory.
 - Reviewer routing appends attached peers holding `roles.reviewer` after the review class's candidates. Without a reviewer, task results and console notices explain direct approval and the skipped candidates.
-- Conflict detection includes `in_review` work. Completed overlapping snapshots that share files generate one concurrent-edit notice per task pair/file, containing both turn ids and attributing the changes to neither peer. Private tasks and sensitive file names remain redacted.
+- Conflict detection includes `in_review` work. Completed overlapping snapshots that share files compute one concurrent-edit change set across the completed overlapping turns and publish at most one conditional notice per affected task, containing both turn ids and attributing the changes to neither peer. Per-task-pair events remain research evidence, while notice persistence grows linearly in the affected tasks (#576). A bounded, per-worktree HEAD reflog cursor classifies moves appended during the turn. Incoming checkout, merge, pull and proven fast-forward reset paths are excluded from attributed changes and undo paths; normal peer commit, amend and cherry-pick paths remain attributed, as do sequencer pick/reword/edit/squash/fixup/continue/finish paths under native command prefixes. The start checkout of rebase or pull --rebase is incoming; overlapping replay paths are ambiguous, not attributed as upstream work. Paths still dirty between end HEAD and the end workspace snapshot are never excluded (including autostash and checkout -m). Independent working-tree edits remain attributed. Fast-forward reset follows this incoming policy even if its descendant target contains commits made by the peer elsewhere. Missing, rotated, truncated, unrecognized or ambiguous move evidence is unknown, never an exclusion; paths shared by own and incoming moves are ambiguous. A HEAD change during snapshot capture makes that capture unknown. Status probes the checkout branch once per synchronous burst, then screens the cached raw branch through the current privacy policy for every rendering; the cache ends before the next control turn. Pi terminal reconciliation reads an owner observation maintained by the existing 500 ms monitor and expiring after 1 s; fresh signature checks remain mandatory at tool/effect admission and teardown. Private tasks and sensitive file names remain redacted.
 - Pi assistant usage is forwarded through the authenticated bridge and recorded before settlement, without counting the same message both at `message_end` and `agent_end`.
 - An idle peer with no open owner/reviewer task and no queued or active delivery skips the quota checkpoint turn; the pause proceeds immediately and the log records the skip.
 - Control protocol 11 adds queue hold metadata; the current coordinator supports authenticated protocol 9, 10 and 11 recovery sources.
@@ -1542,9 +1546,10 @@ or Home/End sequences is that many key presses, never a paste. Home or `<` selec
 the first row of a panel and End or `>` the last (Home tops an open view); the
 Events panel follows new events while its selection is on the last row, keeps a
 row the person moved to, and opening it or changing its filter selects the newest
-row (#441). In panels `w` opens the project dashboard (`ahub ui`) and `o` the pet
-window (`ahub pet --window`) as a person's console command; the `:` line also
-accepts `ui` and `pet` (#452). An Events row's header is
+row (#441). Outside the Peers panel, `w` opens the project dashboard (`ahub ui`);
+in Peers it opens the selected peer's WIP limit edit (#532 W1-W3). `o` opens the
+pet window (`ahub pet --window`) as a person's console command; the `:` line
+also accepts `ui` and `pet` (#452). An Events row's header is
 tokenized by the stream's own tokenizer on the same tab-flattened text, with the
 event's tone and kind; body lines stay plain, and selection changes only the
 `>` marker. The tail prints a peer's context reading once and repeats it only
@@ -1630,9 +1635,37 @@ console emits no box-drawing or other ambiguous-width glyph. The active tab is
 bracketed; the Approvals and Queue tabs count pending requests and
 `needs_review` deliveries. Peers, Approvals, Tasks and Queue are tables: a
 header row, columns two spaces apart sized with `Bun.stringWidth` from every
-row (at most a third of the width), the last column taking the rest. Peers' LINK
-column reads `tools-only` when the optional `toolsOnly` status field (#205) is
-present. Zero counters read `-`, durations `45s`, `12m`, `3h05m` or `2d03h`, and
+row (at most a third of the width), the last column taking the rest. Peers'
+columns are PEER, STATE, MODE, LINK, Q, !, WIP, REVIEW, PAUSE, QUOTA and MODEL;
+MODE appears only when at least one peer has a non-`ask` mode. WIP reads
+`wip/limit` from the peer's `taskWip` entry, preserving zero (for example `0/2`),
+or `-` when absent. It uses the attention tone at `wip >= wipLimit`. WIP is
+optional at narrow widths and drops before PEER, STATE and QUOTA, with or
+without MODE. The Peers hint includes `w WIP limit`, shortened to `w WIP`
+through the existing width adaptation alongside `m permission mode`/`m mode`.
