@staix/agent-hub 0.12.42 → 0.12.44

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1045,7 +1045,11 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
 - Snapshots are taken inside the state transition, before the peer is handed its
   prompt. Turn records (`turns` table in hub.db) keep the last `snapshots.keep`
   per peer. `DEFAULT_CONFIG` has snapshots off, like approvals.notify; a project
-  config turns them on.
+  config turns them on. The daemon shares a monotonic 250 ms Git budget across a
+  synchronous boundary burst, including repository/HEAD probes and end diffs. Each
+  subprocess timeout uses only the remaining budget. Exhaustion or failed diff
+  evidence records an unknown boundary, emits a diagnostic once per burst and
+  grants no undo/attribution; I/O gets a turn before a new budget is available (#576).
 - `ahub undo` refuses the whole turn when any of its files changed since it
   ended (a file-by-file partial undo would leave a mixed state).
 - Codex: the method is `thread/revert {threadId, beforeTurnId}` (codex-cli
@@ -1332,7 +1336,7 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
 - `hub_delivery_retry { delivery_id }` lets an authenticated recipient retry only its own current `needs_review` row. This option is offered only to transports with an independent tool turn (Claude channel/pull, Codex and Pi). The delivery-only local worker and headless ACP peers cannot start a tool turn through their own hold, so they do not advertise this tool and the daemon refuses a manual call before mutation. Their held hints ask the person to resolve the row; ordinary messages never bypass the hold. Kimi TUI remains pull-only and keeps the recipient option. An ephemeral delivery-only MCP marker controls exposure and hint copy only; the current adapter class is the authority. There is no action or reason input: `completed` and `discard` remain person-only. Any explicit retry in that recipient's lineage, including a person's retry, consumes this allowance; a redelivery held again stays for the person. The existing resolution transaction records `peer:<id>` and a fixed reason, keeps original envelopes unchanged and requeues them through the existing put-back path. A busy recipient may consent to this queue-only operation, but delivery waits for idle and all pause/recovery and active-delivery fences remain. The rendered clone reserves the existing journal body cap for the warning, clipping only the clone at a Unicode character boundary with an explicit cut marker when needed; originals remain unchanged. Jcode project MCP entries carry the same delivery-only exposure marker as other headless ACP peers, preserving their own configuration and peer identity rules. Final rendered output, after condensation and on pull or steer, starts with the fixed sanitized header `Hub redelivery warning: An earlier attempt of this delivery is uncertain; check for its effects before acting.` Explicit retry history is scoped by recipient and original envelope ids. A separate monotone consumed-proof projection records one proof id and warning provenance per original, leaving resolution audit rows unchanged. Explicit resolution and coalesced handoff inherit that proof atomically for every grouped non-context original; a rejected checkpoint consumes no fresh allowance. Hub presence originals carry mutable recall/shared context whose id survives merging, so their ids never participate in retry proof lookup, inheritance, warnings or unknown marking. A preface shared with earlier work cannot consume an unrelated new message's retry allowance; actual task/chat originals retain their consumed lineage. Safe-failure requeue, withdrawal of an earlier original, terminal-state changes, pruning, restart or older-writer audit replacement cannot renew the allowance. Older attempt-bearing rows backfill this projection on return. Recovery snapshots without history and unmappable pruned pre-feature retry records mark only their affected recipient/original ids unknown: those lineages require a person, while unrelated new messages keep their allowance. Tool results expose held metadata only (total count, ids, senders, kinds and age), at most 32 rows/4 KiB with explicit truncation; no body or task text enters the hint. These hints work independently of channel mode and do not wait behind the held queue (#434).
 - Local attach and idle model/route replacement require a reachable authenticated gateway, served models and successful minimal availability calls. Busy workers refuse replacement; validation failure leaves the current worker intact. Controlled recovery can reconstruct a manually paused local worker without gateway availability, but manual resume validates its restored choice before lifting the pause. Doctor checks the fixed model against the inventory.
 - Reviewer routing appends attached peers holding `roles.reviewer` after the review class's candidates. Without a reviewer, task results and console notices explain direct approval and the skipped candidates.
-- Conflict detection includes `in_review` work. Completed overlapping snapshots that share files generate one concurrent-edit notice per task pair/file, containing both turn ids and attributing the changes to neither peer. Private tasks and sensitive file names remain redacted.
+- Conflict detection includes `in_review` work. Completed overlapping snapshots that share files compute one concurrent-edit change set across the completed overlapping turns and publish at most one conditional notice per affected task, containing both turn ids and attributing the changes to neither peer. Per-task-pair events remain research evidence, while notice persistence grows linearly in the affected tasks (#576). A bounded, per-worktree HEAD reflog cursor classifies moves appended during the turn. Incoming checkout, merge, pull and proven fast-forward reset paths are excluded from attributed changes and undo paths; normal peer commit, amend and cherry-pick paths remain attributed, as do sequencer pick/reword/edit/squash/fixup/continue/finish paths under native command prefixes. The start checkout of rebase or pull --rebase is incoming; overlapping replay paths are ambiguous, not attributed as upstream work. Paths still dirty between end HEAD and the end workspace snapshot are never excluded (including autostash and checkout -m). Independent working-tree edits remain attributed. Fast-forward reset follows this incoming policy even if its descendant target contains commits made by the peer elsewhere. Missing, rotated, truncated, unrecognized or ambiguous move evidence is unknown, never an exclusion; paths shared by own and incoming moves are ambiguous. A HEAD change during snapshot capture makes that capture unknown. Status probes the checkout branch once per synchronous burst, then screens the cached raw branch through the current privacy policy for every rendering; the cache ends before the next control turn. Pi terminal reconciliation reads an owner observation maintained by the existing 500 ms monitor and expiring after 1 s; fresh signature checks remain mandatory at tool/effect admission and teardown. Private tasks and sensitive file names remain redacted.
 - Pi assistant usage is forwarded through the authenticated bridge and recorded before settlement, without counting the same message both at `message_end` and `agent_end`.
 - An idle peer with no open owner/reviewer task and no queued or active delivery skips the quota checkpoint turn; the pause proceeds immediately and the log records the skip.
 - Control protocol 11 adds queue hold metadata; the current coordinator supports authenticated protocol 9, 10 and 11 recovery sources.
@@ -1542,9 +1546,10 @@ or Home/End sequences is that many key presses, never a paste. Home or `<` selec
 the first row of a panel and End or `>` the last (Home tops an open view); the
 Events panel follows new events while its selection is on the last row, keeps a
 row the person moved to, and opening it or changing its filter selects the newest
-row (#441). In panels `w` opens the project dashboard (`ahub ui`) and `o` the pet
-window (`ahub pet --window`) as a person's console command; the `:` line also
-accepts `ui` and `pet` (#452). An Events row's header is
+row (#441). Outside the Peers panel, `w` opens the project dashboard (`ahub ui`);
+in Peers it opens the selected peer's WIP limit edit (#532 W1-W3). `o` opens the
+pet window (`ahub pet --window`) as a person's console command; the `:` line
+also accepts `ui` and `pet` (#452). An Events row's header is
 tokenized by the stream's own tokenizer on the same tab-flattened text, with the
 event's tone and kind; body lines stay plain, and selection changes only the
 `>` marker. The tail prints a peer's context reading once and repeats it only
@@ -1630,9 +1635,37 @@ console emits no box-drawing or other ambiguous-width glyph. The active tab is
 bracketed; the Approvals and Queue tabs count pending requests and
 `needs_review` deliveries. Peers, Approvals, Tasks and Queue are tables: a
 header row, columns two spaces apart sized with `Bun.stringWidth` from every
-row (at most a third of the width), the last column taking the rest. Peers' LINK
-column reads `tools-only` when the optional `toolsOnly` status field (#205) is
-present. Zero counters read `-`, durations `45s`, `12m`, `3h05m` or `2d03h`, and
+row (at most a third of the width), the last column taking the rest. Peers'
+columns are PEER, STATE, MODE, LINK, Q, !, WIP, REVIEW, PAUSE, QUOTA and MODEL;
+MODE appears only when at least one peer has a non-`ask` mode. WIP reads
+`wip/limit` from the peer's `taskWip` entry, preserving zero (for example `0/2`),
+or `-` when absent. It uses the attention tone at `wip >= wipLimit`. WIP is
+optional at narrow widths and drops before PEER, STATE and QUOTA, with or
+without MODE. The Peers hint includes `w WIP limit`, shortened to `w WIP`
+through the existing width adaptation alongside `m permission mode`/`m mode`.
+Tasks has a `b` toggle between open work and backlog (#532 B1-B5), using the
+same public board response. Backlog rows sort by rank (missing last), then id;
+the heading counts them. Its columns are ID, PRI (priority/rank), RESERVED,
+DEPS (ready or unapproved dependency ids), CLASS, AGE and TITLE. PII titles stay
+stubs. Narrow widths drop metadata before ID, RESERVED and TITLE.
+
+Backlog row keys prefill the existing person CLI: `p` is
+`backlog pull-ready <id> <planningRevision> <reason>`, `a` is `backlog plan`
+with a reservation JSON object, `e` is `backlog plan` with priority/rank/deps,
+and `c` is the existing flow-revision-bound `task cancel`. `n` in either Tasks
+view adds backlog work (`backlog add <class> <title...>`, or the command line's
+`task propose --backlog` with paths/deps). On proposed or in-progress open work,
+`R` returns an ownerless proposal with `backlog return <id>` or accepted,
+untouched work with the planning-revision-and-reason form. The hub retains its
+execution-evidence refusal. Row commands preserve id and revision through
+editing and confirmation, reject stale rows, and execute only after explicit
+confirmation; Esc sends nothing. Backlog mutations on the `:` line confirm too,
+while `backlog list` is read-only. Refusal notices preserve the hub's reason.
+There is no new write path or actor authority; person CLI and planner revision
+checks remain authoritative. Hints follow the selected row's available actions.
+
+LINK reads `tools-only` when the optional `toolsOnly` status field (#205) is
+present. Other zero counters read `-`, durations `45s`, `12m`, `3h05m` or `2d03h`, and
 resets and pauses are relative. Detail views and the Approvals panel's request
 block put labels at column 0 and values one column past the longest label; a
 list puts `- ` before each item, and every other line of a value (its own
@@ -3231,7 +3264,14 @@ later turn; a running turn retains its capture decision and is never stopped.
 
