@staix/agent-hub 0.12.44 → 0.13.0

package/docs/verification/2026-10-19-reviewer-isolation.md

@@ -9,6 +9,8 @@ Status: source integration and model-free production-backend admission are verif
 - Existing #223 Claude behavior is retained. This work adds no new live Claude acceptance proof.
 - Codex/Kimi fresh reviewer declarations require `review_mode: "fresh"`. Existing headless instances with roles `["reviewer"]` but no opt-in retain native transport/worktree/permission behavior and stay outside the fresh pool. Claude keeps #223 automatic selection; agy remains metadata-only unavailable. A failed fresh start never downgrades to a continuing native session.
 
+Current-version update: the [2026-10-22 receipt](2026-10-22-codex-reviewer-isolation.md) additionally verifies 0.163.0 and retains 0.146.0. The 0.163.0 unavailability statements below describe this historical slice.
+
 ## Codex native evidence
 
 - Exact executable used for offline probes: `/opt/homebrew/bin/codex`, reporting `codex-cli 0.146.0`. Its npm package resolves to a native binary. A separate fnm executable on PATH reports 0.163.0; that version has no receipt in this slice and must be unavailable.

package/docs/verification/2026-10-21-469-r1-dashboard-tokens.md

@@ -0,0 +1,43 @@
+# #469 R1: dashboard design tokens, screenshots and layout check
+
+Task #170, branch `feat/469-r1-tokens`. R1 changes the style block, the peer palette variants and the contrast test. It changes no
+layout, view, key or behaviour.
+
+## Source of the screenshots
+
+A scratch hub created under a `mktemp`-style directory outside any git repository (its own `AGENTHUB_HOME`, never the person's
+`~/.agenthub` or live hub), with five fake pull-only peers (claude, codex, kimi, pi, local), eight sample tasks (one in progress,
+one backlog) and one console message. Rendered by a headless Chromium (Chrome for Testing 156) over the DevTools protocol with
+`prefers-color-scheme` emulated, at 1440x1000 and 390x900. The Board view is shown: it is the default view, and the one R1's rules
+touch most. The other views use the same tokens.
+
+| | light | dark |
+| --- | --- | --- |
+| 1440 px | `assets/469-r1-board-1440-light.png` | `assets/469-r1-board-1440-dark.png` |
+| 390 px | `assets/469-r1-board-390-light.png` | `assets/469-r1-board-390-dark.png` |
+
+Computed `body` background in the run: light `rgb(238, 238, 241)`, dark `rgb(18, 19, 22)`; `scrollWidth` equals the viewport width at
+both sizes in both themes (no sideways scroll).
+
+## "No layout change", measured
+
+The same sample hub was rendered from `origin/main` (c4b1c998) and from this branch, and the rectangles of the header, the nav, its
+buttons, the board section, the progress strip, the agent slots, the columns and the cards were compared (148 rectangles over the
+four size and theme combinations).
+
+- Exact pixel equality does not hold, and is not claimed. R1 snaps spacing to the 4px scale, so three paddings grew from 10px to
+  12px: the board column (`.board-column`, 10px to 12px: columns 600 px to 635 px tall at 1440), the agent slot
+  (`.agent-slot`, 10px to 12px: 166 px to 178 px) and the 14px/18px section and row paddings moved to 12px/16px (`.section-head` 14px 18px to 12px 16px). Cards keep their height
+  except one empty-state card (47 px to 68 px) and are 3 px narrower at 1440 because their column is 4 px narrower inside. Nav
+  buttons are up to 4 px wider (control padding 6px/10px to 8px/12px; their 44 px minimum height hides the vertical change). The whole 390 px page is 78 px taller (2905 to
+  2983) and the 1440 px page 16 px taller (1595 to 1611).
+- Structure is identical in all 16 checks (4 selectors x 4 combinations): the same number of columns and rows, the same reading
+  order, 5 board columns at 1440 and 1 at 390, 8 nav buttons in 1 row at 1440 and in 2 rows at 390, the same 3 card columns.
+- Nothing scrolls sideways at 390 or 1440 px after the change.
+
+## Not covered
+
+- Only the Board view was photographed. Office, Stream, Agents, Message, Memory and Settings were not, so their light and dark
+  rendering is covered by the token and contrast tests and by reading the CSS, not by a picture.
+- 768 and 1024 px were not photographed (they belong to R2's AC3).
+- Chrome only; no Firefox or Safari rendering was run.

