@staix/agent-hub 0.12.44 → 0.12.45

package/docs/security.md

@@ -112,7 +112,7 @@ and flag. The current daemon emits `agent_cli` with `delegated: true` and
 `refused: false` for the negotiated outcome. Allowed-class commands retain the peer identity and capability checks, including
 messages, proposals and reviews. Peer starts, pause and resume may delegate
 operational console authority; task assign/escalate under the flag refuse. `--as-user`, person task labels,
-person-authored planning/release/memory/goal writes, SDLC record, benchmark run,
+person-authored planning/release/memory/goal writes, SDLC record, spec and plan-departure acceptance, benchmark run,
 `ahub recovery reattach`, a `--fresh-session` dispose that would replace a repaired
 session's conversation (or whose scope cannot be read), and the pet
 composer are refused; presentation flags such as `--color` or `--verbose` before
@@ -216,7 +216,8 @@ Claude, Codex and Kimi still follow their own file permissions and can edit a
 config file; such an edit changes participation only at the next hub start. A
 live settings write or undo applies its own roster key and does not adopt other
 file edits, and a configuration reload refuses roster changes. External ids outside the known native catalog keep their prior
-admission rules.
+admission rules. A roster key left by an undeclared instance loads as inert and grants
+nothing; the only change it accepts is its removal from `config.local.json`.
 
 Kimi's pull-only TUI owns its tool approvals and session. The person's launcher
 merges/removes only the hub MCP entry; the daemon never edits that file and
@@ -258,6 +259,8 @@ Antigravity (`agy`, #485) is optional, cloud and off roster by default. The laun
 
 Configured ACP adapters (#451 A3) are declared only by the person, in a Git-confirmed untracked `.agenthub/config.local.json`. The whole declaration (command, argv, identity, roles and mode maps) is machine-local authority: a shared or tracked declaration is ignored with a notice, settings never edit it, and changes need a hub restart. The hub runs only the declared argv, never a module or callback. Argv that selects a leader, attach, connect or remote mode is refused, and a Grok declaration needs `--no-leader`. Each start requires the pinned native identity, an exact `session/load` echo on resume, and positive ownership of the spawned process and its original process group; unknown ownership refuses, and stop signals only that verified group. An agent that hands its work to a process outside that group is outside this boundary. Without a mode map native policy is unmanaged, and there is no hub sandbox either way. Configured kinds are cloud peers (never PII), headless only and off roster by default, and the hub makes no quota, context or controlled-recovery claims for them. A read-only instance needs the native read-only mode acknowledged before a prompt and is limited to read and review hub tools, both in the published MCP list and at the host; its native non-read tool requests are rejected, and no setting or runtime change can raise it. These agents' stderr and error text are withheld from logs, and previews redact the executable, argv and session id.
 
+External adapter modules (#451 A4) are the one way to run adapter code that ships outside the hub, and the pin is code authorization, not a sandbox. `adapter_modules` is read only from a Git-confirmed untracked `.agenthub/config.local.json` (never from a shared, tracked or cloned config, and never written by settings or a hub tool). Only daemon startup imports a module, from the captured bytes that matched the `sha256` pin, not by reopening the path; the file must sit inside the project with no symlinked component and not be world-writable. Its imports are bound to the running hub's own `@staix/agent-hub/adapter` and builtins (`bun:ffi` and `bun:test` excluded), and dynamic imports, `require`, `eval` and `Function` are refused by a conservative scan. Once imported, the module runs with the daemon's privileges: the 2 s import deadline stops waiting but does not cancel its code or undo side effects, and the host's default against hub-tool title auto-approval holds only while the module keeps the factory options it is given. Inspect the whole bundle before recording its hash. Refusal reasons withhold source and module error text. A loaded kind keeps its own family, cloud trust (never PII), headless start and off-roster default, and fixed-builtin capabilities are refused.
+
 # Transient ACP activity (#286)
 
 - Watch activity can contain file contents, thoughts and command output. It is console-role only, kept in a bounded in-memory ring and exposed only through the `watch` control request. Agent shells, conductor tools, dashboard snapshots, hub tools and memory observers cannot read it. Terminal bodies pass through the console's sanitization and wrapping helpers. Slow sockets close instead of accumulating unbounded output.
@@ -365,7 +368,7 @@ The fresh Codex reviewer (#519) needs `review_mode: "fresh"` and an installed Co
 
 The fresh Kimi reviewer (#533) needs `review_mode: "fresh"` and Kimi Code 2.2.0 with its native OAuth login; any other version, or a failed preparation, is unavailable. It is a native tool-authority boundary, not a sandbox: no Seatbelt wraps it, and same-user native code is not isolated from the filesystem or network. Each review starts a new child in a private `KIMI_CODE_HOME` with managed-provider-only config, a clean temporary working directory and an empty skills directory. Its agent may use only `hub_review` and `hub_task_show`, served by a loopback MCP session bound to the task, head and review revision that never carries the hub's control token; it has no native read, file or shell tool and sees only the screened review brief and host facts. Its `credentials/` and `oauth/` directories and `device_id` link to the person's native ones, so refresh keeps Kimi's own lock and atomic rename; no token is copied and `KIMI_DISABLE_OAUTH_LOCK` is never set. A stop revokes its verdict authority before termination; killing it mid-refresh may require a native re-login. Private tasks are never given to it, and a child that ends without a saved verdict is never approval.
 
-The review brief (#520) withholds private changes whole (both sides of a move) and counts them; a rule file that fails the private-data screen is named, not shown. Attributes and rules are read at the merge base, so a change cannot loosen its own review. Spec acceptance, plan review, premature-review and cost reads fetch GitHub metadata only (edit times, check states, thread authorship and resolution), never issue bodies or comments. The CI workflow keeps `contents: read` and `actions: read`.
+The review brief (#520) withholds private changes whole (both sides of a move) and counts them; a rule file that fails the private-data screen is named, not shown. Attributes and rules are read at the merge base, so a change cannot loosen its own review. Spec acceptance, plan review, plan conformance, premature-review and cost reads fetch GitHub metadata only (edit times, check states, thread authorship and resolution, changed file names), never issue bodies, comments or patches. The CI workflow keeps `contents: read` and `actions: read`.
 