 The console's sixth Settings tab reads the same registry as the dashboard. It edits
 through the authenticated daemon client: value, preview, nonempty bounded reason,
-then explicit y; undo also previews and confirms. Stale preview replies cannot arm a
+then explicit y; undo also previews and confirms. In the Peers tab, `w` enters
+this same editor in place on Peers for `tasks.wip_limits.<peer>`, prefilled
+with the selected peer's current limit. Bounds (currently 0..32), the `raises` risk label and
+`applies: live` come from the setting definition. A missing `taskWip` entry
+produces a notice and opens no edit. Esc cancels without a write; `6`, then
+`u` invokes the existing Settings undo preview/confirmation operation. The shortcut creates no
+write path or authority: Settings remain person-only and `ahub settings` keeps
+its agent-shell refusal. Stale preview replies cannot arm a
 write, and pasted confirmation text never executes one. The daemon accepts additive
 settings_reload and undo-preview requests only from console roles. The dashboard's
 setting_reload action uses its existing authenticated session; manager forwarding
@@ -3453,9 +3493,9 @@ load daemon config or infer executable commands from environment text.
 the host still performs each probe, while definitions validate or display it.
 `cli.authority` and `cli.personOnlyFlags` can only restrict existing authority;
 identity.ts stays authoritative and missing/unknown metadata retains today's
-rule. `start.passthrough` is data only. The MCP hook is a pure plan over the
-existing project/state/server-entrypoint/form tuple; every write, ordering fence
-and finally cleanup remains in the CLI host.
+rule. `start.passthrough` is data only. MCP installation, ordering fences and
+finally cleanup remain in the existing CLI host; A2b removes the unconsumed
+`init.mcpPlan` sketch instead of advertising another installation path.
 
 ### A2 internal native host projections (2026-10-18)
 
@@ -3618,6 +3658,70 @@ import/reexport bindings through lexical symbols before classifying comparisons.
 Shadowed and unrelated bindings remain independent; named non-peer enum exceptions
 keep their exact scope. It performs no filesystem or package lookup.
 
+### A2b consumed contracts and conformance (2026-10-21, #451, #625 phases 2-3)
+
+Runtime `start.launch` is optional and supplies only real native argv planners.
+Kimi, Pi, local, Jcode and fresh-review children use verified host startup ports,
+not unused CLI-wrapper plans. The frozen A1 export retains its old compatibility
+shape under a separate legacy type and is never selected by runtime consumers.
+Remove unused `start.ownsTerminal`, `init`, `QuotaReader.resetOnWindow` and hooks
+`agentIdentity`, `onAttach`, `onDetach`, `conversationRevert`, `replaceSession`.
+Actual terminal ownership, identity, revert, replacement and MCP writes retain
+their existing transport/host paths. The consumed native facts hook remains.
+Remove unconsumed runtime `permission.modes` and `permission.readOnly`; native mode
+mappings, host approval gates and fresh-review isolation receipts remain
+unchanged and authoritative. Missing metadata never grants permission.
+
+`attach.externalHello` explicitly admits an authenticated external process.
+`instances.mode` separately selects external or headless declaration policy,
+with an optional fixed role ceiling. MCP configuration shape grants neither.
+Claude keeps human-owned external planner/reviewer instances and its fresh
+headless reviewer exception; agy now refuses ordinary extra instances at config load (older declarations could load as inert pull-only extras).
+Qwen context is now unknown because it has no verified occupancy source; it no
+longer borrows Kimi's context parser.
+Declaration admission never proves execution-root ownership or isolation.
+
+Daemon normalization dispatches through the resolved definition's `budget.reader`
+and `budget.context`. Preserve source timestamps and current session, launch,
+generation and privacy fences. Missing readers stay unknown, including ACP kinds
+without a verified occupancy source; never borrow another kind's parser or
+manufacture empty quota readings or zero occupancy.
+
+The fixed-builtin restrictions above remain ceilings: `acpCommand` selects the
+Kimi-specific host startup path; `attach.admission` consumes its native TUI launch
+receipt; `resetSoftTokensOnResume` resets host-owned soft accounting;
+`crashIdentity` validates released native recovery records; `pi-rpc` owns the
+verified relay, sandbox and process-monitor lifecycle. Configured definitions
+cannot opt into these host-global assumptions. Their upgrade path is typed,
+kind-neutral host ports before external loading, not removal of scope guards.
+
+Registry coherence validates base and reviewer-variant attach, factory and reader
+structure without invoking a reader or performing I/O. Conformance enumerates
+every definition and variant with distinct enrollment or an unsupported reason
+naming dedicated coverage. Driven fixtures use `definition.start.create`; Claude
+uses its real external channel. Jcode exercises its owned-ACP watchdog and Kimi
+separately exercises TUI pull-only queue behavior. Unsupported native permission
+or quota legs never imply readiness.
+
+The AST guard additionally checks native defaults, source-proven peer/kind call
+arguments, exact native regexes, startsWith/includes/hasOwn predicates (including
+constant bracket spellings), and adapter-origin native instanceof dispatch.
+Aliases and shadowing remain source-bound; generic hub classes, dynamic keys and
+prose are not native identity policy. Keep the frozen core baseline empty and
+existing seed entries unchanged except the reviewed search/replacement-only
+reanchors of `roster-detached-pi-recovery` and `kimi-watch-live-owner` from
+instanceof to the equivalent native predicates. Their identity and named tests
+stay unchanged, with green-to-named-assertion proof through the seed runner. Add a
+registry START_MODE_PEERS membership mutation seed.
+Native type predicates and the external channel implementation live in adapters;
+authentication and lifecycle authority remain in the daemon. Stable hub leaf
+exports preserve source compatibility for native state readers.
+
+After unidentifiable Codex cancellation, status carries a fixed
+`unidentified-cancellation` notice while its existing offline latch holds. Late
+completion cannot clear it; verified native reattachment does. No native ids or
+provider text reach the notice.
+
 ## Amendment: playbook lifecycle and criteria checklist, 2026-10-18 (#481 S0/S8)
 