package/docs/verification/2026-10-21-469-r2-dashboard-shell.md

@@ -0,0 +1,54 @@
+# #469 R2: dashboard app shell, screenshots and width check
+
+Task #171, branch `feat/469-r2-shell` (on top of `feat/469-r1-tokens`). R2 adds the shell (top bar, sidebar or tabs), the icon sprite
+and the view keys. It keeps the view names, their order, the `agent-hub-view` cookie, the pinned ids and every action.
+
+## Source
+
+A scratch hub outside any git repository, with its own `HOME` and `AGENTHUB_HOME` (never the person's home or live hub): five fake
+pull-only peers, sixteen to twenty-four sample tasks, one console message. Headless Chromium (Chrome for Testing 156) over the
+DevTools protocol with `prefers-color-scheme` emulated. Every one of the seven views was visited at 1440, 1024, 768 and 390 px in
+light and dark (56 combinations), and one representative set is kept here.
+
+| View and size | image |
+| --- | --- |
+| Board 1440, light | `assets/469-r2-board-1440-light.png` |
+| Board 1440, dark | `assets/469-r2-board-1440-dark.png` |
+| Board 1024, light | `assets/469-r2-board-1024-light.png` |
+| Board 768, light (tabs) | `assets/469-r2-board-768-light.png` |
+| Board 390, light | `assets/469-r2-board-390-light.png` |
+| Board 390, dark | `assets/469-r2-board-390-dark.png` |
+| Agents 1440, dark | `assets/469-r2-agents-1440-dark.png` |
+| Agents 768, dark | `assets/469-r2-agents-768-dark.png` |
+
+## AC3: nothing scrolls the page sideways
+
+Measured in the page, not assumed: for each of the 56 combinations the document's `scrollWidth` was compared with the viewport width
+and every element past the right edge (outside the nav) was listed.
+
+- 1440 px: `scrollWidth` 1440 in all 14 view and theme combinations. 1024 px: 1024. 768 px: 768. 390 px: 390.
+- No element extended past the viewport in any of the 56 combinations.
+- The nav is a column of width 199 px at 1440 and 1024, and a row at 768 and 390 whose own `scrollWidth` (769) exceeds its
+  `clientWidth` (768 or 390): the tabs scroll inside the nav, as designed, and the page does not.
+- The top bar is 61 px tall from 1024 px up and 129 px at 768 and 390 (it wraps below 1024 px; the screenshots show it).
+
+## AC4: keys
+
+Tested through the page's own handler in the navigation test harness (`test/dashboard-views.test.ts`): `1`-`7` switch the seven
+views in order and write the cookie, `?` opens the key list, the buttons open and close it, and view keys are ignored inside an
+input, a textarea, a select, an editable node, with Ctrl, Alt or Cmd held, and while the key list or the task detail is open.
+`Esc` is the native dialog's own close and is not handled by the page. Six deliberate breakages of the key handler each fail a test (a seventh, accepting multi-character keys such as `01`, first survived and led to a stronger test), and eight breakages of the sprite, labels and shell CSS each fail a test too. Not covered: a
+real browser key press (no browser-driven test of the keys was run), and `Esc` itself, which rests on the dialog element.
+
+## Icons
+
+Nine Tabler Icons (outline) in one inline sprite, path data copied unchanged from tabler-icons; the MIT notice is in
+`THIRD_PARTY_NOTICES.md`. A test checks the count (at most 20), one stroke width, path-only symbols, no external reference, no
+unused or undefined symbol, `aria-hidden` on every icon, and a text label or `aria-label` next to each.
+
+## Not covered
+
+- Screenshots show Board and Agents only, at the sizes above; Office, Stream, Message, Memory and Settings were measured for width
+  but not photographed.
+- Chrome only. The sidebar's sticky height uses `100vh`, which on a mobile browser with a collapsing toolbar was not tried.
+- The "tabs scroll sideways" behaviour at 390 px is shown by the cut-off fourth tab in the screenshot, not by a scroll gesture.