 ## Bounded task specs and isolated checks (#418)
 

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1387,7 +1387,7 @@ upgrade sources; ordinary clients must use protocol 12 (13 from 0.12.4, with 12
 
 ## Amendment: turn-free facts at tool boundaries (issue #108)
 
-- `src/hub/facts.ts` keeps three things apart per peer: what the hub observed in the tree (latest version and transitions per file), what it offered (bounded offers with their file versions and plans), and what the peer acknowledged (its view). Only an acknowledgement moves a view; a later boundary offers everything since the view again. Files are the paths every task of each live cohort in which the peer has an open task names (a directory expands to git's changed files against HEAD, staged or not, and its new and deleted files, 200 at most, with a note when more were cut, told until it is read back and again in a new session), contained in the project as real paths and never `.git` or anything the denylist (`src/local/deny.ts`, `local.deny`) keeps from agents, plus the last 64 it touched in its current session; a file that falls out of those is named in every offer until one naming it is read back (#112). A file the peer touched before it had a view of it is compared with its version at that touch, so a change in between is shown, not absorbed into a first look; a file it saw under a named directory stays covered after git stops listing it (put back to HEAD's bytes, or the directory moved away; 200 at most, the rest named as no longer followed until that is read back; a new session hears only the drops of its own). A directory file it has neither seen nor touched is named without a diff when it appears with bytes that differ from HEAD's (a rewrite with HEAD's bytes, listed until git refreshes its index, is no change, for the fact and for whether the peer is current; a file too large to read is compared by git's blob id of its bytes, hashed in-process, while all such files in one comparison total 64 MiB or less, and is not compared otherwise (so the answer never depends on what an earlier comparison hashed); the bytes are the raw working-tree bytes, without git's filters, so with an end-of-line conversion or LFS such a file reads as changed and is named; #112) (diffing it against HEAD would show what changed while tracking was off, a PII window, and credit unseen changes by elimination), and counts as not yet shown until that fact is read back. Only regular files of 256 KB or less are read, re-resolved at every read and opened without following a final link or blocking. A history longer than the 64 kept transitions makes the change's attribution unknown.
+- `src/hub/facts.ts` keeps three things apart per peer: what the hub observed in the tree (latest version and transitions per file), what it offered (bounded offers with their file versions and plans), and what the peer acknowledged (its view). Only an acknowledgement moves a view; a later boundary offers everything since the view again. Files are the paths every task of each live cohort in which the peer has an open task names (a directory expands to git's changed files against HEAD, staged or not, and its new and deleted files, 200 at most, with a note when more were cut, told until it is read back and again in a new session), contained in the project as real paths and never `.git` or anything the denylist (`src/local/deny.ts`, `local.deny`) keeps from agents, plus the last 64 it touched in its current session; a file that falls out of those is named in every offer until one naming it is read back (#112). A file the peer touched before it had a view of it is compared with its version at that touch, so a change in between is shown, not absorbed into a first look; a file it saw under a named directory stays covered after git stops listing it (put back to HEAD's bytes, or the directory moved away; 200 at most, the rest named as no longer followed until that is read back; a new session hears only the drops of its own). A directory file it has neither seen nor touched is named without a diff when it appears with bytes that differ from HEAD's (a rewrite with HEAD's bytes, listed until git refreshes its index, is no change, for the fact and for whether the peer is current; a file too large to read is compared by git's blob id of its bytes, hashed in-process, while all such files in one comparison total 64 MiB or less, and is not compared otherwise (so the answer never depends on what an earlier comparison hashed); the bytes are the raw working-tree bytes, without git's filters, so with an end-of-line conversion or LFS such a file reads as changed and is named; #112) (diffing it against HEAD would show what changed while tracking was off, a PII window, and credit unseen changes by elimination), and counts as not yet shown until that fact is read back. Only regular files of 256 KB or less are read, re-resolved at every read and opened without following a final link or blocking; a larger file is compared by size and mtime, except that one whose last change (ctime) is under 2 s old and 4 MiB or less is named by git's blob id of its bytes (git's racily-clean rule: Linux before 6.13 stamps files from a coarse clock, so a same-size rewrite within one tick keeps every stat field; #428), hashed once per version in a public entry point and 16 MiB in all per store per event-loop turn, the stat stamp alone beyond either; the HEAD comparison above keeps its own 64 MiB bound and is not limited by these. A version seen racy keeps its version once it settles with the same bytes, and an integration target (`tree()`) counts large files by their stat stamp only, so it does not move when one settles. Known ceilings: a racy file over the cap or past the budget misses a same-tick same-size rewrite; a racy file first seen past the budget (kept stat-only) reads as changed once when a later turn hashes it with the same bytes; a file written continuously is hashed at every look within the budget; a settled file made racy with the same bytes (chmod, `cp -p`) reads as changed once; a version first seen racy costs an open and a stat at every later look. A history longer than the 64 kept transitions makes the change's attribution unknown.
 - Attribution: a transition is credited only with effect evidence: a Claude Edit, MultiEdit or Write whose result equals its input applied to the file as observed at PreToolUse with no observation in between, or a Codex `fileChange` whose changed lines equal the observed diff. Everything else is shown with its attribution unknown; an agent's own verified writes advance its view and are not shown back. A Claude Read advances its view only when it returned the whole file (no offset or limit, at most 2000 lines, none over 2000 characters); a Codex read action never does (it may be partial). A diff that matches a PII pattern is replaced by a note naming the file, and a changed file whose name matches one is counted without its name.
 - Acknowledgement and capability: Claude's hook runs before and after every tool and at Stop (`ahub claude` injects it in a turn-free project); the pre answer's text becomes `additionalContext`, and the row Claude Code writes in its transcript for it (matched by tool use id and offer id) is the readback. Codex's offer goes in with `steerText` (bound to the running turn), and the steered input coming back as a `userMessage` item is the readback. A readback marks the peer's path verified; a new session or thread, the peer going offline, or three offers past a minute without one (checked at boundaries and every 30 seconds; facts sent with an integration request wait for the next done and never count, a refused steer is dropped, not unread, and an unanswered one stays pending, since it may have gone in) unverifies it. Until verified, a peer gets a one-line probe at most three times per session, and no offers at all once three are unread; a Claude session whose transcript the hub cannot find gets none at all and loses a verified path.
 - The control contract is protocol 13: `facts` carries the phase, tool, input, tool use id, session id and transcript path; `silenced` serves check-path; `send` results name held-back recipients. Protocol 12 stays an authenticated recovery source.
@@ -2007,6 +2007,18 @@ push `accepted` and show none of them.
   detach and pull-only attach remove that capability. Ordinary messages remain
   queued while busy. A notification write alone is not proof that the native
   model saw it; the earlier print-mode probe was inconclusive.
+- Known limit and hint behaviour (#221). Mid-turn consumption of an important
+  steer was proven only on Claude Code 2.1.302, yet push-capable `WsPeer` offers
+  steer to every push-capable Claude session. On an older client a dropped
+  mid-turn notification stays `accepted` until a person resolves it. No client
+  version gate is added: the hello does not carry the client version, and the
+  oldest version on which steer works was never probed, so a gate would be a
+  guess that could disable a working path. A gate needs a probe of the older
+  client and an optional hello field. A tool result that carries a held-delivery
+  hint keeps the queued and important counts but drops the advice to call
+  `hub_inbox`, because `Bus.pull` refuses under that hold. A `hub_inbox` result
+  that already states how many messages remain unread adds only the important
+  count.
 