 - The AI-Native SDLC Playbook supplies the built-in stage model of an enabled lifecycle: intent (Plan), spec (Design), plan and build (Build), test (Test), review, merge and release (Deploy), maintain (Maintain). `mode` advise or enforce without `stages` selects this list. Off (no file, or `mode = "off"`) keeps the seven #257 stages, so its config, receipts, `hub_sdlc_record` schema and status output stay byte for byte. An explicit #257 list still loads: off keeps it as written, and an enabled lifecycle keeps its order under canonical ids (spec, plan, build, review, test, merge, release). Any other list needs definitions.
@@ -3684,7 +3788,7 @@ ahub builds the review brief that the workspace gate used to take from `ocr dele
 
 ## Claude peer instances I3 amendment (#450)
 
-- A declared instance of a channel-plugin kind (Claude) is admitted when its declaration names `roles`, reviewer and/or planner only. `start_mode` and `worktree` are refused: the instance starts only from the person's terminal with `ahub claude --as <id>`, so the hub never starts, watches or owns writes for it, and it is neither startable nor reserved from external admission.
+- Superseded by A2b `instances.mode` and explicit role policy (MCP shape grants no instance admission): a declared instance of a channel-plugin kind (Claude) was admitted when its declaration names `roles`, reviewer and/or planner only. `start_mode` and `worktree` are refused: the instance starts only from the person's terminal with `ahub claude --as <id>`, so the hub never starts, watches or owns writes for it, and it is neither startable nor reserved from external admission.
 - The launcher sets the child's `AGENTHUB_PEER_ID` to the instance id; the channel plugin and the statusline tee already key on it. Launch, session and context state files stay `claude-launch.json`, `claude-session.json` and `claude-context.json` for the builtin and become `<base>.<id>.json` for an instance (`src/hub/claude-state.ts`). Account usage stays shared. The daemon's context and usage readers, the permission-launch check, the facts handler, terminal recovery (project root, no worktree), the upgrade blocker check and `ahub reset` read each instance's own files.
 - The Claude version probe stays on the builtin peer (ponytail: instances are reviewers started by hand); zero-turn detection reads each peer's own evidence, as below.
 - Status, which the console and dashboard read, lists each declared instance right after its kind. `ahub <kind> --as <id>` starts only an instance the running daemon bound at startup (status `activeInstances`); otherwise it asks for a restart or an upgrade before any effect.
@@ -3883,3 +3987,95 @@ The P1 host introduces additive `native_hook_launch` and `native_facts` control
 The collected T0 proves the plugin, hook codec and read transport, not a native prompt override. P1 therefore keeps all runtime modes unmanaged and refuses unattended/headless/resume selectors until those individual mappings are proved. The old daemon refuses the additive launch request rather than silently weakening hook identity. An actual project TUI launch requires a running daemon with this feature; source/fixture verification does not claim that live rollout.
 