package/docs/verification/2026-10-21-469-r3-dashboard-board.md

@@ -0,0 +1,51 @@
+# #469 R3: dashboard board, side sheets and the Plan sheet
+
+Task #172, branch `feat/469-r3-board` (on top of `feat/469-r2-shell`). R3 changes the cards, the task detail and where the five board
+forms live. It keeps drag and drop, the Pull and Assign buttons, the Ready and Waiting subheads, "Show N older" and every action.
+
+## Source
+
+A scratch hub outside any git repository with its own `HOME` and `AGENTHUB_HOME` (never the person's home or live hub): five fake
+pull-only peers, eight sample tasks (one in progress, backlog tasks, no owner on some). Headless Chromium (Chrome for Testing 156)
+over the DevTools protocol with `prefers-color-scheme` emulated, at 1440x1000 and 390x900.
+
+| What | image |
+| --- | --- |
+| Board 1440, light | `assets/469-r3-board-1440-light.png` |
+| Board 1440, dark | `assets/469-r3-board-1440-dark.png` |
+| Board 390, light | `assets/469-r3-board-390-light.png` |
+| Detail sheet 1440, light | `assets/469-r3-detail-1440-light.png` |
+| Detail sheet 1440, dark | `assets/469-r3-detail-1440-dark.png` |
+| Detail sheet 390, dark | `assets/469-r3-detail-390-dark.png` |
+| Plan sheet 1440, light | `assets/469-r3-plan-1440-light.png` |
+| Plan sheet 390, light | `assets/469-r3-plan-390-light.png` |
+
+## AC5: cards and the detail sheet
+
+Measured in the page for eight cards at each of the four size and theme combinations:
+
+- every card has two children (the head with the avatar and the title, and one line with the badge and the release chip), exactly one
+  badge, exactly one owner avatar, and a title no taller than two lines (`title height / line height` was 2 at most);
+- the page does not scroll sideways (`scrollWidth` equals the viewport at 1440 and 390);
+- the detail sheet is open and pinned to the right edge at 1440 (x 920, width 520, the full 1000 px height) and fills the screen at 390
+  (x 0, width 390, the full 900 px height); the Plan sheet likewise (x 880, width 560 at 1440).
+
+The detail groups its lines into Status, People, Dates and Links. Each original line (class, stage, waiting, rework, check, SDLC,
+overdue, owner, reviewer, guidance, description, planned and actual dates, release, GitHub link, pinned) appears exactly once, in its
+group; a group with nothing to show is left out. Group headings are `h4`, not `h3`, because the board tests find the five columns by `h3`.
+
+## AC6: the Plan sheet
+
+The five forms (`planning`, `split-backlog`, `release-new`, `release-plan`, `propose`) moved out of five `<details>` blocks (plan, split, releases, delivery evidence, propose) into one native
+`<dialog id="plan-dialog">` opened by a Plan button in the board toolbar. Their controls were compared with `origin/main`: identical
+ids and order in all five (11, 4, 3, 6 and 5 controls), and every submit handler still attaches by id. The Releases panel, the delivery
+evidence panel and the split panel keep their ids. A test now pins the full control list of each form.
+
+## Not covered
+
+- Drag and drop, hover and the pressed (dragging) shadow were not exercised in a browser: the drop handlers are unchanged and covered by
+  the existing board tests, and the hover and drag styles are CSS only, read, not seen.
+- Only the sample data above was rendered: no release chip, no GitHub link, no SDLC lifecycle and no rework round appear in the
+  screenshots; those lines are covered by the DOM tests only.
+- The sheet slide-in animation was not observed, and `Esc` rests on the native dialog.
+- Chrome only.