 ## Amendment: owner and reviewer read their task (issue #208)
 
@@ -3722,6 +3734,23 @@ After unidentifiable Codex cancellation, status carries a fixed
 completion cannot clear it; verified native reattachment does. No native ids or
 provider text reach the notice.
 
+### Peer capability ports (#625 phase 6, slice 1)
+
+`PeerAdapter` optionally exposes a readonly `sessionGeneration` (string or number),
+readonly `permissionModeState` (a permission mode, unknown or unmanaged), and an
+acknowledged `setPermissionMode(mode)` operation. Generic runtime permission and
+generation dispatch uses these ports without native-class enrollment. An absent
+generation port retains the existing recovery-session/owner-token fallback; a
+present but undefined generation is unknown and refuses bounded checks.
+Checkpoints fence a present generation unless `checkpointUsesSessionGeneration`
+is explicitly false. Pi keeps that exception so its owner/session-only checkpoint
+behavior is unchanged. BasePeer installs no default generation property.
+Read-only and unmanaged ceilings, never-ask confirmation, serialization and the
+current-owner/not-offline check after acknowledgement remain authoritative.
+Codex proxy/startup/restoration-debt and Claude launch-generation/unattended-hook
+proofs remain native branches; typed semantic ports for those proofs belong to a
+later slice.
+
 ## Amendment: playbook lifecycle and criteria checklist, 2026-10-18 (#481 S0/S8)
 
 - The AI-Native SDLC Playbook supplies the built-in stage model of an enabled lifecycle: intent (Plan), spec (Design), plan and build (Build), test (Test), review, merge and release (Deploy), maintain (Maintain). `mode` advise or enforce without `stages` selects this list. Off (no file, or `mode = "off"`) keeps the seven #257 stages, so its config, receipts, `hub_sdlc_record` schema and status output stay byte for byte. An explicit #257 list still loads: off keeps it as written, and an enabled lifecycle keeps its order under canonical ids (spec, plan, build, review, test, merge, release). Any other list needs definitions.
@@ -3733,6 +3762,10 @@ provider text reach the notice.
 - `ahub sdlc export`: a plain off lifecycle (no retired setting) keeps the #257 export bytes (schema 1, `workflow: "none"`, `phase: null`). An enabled or retired-setting lifecycle emits schema 2: sanitized state (id, state, stage, criteria view or a private stub), `stateHash` and `sourceHash`, without the workflow field. In off, a `phase` receipt write also keeps its #257 bytes (`tasks: []`); task import stays retired in every mode, so a non-empty list is refused.
 - Contract amendment, seeds (419 before and after: 414 byte-unchanged, 3 modified, 2 removed, 2 added; the registry baseline is unchanged). Modified, each with the same id, test file, test name and mutation intent: `workflow-reviewer-only` (the criteria/phase check), plus `override-local-schema` and `lifecycle-native-schema`. The person approved the last two on 2026-10-18, because the `lifecycleCriteria` plumbing changed their call sites. Removed with the code they mutated: `workflow-exact-after` and `lifecycle-phase-view-required`. Added for the new guards: `criteria-task-import-retired` and `sdlc-workflow-window-closes`. Tests that pinned the retired gsd-lite behaviour (task import, phase naming, the workflow projection, the implement id stored in an enabled config) are amended in the same PR; every other test is unchanged.
 - S0/S8 implement none of S1-S7 and S9-S11. The issue stays the spec, Tasks owns mutations and GitHub owns PR, check and tag facts.
+### S3 structured findings clarification (#481, hub task #196)
+
+Open Important findings carry across reviewed heads until the reviewer explicitly marks fixed or false_positive, or the person accepts with a rationale; nits do not carry. Review requests list carried public ids, pass, severity and optional path, with private details limited to counts. Use a shared valid-head resolver (PR, reviewed, local, then valid commit metadata); enforce refuses a non-empty report with no resolvable head. Recurrence uses semantic pass/id pairs excluding false positives and a durable card marker rather than its title.
+
 ## Reviewer separation amendment (#450, hub task #223)
 
 Owner decision 2026-10-18 (#450 comment 6248184754), R1-R5. R3's mechanism, chosen by the person: a new headless Claude session per review request.
@@ -3815,7 +3848,13 @@ never initializes that app-server on the TUI's behalf. `ahub <kind> --as <id>`
 selects the declared identity; selection is removed from native passthrough.
 Missing `peer_instances` evidence on an old daemon/upgrade target is a refusal
 before instance runtime effects, rather than a guess that the instance is a base
-peer.
+peer, but only while a declared instance is live or unreadable: a source whose
+status shows every declared id offline proceeds, because there is no extra
+identity left to reinterpret. The refusal asks the person to end extra native
+sessions and, only when an extra session cannot be ended, to remove the
+declarations temporarily. A roster key left behind by an undeclared instance
+loads as inert and `ahub roster remove <id>` deletes it; any other unknown key
+is still an unsupported peer.
 
 Each additional implementer requires an explicit registered Git worktree at
 `<project>/.worktrees/<id>` with an attached branch. I2 creates no worktree or
@@ -3953,9 +3992,19 @@ S9 privacy and notice ceilings: private build work with an issue ref remains ina
 