+Tasks has a `b` toggle between open work and backlog (#532 B1-B5), using the
+same public board response. Backlog rows sort by rank (missing last), then id;
+the heading counts them. Its columns are ID, PRI (priority/rank), RESERVED,
+DEPS (ready or unapproved dependency ids), CLASS, AGE and TITLE. PII titles stay
+stubs. Narrow widths drop metadata before ID, RESERVED and TITLE.
+
+Backlog row keys prefill the existing person CLI: `p` is
+`backlog pull-ready <id> <planningRevision> <reason>`, `a` is `backlog plan`
+with a reservation JSON object, `e` is `backlog plan` with priority/rank/deps,
+and `c` is the existing flow-revision-bound `task cancel`. `n` in either Tasks
+view adds backlog work (`backlog add <class> <title...>`, or the command line's
+`task propose --backlog` with paths/deps). On proposed or in-progress open work,
+`R` returns an ownerless proposal with `backlog return <id>` or accepted,
+untouched work with the planning-revision-and-reason form. The hub retains its
+execution-evidence refusal. Row commands preserve id and revision through
+editing and confirmation, reject stale rows, and execute only after explicit
+confirmation; Esc sends nothing. Backlog mutations on the `:` line confirm too,
+while `backlog list` is read-only. Refusal notices preserve the hub's reason.
+There is no new write path or actor authority; person CLI and planner revision
+checks remain authoritative. Hints follow the selected row's available actions.
+
+LINK reads `tools-only` when the optional `toolsOnly` status field (#205) is
+present. Other zero counters read `-`, durations `45s`, `12m`, `3h05m` or `2d03h`, and
 resets and pauses are relative. Detail views and the Approvals panel's request
 block put labels at column 0 and values one column past the longest label; a
 list puts `- ` before each item, and every other line of a value (its own
@@ -3231,7 +3264,14 @@ later turn; a running turn retains its capture decision and is never stopped.
 
 The console's sixth Settings tab reads the same registry as the dashboard. It edits
 through the authenticated daemon client: value, preview, nonempty bounded reason,
-then explicit y; undo also previews and confirms. Stale preview replies cannot arm a
+then explicit y; undo also previews and confirms. In the Peers tab, `w` enters
+this same editor in place on Peers for `tasks.wip_limits.<peer>`, prefilled
+with the selected peer's current limit. Bounds (currently 0..32), the `raises` risk label and
+`applies: live` come from the setting definition. A missing `taskWip` entry
+produces a notice and opens no edit. Esc cancels without a write; `6`, then
+`u` invokes the existing Settings undo preview/confirmation operation. The shortcut creates no
+write path or authority: Settings remain person-only and `ahub settings` keeps
+its agent-shell refusal. Stale preview replies cannot arm a
 write, and pasted confirmation text never executes one. The daemon accepts additive
 settings_reload and undo-preview requests only from console roles. The dashboard's
 setting_reload action uses its existing authenticated session; manager forwarding
@@ -3881,3 +3921,5 @@ The pinned agy 1.4.2 T0 receipt precedes implementation: isolated HOME/`.gemini`
 The P1 host introduces additive `native_hook_launch` and `native_facts` control requests. Only the person begins/ends a launch; hook tools cannot grant themselves launcher authority, and conductor starts are refused. The interactive child remains in the launcher's foreground process group. Launch authority belongs to the console socket that began it and is revoked on that socket's close; an old socket cannot revoke a replacement launch. The managed launcher embeds its daemon/launch identity in the plugin hooks, and the host binds observations to one native conversation and socket generation. It acknowledges a normal fully-idle Stop only after a fresh native completion row. Turn-free facts are injected at the observed model boundary and acknowledged only from SDK transcript rows; unobserved native file effects receive no attribution. Hook input over one MiB is refused before decoding or forwarding. Out-of-ceiling agy roles are dropped with a config log notice before conductor validation, preserving other peers' admission.