package/docs/verification/2026-10-21-469-r4-dashboard-views.md

@@ -0,0 +1,77 @@
+# #469 R4 and R5: the other dashboard views, glyphs to icons, Office colour checks
+
+Task #173, branch `feat/469-r4-views` (on top of `feat/469-r3-board`). R4 restyles Agents, Stream, Memory, Settings and Message and
+replaces the symbol glyphs. R5 puts the Office scene's colour use under the contrast test. Behaviour, view names and order, the view
+cookie, element ids and every action are unchanged.
+
+## Source
+
+A scratch hub outside any git repository with its own `HOME` and `AGENTHUB_HOME` (never the person's home or live hub): five fake
+pull-only peers, seven sample tasks plus a backlog task, four short-term memory notes (decision, fail, contract, finding) and three
+console messages. Headless Chromium over the DevTools protocol with `prefers-color-scheme` emulated, at 1440x1000 and 390x900.
+
+| What | image |
+| --- | --- |
+| Agents 1440 light / dark | `assets/469-r4-agents-1440-light.png`, `assets/469-r4-agents-1440-dark.png` |
+| Agents 390 dark | `assets/469-r4-agents-390-dark.png` |
+| Stream 1440 light, 390 light | `assets/469-r4-stream-1440-light.png`, `assets/469-r4-stream-390-light.png` |
+| Memory 1440 light / dark, 390 dark | `assets/469-r4-memory-1440-light.png`, `assets/469-r4-memory-1440-dark.png`, `assets/469-r4-memory-390-dark.png` |
+| Settings 1440 light / dark | `assets/469-r4-settings-1440-light.png`, `assets/469-r4-settings-1440-dark.png` |
+| Message 1440 light | `assets/469-r4-message-1440-light.png` |
+| Office (Flat) 1440 light / dark | `assets/469-r4-office-1440-light.png`, `assets/469-r4-office-1440-dark.png` |
+
+The rig also shot the other combinations (all six views at 1440 and 390, light and dark); only the ones above are attached.
+
+## R4
+
+- **Agents.** Every peer row (five of five) has one summary line (queued count, "Working on #n" or "No active task") and exactly one
+  closed `<details class="peer-fold">` holding the former meta lines. Row height was 144 to 145 px with the fold closed. The status
+  notice stays outside the fold. Approvals stay first.
+- **Stream.** The filter chips and Follow latest are in the section head, above the scrolling list. Each event is a head line (time,
+  sender, kind) above a monospace body; in the page the left edge of every event was the same x (249 at 1440, 29 at 390). That is
+  aligned rows, not four separate columns: the spec's "time column, kind, sender, body" is met as one head line plus the body.
+- **Memory.** Rows show title, a kind badge and a meta line with the id, peer and date and time (not a relative age); the selected row has an accent edge. The graph
+  and the detail pane use tokens only. With four notes: four rows, one pressed, the detail pane filled.
+- **Settings.** Six groups as sections. The reload row now has padding, and a "restart pending" badge and a count by "Pending
+  restart" exist in the markup. The text lines, Preview, Save and Undo are as before.
+- **Message.** Same form, capped at 640 px, with the shared field and label styles.
+- **No page scrolls sideways** in any of the six views at 1440 or 390 in either theme (`scrollWidth` equals the viewport).
+
+## AC7: glyphs
+
+- A test fails if any of `○ ● × ‖ ⚑ ★ → ⟳` is back as a quoted string in the page, and one fails if an Office shape name is renamed.
+  Both were run red (see below).
+- The star, the stream arrow and the Office "checking" mark are Tabler `star`, `arrow-right` and `refresh` (the path data was compared
+  with the upstream files, unchanged). The sprite has twelve symbols of the twenty allowed, and `THIRD_PARTY_NOTICES.md` names all of them.
+- The Office conditions are drawn as shapes (ring, disc, cross, bars, raised hand), each next to its words. The condition names
+  (`idle`, `busy`, `offline`, `paused`, `waiting`) are unchanged.
+- Every icon use sits beside a text label or has an `aria-label`; a test counts the `icon()` and `officeIcon()` call sites.
+
+## R5: Office colours and contrast
+
+The Office rules already named colours only through `var(--token)`, so nothing was remapped. What changed is the checks:
+
+- The colour-literal test no longer skips the Office block.
+- A new test reads the tokens each Office rule uses, fails on a token it does not classify, and checks text tokens at 4.5:1 and mark
+  tokens at 3:1 against the three Office surfaces (`--panel-soft`, `--panel`, `--control`), in both themes. The earlier R1 test
+  already covered text, `--dot`, `--on-accent`, disabled controls and the peer palette.
+- **Decision to review:** the hairline tokens `--line` and `--control-border` carry no information (room, desk and shelf edges,
+  dividers) and measure 1.2 to 1.7:1 on those surfaces, so they are classified as separators and not held to 3:1. If a reviewer wants a
+  3:1 edge, that is a colour change to the tokens, not a test change.
+
+## Checks that were run red
+
+Each was applied to the working tree, the tests run, and the file restored:
+
+- an Office rule using an unknown token: the new Office token test failed;
+- a `⟳` put back into the page script: the AC7 glyph test failed;
+- the Office `ring` shape renamed in `office-model.ts`: the AC7 shape test failed.
+
+## Not covered
+
+- The Office was shot in Flat mode with five idle peers. The busy, offline, paused and waiting shapes, the checking icon and the
+  approval hand were checked by the model tests and the DOM tests, not seen in a browser. Isometric was not shot.
+- The "restart pending" badge on a setting row and the Pending restart count need a pending key, and the sample hub had none, so they
+  were not rendered. They are covered by the DOM tests only.
+- Memory's long-term and tasks tiers, and the graph with more than one hop, were not shot.
+- Chrome only. Of the attached images, the Message and the dark Office were not looked at one by one.