 - Task plans carry explicit review scope (none/delta/full, bounded reviewer count) and CI scope (focused/full/reuse); S9 receipts copy the planner-selected values. None uses zero reviewers; other scopes use one to eight. Legacy scope is unspecified, readable and never guessed. Advise reports the gap; new enforce receipts require both scopes, while old scope-less receipts remain valid to their next non-release planning revision under the complete-history S11 exception. Omitted cost keys on an owner file-list update retain the reviewed scope; explicit prospective drift refuses enforce acceptance. Scope does not change reviewer authority or bypass CI; S2 owns actual conformance comparison.
 - Review admission is separate from #520 brief/coverage. Before done/cohort writes, enforce requires the task's exact PR head, successful configured checks (native default: both OS checks and seeded guards), and no unanswered pending bot thread. Resolution settles a thread; an unresolved thread needs a user reply after the last bot comment. Only metadata is fetched. Advise reports gaps, including a generic unknown-readiness notice when a private turn finishes its own PII task without remote metadata; ordinary work remains refused during a private turn. Off adds no readback. Identity/privacy/owner and runtime authority are rechecked across awaits and each external read. Background role maintenance may retain a saved role while holding an unadmitted review envelope; a manual reviewer resend performs fresh admission.
-- Whole-workflow repository serialization closes the admission race, keeping required check names and read-only permissions; queue:max retains up to 100 pending controllers instead of canceling the previous pending one. Identical-tree successful full proof is reused for PR and push. Reuse expands both OS matrix names and reports the required seeded aggregate, using only a `Reuse verified identical-tree full gate` marker step with the original run id. These successful reporting jobs and skipped jobs are not fresh full proof; duplicate active full gates and unknown active coverage refuse admission. Pending controllers do not run gates. CI proof searches are bounded; missed older success can require a new gate, never invent green evidence.
+- CI controllers are serialized per pull request (`check-pr-<number>`, `queue: single`: a newer pending run replaces the older pending one) and for main pushes and ordinary dispatches (`check-main`, `queue: max`; a macOS timing dispatch has its own `macos-timing` group), for the whole workflow and without cancelling an admitted controller (#609). A superseded PR head that is already running completes; this is a cost ceiling, not a proof gap. Two groups admitting one tree at the same instant can run it twice; the duplicate costs one run and never yields a false green. A visible active same-tree gate in any group still refuses admission. Required check names and read-only permissions are unchanged. Identical-tree successful full proof is reused for PR and push. Reuse expands both OS matrix names and reports the required seeded aggregate, using only a `Reuse verified identical-tree full gate` marker step with the original run id. These successful reporting jobs and skipped jobs are not fresh full proof; duplicate active full gates and unknown active coverage refuse admission. Pending controllers do not run gates. CI proof searches are bounded; missed older success can require a new gate, never invent green evidence.
 - Cost reporting is read-only over bounded current public board links plus merged-PR/check metadata: review handoff rounds and elapsed time, CI run ids and extra attempts, full re-reviews versus deltas, and unknown scope. Private/relinked counterparts are excluded at each read and projection. Pure band-breach proposal data is delivered here; the S7 baseline/configuration/automatic board-card scheduler is deliberately not implemented in S10.
-- Nonblocking policy ceilings stay unchanged and are recorded in hub task #230: fail-closed metadata errors, repository-wide queue fairness, unknown thread author kinds, and strict advise readback races. Their planner-reviewed alternatives are deferred.
+- The nonblocking policy ceilings deferred to hub task #230 are settled in the follow-up below.
+
+### S10 policy ceilings follow-up (#481, hub task #230)
+
+These rules are settled here and land with hub tasks #284-#286; until then the S10 behaviour above holds.
+
+- CI admission separates lost proof from active-coverage uncertainty. If a commit or jobs read for one prior successful run is missing (404), times out on its own per-read limit or is malformed, that run is dropped as reuse proof; if the success list itself fails that way, all reuse proof is dropped. Admission then continues and can require a fresh full gate, never reuse. Any other read failure (5xx, 403, 429, the response size bound, authentication) stays unknown, and an exhausted read budget or overall deadline is unknown even when it surfaces as a per-read timeout. Unknown active coverage still refuses admission, as before: an unreadable, truncated or unidentifiable in-progress inventory, or an exhausted read budget or deadline. The release reader (`--require`) still refuses without a verified identical-tree proof. Degrading unknown active coverage to a fresh run is not adopted; it would need a person ruling against #609.
+- Review-thread authors are classified only by `__typename`. A `User` comment answers. Every other author counts as a pending bot comment: `Bot`, a null or deleted author, `Organization`, `Mannequin`, `EnterpriseUserAccount` or any unlisted kind. An unresolved thread is therefore settled only by resolution or by a `User` comment after its last non-`User` comment. Invalid timestamps and truncated pages remain unavailable evidence. No comment body, login or other author field is read.
+- In advise, a done or delayed-completion review-admission readback during which only quiet events (`QUIET_EVENTS`: answer, reviewer changed, idle sweep, memory reference started) were appended to the task is discarded, and the transition continues with a generic unknown-readiness notice and no further external read. A quiet `reviewer changed` entry, or a changed reviewer field, does not refuse in advise: the transition re-derives the reviewer from the current task before it sends the review. Any other drift still refuses in advise: another history event, a change of mode, owner, privacy or receipt, a revoked conductor authority, or a private turn on ordinary work. Each transition's final owner/state/check fences run before its writes. Enforce refuses any drift, unchanged. A manual reviewer assignment or retry keeps its own readback rules.
+- A delayed check whose completion is refused tells the owner, privacy-screened, to call `hub_task_done` again, but only when the task is still `in_progress` and its owner is the one that started the check (the same condition as the late-result branch of `finishChecked`); otherwise the console notice alone is recorded.
+- Fixtures pin each rule before its implementation lands (`test/ci-reuse.test.ts` for admission: a lost row then proof reuses, lost rows without proof run, active-scan failures and budget exhaustion stay unknown, the release refusal stays; `test/cost-governance.test.ts` for thread authors and advise readbacks). The dead `findVerifiedRun` reader is removed with the admission change.
 