 Version line (#589, owner decision 2026-10-20): agy updates itself, so the launcher accepts the 1.4.x line instead of exactly 1.4.2. 1.4.2 launches silently; another 1.4.x patch launches with one stderr warning naming the observed version and the 1.4.2 receipt; any other version, unparseable output or a failing `--version` is refused before a hub connection or plugin write. A T0 re-run on a newer patch is a separate follow-up.
+
+
+## Amendment: no-write owner advisories (#498)
+
+- A completed native owner turn on an accepted `in_progress` `implement` or `bulk_edit` task counts only when its snapshot diff is known empty, HEAD and shared local/remote branch refs (`refs/heads/*`, `refs/remotes/*`) are known unchanged, and it has no task-tool effect. `task_sweep.no_writes_turns` is a live nonnegative safe integer, default 2; 0 disables it independently of the disabled-by-default time sweep. A change, successful mutation (including accept with a plan), pending or uncertain mutation, or unknown capture breaks the streak. Read-only tools do not reset it. Owner/acceptance changes start a new generation. Counters are run-local; structured threshold stalls persist through the existing stall store and deduplicate notices per cause. The planner notice names the public task title and consecutive count.
+- Done remains advisory. For writing classes only, the review request adds the exact line `no writes recorded since acceptance` when there are no branch refs, review heads (`refs.commit`, `sdlc.head`, `sdlc.localHead`) or recorded PR, no owner touches for this task since the first acceptance after its current ownership boundary, and a proven empty diff from that acceptance snapshot to now. Canonical-root D2 evidence is unknown when recorded elsewhere hints or the current worktree scope cannot exclude work elsewhere. Re-acceptance to revise a plan preserves this D2 baseline and earlier touches; D1 still fences each turn against the latest acceptance. The host records the resulting boolean on the done history entry; models cannot supply it. Other classes are exempt. Existing privacy screening and review authority remain unchanged.
+- The first explicit acceptance/self-claim of the ownership span captures its baseline through the guarded host `ownerAccepted` callback; later re-acceptance cannot move it. An acceptance manufactured by done has no pre-work baseline and leaves D2 unknown; it adds no capture ahead of the existing review projection. Acceptance and done snapshots use the existing hardened snapshot machinery and shared 250 ms burst budget. Declared instances require their current execution adapter/root binding; canonical-checkout dirtiness cannot substitute for an instance's evidence. Unknown, disabled, private, missing/pruned or restart-lost captures never become empty evidence. Native writing-turn boundaries hash shared branch refs with one budgeted `for-each-ref` probe, without exposing names. HEAD or any shared branch-ref movement is progress, including commit-only turns in ignored worktrees. A canonical-root turn with recorded branch/commit, `.worktrees` paths or SDLC PR/head evidence remains unknown when its visible tree/refs are empty; a canonical tree cannot disprove work elsewhere. Even without recorded hints, negative canonical evidence additionally requires a bounded `git worktree list --porcelain -z` proof of a sole worktree at both boundaries and no ignored `.worktrees` directory. Uncommitted/detached work elsewhere therefore remains unknown before its first ref movement. The shadow repository compares its own private Git directory as the registered bare main-worktree path, preserving the same metadata validation and unknown-on-failure rules. Builtin-owner D1 is deliberately inert while `.worktrees` exists; the upgrade path is binding each owner to its actual execution worktree. Both probes cap output at 1 MiB and share the same snapshot deadline; no raw ref names or worktree paths escape. Check start/cancel, escalation and memory correction are task-tool effects alongside existing mutations; read-only check results are not. No snapshot is added during a private snapshot window; a PII notice, if trusted evidence is available, uses only `publicTitle`. Capturing private evidence and restoring acceptance baselines across daemon restarts remain outside this advisory.
+- Structured `no-writes` stalls feed the S9 grooming digest and status. S7 consumers receive additive `stalls.noWrites` and `stalls.doneWithoutWrites` counts from cost reporting over that report's existing bounded, public, repository/PR-scoped tasks; they are not a count of every board row. No model call, automatic reassignment, done gate or new write endpoint is added.
+
+## Amendment: config-only ACP adapters, A3 (#451, #486)
+
+A3 adds declarative ACP definitions. It does not add A4 module loading, executable
+callbacks or config-selected imports. `adapters.<kind>` is accepted only from a
+Git-confirmed untracked `.agenthub/config.local.json`; the entire declaration is
+machine-local authority, not just its command and arguments. A tracked local file
+or a shared `config.json` cannot introduce one. Validate plain own-data objects
+and bounded arrays before constructing definitions. Unknown fields, accessors,
+inherited authority and collisions with builtin or reserved identities refuse.
+
+Each declaration names `transport: "acp"`, `command`, optional `args`,
+`displayName` and `roles`, with optional `identity: { name, version }`,
+`permission` (hub-mode to native-mode mapping) and `readOnly` (native mode id).
+Adapter role defaults cannot appoint a conductor; a person can still select one through explicit project role policy and its existing authority checks. Other kind-meaning capabilities remain builtin-only. A project captures one
+immutable catalog at startup; declared kinds and their explicitly declared
+instances resolve through that catalog, never a mutable global registry. Adapter
+changes, including removal and their derived defaults, require a restart.
+
+Configured kinds are optional, cloud and headless-only, off roster by default.
+They do not change default routing or inherit another kind's identity, quota,
+context parser or privileged capability. A configured kind may join the roster
+through the existing person-controlled path. Roles, exact nominations and
+reservations, family independence, instance execution-root admission and PII
+refusal use the same host routing rules as builtin definitions. Kind preferences
+may expand to declared instances; an explicit instance or canonical id remains
+exact. Absence of a permission map means unmanaged native policy. Absence of a
+budget block exempts the registered kind from quota accounting; it is not a zero
+reading, while unknown external ids retain existing manual accounting.
+
+The identity pin is optional in the declaration schema so an unverified adapter
+can be described, but a start without it refuses before a prompt. Initialize must
+return the pinned agentInfo name and version. A resumed `session/load` must echo
+the requested sessionId; a missing or different echo refuses before a prompt.
+No implicit fresh-session fallback repairs an identity failure. Explicit session selectors must be nonblank, bounded and control-free. A configured start in progress refuses another start rather than joining its result; an attached peer accepts an already-running result only for the same requested native session (or no selector). Config argv that
+selects a leader or attaches to another native process is refused at load.
+
+Owned-process admission has a deliberately bounded proof. The pinned native
+foreground contract must be supported by a T0 receipt; the spawned pid, original
+process group and process signature must have positive current evidence before
+admission and before stop. Unknown ownership refuses. Stop signals only that
+original verified owned group, never a pre-existing leader or any process outside
+it. ACP provides no generic kernel-bound responder attestation, and A3 adds no
+protocol extension pretending to provide one. A native agent that delegates its
+responses to an unowned process is unsupported by this boundary.
+
+The Grok proof target is the config-only `grok agent stdio` command, with no
+leader or attach flags and with explicit `--no-leader`. Config load refuses a Grok kind, Grok executable or Grok native-identity pin without that standalone opt-out before argv termination; valued forms such as `--no-leader=false` also refuse. Native `--leader` and `--leader-socket` remain refused even alongside the opt-out. This is necessary because the native default inherits `[cli] use_leader` from ambient config. Its T0 must record that default and run under isolated HOME and Grok home in a
+scratch project, preserve the person's config bytes, record the pinned build's
+process tree, and inspect sockets/IPC while a prompt runs for links to processes
+outside the owned group. It must separately record initialize identity, load echo,
+native mode support or absence, usage unknowns and an actual hub tool receipt.
+If in-process service and the no-external-IPC boundary cannot be established,
+Grok remains explicitly unsupported; the generic ACP path may still ship with a
+fake ACP transport receipt. This amendment describes the implementation contract,
+not completed Grok live verification. Fixture results are not a native T0 receipt.
+
+The optional definition `readOnly` capability names a native mode; it does not
+select that mode for every instance. An instance selects it explicitly with
+`readOnly: true`. Admission requires the native mode to be advertised and its
+selection acknowledged before a prompt, plus the host's read-only kind/tool gate
+and MCP mutation refusal. The selection is non-raisable: runtime and stored
+permission changes cannot lift it. A missing mode, failed acknowledgement or
+unknown policy refuses rather than falling back to an ordinary permission mode.
+Mapped ordinary modes likewise require advertised native support and an
+acknowledged selection; no map remains unmanaged and grants no hub sandbox claim.
+
+Configured ACP crash resume reads only a bounded, control-free session id and requires exact session/load echo; it never imports a model override from old launch metadata. Controlled recovery remains explicitly refused for configured ACP because no terminal/recovery driver has been verified. Recovery source and target capability checks require `configured_acp` before reinterpreting configured identities or taking recovery effects. The initial Grok 1.0.62 isolated receipt found no initialize agentInfo and a refused session/new, so it does not establish native readiness; see `docs/verification/2026-10-21-grok-config-acp-t0.md`.
+
+MCP publication appends project start targets only from authenticated daemon catalog metadata, preserving the builtin default enum. Read-only instances publish only the R2 read/review tool set; every mutation remains independently refused at the host boundary. Incomplete catalog metadata withholds configured start targets. If active lifecycle metadata is unavailable, tool discovery may retain the ordinary list until current status arrives; the host still independently refuses read-only mutations, and discovery never grants authority. A malformed generic session/new identity refuses before admission, and failed spawns are released only on positive no-process/empty-group evidence.
+
+Task/conductor MCP refusals retain their existing error text and also set the optional `isError: true` result flag, so SDK consumers observe an unsuccessful tool call instead of an ordinary text result.
+
+Configured ACP permission requests never use hub-tool titles for automatic approval. Requests use the ordinary person approval path unless the explicit permission-mode policy authorizes them, even when a title spells a known hub tool; builtin Kimi/Qwen title handling stays confined to those verified contracts. Owned-group identity across exec is the live child plus PID, parent, process group and start time; command/comm changes are evidence, not a new owner. Group teardown deliberately freezes, re-verifies and kills the original group; unreadable re-verification sends no further signal and retains the owner for an explicit retry.
+
+## Adding an AI tool guide and adapter definitions (#451 A5)
+
+- Human-oriented guide `docs/adding-an-ai-tool.md` documents today's builtin Adapter API 1 path (`AdapterDefinition` in `src/adapters/registry-types.ts` and `src/adapters/registry.ts`), covering:
+  - Architecture and core independence: one frozen definition per kind; the core daemon, tasks, and routing inspect definition fields rather than hard-coded vendor name comparisons.
+  - Transport selection: `acp` (stdio JSON-RPC), `codex-appserver`, `claude-channel`, `ws-pull` (pull-only workspace MCP plugin), and `hub-native`.
+  - Conformance kit (`test/conformance/`): enrollment invariants, delivery occupancy, watchdog expiry, process-group teardown, and explicit reasons in `UNSUPPORTED` (per kind) and `UNSUPPORTED_LEGS` (per ACP leg).
+  - Review and verification checklist: T0 receipt, path protection (`AGENT_CONFIG_SEGMENTS`), PII safety (`trust.onPrem`), process isolation, and documentation freshness.
+  - Config-only generic ACP adapters (#451 A3, board task #217) follow the A3 amendment above, including its isolated native-proof boundary. External adapter modules (#451 A4, board task #135) remain planned; their hash-pinning and module trust rules land with A4.
+- `docs/agent-notes/adapters.md` keeps only the per-adapter rules that bind code, pointing to `docs/adding-an-ai-tool.md` and `src/adapters/registry-types.ts` for conceptual architecture and definitions.