 
 The collected T0 proves the plugin, hook codec and read transport, not a native prompt override. P1 therefore keeps all runtime modes unmanaged and refuses unattended/headless/resume selectors until those individual mappings are proved. The old daemon refuses the additive launch request rather than silently weakening hook identity. An actual project TUI launch requires a running daemon with this feature; source/fixture verification does not claim that live rollout.
+
+Version line (#589, owner decision 2026-10-20): agy updates itself, so the launcher accepts the 1.4.x line instead of exactly 1.4.2. 1.4.2 launches silently; another 1.4.x patch launches with one stderr warning naming the observed version and the 1.4.2 receipt; any other version, unparseable output or a failing `--version` is refused before a hub connection or plugin write. A T0 re-run on a newer patch is a separate follow-up.

package/docs/verification/2026-10-20-0.12.42.md

@@ -0,0 +1,48 @@
+# 0.12.42 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or a live `ahub agy` TUI launch.
+
+## Candidate
+
+Version 0.12.42, control protocol 16 (unchanged; no daemon feature added), from merged main. The local Antigravity CLI updated itself to 1.4.3 on 2026-10-20 and `ahub agy` refused it (`agy P1 requires the verified Antigravity CLI 1.4.2`). The person directed on 2026-10-20 to relax the gate to the 1.4.x line with a warning, register and fix the Bun drift and the problems found on the way, merge, and ship.
+
+- agy version line (#589, PR #590): 1.4.2 launches silently, another 1.4.x patch launches with one stderr warning, anything else is refused before a hub connection or plugin write.
+- Pinned Bun for the bundle (#591, PR #592): `scripts/build.mjs` re-runs itself through `bun x bun@<.bun-version>` when the running Bun differs.
+- Test watchdog budget (#593, PRs #594 and #598): hosted macOS 1260 s and Linux 1080 s inside a 25-minute job, local default 960 s; the 20 s per-test timeout unchanged. The first release PR run hit the old 780 s Linux cutoff one second after a passing test (run 39441258200), which led to #598.
+- Test isolation (#595, PR #596): the recorded-launch allowlist test clears the ambient `CLAUDE_CONFIG_DIR`.
+- Still open: a T0 re-run on agy 1.4.3 (its changelog changes `PostToolUse` failure handling and `agy plugin validate`, not the hook envelope the hub parses), and every live leg listed in [the 0.12.40 record](2026-10-20-0.12.40.md).
+
+## Reviews
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #590 (#589) | c8837f8f (reviewed diff 6a93e48f plus a merge of main) | OCR delegation review: no High or Medium findings. codex-connector: no findings | exact head, success (both OS checks) |
+| #592 (#591) | d1ac9033 | OCR delegation review: no findings. codex-connector: no findings | exact head, success (both OS checks, 4/4 seeded shards) |
+| #594 (#593) | 16ee60db | OCR delegation review: no findings (no other job runs `check.sh`; 25 minutes covers 1260 s plus setup). codex-connector: no findings | exact head, success (both OS checks) |
+| #598 (#593) | b023cd6b | Config-only diff reviewed: 1080 s plus setup fits the 25-minute job. codex-connector: no findings | exact head, success (both OS checks) |
+| #596 (#595) | 7adf8c45 (bf7c66b7 plus a merge of main) | Test-only diff reviewed (excluded from OCR by path). codex-connector: no findings | exact head, success (both OS checks) |
+
+Claude and Copilot PR reviews were skipped for quota on all five PRs.