 ### S11 release-train amendment (#481, hub task #216)
 
@@ -4077,5 +4126,65 @@ Configured ACP permission requests never use hub-tool titles for automatic appro
   - Transport selection: `acp` (stdio JSON-RPC), `codex-appserver`, `claude-channel`, `ws-pull` (pull-only workspace MCP plugin), and `hub-native`.
   - Conformance kit (`test/conformance/`): enrollment invariants, delivery occupancy, watchdog expiry, process-group teardown, and explicit reasons in `UNSUPPORTED` (per kind) and `UNSUPPORTED_LEGS` (per ACP leg).
   - Review and verification checklist: T0 receipt, path protection (`AGENT_CONFIG_SEGMENTS`), PII safety (`trust.onPrem`), process isolation, and documentation freshness.
-  - Config-only generic ACP adapters (#451 A3, board task #217) follow the A3 amendment above, including its isolated native-proof boundary. External adapter modules (#451 A4, board task #135) remain planned; their hash-pinning and module trust rules land with A4.
+  - Config-only generic ACP adapters (#451 A3, board task #217) follow the A3 amendment above, including its isolated native-proof boundary. External adapter modules (#451 A4, board task #135) follow the A4 trust boundary below.
 - `docs/agent-notes/adapters.md` keeps only the per-adapter rules that bind code, pointing to `docs/adding-an-ai-tool.md` and `src/adapters/registry-types.ts` for conceptual architecture and definitions.
+
+
+### A4 external module trust boundary (2026-10-21, #451)
+
+`adapter_modules: [{ path, sha256 }]` is accepted only from an untracked,
+machine-local `.agenthub/config.local.json`. Shared, tracked, cloned or unknown
+provenance never evaluates module code. The declaration is person-owned,
+never settings-editable, and restart-bound. The daemon imports modules at
+startup; a CLI read, preview, reload or watcher never imports them.
+
+Each pinned entry is a self-contained JavaScript bundle inside the canonical
+project root. Refuse symlink components, a file outside that root, a
+world-writable or nonregular entry, an unreadable/oversized entry and a SHA-256
+mismatch. A module bundles its own dependencies; core adds no third-party
+runtime dependency. Runtime permits static imports of Node/Bun builtins except
+`bun:ffi` and `bun:test`, plus the public `@staix/agent-hub/adapter` entry only.
+The `/conformance` export is for the module author's CI, not runtime modules.
+Relative imports, other package imports, dynamic/nonliteral imports, require,
+eval and Function-based code loading that the loader can detect are refused.
+Dependencies must be bundled as ESM; `import.meta.require` and CommonJS loading
+are refused. Use Bun.Transpiler's import records and token inspection before
+evaluation. After checking the original content pin, compile its scanned static
+SDK imports to file URLs of the running daemon's own adapter entry, never a
+project-resolved package copy. Re-hash the original captured bytes immediately
+before importing the rewritten result; never reopen the mutable source path.
+A pin is code authorization, not
+a sandbox: approved module code runs with daemon privileges; scanner rejection
+is deliberately conservative and is not a proof against obfuscated code.
+Refuse a failed module independently with a bounded, body-free status reason;
+keep builtins and other verified modules available. When trusted module
+declarations exist, unknown roster ids remain inert, including on CLI config
+reads while no daemon metadata is available; a roster row grants no adapter identity.
+
+A module exports `definition` with the current `ADAPTER_API`. Validate the
+accepted structural subset and fixed-builtin capability exclusions before
+publishing it in the immutable project catalog. The initial accepted executable
+subset is a headless ACP definition (`transport: "acp"`, `start.daemonPort:
+"acp"`), with a factory returning the public AcpPeer transport for its bound id.
+Its own family, optional/off-roster defaults and cloud/unsandboxed trust are
+mandatory. Native hooks, budgets, configuration callbacks, reviewer backends,
+instance policies and other fixed-native fields are refused rather than
+advertised as usable extension points. A broader transport needs a reviewed
+kind-neutral host-port contract first (#625 phase 6). Builtin collisions, duplicate
+kinds, incompatible API and unsupported fields refuse the module. Never add
+a module to the process-global builtin registry. Builtin and configured instance
+namespaces (`<kind>-*`) are reserved against external module kinds.
+
+The CLI receives external kinds only as bounded id/display metadata from the
+running daemon. That projection cannot grant permissions or register code.
+A4 refuses declared instances of external kinds with an explicit unsupported
+reason; their execution-root, recovery and CLI declaration contracts are a
+follow-up. The exported Bun conformance entry exposes callable transport
+registrations and packaged fake transports without executing those fakes on
+import. Builtins keep their existing applicable contract tests and explicit
+unsupported-leg reasons; an external module exercises the same contracts in
+its own CI.
+
+### S2 plan conformance boundary (#481)
+
+Optional proof/risks lists are bounded to 32 strings of 512 characters. Literal file/directory-prefix coverage uses complete current PR file metadata, never patches or glob execution. Root plan entries never cover all files; renamed/copied files whose old identity is unavailable make the inventory unknown. Untouched paths are advisory; uncovered changed paths block enforce approval until plan amendment or person acceptance. Host content revisions are separate from backlog planningRevision. "Plan revisions after the first observed push" binds the first observed remote head to plan fingerprint/revision; earlier pushes are unknown. Pending observations persist only at successful owner/reviewer transitions; status and queue reads never append history, and off mode captures no S2 observations or content revisions. Lost pending intervals remain unknown. The ceiling is no true push-event source; the upgrade path is a webhook or Actions push receipt. Person-only `ahub sdlc accept-departure <task> <head> <reason...>` records complete current repo/PR/head inventory and plan fingerprint/revision, with bounded sanitized privacy-screened rationale; changed identity, plan or inventory invalidates it, including plan edits while reporting is off. Departure consent expires on host restart to prevent unpersisted invalidations from reviving; the upgrade path is a durable host observation journal. Private projections reveal only existence, and unavailable private inventories stay unknown.

package/docs/verification/2026-10-21-469-r1-dashboard-tokens.md

@@ -0,0 +1,43 @@
+# #469 R1: dashboard design tokens, screenshots and layout check
+
+Task #170, branch `feat/469-r1-tokens`. R1 changes the style block, the peer palette variants and the contrast test. It changes no
+layout, view, key or behaviour.
+
+## Source of the screenshots
+
+A scratch hub created under a `mktemp`-style directory outside any git repository (its own `AGENTHUB_HOME`, never the person's
+`~/.agenthub` or live hub), with five fake pull-only peers (claude, codex, kimi, pi, local), eight sample tasks (one in progress,
+one backlog) and one console message. Rendered by a headless Chromium (Chrome for Testing 156) over the DevTools protocol with
+`prefers-color-scheme` emulated, at 1440x1000 and 390x900. The Board view is shown: it is the default view, and the one R1's rules
+touch most. The other views use the same tokens.
+
+| | light | dark |
+| --- | --- | --- |
+| 1440 px | `assets/469-r1-board-1440-light.png` | `assets/469-r1-board-1440-dark.png` |
+| 390 px | `assets/469-r1-board-390-light.png` | `assets/469-r1-board-390-dark.png` |
+
+Computed `body` background in the run: light `rgb(238, 238, 241)`, dark `rgb(18, 19, 22)`; `scrollWidth` equals the viewport width at
+both sizes in both themes (no sideways scroll).
+
+## "No layout change", measured
+
+The same sample hub was rendered from `origin/main` (c4b1c998) and from this branch, and the rectangles of the header, the nav, its
+buttons, the board section, the progress strip, the agent slots, the columns and the cards were compared (148 rectangles over the
+four size and theme combinations).
+
+- Exact pixel equality does not hold, and is not claimed. R1 snaps spacing to the 4px scale, so three paddings grew from 10px to
+  12px: the board column (`.board-column`, 10px to 12px: columns 600 px to 635 px tall at 1440), the agent slot
+  (`.agent-slot`, 10px to 12px: 166 px to 178 px) and the 14px/18px section and row paddings moved to 12px/16px (`.section-head` 14px 18px to 12px 16px). Cards keep their height
+  except one empty-state card (47 px to 68 px) and are 3 px narrower at 1440 because their column is 4 px narrower inside. Nav
+  buttons are up to 4 px wider (control padding 6px/10px to 8px/12px; their 44 px minimum height hides the vertical change). The whole 390 px page is 78 px taller (2905 to
+  2983) and the 1440 px page 16 px taller (1595 to 1611).
+- Structure is identical in all 16 checks (4 selectors x 4 combinations): the same number of columns and rows, the same reading
+  order, 5 board columns at 1440 and 1 at 390, 8 nav buttons in 1 row at 1440 and in 2 rows at 390, the same 3 card columns.
+- Nothing scrolls sideways at 390 or 1440 px after the change.
+
+## Not covered
+
+- Only the Board view was photographed. Office, Stream, Agents, Message, Memory and Settings were not, so their light and dark
+  rendering is covered by the token and contrast tests and by reading the CSS, not by a picture.
+- 768 and 1024 px were not photographed (they belong to R2's AC3).
+- Chrome only; no Firefox or Safari rendering was run.