package/docs/verification/2026-10-21-469-r6-dashboard-motion-states.md

@@ -0,0 +1,82 @@
+# #469 R6: keyed rendering, quiet motion, and loading, empty, disconnected and toast states
+
+Task #174, branch `feat/469-r6-motion` (on top of `feat/469-r4-views`). The poll interval, every action, authority rule and pinned
+element id are unchanged.
+
+## Source
+
+A scratch hub outside any git repository with its own `HOME` and `AGENTHUB_HOME` (never the person's home or live hub): five fake
+pull-only peers and eight sample tasks, plus a second hub with no peers and no tasks for the empty views. Headless Chromium over the
+DevTools protocol with `prefers-color-scheme` emulated, at 1440x1000 and 390x900. `/snapshot` was held, failed and released through
+the DevTools Fetch domain to produce the skeleton and the disconnected state.
+
+| What | image |
+| --- | --- |
+| Skeleton, board 1440 light / 390 dark | `assets/469-r6-skeleton-1440-light.png`, `assets/469-r6-skeleton-390-dark.png` |
+| Toast stack 1440 light / dark, 390 light | `assets/469-r6-toasts-1440-light.png`, `assets/469-r6-toasts-1440-dark.png`, `assets/469-r6-toasts-390-light.png` |
+| Disconnected 1440 light / dark, 390 dark | `assets/469-r6-disconnected-1440-light.png`, `assets/469-r6-disconnected-1440-dark.png`, `assets/469-r6-disconnected-390-dark.png` |
+| Empty board 1440 light / dark | `assets/469-r6-board-empty-1440-light.png`, `assets/469-r6-board-empty-1440-dark.png` |
+| Empty peers 390 light / dark | `assets/469-r6-agents-empty-390-light.png`, `assets/469-r6-agents-empty-390-dark.png` |
+| Board after load 1440 light, 390 dark | `assets/469-r6-board-1440-light.png`, `assets/469-r6-board-390-dark.png` |
+
+## AC8: keyed rendering
+
+How it works: a keyed pass (`keyedStart`) hands out one node per key. A card, peer row or memory row whose JSON signature is the same
+as last time is the same node; a changed one is rebuilt (its listeners close over its data, so it is replaced, not patched) and, if
+it held focus, `update()` hands the focus to the replacement. Keys that are gone are dropped. The card signature includes the
+board context, the capabilities its buttons depend on and the release name, so a change to any of those rebuilds the card.
+
+- **vm tests** (`test/dashboard-motion.test.ts`), on the real board code and the real `update()`: after a poll that changes one
+  task the other three cards are the same objects, the changed one is new, and a focused card keeps focus; a focused card that
+  itself changes passes its focus to its replacement; an unchanged poll leaves `children` as the same array; a gone card is removed
+  and the rest are untouched; a card that changes capability is rebuilt.
+- **Chrome**, four theme and size combinations: focus the first card, add a task, wait three polls: `document.activeElement` is
+  still that card, it is still connected, and the three cards after it are the same nodes (`3/3`), with the card count up by one.
+
+## AC9: motion, states
+
+- **Motion test over the CSS:** every `transition` is `none` or on `transform` or `opacity` only, 120 to 200 ms (the Office's own
+  .8 s transform move is pinned elsewhere and allowed up to .8 s); every `@keyframes` moves only `transform` and `opacity`; every
+  animation names one of the known keyframes at 120 to 200 ms (the Office ones keep their pinned timings); the only `infinite`
+  animation in the page is the Office pulse; and one `@media(prefers-reduced-motion:reduce)` rule turns `transition` and
+  `animation` off for `*`, `*::before` and `*::after`.