+
+## Document review
+
+Seven documents were stale against the 0.12.41 stamps (`644f9a45`), through #590, #594 and this release. Restamped to the release branch head `6f012880`; `docs/agent-notes/tests.md` and `docs/operations.md` again to `ba26148f` after #598 merged.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.12.42; the agy 1.4.x line (#589); verification link. |
+| `docs/quickstart.md` | corrected | Install pin `v0.12.42`; "Upgrading to 0.12.42"; plugin restart names 0.12.42; agy install names the 1.4.x line (#590). |
+| `docs/operations.md` | corrected | Version line, protocol 16 range and upgrade commands name 0.12.42; agy 1.4.x line (#590); watchdog values (#594, #598). |
+| `docs/security.md` | corrected | The agy launcher's 1.4.x acceptance, the unverified-patch warning and the refusal boundary (#589). |
+| `docs/agent-notes/adapters.md` | corrected in #590 | The launcher refuses versions outside the 1.4.x line. |
+| `docs/agent-notes/tests.md` | corrected in #594 and #598 | Watchdog values per platform (Linux 1080 s). #596 changed a test only; no test-gate rule changed. |
+| `src/cli/help.ts` | corrected in #590 | `ahub agy` names the 1.4.x line; no command, subcommand or flag changed. |
+
+## Checks
+
+- Each PR's exact-head CI passed (table above); all checks share one serialized queue.
+- Local full `scripts/check.sh` runs before #593/#595 were cut off by the 600 s watchdog while tests still passed, and showed the `CLAUDE_CONFIG_DIR` failure fixed by #595. CI is the full gate for this release.
+- The bundle was rebuilt with `bun run build` under a local Bun 1.4.3; #591 re-ran it under 1.4.2 and the diff is the version stamp only.
+- `node scripts/check-docs.mjs --require-fresh`: `docs: OK (0 stale documents)` at the restamp.
+- Codex P1 on #597 (stamps not an ancestor of a squashed commit) declined: `6f012880` is an ancestor of the PR merge ref and `--require-fresh` passes there; release PRs use a merge commit.
+- Exact-head CI on the release PR.

package/docs/verification/2026-10-21-0.12.43.md

@@ -0,0 +1,50 @@
+# 0.12.43 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or a live TUI launch.
+
+## Candidate
+
+Version 0.12.43, control protocol 16 (unchanged; no control message added), from merged main. The person directed on 2026-10-21 to finish the open PRs, merge and ship.
+
+- Hot paths under HEAD movement (#576, PR #608): snapshot Git calls in one burst share a 250 ms budget, an exhausted or failed boundary is unknown, concurrent-edit notices go once per affected task, and HEAD moves are classified from the HEAD reflog so incoming checkouts, merges and fast-forwards are excluded while a peer's own commits, amends, rebase replays and cherry-picks stay attributed. Scratch burst: `status` 21.3 s -> 0.27 s, false conflicts 144 -> 0, CPU 13 s -> 0.37 s.
+- Restore mapping retry (#599, PR #600), named-owner refusal (#601, PR #602), `ahub completion` (#603, PR #604), agy read facts for 1.4.2 and 1.4.3 (#555, PR #605), agy 1.4.3 T0 receipt with 1.4.3 kept unverified (#267, PR #606), console Peers WIP column and `w` (PR #615) and the Tasks backlog view and row actions (PR #620) (#532), manager open stops a losing spawn (#584, PR #614).
+- Contributor gate: per-PR CI concurrency groups and `scripts/check.sh --changed` with a pinned test environment (#609, #610, PR #611); two timing-dependent tests fixed (#617, #618, PR #619); live PII screen calibration recorded (#198, PRs #613 and #616).
+- Still open: the agy TUI first-turn tools gap (#607), the #612 attribution-cost follow-ups, #428 (a facts test that fails in a full Linux container run), and every live leg listed in [the 0.12.40 record](2026-10-20-0.12.40.md).