package/docs/verification/2026-10-21-469-r2-dashboard-shell.md

@@ -0,0 +1,54 @@
+# #469 R2: dashboard app shell, screenshots and width check
+
+Task #171, branch `feat/469-r2-shell` (on top of `feat/469-r1-tokens`). R2 adds the shell (top bar, sidebar or tabs), the icon sprite
+and the view keys. It keeps the view names, their order, the `agent-hub-view` cookie, the pinned ids and every action.
+
+## Source
+
+A scratch hub outside any git repository, with its own `HOME` and `AGENTHUB_HOME` (never the person's home or live hub): five fake
+pull-only peers, sixteen to twenty-four sample tasks, one console message. Headless Chromium (Chrome for Testing 156) over the
+DevTools protocol with `prefers-color-scheme` emulated. Every one of the seven views was visited at 1440, 1024, 768 and 390 px in
+light and dark (56 combinations), and one representative set is kept here.
+
+| View and size | image |
+| --- | --- |
+| Board 1440, light | `assets/469-r2-board-1440-light.png` |
+| Board 1440, dark | `assets/469-r2-board-1440-dark.png` |
+| Board 1024, light | `assets/469-r2-board-1024-light.png` |
+| Board 768, light (tabs) | `assets/469-r2-board-768-light.png` |
+| Board 390, light | `assets/469-r2-board-390-light.png` |
+| Board 390, dark | `assets/469-r2-board-390-dark.png` |
+| Agents 1440, dark | `assets/469-r2-agents-1440-dark.png` |
+| Agents 768, dark | `assets/469-r2-agents-768-dark.png` |
+
+## AC3: nothing scrolls the page sideways
+
+Measured in the page, not assumed: for each of the 56 combinations the document's `scrollWidth` was compared with the viewport width
+and every element past the right edge (outside the nav) was listed.
+
+- 1440 px: `scrollWidth` 1440 in all 14 view and theme combinations. 1024 px: 1024. 768 px: 768. 390 px: 390.
+- No element extended past the viewport in any of the 56 combinations.
+- The nav is a column of width 199 px at 1440 and 1024, and a row at 768 and 390 whose own `scrollWidth` (769) exceeds its
+  `clientWidth` (768 or 390): the tabs scroll inside the nav, as designed, and the page does not.
+- The top bar is 61 px tall from 1024 px up and 129 px at 768 and 390 (it wraps below 1024 px; the screenshots show it).
+
+## AC4: keys
+
+Tested through the page's own handler in the navigation test harness (`test/dashboard-views.test.ts`): `1`-`7` switch the seven
+views in order and write the cookie, `?` opens the key list, the buttons open and close it, and view keys are ignored inside an
+input, a textarea, a select, an editable node, with Ctrl, Alt or Cmd held, and while the key list or the task detail is open.
+`Esc` is the native dialog's own close and is not handled by the page. Six deliberate breakages of the key handler each fail a test (a seventh, accepting multi-character keys such as `01`, first survived and led to a stronger test), and eight breakages of the sprite, labels and shell CSS each fail a test too. Not covered: a
+real browser key press (no browser-driven test of the keys was run), and `Esc` itself, which rests on the dialog element.
+
+## Icons
+
+Nine Tabler Icons (outline) in one inline sprite, path data copied unchanged from tabler-icons; the MIT notice is in
+`THIRD_PARTY_NOTICES.md`. A test checks the count (at most 20), one stroke width, path-only symbols, no external reference, no
+unused or undefined symbol, `aria-hidden` on every icon, and a text label or `aria-label` next to each.
+
+## Not covered
+
+- Screenshots show Board and Agents only, at the sizes above; Office, Stream, Message, Memory and Settings were measured for width
+  but not photographed.
+- Chrome only. The sidebar's sticky height uses `100vh`, which on a mobile browser with a collapsing toolbar was not tried.
+- The "tabs scroll sideways" behaviour at 390 px is shown by the cut-off fourth tab in the screenshot, not by a scroll gesture.

package/docs/verification/2026-10-21-469-r3-dashboard-board.md

@@ -0,0 +1,51 @@
+# #469 R3: dashboard board, side sheets and the Plan sheet
+
+Task #172, branch `feat/469-r3-board` (on top of `feat/469-r2-shell`). R3 changes the cards, the task detail and where the five board
+forms live. It keeps drag and drop, the Pull and Assign buttons, the Ready and Waiting subheads, "Show N older" and every action.
+
+## Source
+
+A scratch hub outside any git repository with its own `HOME` and `AGENTHUB_HOME` (never the person's home or live hub): five fake
+pull-only peers, eight sample tasks (one in progress, backlog tasks, no owner on some). Headless Chromium (Chrome for Testing 156)
+over the DevTools protocol with `prefers-color-scheme` emulated, at 1440x1000 and 390x900.
+
+| What | image |
+| --- | --- |
+| Board 1440, light | `assets/469-r3-board-1440-light.png` |
+| Board 1440, dark | `assets/469-r3-board-1440-dark.png` |
+| Board 390, light | `assets/469-r3-board-390-light.png` |
+| Detail sheet 1440, light | `assets/469-r3-detail-1440-light.png` |
+| Detail sheet 1440, dark | `assets/469-r3-detail-1440-dark.png` |
+| Detail sheet 390, dark | `assets/469-r3-detail-390-dark.png` |
+| Plan sheet 1440, light | `assets/469-r3-plan-1440-light.png` |
+| Plan sheet 390, light | `assets/469-r3-plan-390-light.png` |
+
+## AC5: cards and the detail sheet
+
+Measured in the page for eight cards at each of the four size and theme combinations:
+
+- every card has two children (the head with the avatar and the title, and one line with the badge and the release chip), exactly one
+  badge, exactly one owner avatar, and a title no taller than two lines (`title height / line height` was 2 at most);
+- the page does not scroll sideways (`scrollWidth` equals the viewport at 1440 and 390);
+- the detail sheet is open and pinned to the right edge at 1440 (x 920, width 520, the full 1000 px height) and fills the screen at 390
+  (x 0, width 390, the full 900 px height); the Plan sheet likewise (x 880, width 560 at 1440).
+
+The detail groups its lines into Status, People, Dates and Links. Each original line (class, stage, waiting, rework, check, SDLC,
+overdue, owner, reviewer, guidance, description, planned and actual dates, release, GitHub link, pinned) appears exactly once, in its
+group; a group with nothing to show is left out. Group headings are `h4`, not `h3`, because the board tests find the five columns by `h3`.
+
+## AC6: the Plan sheet
+
+The five forms (`planning`, `split-backlog`, `release-new`, `release-plan`, `propose`) moved out of five `<details>` blocks (plan, split, releases, delivery evidence, propose) into one native
+`<dialog id="plan-dialog">` opened by a Plan button in the board toolbar. Their controls were compared with `origin/main`: identical
+ids and order in all five (11, 4, 3, 6 and 5 controls), and every submit handler still attaches by id. The Releases panel, the delivery
+evidence panel and the split panel keep their ids. A test now pins the full control list of each form.
+
+## Not covered
+
+- Drag and drop, hover and the pressed (dragging) shadow were not exercised in a browser: the drop handlers are unchanged and covered by
+  the existing board tests, and the hover and drag styles are CSS only, read, not seen.
+- Only the sample data above was rendered: no release chip, no GitHub link, no SDLC lifecycle and no rework round appear in the
+  screenshots; those lines are covered by the DOM tests only.
+- The sheet slide-in animation was not observed, and `Esc` rests on the native dialog.
+- Chrome only.