+- **Chrome with reduced motion emulated:** computed styles at 1440. With no preference: view animation `view-in` 0.16 s, button
+  transition 0.12 s, card transition 0.15 s, toast `toast-in`. With `reduce`: all four are `none` or `0s`.
+- **Skeleton:** five column blocks on the board and three bars in the peer list, `aria-hidden`, with the text "Loading the board..."
+  next to them. With `/snapshot` held they were on screen; after release `.skeleton` was gone from the page (0 left). They do not
+  animate.
+- **Empty views:** the board, peers, stream, approvals, memory (three cases) say what fills them and the command. Every command they
+  name is in `ahub help` (a test). The empty hub showed the board and peers texts in Chrome.
+- **Disconnected:** with `/snapshot` failing, `main` gets `data-stale`, its content measured `opacity 0.6`, the status read
+  "Disconnected / retrying: Failed to fetch", and the line read "Last snapshot at 10:43:11 PM. Polling continues every second."
+  After the fetch came back both were cleared. Seen at 1440 and 390, light and dark.
+- **Toasts:** three notices (one success, two errors) gave a stack of three with a Dismiss button each, the box inside the viewport
+  and no sideways scroll (`scrollWidth` equals the viewport). Five seconds later the success had faded and both errors were still
+  there; pressing Dismiss on each left none. Test: four at most, the same text replaces its toast, an empty text clears the stack,
+  the fade starts at 4 s and the removal 160 ms later, an error never expires, reduced motion keeps a success.
+
+## Pinned contracts changed (named, nothing loosened)
+
+- `test/ui.test.ts`: it read `#notice` as one element (`textContent`, `error`). With a stack those two reads come from the newest
+  toast, defined once in the harness. Every assertion below is unchanged.
+- `test/dashboard-views.test.ts`: it pinned five `setTimeout(` calls in the page. The five are still there; `notice()` adds two
+  (the fade and the removal), and the test now pins both counts, so a timer anywhere else still fails it.
+- The card's own transition was `transform .15s, box-shadow .15s`. It is `transform .15s` now, because the spec limits motion to
+  `transform` and `opacity`; the hover shadow still appears, without easing.
+- `update()` gained focus carry-over and `resetView` clears the keyed caches; neither changes the signature fast path.
+
+## Checks that were run red
+
+Each applied to the page, the new tests run, the file restored: a cache that never hits; no focus hand-off; a success toast that
+never fades; an error toast that fades; a `width` transition; a weakened reduced-motion rule; an `infinite` card animation; a
+disconnected line never cleared; an animated skeleton; a capability left out of the card signature. Each failed the test written
+for it.
+
+## Not covered
+
+- Peer rows and memory rows use the same keyed pass, but only the board's cards were driven through a poll in a browser and in the
+  vm tests; the peer and memory paths are covered by the shared pass test and by the existing tests, which still pass.
+- A card that is replaced and was hovered loses its hover until the pointer moves. That is the browser's behaviour for a new node.
+- The card's enter animation and the toast's fade were checked by computed style and by the test over the CSS, not watched.
+- Dragging a card across a poll was not exercised.
+- Chrome only. The dark skeleton, the 390 empty board and the Stream's empty text were not looked at one by one.