+
+## Reviews
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #600 (#599) | 729ec0b6 | Reviewer read of both paths; terminal-recovery tests 27/0 run by the reviewer. codex-connector: no findings | exact head, success |
+| #602 (#601) | da3cf17b | Author self-review plus two codex-connector findings (self-claim note, enforce-mode refusal) fixed and answered | exact head, success |
+| #604 (#603) | 40795529 | Three codex-connector findings (fish empty word, placeholder values, positional subcommands) fixed and answered; live fish and bash checks | exact head, success |
+| #605 (#555) | b07e7f02 | Reviewer read; changes requested once for agy 1.4.3 `read_file`; connector P1 on ranged reads answered; agy tests 16/0 | exact head, success |
+| #606 (#267) | 2ddcc915 | Reviewer read of the receipt; reference fix requested and applied | exact head, success |
+| #608 (#576) | 4e6adb6e | Three review rounds, each with an independent read-only reviewer probing real git 2.56 reflog forms; R3 no Important finding; follow-ups in #612 | exact head, success |
+| #611 (#609, #610) | 9af81d4b | Author review; first head was an invalid workflow (`queue: max` with `cancel-in-progress`), fixed; two connector findings on `--changed` fixed | exact head, success |
+| #613 (#198) | 994d02cc | Docs only. A connector thread on the mutable model alias was answered after merge and fixed in #616 | exact head, success |
+| #614 (#584) | b330ad32 | Reviewer codex approved; merger read the manager change | exact head, success |
+| #615 (#532) | 0fb5c8c8 | Reviewer read; one change request (declared-instance WIP keys) fixed; `--changed` 463/0 and a full Linux exact-commit gate green except #428 | exact head, success (one rerun of the #618 flake) |
+| #616 (#198) | 200adb70 | Served-model recording; connector finding on the probe cache fixed and answered | exact head, success |
+| #620 (#532) | 42272f93 | Reviewer read: row actions bound to id and planning/flow revision, rechecked at Enter and y, no new write path; 37 new tests. codex-connector: no findings | exact head, success |
+| #619 (#617, #618) | 534d9ebf | Reviewer read; macOS 20/20 and 100/100 reruns by the author | exact head, success |
+
+## Document review
+
+Thirteen documents were stale against the 0.12.42 stamps. Each was checked against `git log <stamp>..HEAD` over its paths by a read-only reviewer per group, and the edits were applied on the release branch. All thirteen are restamped to the release branch commit `53743efd`, which includes #616 and #620.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.12.43; agy read facts and 1.4.3 second-turn tools; console WIP limits; verification link. |
+| `docs/quickstart.md` | corrected | Install pin `v0.12.43`; "Upgrading to 0.12.43"; plugin restart names 0.12.43; agy 1.4.3 second-turn note. |
+| `docs/operations.md` | corrected | Version line, protocol 16 range, upgrade commands; restore mapping re-read (#599); unknown turn boundaries and reflog HEAD-move rules (#576); named-owner refusal (#601); agy read facts and 1.4.3 receipt (#555, #267); per-PR CI groups and `--changed` (#609, #610); per-instance WIP keys (#532). |
+| `docs/security.md` | corrected | Snapshot budget (250 ms per burst, 10 s per call, unknown on exhaustion) (#576); a losing manager open stops its spawn (#584). |
+| `src/cli/help.ts` | corrected | `task assign` says a peer that cannot take the task is refused with the reason (#601); `ahub completion` already listed; no other command, subcommand or flag changed. |
+| `docs/agent-notes/daemon.md` | corrected | Settings editor bound to its opening panel incl. the Peers `w` shortcut (#532); console backlog row actions bound to id and revision (#532, PR #620); restore mapping re-read (#599); `openManager` keeps only the answering manager (#584). |
+| `docs/agent-notes/adapters.md` | corrected | agy read decoding and Pre/PostToolUse facts (#555). |
+| `docs/agent-notes/tests.md` | corrected | Captures yield an I/O turn when a test is not about the snapshot budget (#617). |
+| `docs/agent-notes/README.md`, `benchmarks.md`, `budget.md`, `bus.md`, `tasks.md` | no change | Rules checked against the diffs (#601 and #608 rules already added in their PRs); no contradiction. |
+
+## Release mechanics
+
+Merge the release PR with a merge commit (the stamps name release-branch commits), run `node scripts/check-docs.mjs --require-fresh` on the merged main, then tag `v0.12.43`.

package/docs/verification/2026-10-21-agy-1.4.3-t0.md

@@ -0,0 +1,65 @@
+# Antigravity 1.4.3 T0 re-run (#267)
+
+Status: the 1.4.2 P1 T0 receipt ([2026-10-19-agy-p1-t0.md](2026-10-19-agy-p1-t0.md)) was re-run on 2026-10-21 against `agy 1.4.3`. **1.4.3 is not marked verified.** Most observations match, but the native tool names and the model-facing `call_mcp_tool` schema changed, the unmodified 1.4.2 probes no longer reach the hub, and in the interactive TUI the plugin MCP server is attached lazily on the first prompt, so the first model turn has no hub tools. No code changed. The live TUI leg was done separately in #268 (see below).