package/docs/verification/2026-10-21-0.12.43.md

@@ -0,0 +1,50 @@
+# 0.12.43 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or a live TUI launch.
+
+## Candidate
+
+Version 0.12.43, control protocol 16 (unchanged; no control message added), from merged main. The person directed on 2026-10-21 to finish the open PRs, merge and ship.
+
+- Hot paths under HEAD movement (#576, PR #608): snapshot Git calls in one burst share a 250 ms budget, an exhausted or failed boundary is unknown, concurrent-edit notices go once per affected task, and HEAD moves are classified from the HEAD reflog so incoming checkouts, merges and fast-forwards are excluded while a peer's own commits, amends, rebase replays and cherry-picks stay attributed. Scratch burst: `status` 21.3 s -> 0.27 s, false conflicts 144 -> 0, CPU 13 s -> 0.37 s.
+- Restore mapping retry (#599, PR #600), named-owner refusal (#601, PR #602), `ahub completion` (#603, PR #604), agy read facts for 1.4.2 and 1.4.3 (#555, PR #605), agy 1.4.3 T0 receipt with 1.4.3 kept unverified (#267, PR #606), console Peers WIP column and `w` (PR #615) and the Tasks backlog view and row actions (PR #620) (#532), manager open stops a losing spawn (#584, PR #614).
+- Contributor gate: per-PR CI concurrency groups and `scripts/check.sh --changed` with a pinned test environment (#609, #610, PR #611); two timing-dependent tests fixed (#617, #618, PR #619); live PII screen calibration recorded (#198, PRs #613 and #616).
+- Still open: the agy TUI first-turn tools gap (#607), the #612 attribution-cost follow-ups, #428 (a facts test that fails in a full Linux container run), and every live leg listed in [the 0.12.40 record](2026-10-20-0.12.40.md).
+
+## Reviews
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #600 (#599) | 729ec0b6 | Reviewer read of both paths; terminal-recovery tests 27/0 run by the reviewer. codex-connector: no findings | exact head, success |
+| #602 (#601) | da3cf17b | Author self-review plus two codex-connector findings (self-claim note, enforce-mode refusal) fixed and answered | exact head, success |
+| #604 (#603) | 40795529 | Three codex-connector findings (fish empty word, placeholder values, positional subcommands) fixed and answered; live fish and bash checks | exact head, success |
+| #605 (#555) | b07e7f02 | Reviewer read; changes requested once for agy 1.4.3 `read_file`; connector P1 on ranged reads answered; agy tests 16/0 | exact head, success |
+| #606 (#267) | 2ddcc915 | Reviewer read of the receipt; reference fix requested and applied | exact head, success |
+| #608 (#576) | 4e6adb6e | Three review rounds, each with an independent read-only reviewer probing real git 2.56 reflog forms; R3 no Important finding; follow-ups in #612 | exact head, success |
+| #611 (#609, #610) | 9af81d4b | Author review; first head was an invalid workflow (`queue: max` with `cancel-in-progress`), fixed; two connector findings on `--changed` fixed | exact head, success |
+| #613 (#198) | 994d02cc | Docs only. A connector thread on the mutable model alias was answered after merge and fixed in #616 | exact head, success |
+| #614 (#584) | b330ad32 | Reviewer codex approved; merger read the manager change | exact head, success |
+| #615 (#532) | 0fb5c8c8 | Reviewer read; one change request (declared-instance WIP keys) fixed; `--changed` 463/0 and a full Linux exact-commit gate green except #428 | exact head, success (one rerun of the #618 flake) |
+| #616 (#198) | 200adb70 | Served-model recording; connector finding on the probe cache fixed and answered | exact head, success |
+| #620 (#532) | 42272f93 | Reviewer read: row actions bound to id and planning/flow revision, rechecked at Enter and y, no new write path; 37 new tests. codex-connector: no findings | exact head, success |
+| #619 (#617, #618) | 534d9ebf | Reviewer read; macOS 20/20 and 100/100 reruns by the author | exact head, success |
+
+## Document review
+
+Thirteen documents were stale against the 0.12.42 stamps. Each was checked against `git log <stamp>..HEAD` over its paths by a read-only reviewer per group, and the edits were applied on the release branch. All thirteen are restamped to the release branch commit `53743efd`, which includes #616 and #620.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.12.43; agy read facts and 1.4.3 second-turn tools; console WIP limits; verification link. |
+| `docs/quickstart.md` | corrected | Install pin `v0.12.43`; "Upgrading to 0.12.43"; plugin restart names 0.12.43; agy 1.4.3 second-turn note. |
+| `docs/operations.md` | corrected | Version line, protocol 16 range, upgrade commands; restore mapping re-read (#599); unknown turn boundaries and reflog HEAD-move rules (#576); named-owner refusal (#601); agy read facts and 1.4.3 receipt (#555, #267); per-PR CI groups and `--changed` (#609, #610); per-instance WIP keys (#532). |
+| `docs/security.md` | corrected | Snapshot budget (250 ms per burst, 10 s per call, unknown on exhaustion) (#576); a losing manager open stops its spawn (#584). |
+| `src/cli/help.ts` | corrected | `task assign` says a peer that cannot take the task is refused with the reason (#601); `ahub completion` already listed; no other command, subcommand or flag changed. |
+| `docs/agent-notes/daemon.md` | corrected | Settings editor bound to its opening panel incl. the Peers `w` shortcut (#532); console backlog row actions bound to id and revision (#532, PR #620); restore mapping re-read (#599); `openManager` keeps only the answering manager (#584). |
+| `docs/agent-notes/adapters.md` | corrected | agy read decoding and Pre/PostToolUse facts (#555). |
+| `docs/agent-notes/tests.md` | corrected | Captures yield an I/O turn when a test is not about the snapshot budget (#617). |
+| `docs/agent-notes/README.md`, `benchmarks.md`, `budget.md`, `bus.md`, `tasks.md` | no change | Rules checked against the diffs (#601 and #608 rules already added in their PRs); no contradiction. |
+
+## Release mechanics
+
+Merge the release PR with a merge commit (the stamps name release-branch commits), run `node scripts/check-docs.mjs --require-fresh` on the merged main, then tag `v0.12.43`.