package/docs/verification/2026-10-22-0.12.45.md

@@ -0,0 +1,60 @@
+# 0.12.45 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or a live TUI launch.
+
+## Candidate
+
+Version 0.12.45, from merged main at 0612e5d5. The person directed on 2026-10-22 to finish the work in progress and release it.
+
+- Dashboard redesign (#469): tokens (#649), app shell and view keys (#650), board cards with detail and Plan sheets (#651), view restyle and Office colours (#659), keyed rendering, motion and loading, empty, disconnected and toast states (#660), and follow-ups (#662, #664).
+- External adapter modules and the conformance kit (#451 A4, #648, #653); the A5 guide and adapters note pass (#668).
+- Peer lists and the CLI surface derived from adapter definitions (#625, #656), and PeerAdapter capability members (#625 phase 6 slice 1, #667).
+- Structured review findings with an Important gate (#481 S3, #652, #657) and plan conformance with person-only departure acceptance (#481 S2, #665).
+- #230 S10 review-readiness rulings (#641, #643, #644), #428 racy same-size rewrites of large files (#646), #221 channel hints (#647), #225 stale roster keys and the shared git budget (#663), #654 Kimi TUI retained-command diagnostic (#658), and #661 held snapshot clocks for runner-speed-dependent daemon tests (#666, #669).
+- Still open: #655 (dependency-ready auto-assignment ignores the owner's WIP cap), board task #287 (external-kind instances), the later #625 phase 6 slices and #481 S4-S7.
+
+## Reviews
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #641, #643, #644 (#230) | see PRs | Spec ruling, then code review with red-first regressions | exact head, success |
+| #646 (#428) | e4b3fb9a | Two rounds with an independent reviewer (unbounded hashing and the atHead regression fixed) | exact head, success |
+| #647 (#221) | 0b1ae257 | Reviewer read; a connector P2 (legacy nudge under a held hint) fixed by the reviewer | exact head, success |
+| #648, #653 (#451 A4) | 222a5839, 4a271455 | Two rounds with independent security and packaging reviews; project-cwd SDK resolution, whole-daemon refusal and offline roster fixed; follow-ups in #653 | exact head, success |
+| #649, #650, #651, #659, #660 (#469) | see PRs | Reviewer read per phase; R3 seed rot re-anchored; connector findings fixed or tracked (#293, #296) | exact head, success (R6 after one Ubuntu rerun of the #661 flake) |
+| #652, #657 (#481 S3) | d60d5bd6, ecc4b39f | Two rounds with an independent reviewer (unbound-head bypass and head carry-forward fixed); a connector P1 (supplied head) fixed in #657 | exact head, success |
+| #656 (#625) | d803de2b | Reviewer read against the projection ruling; fixture correction (#294); bundle rebuilt after #658 | exact head, success |
+| #658 (#654) | a6409371 | Reviewer read; root cause reproduced by delay | exact head, success |
+| #662 | f46cb77f | Main-red fix after #656 and #660 crossed | exact head, success |
+| #663 (#225) | fd71191b | Reviewer read; three connector findings (instance eligibility, shared-config removal, result text) fixed red-first | exact head, success |
+| #664 (#296) | 0d21de7a | Reviewer read; fixes two connector P2s from #660 | exact head, success |
+| #665 (#481 S2) | 88bec9ab | Three rounds with an independent reviewer (rename and root-entry bypasses, status writes, off-mode, queue rename regression fixed); a connector P1 (departure scope) fixed red-first (#298) | exact head, success |
+| #666, #669 (#661) | 948b6afd, 389262df | Reviewer read; red-first with a slowed-git stand-in; a connector P1 (20 s per-test ceiling) fixed | exact head, success |
+| #667 (#625) | 17ab88d2 | Reviewer read against the phase 6 rulings | exact head, success |
+| #668 (#451 A5) | fc052e89 | Reviewer read; two connector P2s fixed by the reviewer | exact head, success |
+
+## Document review
+
+Fourteen documents were stale against the 0.12.44 stamps. Each was checked against `git log <stamp>..HEAD` over its paths (with PR #665's diff) by read-only reviewers in four groups, and corrected where a merged change made a statement wrong or missing.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.12.45; dashboard, adapter modules, review findings and plan conformance, stale roster key removal; verification link. |
+| `docs/quickstart.md` | corrected | Install pin `v0.12.45`; "Upgrading to 0.12.45" (dashboard, modules, findings, plan conformance and `accept-departure`, Kimi diagnostic, channel hints, #428). |
+| `docs/operations.md` | corrected | New "External adapter modules" section; recovery floor; conditional source refusal; shared git budget; stale roster keys; SDLC S3 and S2 with pointers to `docs/sdlc.md`. |
+| `docs/security.md` | corrected | A4 trust paragraph (a pin authorizes code, not a sandbox); delegated-CLI refusals include departure acceptance; metadata-only plan conformance reads; stale roster keys grant nothing. |
+| `src/cli/help.ts` | corrected | `release-assign <reason...>`; roster remove deletes a stale instance key; `plan-review` flag grouping; native usage rendered from definitions matches each entry parser. |
+| `docs/agent-notes/tasks.md` | corrected | Supplied-head binding, id-only settlement, hub-proposed recurrence markers, S2 conformance and departure consent rules; `plan-conformance.ts` in scope. |
+| `docs/agent-notes/daemon.md` | corrected | Module recovery floor, conditional source refusal, historical receipt reads, stale keys, external catalog, retained `kimi_cmd` diagnostic. |
+| `docs/agent-notes/adapters.md` | corrected | PeerAdapter capability ports (#667). |
+| `docs/agent-notes/tests.md` | corrected | Held snapshot clocks, the 20 s per-test ceiling, seed re-anchoring, CI tests the PR head, kit and fakes under `src/adapters/conformance/`. |
+| `docs/agent-notes/local-worker.md` | corrected | #428 racy large-file rule. |
+| `docs/agent-notes/budget.md` | corrected | `Budget.report` skips external module kinds. |
+| `docs/agent-notes/README.md` | corrected | Background section holding the rationale moved out of the notes. |
+| `docs/agent-notes/benchmarks.md`, `bus.md` | no change | Rules checked against the diffs; no contradiction. |
+
+`AGENTS.md` and `docs/verified.json` gain the new task-board and test paths, and the pre-0.7.7 issue-numbering note is removed from `AGENTS.md` at the person's request.
+
+## Release mechanics
+
+Merge the release PR with a merge commit (the stamps name release-branch commits), run `node scripts/check-docs.mjs --require-fresh` on the merged main, then tag `v0.12.45`.