+
+## Environment and isolation
+
+- Observed CLI version: `agy 1.4.3`.
+- Executable SHA-256: `836c446f6118140e86679ec6966a785eeedbf56b3711a8eb1f41947483e9802a` (the person's `~/.local/bin/agy`, unchanged before and after).
+- Bun 1.4.3 ran the probes. The 1.4.2 receipt used Bun 1.4.2, so the plugin MCP server and hook scripts also ran on a newer Bun. This is a second variable, not separated from the agy change.
+- Probe scripts are copies of the 1.4.2 scripts (`actual-hub.ts`, `native-hooks.ts`, `workspace-plugin*.ts`), re-pointed at a clean worktree of main. The originals were not edited. Adapted variants (below) are separate copies.
+- Same isolation as the receipt: a new temporary HOME with its own `.gemini`, workspace and temporary directory per run, an explicit environment, the Seatbelt profile from `src/local/sandbox.ts` denying the person's home except the executable, and a loopback Gemini protocol fixture. No real account or cloud model call is part of this receipt. The scratch hub had memory, inference, snapshots and auto-start disabled and explicit agy roster admission.
+- SHA-256 of the person's Gemini CLI files (`antigravity-cli/settings.json`, `config/config.json`, `config/hooks.json`, `config/mcp_config.json`, `config/skills.json`, legacy `settings.json`) taken before the first run and after the last run are equal. The probes' own before/after hash (a subset) was equal on every completed run. The project's `.agents/` directory was not written; owned process groups were stopped and temporary roots removed.
+- A first pass ran the unmodified `actual-hub.ts` with the agent scratch directory (under the person's home) as the temporary directory. It loaded no plugin hooks and made no MCP call. That run is not execution evidence and is not used below. All receipt runs use the per-user temporary directory, as the 1.4.2 run did.
+- Real-HOME contact: the agent ran `agy --version` and `agy --help` (print and exit, no session, no plugin load) under the person's real HOME at about 03:49 and 04:01 KST before switching to a fresh HOME for every other call. The person's `~/.gemini/antigravity-cli/log/` has a `/usage` print-mode run from cwd `/` at 04:01:38 KST (`cli-20261021_040138.log`). It is one of a file series at a five minute cadence (`:01:38`, `:56:38`, `:51:38`, `:41:38` and so on), started by something outside these probes, none of which was a probe call: the probes only started agy with a temporary HOME and `--log-file` in a temporary directory.
+- Raw bounded receipts and scripts remain in the local scratch workspace; they are not public artifacts.
+
+## Per-item comparison with 1.4.2
+
+| Item | 1.4.3 observation | vs 1.4.2 |
+| --- | --- | --- |
+| `--version` | prints `1.4.3`, exit 0 | same (new number) |
+| `--help` flags | still advertises `--conversation`, `--continue`, `--dangerously-skip-permissions`, `--mode`, `--new-project`, `--input-format`/`--output-format` stream JSON; no `--new` | same for every listed flag. A full diff is not possible: the 1.4.2 binary is not retained |
+| `--acp` refusal | exit 2, `flags provided but not defined: -acp`; no ACP subcommand in the list | same. Refusal of the tested flag only, as before |
+| `--new` | exit 2, undefined flag | same |
+| Workspace plugin discovery | `.agents/plugins/agent-hub/` is loaded without install or global write; server name `agent-hub_agent-hub`; the unprefixed name still fails with `tool ... is not enabled for server agent-hub`; `agy mcp list` still prints `No MCP servers configured.` | same |
+| Plugin-local `hooks.json` | the six hooks run from `.agents/plugins/agent-hub/hooks.json` | same |
+| Hook stdin shared fields | `conversationId`, `workspacePaths`, `transcriptPath`, `artifactDirectoryPath`, `modelName`; transcript `transcript_full.jsonl` | same |
+| `PreInvocation`/`PostInvocation` fields | adds `initialNumSteps`, `invocationNum` | same |
+| Tool hook stdin | `toolCall: { name, args }`, `stepIdx`; `PostToolUse` has empty `error` on success; tool hooks still need `matcher: ".*"` with a nested `hooks` array | same shape |
+| Native read tool in the tool hook | `read_file` with `Path`, `StartLine`, `EndLine` | **changed** (1.4.2: `view_file` with `AbsolutePath`) |