package/docs/verification/2026-10-21-469-r4-dashboard-views.md

@@ -0,0 +1,77 @@
+# #469 R4 and R5: the other dashboard views, glyphs to icons, Office colour checks
+
+Task #173, branch `feat/469-r4-views` (on top of `feat/469-r3-board`). R4 restyles Agents, Stream, Memory, Settings and Message and
+replaces the symbol glyphs. R5 puts the Office scene's colour use under the contrast test. Behaviour, view names and order, the view
+cookie, element ids and every action are unchanged.
+
+## Source
+
+A scratch hub outside any git repository with its own `HOME` and `AGENTHUB_HOME` (never the person's home or live hub): five fake
+pull-only peers, seven sample tasks plus a backlog task, four short-term memory notes (decision, fail, contract, finding) and three
+console messages. Headless Chromium over the DevTools protocol with `prefers-color-scheme` emulated, at 1440x1000 and 390x900.
+
+| What | image |
+| --- | --- |
+| Agents 1440 light / dark | `assets/469-r4-agents-1440-light.png`, `assets/469-r4-agents-1440-dark.png` |
+| Agents 390 dark | `assets/469-r4-agents-390-dark.png` |
+| Stream 1440 light, 390 light | `assets/469-r4-stream-1440-light.png`, `assets/469-r4-stream-390-light.png` |
+| Memory 1440 light / dark, 390 dark | `assets/469-r4-memory-1440-light.png`, `assets/469-r4-memory-1440-dark.png`, `assets/469-r4-memory-390-dark.png` |
+| Settings 1440 light / dark | `assets/469-r4-settings-1440-light.png`, `assets/469-r4-settings-1440-dark.png` |
+| Message 1440 light | `assets/469-r4-message-1440-light.png` |
+| Office (Flat) 1440 light / dark | `assets/469-r4-office-1440-light.png`, `assets/469-r4-office-1440-dark.png` |
+
+The rig also shot the other combinations (all six views at 1440 and 390, light and dark); only the ones above are attached.
+
+## R4
+
+- **Agents.** Every peer row (five of five) has one summary line (queued count, "Working on #n" or "No active task") and exactly one
+  closed `<details class="peer-fold">` holding the former meta lines. Row height was 144 to 145 px with the fold closed. The status
+  notice stays outside the fold. Approvals stay first.
+- **Stream.** The filter chips and Follow latest are in the section head, above the scrolling list. Each event is a head line (time,
+  sender, kind) above a monospace body; in the page the left edge of every event was the same x (249 at 1440, 29 at 390). That is
+  aligned rows, not four separate columns: the spec's "time column, kind, sender, body" is met as one head line plus the body.
+- **Memory.** Rows show title, a kind badge and a meta line with the id, peer and date and time (not a relative age); the selected row has an accent edge. The graph
+  and the detail pane use tokens only. With four notes: four rows, one pressed, the detail pane filled.
+- **Settings.** Six groups as sections. The reload row now has padding, and a "restart pending" badge and a count by "Pending
+  restart" exist in the markup. The text lines, Preview, Save and Undo are as before.
+- **Message.** Same form, capped at 640 px, with the shared field and label styles.
+- **No page scrolls sideways** in any of the six views at 1440 or 390 in either theme (`scrollWidth` equals the viewport).
+
+## AC7: glyphs
+
+- A test fails if any of `○ ● × ‖ ⚑ ★ → ⟳` is back as a quoted string in the page, and one fails if an Office shape name is renamed.
+  Both were run red (see below).
+- The star, the stream arrow and the Office "checking" mark are Tabler `star`, `arrow-right` and `refresh` (the path data was compared
+  with the upstream files, unchanged). The sprite has twelve symbols of the twenty allowed, and `THIRD_PARTY_NOTICES.md` names all of them.
+- The Office conditions are drawn as shapes (ring, disc, cross, bars, raised hand), each next to its words. The condition names
+  (`idle`, `busy`, `offline`, `paused`, `waiting`) are unchanged.
+- Every icon use sits beside a text label or has an `aria-label`; a test counts the `icon()` and `officeIcon()` call sites.
+
+## R5: Office colours and contrast
+
+The Office rules already named colours only through `var(--token)`, so nothing was remapped. What changed is the checks:
+
+- The colour-literal test no longer skips the Office block.
+- A new test reads the tokens each Office rule uses, fails on a token it does not classify, and checks text tokens at 4.5:1 and mark
+  tokens at 3:1 against the three Office surfaces (`--panel-soft`, `--panel`, `--control`), in both themes. The earlier R1 test
+  already covered text, `--dot`, `--on-accent`, disabled controls and the peer palette.
+- **Decision to review:** the hairline tokens `--line` and `--control-border` carry no information (room, desk and shelf edges,
+  dividers) and measure 1.2 to 1.7:1 on those surfaces, so they are classified as separators and not held to 3:1. If a reviewer wants a
+  3:1 edge, that is a colour change to the tokens, not a test change.
+
+## Checks that were run red
+
+Each was applied to the working tree, the tests run, and the file restored:
+
+- an Office rule using an unknown token: the new Office token test failed;
+- a `⟳` put back into the page script: the AC7 glyph test failed;
+- the Office `ring` shape renamed in `office-model.ts`: the AC7 shape test failed.
+
+## Not covered
+
+- The Office was shot in Flat mode with five idle peers. The busy, offline, paused and waiting shapes, the checking icon and the
+  approval hand were checked by the model tests and the DOM tests, not seen in a browser. Isometric was not shot.
+- The "restart pending" badge on a setting row and the Pending restart count need a pending key, and the sample hub had none, so they
+  were not rendered. They are covered by the DOM tests only.
+- Memory's long-term and tasks tiers, and the graph with more than one hop, were not shot.
+- Chrome only. Of the attached images, the Message and the dark Office were not looked at one by one.