package/docs/verification/2026-10-21-0.12.44.md

@@ -0,0 +1,54 @@
+# 0.12.44 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or a live TUI launch.
+
+## Candidate
+
+Version 0.12.44, control protocol 16 (unchanged), from merged main. The person directed on 2026-10-21 to finish the work in progress and release it.
+
+- Config-only ACP adapters (#451 A3, PR #638): `adapters.<kind>` in an untracked `.agenthub/config.local.json` declares a headless, off-roster ACP kind with a pinned native identity, a strict `session/load` echo, owned process-group proof at start and stop, no title-based auto-approval, a required project catalog on every instance and roster resolver, and an explicit `--no-leader` for Grok. Grok 1.0.62 itself stays unsupported (no `initialize` agentInfo; T0 receipt in `2026-10-21-grok-config-acp-t0.md`). The CLI no longer stops `permission` and `settings` on an unreadable local config, and `settings undo` resolves configured keys (PR #642).
+- Adapter definitions are the dispatch point for quota and context readers, admission and instance policy, with registry-driven conformance enrollment and a widened vendor-literal guard (#451 A2b, PRs #630 and #631); the "Adding an AI tool" guide (PR #633).
+- agy no longer reads Claude's state files (#624, PR #627); the agy first-turn tools gap is documented and the init block updated (#607, PR #623).
+- No-write owner advisories (#498, PRs #626 and #629), the headless watch pane (#286 AC10, PR #628), the Kimi admission release on an invalid `kimi_cmd` (#549, PR #622), the recovery lease log nits (#479, PR #632), the injected memory store alias (#237 follow-up, PR #640), and two macOS-only test flakes (#634, PR #639).
+- Still open: #558 (a checks-runner test that fails on hosted macOS after an earlier `upstream reset`), the #230 S10 rulings and their implementation (spec PR #641, PRs #643 and #644, merged after this release), #612, and every live leg listed in [the 0.12.40 record](2026-10-20-0.12.40.md).
+
+## Reviews
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #622 (#549) | 356db622 | Board review before this release window (details in the PR) | exact head, success |
+| #623 (#607) | 71ac68e9 | Author change; connector finding (profile templates) fixed and answered | exact head, success |
+| #626 (#498) | 661183cc | Two rounds with independent read-only reviewers; R0 false-stall finding fixed; follow-ups in #279 | exact head, success |
+| #627 (#624) | 44543a7e | OCR delegation review (no Important finding); two red-first daemon tests reproduce the field symptom | exact head, success |
+| #628 (#286) | a0478105 | Reviewer read: fixed argv, no caller text, provider failure never fails the start | exact head, success |
+| #629 (#498) | 507a4be2 | Reviewer read and affected tests 121/0; connector finding (case-insensitive `.worktrees` hint) fixed | exact head, success |
+| #630 (#451) | b0be266f | Two independent read-only reviews (runtime; tests and guard) and 356 affected tests run by the reviewer; follow-ups in #280 | exact head, success |
+| #631 (#451) | 5011c25d | Reviewer read and 525 affected tests; one macOS rerun of the #558 flake | exact head, success |
+| #632 (#479) | 721c6514 | Reviewer read and 340 affected tests; one macOS rerun of the #558 flake | exact head, success |
+| #633 (#451 A5) | 809b5264 | Two rounds: sections describing unshipped A3/A4 turned into planned notes; connector findings fixed | exact head, success |
+| #638 (#451 A3) | d1d06f58 | Two rounds with independent trust-boundary and runtime reviews; title auto-approval, roster removal, optional-catalog fallback and exec ownership fixed; a surviving seed fixed (#283); a connector finding (empty permission map) fixed | exact head, success |
+| #639 (#634) | 97feb6e0 | Reviewer read; connector finding (a gate that never opens) fixed | exact head, success |
+| #640 (#237) | 1c080d15 | Codex review; a connector P1 (stale injected-store shard) fixed and re-read by the merger | exact head, success |
+| #642 (#638 follow-up) | see release PR | Independent read-only review; its findings applied | exact head, success |
+
+## Document review
+
+Fourteen documents were stale against the 0.12.43 stamps. Each was checked against `git log <stamp>..HEAD` over its paths by read-only reviewers, in three passes (user docs, area notes, and the #638/#640 delta), and the edits were applied on the release branch. All fourteen are restamped to the release branch commit `e185b9e6`, which includes #642, and the notes' stamp paths gained the new sources they describe.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.12.44; watch pane, no-write advisories, agy extra-instance refusal and config-only ACP adapters in the 0.12.44 summary; verification link. |
+| `docs/quickstart.md` | corrected | Install pin `v0.12.44`; "Upgrading to 0.12.44" (init refresh, agy fix, watch pane, no-write notice, config-only ACP, `configured_acp` upgrade floor, stricter `peers.<id>`); plugin restart wording. |
+| `docs/operations.md` | corrected | New "Configured ACP adapters" operator section; automatic watch pane; Qwen context unknown; agy extra-instance refusal. |
+| `docs/security.md` | corrected | Watch pane under the fixed-words rule; configured ACP trust boundary; no title auto-approval for configured kinds; agy extra-instance refusal. |
+| `src/cli/help.ts` | no change | The configured-kind usage row matches the CLI parser; no other command, subcommand or flag changed. |
+| `docs/agent-notes/adapters.md` | corrected | Configured-kind roles, error withholding and CLI flags; no title auto-approval and the read-only kind filter; `AcpOwnedGroup` stop rules. |
+| `docs/agent-notes/daemon.md` | corrected | `configured_acp` recovery floor; project adapter catalog binding and locked rows; configured ACP start rules; injected-store memory alias. |
+| `docs/agent-notes/tasks.md` | corrected | Project catalog resolution; hub tool publication never authority; `no-writes.ts` in scope. |
+| `docs/agent-notes/budget.md` | corrected | Declared reader dispatch; `Budget.report` resolves through the project catalog. |
+| `docs/agent-notes/tests.md` | corrected | Conformance enrollment maps; gated fake actions; owned-group test ports. |
+| `docs/agent-notes/README.md`, `benchmarks.md`, `bus.md`, `local-worker.md` | no change | Rules checked against the diffs; no contradiction. |
+
+## Release mechanics
+
+Merge the release PR with a merge commit (the stamps name release-branch commits), run `node scripts/check-docs.mjs --require-fresh` on the merged main, then tag `v0.12.44`.