+| `injectSteps` | `SessionStart` and `PreInvocation` `ephemeralMessage` accepted and shown to the model | same |
+| Pre-tool `{ "decision": "allow" }` | accepted for the tested calls | same (still no override proof) |
+| `Stop` fields | `executionNum`, `terminationReason` (`NO_TOOL_CALL`), `error`, `fullyIdle` | same |
+| `call_mcp_tool` arguments | `ServerName`, `ToolName`, `Arguments` only. `toolSummary` and `toolAction` are now rejected: `additional properties 'toolAction', 'toolSummary' not allowed` | **changed** (1.4.2 required both) |
+| Model-facing tool declarations | 15 tools: `read_file`, `write_file`, `edit_file`, `search_web` replace `view_file`, `write_to_file`, `replace_file_content`, `read_url_content`. A call to `view_file` fails with `unknown tool` although the stream-JSON `init` event still lists 60 tools including `view_file` | **changed** (1.4.2: 16 tools) |
+| `init` event | 60 tools, `permission_mode: request-review`; no name added or removed | same |
+| Unmodified 1.4.2 probes | every call that used `toolSummary`/`toolAction` or `view_file` is rejected before execution. `native-hooks.ts`: no `PreToolUse`/`PostToolUse` rows, no `tools/call` at the fixture MCP. `actual-hub.ts`: the single `hub_inbox` call is rejected, nonce not seen by the provider | **changed** |
+| Actual scratch-hub `hub_inbox` with nonce, probes adapted to the 1.4.3 schema | exit 0, empty stderr, `hub_inbox` called once through the shipped bundle and the workspace plugin, the random nonce held only in the scratch bus preface appeared in the following fixture-provider request, all six hooks ran from the plugin-local file, native output SHA-256 `f1970aa687f0661c23e0f84924f2ff603d5f1c9edf9f718cc5e435448c862f3c` | same outcome, but only after fixture adaptation |
+
+Adaptation used for the passing 1.4.3 runs: drop `toolSummary` and `toolAction` from `call_mcp_tool` arguments, and use `read_file` with `Path` for the native read. Nothing else was changed in the fixtures.
+
+## Late plugin MCP start: print mode versus the interactive TUI
+
+The task owner saw hub tools missing on an early first turn of the person's own `ahub agy` TUI on 1.4.3 and present about ten minutes later in the same process. The isolated runs reproduce that as a startup-order effect, not a permanent failure. Times are seconds after spawn, taken from fixture timestamps (provider requests and the MCP fixture log), same Seatbelt profile and plugin files, fresh HOME each run:
+
+- **Print mode (`-p`)**: the plugin MCP server is started during the first turn. The first provider request is the title generation (0 tools). The first agent request already carries 15 tools including `call_mcp_tool`, `list_resources` and `read_resource`, and the tool call succeeds.
+- **Interactive TUI**: the plugin MCP server is not started at launch and not during the onboarding or idle time. In four runs (30 s, 13 s, 3 s and 3 s of idle after the trust prompt) it was started only when the first prompt was submitted: `server/discover`, `initialize` and `tools/list` ran in the same second as the first prompt. The first agent request after that prompt carried 12 tools and no `call_mcp_tool`. The next agent request carried 15 tools including `call_mcp_tool`, and every later request kept them. In the runs that sent prompts in quick succession that next request came 0.4 s to 1.7 s after the first prompt. A single-prompt run never made a second agent request, so whether the attach is driven by elapsed time or by the next request cannot be separated at this resolution. Waiting longer before the first prompt did not change the first request (30 s idle: still 12 tools).
+- Consequence: on 1.4.3 the TUI attaches the plugin MCP server lazily on the first prompt, and the first model turn has no hub tools. A prompt that needs a hub tool on that turn fails. The tools are available from the following turn. The roughly ten minute delay seen in the person's session is longer than anything measured here and is not explained (the person's HOME also loads a global MCP server and global hooks, which the isolated HOME does not). In the isolated runs a second prompt had the tools within two seconds.