package/docs/verification/2026-10-21-469-r6-dashboard-motion-states.md

@@ -0,0 +1,82 @@
+# #469 R6: keyed rendering, quiet motion, and loading, empty, disconnected and toast states
+
+Task #174, branch `feat/469-r6-motion` (on top of `feat/469-r4-views`). The poll interval, every action, authority rule and pinned
+element id are unchanged.
+
+## Source
+
+A scratch hub outside any git repository with its own `HOME` and `AGENTHUB_HOME` (never the person's home or live hub): five fake
+pull-only peers and eight sample tasks, plus a second hub with no peers and no tasks for the empty views. Headless Chromium over the
+DevTools protocol with `prefers-color-scheme` emulated, at 1440x1000 and 390x900. `/snapshot` was held, failed and released through
+the DevTools Fetch domain to produce the skeleton and the disconnected state.
+
+| What | image |
+| --- | --- |
+| Skeleton, board 1440 light / 390 dark | `assets/469-r6-skeleton-1440-light.png`, `assets/469-r6-skeleton-390-dark.png` |
+| Toast stack 1440 light / dark, 390 light | `assets/469-r6-toasts-1440-light.png`, `assets/469-r6-toasts-1440-dark.png`, `assets/469-r6-toasts-390-light.png` |
+| Disconnected 1440 light / dark, 390 dark | `assets/469-r6-disconnected-1440-light.png`, `assets/469-r6-disconnected-1440-dark.png`, `assets/469-r6-disconnected-390-dark.png` |
+| Empty board 1440 light / dark | `assets/469-r6-board-empty-1440-light.png`, `assets/469-r6-board-empty-1440-dark.png` |
+| Empty peers 390 light / dark | `assets/469-r6-agents-empty-390-light.png`, `assets/469-r6-agents-empty-390-dark.png` |
+| Board after load 1440 light, 390 dark | `assets/469-r6-board-1440-light.png`, `assets/469-r6-board-390-dark.png` |
+
+## AC8: keyed rendering
+
+How it works: a keyed pass (`keyedStart`) hands out one node per key. A card, peer row or memory row whose JSON signature is the same
+as last time is the same node; a changed one is rebuilt (its listeners close over its data, so it is replaced, not patched) and, if
+it held focus, `update()` hands the focus to the replacement. Keys that are gone are dropped. The card signature includes the
+board context, the capabilities its buttons depend on and the release name, so a change to any of those rebuilds the card.
+
+- **vm tests** (`test/dashboard-motion.test.ts`), on the real board code and the real `update()`: after a poll that changes one
+  task the other three cards are the same objects, the changed one is new, and a focused card keeps focus; a focused card that
+  itself changes passes its focus to its replacement; an unchanged poll leaves `children` as the same array; a gone card is removed
+  and the rest are untouched; a card that changes capability is rebuilt.
+- **Chrome**, four theme and size combinations: focus the first card, add a task, wait three polls: `document.activeElement` is
+  still that card, it is still connected, and the three cards after it are the same nodes (`3/3`), with the card count up by one.
+
+## AC9: motion, states
+
+- **Motion test over the CSS:** every `transition` is `none` or on `transform` or `opacity` only, 120 to 200 ms (the Office's own
+  .8 s transform move is pinned elsewhere and allowed up to .8 s); every `@keyframes` moves only `transform` and `opacity`; every
+  animation names one of the known keyframes at 120 to 200 ms (the Office ones keep their pinned timings); the only `infinite`
+  animation in the page is the Office pulse; and one `@media(prefers-reduced-motion:reduce)` rule turns `transition` and
+  `animation` off for `*`, `*::before` and `*::after`.
+- **Chrome with reduced motion emulated:** computed styles at 1440. With no preference: view animation `view-in` 0.16 s, button
+  transition 0.12 s, card transition 0.15 s, toast `toast-in`. With `reduce`: all four are `none` or `0s`.
+- **Skeleton:** five column blocks on the board and three bars in the peer list, `aria-hidden`, with the text "Loading the board..."
+  next to them. With `/snapshot` held they were on screen; after release `.skeleton` was gone from the page (0 left). They do not
+  animate.
+- **Empty views:** the board, peers, stream, approvals, memory (three cases) say what fills them and the command. Every command they
+  name is in `ahub help` (a test). The empty hub showed the board and peers texts in Chrome.
+- **Disconnected:** with `/snapshot` failing, `main` gets `data-stale`, its content measured `opacity 0.6`, the status read
+  "Disconnected / retrying: Failed to fetch", and the line read "Last snapshot at 10:43:11 PM. Polling continues every second."
+  After the fetch came back both were cleared. Seen at 1440 and 390, light and dark.
+- **Toasts:** three notices (one success, two errors) gave a stack of three with a Dismiss button each, the box inside the viewport
+  and no sideways scroll (`scrollWidth` equals the viewport). Five seconds later the success had faded and both errors were still
+  there; pressing Dismiss on each left none. Test: four at most, the same text replaces its toast, an empty text clears the stack,
+  the fade starts at 4 s and the removal 160 ms later, an error never expires, reduced motion keeps a success.
+
+## Pinned contracts changed (named, nothing loosened)
+
+- `test/ui.test.ts`: it read `#notice` as one element (`textContent`, `error`). With a stack those two reads come from the newest
+  toast, defined once in the harness. Every assertion below is unchanged.
+- `test/dashboard-views.test.ts`: it pinned five `setTimeout(` calls in the page. The five are still there; `notice()` adds two
+  (the fade and the removal), and the test now pins both counts, so a timer anywhere else still fails it.
+- The card's own transition was `transform .15s, box-shadow .15s`. It is `transform .15s` now, because the spec limits motion to
+  `transform` and `opacity`; the hover shadow still appears, without easing.
+- `update()` gained focus carry-over and `resetView` clears the keyed caches; neither changes the signature fast path.
+
+## Checks that were run red
+
+Each applied to the page, the new tests run, the file restored: a cache that never hits; no focus hand-off; a success toast that
+never fades; an error toast that fades; a `width` transition; a weakened reduced-motion rule; an `infinite` card animation; a
+disconnected line never cleared; an animated skeleton; a capability left out of the card signature. Each failed the test written
+for it.
+
+## Not covered
+
+- Peer rows and memory rows use the same keyed pass, but only the board's cards were driven through a poll in a browser and in the
+  vm tests; the peer and memory paths are covered by the shared pass test and by the existing tests, which still pass.
+- A card that is replaced and was hovered loses its hover until the pointer moves. That is the browser's behaviour for a new node.
+- The card's enter animation and the toast's fade were checked by computed style and by the test over the CSS, not watched.
+- Dragging a card across a poll was not exercised.
+- Chrome only. The dark skeleton, the 390 empty board and the Stream's empty text were not looked at one by one.