package/docs/verification/2026-10-21-agy-1.4.3-t0.md

@@ -0,0 +1,65 @@
+# Antigravity 1.4.3 T0 re-run (#267)
+
+Status: the 1.4.2 P1 T0 receipt ([2026-10-19-agy-p1-t0.md](2026-10-19-agy-p1-t0.md)) was re-run on 2026-10-21 against `agy 1.4.3`. **1.4.3 is not marked verified.** Most observations match, but the native tool names and the model-facing `call_mcp_tool` schema changed, the unmodified 1.4.2 probes no longer reach the hub, and in the interactive TUI the plugin MCP server is attached lazily on the first prompt, so the first model turn has no hub tools. No code changed. The live TUI leg was done separately in #268 (see below).
+
+## Environment and isolation
+
+- Observed CLI version: `agy 1.4.3`.
+- Executable SHA-256: `836c446f6118140e86679ec6966a785eeedbf56b3711a8eb1f41947483e9802a` (the person's `~/.local/bin/agy`, unchanged before and after).
+- Bun 1.4.3 ran the probes. The 1.4.2 receipt used Bun 1.4.2, so the plugin MCP server and hook scripts also ran on a newer Bun. This is a second variable, not separated from the agy change.
+- Probe scripts are copies of the 1.4.2 scripts (`actual-hub.ts`, `native-hooks.ts`, `workspace-plugin*.ts`), re-pointed at a clean worktree of main. The originals were not edited. Adapted variants (below) are separate copies.
+- Same isolation as the receipt: a new temporary HOME with its own `.gemini`, workspace and temporary directory per run, an explicit environment, the Seatbelt profile from `src/local/sandbox.ts` denying the person's home except the executable, and a loopback Gemini protocol fixture. No real account or cloud model call is part of this receipt. The scratch hub had memory, inference, snapshots and auto-start disabled and explicit agy roster admission.
+- SHA-256 of the person's Gemini CLI files (`antigravity-cli/settings.json`, `config/config.json`, `config/hooks.json`, `config/mcp_config.json`, `config/skills.json`, legacy `settings.json`) taken before the first run and after the last run are equal. The probes' own before/after hash (a subset) was equal on every completed run. The project's `.agents/` directory was not written; owned process groups were stopped and temporary roots removed.
+- A first pass ran the unmodified `actual-hub.ts` with the agent scratch directory (under the person's home) as the temporary directory. It loaded no plugin hooks and made no MCP call. That run is not execution evidence and is not used below. All receipt runs use the per-user temporary directory, as the 1.4.2 run did.
+- Real-HOME contact: the agent ran `agy --version` and `agy --help` (print and exit, no session, no plugin load) under the person's real HOME at about 03:49 and 04:01 KST before switching to a fresh HOME for every other call. The person's `~/.gemini/antigravity-cli/log/` has a `/usage` print-mode run from cwd `/` at 04:01:38 KST (`cli-20261021_040138.log`). It is one of a file series at a five minute cadence (`:01:38`, `:56:38`, `:51:38`, `:41:38` and so on), started by something outside these probes, none of which was a probe call: the probes only started agy with a temporary HOME and `--log-file` in a temporary directory.
+- Raw bounded receipts and scripts remain in the local scratch workspace; they are not public artifacts.
+
+## Per-item comparison with 1.4.2
+
+| Item | 1.4.3 observation | vs 1.4.2 |
+| --- | --- | --- |
+| `--version` | prints `1.4.3`, exit 0 | same (new number) |
+| `--help` flags | still advertises `--conversation`, `--continue`, `--dangerously-skip-permissions`, `--mode`, `--new-project`, `--input-format`/`--output-format` stream JSON; no `--new` | same for every listed flag. A full diff is not possible: the 1.4.2 binary is not retained |
+| `--acp` refusal | exit 2, `flags provided but not defined: -acp`; no ACP subcommand in the list | same. Refusal of the tested flag only, as before |
+| `--new` | exit 2, undefined flag | same |
+| Workspace plugin discovery | `.agents/plugins/agent-hub/` is loaded without install or global write; server name `agent-hub_agent-hub`; the unprefixed name still fails with `tool ... is not enabled for server agent-hub`; `agy mcp list` still prints `No MCP servers configured.` | same |
+| Plugin-local `hooks.json` | the six hooks run from `.agents/plugins/agent-hub/hooks.json` | same |
+| Hook stdin shared fields | `conversationId`, `workspacePaths`, `transcriptPath`, `artifactDirectoryPath`, `modelName`; transcript `transcript_full.jsonl` | same |
+| `PreInvocation`/`PostInvocation` fields | adds `initialNumSteps`, `invocationNum` | same |
+| Tool hook stdin | `toolCall: { name, args }`, `stepIdx`; `PostToolUse` has empty `error` on success; tool hooks still need `matcher: ".*"` with a nested `hooks` array | same shape |
+| Native read tool in the tool hook | `read_file` with `Path`, `StartLine`, `EndLine` | **changed** (1.4.2: `view_file` with `AbsolutePath`) |
+| `injectSteps` | `SessionStart` and `PreInvocation` `ephemeralMessage` accepted and shown to the model | same |
+| Pre-tool `{ "decision": "allow" }` | accepted for the tested calls | same (still no override proof) |
+| `Stop` fields | `executionNum`, `terminationReason` (`NO_TOOL_CALL`), `error`, `fullyIdle` | same |
+| `call_mcp_tool` arguments | `ServerName`, `ToolName`, `Arguments` only. `toolSummary` and `toolAction` are now rejected: `additional properties 'toolAction', 'toolSummary' not allowed` | **changed** (1.4.2 required both) |
+| Model-facing tool declarations | 15 tools: `read_file`, `write_file`, `edit_file`, `search_web` replace `view_file`, `write_to_file`, `replace_file_content`, `read_url_content`. A call to `view_file` fails with `unknown tool` although the stream-JSON `init` event still lists 60 tools including `view_file` | **changed** (1.4.2: 16 tools) |
+| `init` event | 60 tools, `permission_mode: request-review`; no name added or removed | same |
+| Unmodified 1.4.2 probes | every call that used `toolSummary`/`toolAction` or `view_file` is rejected before execution. `native-hooks.ts`: no `PreToolUse`/`PostToolUse` rows, no `tools/call` at the fixture MCP. `actual-hub.ts`: the single `hub_inbox` call is rejected, nonce not seen by the provider | **changed** |
+| Actual scratch-hub `hub_inbox` with nonce, probes adapted to the 1.4.3 schema | exit 0, empty stderr, `hub_inbox` called once through the shipped bundle and the workspace plugin, the random nonce held only in the scratch bus preface appeared in the following fixture-provider request, all six hooks ran from the plugin-local file, native output SHA-256 `f1970aa687f0661c23e0f84924f2ff603d5f1c9edf9f718cc5e435448c862f3c` | same outcome, but only after fixture adaptation |
+
+Adaptation used for the passing 1.4.3 runs: drop `toolSummary` and `toolAction` from `call_mcp_tool` arguments, and use `read_file` with `Path` for the native read. Nothing else was changed in the fixtures.
+
+## Late plugin MCP start: print mode versus the interactive TUI
+
+The task owner saw hub tools missing on an early first turn of the person's own `ahub agy` TUI on 1.4.3 and present about ten minutes later in the same process. The isolated runs reproduce that as a startup-order effect, not a permanent failure. Times are seconds after spawn, taken from fixture timestamps (provider requests and the MCP fixture log), same Seatbelt profile and plugin files, fresh HOME each run:
+
+- **Print mode (`-p`)**: the plugin MCP server is started during the first turn. The first provider request is the title generation (0 tools). The first agent request already carries 15 tools including `call_mcp_tool`, `list_resources` and `read_resource`, and the tool call succeeds.
+- **Interactive TUI**: the plugin MCP server is not started at launch and not during the onboarding or idle time. In four runs (30 s, 13 s, 3 s and 3 s of idle after the trust prompt) it was started only when the first prompt was submitted: `server/discover`, `initialize` and `tools/list` ran in the same second as the first prompt. The first agent request after that prompt carried 12 tools and no `call_mcp_tool`. The next agent request carried 15 tools including `call_mcp_tool`, and every later request kept them. In the runs that sent prompts in quick succession that next request came 0.4 s to 1.7 s after the first prompt. A single-prompt run never made a second agent request, so whether the attach is driven by elapsed time or by the next request cannot be separated at this resolution. Waiting longer before the first prompt did not change the first request (30 s idle: still 12 tools).
+- Consequence: on 1.4.3 the TUI attaches the plugin MCP server lazily on the first prompt, and the first model turn has no hub tools. A prompt that needs a hub tool on that turn fails. The tools are available from the following turn. The roughly ten minute delay seen in the person's session is longer than anything measured here and is not explained (the person's HOME also loads a global MCP server and global hooks, which the isolated HOME does not). In the isolated runs a second prompt had the tools within two seconds.
+- Plugin hooks fire in the TUI from `SessionStart`, including `PreToolUse` and `PostToolUse` for the MCP call.
+- The agy log prints `hooks_manager ... loaded 0 named hooks from 0 hooks.json file(s)` in both modes while the plugin hooks run, and print mode adds a line for the plugin file. The line is not a reliable signal of plugin hook loading.
+- A fresh HOME makes the TUI stop at onboarding (theme, terms, workspace trust). The runs answered those with key presses (Enter, Down, Right, Enter, Enter).
+- **Not established: whether 1.4.2 behaved the same.** The 1.4.2 receipt never observed the TUI and no 1.4.2 binary is retained anywhere on this machine, so time-to-tools cannot be measured there. This is a 1.4.3 mode difference, not a proven 1.4.2 to 1.4.3 regression.
+
+## Consequences
+
+- `agyVersionGate` is not changed: 1.4.3 keeps the one-line stderr warning and is not added to the verified set.
+- `src/adapters/agy/hooks.ts` classifies a native read only when `toolCall.name === "view_file"` and `args.AbsolutePath` is a string. On 1.4.3 the native read is `read_file` with `Path`, so the decoder passes the call through as an unclassified tool and no `Read` fact is attributed. This is a follow-up for a separate task. It was not changed here because the task forbids code changes when anything differs.
+- Any hub-side prompt or fixture that tells the model to call `call_mcp_tool` with `toolSummary`/`toolAction` is invalid on 1.4.3.
+- The launcher's plugin namespace assumption (`agent-hub_agent-hub`) still holds.
+- Do not rely on `hub_*` tools on the first TUI turn of a 1.4.3 session. A launcher or preface that needs the hub on turn one has to wait for the second turn (or the person submits any first prompt). The live TUI leg (#268, agy's own TUI on hub 0.12.42 and agy 1.4.3, which superseded the cancelled #251) passed `hub_inbox`, 42 hub tools, a `hub_send` round trip and a board read from the second turn on, and also had no hub tools on its first turn, as the timing above explains. The close-cleanup check is still open.
+
+## Unchanged limits
+
+- Permission prompt mappings, `allow` versus native approval prompts, Stop continuation and post-invocation termination overrides remain unverified. Keep the peer unmanaged.
+- Not a sandbox claim for the proposed agy peer. Documentation alone is not native proof.