+- Plugin hooks fire in the TUI from `SessionStart`, including `PreToolUse` and `PostToolUse` for the MCP call.
+- The agy log prints `hooks_manager ... loaded 0 named hooks from 0 hooks.json file(s)` in both modes while the plugin hooks run, and print mode adds a line for the plugin file. The line is not a reliable signal of plugin hook loading.
+- A fresh HOME makes the TUI stop at onboarding (theme, terms, workspace trust). The runs answered those with key presses (Enter, Down, Right, Enter, Enter).
+- **Not established: whether 1.4.2 behaved the same.** The 1.4.2 receipt never observed the TUI and no 1.4.2 binary is retained anywhere on this machine, so time-to-tools cannot be measured there. This is a 1.4.3 mode difference, not a proven 1.4.2 to 1.4.3 regression.
+
+## Consequences
+
+- `agyVersionGate` is not changed: 1.4.3 keeps the one-line stderr warning and is not added to the verified set.
+- `src/adapters/agy/hooks.ts` classifies a native read only when `toolCall.name === "view_file"` and `args.AbsolutePath` is a string. On 1.4.3 the native read is `read_file` with `Path`, so the decoder passes the call through as an unclassified tool and no `Read` fact is attributed. This is a follow-up for a separate task. It was not changed here because the task forbids code changes when anything differs.
+- Any hub-side prompt or fixture that tells the model to call `call_mcp_tool` with `toolSummary`/`toolAction` is invalid on 1.4.3.
+- The launcher's plugin namespace assumption (`agent-hub_agent-hub`) still holds.
+- Do not rely on `hub_*` tools on the first TUI turn of a 1.4.3 session. A launcher or preface that needs the hub on turn one has to wait for the second turn (or the person submits any first prompt). The live TUI leg (#268, agy's own TUI on hub 0.12.42 and agy 1.4.3, which superseded the cancelled #251) passed `hub_inbox`, 42 hub tools, a `hub_send` round trip and a board read from the second turn on, and also had no hub tools on its first turn, as the timing above explains. The close-cleanup check is still open.
+
+## Unchanged limits
+
+- Permission prompt mappings, `allow` versus native approval prompts, Stop continuation and post-invocation termination overrides remain unverified. Keep the peer unmanaged.
+- Not a sandbox claim for the proposed agy peer. Documentation alone is not native proof.

package/docs/verification/2026-10-21-pii-screen.md

@@ -0,0 +1,14 @@
+# PII screen calibration (issue #198), 2026-10-20
+
+- Screen: campus gateway, model coding
+- Served model (as the gateway reported it): qwen3.8-flash-next
+- Fixtures: 78 synthetic items (38 positives, 40 hard negatives), test/fixtures/pii-screen.json
+- Recall (pii labels only): 100.0%; bound 90.0%, fixed before measuring: met
+- Recall as handled (pii or unknown): 100.0%
+- Precision (pii labels): 100.0%
+- Unknown rate: 0.0%
+- Hard negatives held as PII (pii or unknown): 0.0%
+- Category agreement on true positives: 100.0%
+- Latency: p50 246 ms, p95 301 ms, max 869 ms
+- Missed positives: none
+- Negatives not cleared: none

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -69,7 +69,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "e57b1936bd234fad65aded000c921f5c9d7a3718",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -81,7 +81,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "e57b1936bd234fad65aded000c921f5c9d7a3718",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -98,7 +98,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "e57b1936bd234fad65aded000c921f5c9d7a3718",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -113,7 +113,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -188,7 +188,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -215,7 +215,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -233,7 +233,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "e57b1936bd234fad65aded000c921f5c9d7a3718",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",
@@ -242,7 +242,7 @@
       ]
     },
     "src/cli/help.ts": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "53743efd865a91f1f0766f5af0613c298ac3d7b9",
       "paths": [
         "src/cli/main.ts",
         "src/cli/launch.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.41",
+  "version": "0.12.43",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.41",
+  "version": "0.12.43",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",