package/docs/verification/2026-10-21-grok-config-acp-t0.md

@@ -0,0 +1,30 @@
+# Grok config-only ACP T0, 2026-10-21
+
+This receipt separates the generic ACP implementation from native Grok readiness. It does not establish #486 AC1-AC6 or #451 AC3 as complete.
+
+## Observed native build and isolation
+
+- Local native binary reports `grok 1.0.62 (1474f9cbdd91)`.
+- Version, agent help and stdio help exited 0 under a temporary HOME, Grok home, XDG config/cache/data directories and project directory outside a Git repository.
+- The protocol probe used `grok agent --no-leader stdio`, with inherited agent markers removed and a probe-specific peer identity. The probe harness copied no personal config or credential files and wrote only to its isolated directories; no production hub was used. The exact native-file check below is bounded, and broader native credential state remains unverified.
+- The saved agent help states that the leader default is `[cli] use_leader` in `config.toml`, rather than a guaranteed foreground default; `--no-leader` forces a new agent. A plain `grok agent stdio` argv therefore does not itself establish foreground ownership in an ambient home. `--leader-socket` is also an attach selector. The config compiler therefore requires explicit standalone `--no-leader` for recognized Grok declarations before any process starts, and still refuses `--leader` and `--leader-socket`; isolated HOME alone is not substituted for the opt-out.
+- Before/after SHA-256 values of the exact real Grok `config.toml` and `version.json` matched. The additionally checked `config.json`, `settings.json` and `mcp.json` were absent before and after. This bounded check is not a claim about every native configuration path.
+
+## Protocol result
+
+- Initialize replied and advertised `loadSession: true`, image/audio prompt support false, embedded context true, HTTP/SSE MCP support and session list/resume/close capabilities.
+- Initialize did not provide `agentInfo`. The config-only adapter requires the observed native name/version pin to match initialize before creating a session or prompting. The native build therefore has no usable runtime identity pin under this contract.
+- The separate raw protocol probe attempted `session/new` in the isolated project with an empty MCP server list. It received an RPC error. Its raw error payload was neither logged nor published; the cause remains unclassified.
+- No model prompt or native MCP tool ran. Session/load echo, session/set_mode, usage/occupancy and a real hub-tool result are unverified. Advertising load or MCP support is not proof of those operations.
+- Because no prompt ran, no process-tree and socket/IPC observation while a prompt was active exists. The required no-detached-leader evidence is unverified.
+
+## Owned group and teardown
+
+- The runtime ownership helper positively verified the direct child, its original process group and shared process signature at start and immediately before teardown.
+- The first probe's teardown returned `unconfirmed`. A fresh process-table read after the probe exited showed no Grok process. This is not recorded as a confirmed stop receipt.
+- A post-SIGKILL defunct-row observation edge was fixed and covered by deterministic regression tests: after the last signal, wait for the original group to disappear within the bound, tolerating command/parent changes of a dying row while preserving PID/start/group identity. Pre-signal ownership checks remain strict, and no process outside the spawned group is signalled.
+- A second isolated probe with the same native build again lacked initialize identity and had session/new refused. With the corrected observation fence, start and pre-stop group checks passed, group disappearance was confirmed, and a separate fresh process-table read found no Grok process. The exact real-config hashes again matched. This confirms teardown for this refused attempt, not foreground behavior during a model prompt.
+
+## Readiness decision
+
+Grok remains unsupported by this receipt. The generic config-only ACP path is covered independently with the repository's fake ACP transport, including identity mismatch, load-echo refusal, owned-group checks, permission ACKs, read-only ceilings, task delivery and project isolation. Native Grok admission still needs a build with matching initialize identity plus successful isolated session creation, actual hub-tool execution, load-echo evidence and foreground tree/IPC proof during a prompt. No permission, quota, sandbox, planner or reviewer claim is inferred from these observations.

package/docs/verification/2026-10-21-pii-screen.md

@@ -0,0 +1,14 @@
+# PII screen calibration (issue #198), 2026-10-20
+
+- Screen: campus gateway, model coding
+- Served model (as the gateway reported it): qwen3.8-flash-next
+- Fixtures: 78 synthetic items (38 positives, 40 hard negatives), test/fixtures/pii-screen.json
+- Recall (pii labels only): 100.0%; bound 90.0%, fixed before measuring: met
+- Recall as handled (pii or unknown): 100.0%
+- Precision (pii labels): 100.0%
+- Unknown rate: 0.0%
+- Hard negatives held as PII (pii or unknown): 0.0%
+- Category agreement on true positives: 100.0%
+- Latency: p50 246 ms, p95 301 ms, max 869 ms
+- Missed positives: none
+- Negatives not cleared: none