package/docs/verification/2026-10-22-code-facts.md

@@ -0,0 +1,78 @@
+# Optional code-facts native receipt, 2026-10-22
+
+- Hub source commit: `21ed30ed72f6b5436126461945a9f409eb056b38`.
+- Native tool: installed ripwire 0.6.7. The module verifies its version and output schema/keys; this is not a binary attestation.
+- Host: macOS, Bun 1.4.2. Model-free tiny temporary Git fixture with two TypeScript functions; no model, provider login or live agent turn.
+- The production `CodeFacts` methods were invoked for changed symbols, one enclosing definition, existence and one-hop neighbours. All four returned parsed known values. Both actual XML verbs and the actual callers/callees JSON path were exercised.
+- The fixture's main HEAD stayed unchanged; after every read the disposable worktree was removed and only the original fixture checkout remained. The fixture itself was removed afterwards. No analysis of the agent-hub main checkout was performed.
+- Change kinds remain unknown: ripwire 0.6.7 omits deleted definitions and does not expose both-tree change identity. `countsFloor` is retained for graph observations. This receipt does not establish a complete semantic diff or graph.
+- Separate Linux fakes cover missing/version/schema/truncated/overflow failures, deadline teardown, an exited CLI leaving a descendant, reader close, untracked owner contamination, repository filters, metadata screening and review admission fences. The strict file/coverage gate is unchanged.
+
+## Parsed fixture values
+
+```json
+{
+  "changed": {
+    "state": "known",
+    "value": [
+      {
+        "name": "retained",
+        "kind": "fn",
+        "path": "a.ts",
+        "line": 1,
+        "ambiguous": false,
+        "change": "unknown"
+      },
+      {
+        "name": "added",
+        "kind": "fn",
+        "path": "a.ts",
+        "line": 3,
+        "ambiguous": false,
+        "change": "unknown"
+      }
+    ]
+  },
+  "at": {
+    "state": "known",
+    "value": [
+      {
+        "name": "added",
+        "kind": "fn",
+        "path": "a.ts",
+        "line": 3,
+        "ambiguous": false,
+        "change": "unknown",
+        "endLine": 3
+      }
+    ]
+  },
+  "exists": {
+    "state": "known",
+    "value": {
+      "exists": true,
+      "ambiguous": false
+    }
+  },
+  "neighbours": {
+    "state": "known",
+    "value": {
+      "countsFloor": true,
+      "callers": [
+        {
+          "name": "added",
+          "kind": "fn",
+          "path": "a.ts",
+          "line": 3,
+          "ambiguous": false,
+          "change": "unknown"
+        }
+      ],
+      "callees": [],
+      "hiddenAmbiguous": 0
+    }
+  },
+  "mainUnchanged": true,
+  "worktrees": 1
+}
+```

package/docs/verification/2026-10-22-codex-reviewer-isolation.md

@@ -0,0 +1,47 @@
+# Codex 0.163.0 fresh-reviewer isolation receipt
+
+Date: 2026-10-22. Platform: macOS arm64. Scope: model-free production `codexReviewerBackend.prepare`; no `codex exec`, model request, account login, credential copy or live review was performed. This extends the [0.146.0 receipt](2026-10-19-reviewer-isolation.md), retaining its limitations.
+
+## Source identity
+
+The upstream annotated tag `openai/codex` `rust-v0.163.0` resolves to tag object `129b8ec7ee6f4511557a4856279f529025c25af4`, peeled commit `83086188ae0614bd882818ff1aa23f3194962012` (`git ls-remote` readback).
+
+- [Exec switches](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/exec/src/cli.rs#L40) retain ephemeral sessions, ignored user config and ignored execpolicy rules. These do not remove every config layer.
+- [Apps gate](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/core/src/mcp.rs#L403) excludes the runtime compatibility MCP server when Apps is disabled; configured MCP inventory alone cannot establish that.
+- [Plugin manager](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/core-plugins/src/manager.rs#L821) returns no plugins when disabled. [MCP schema](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/config/src/mcp_types.rs#L234) retains disabled-server exclusion and the enabled-tools allowlist.
+- Legacy `notify` is independent of the hooks feature: [session construction](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/core/src/session/mod.rs#L5461), [hook registry](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/hooks/src/registry.rs#L124). The host now additionally pins `notify=[]` in both metadata proofs and returned exec argv. This is a source/argv guarantee, not a model-driven hook execution test.
+- [Seatbelt compiler](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/sandboxing/src/seatbelt.rs#L624) retains anchored unreadable-glob translation, including `**/`, canonical-prefix and ancestor protections.
+
+## Native production preparation
+
+The installed fnm launcher was selected explicitly, rather than changing `codex_bin` or downgrading the main peer. The producer resolves it to the native `@openai/codex-darwin-arm64` executable and hashes its bytes. Its receipt's binary identity is `sha256:721bb3cd0657262380cfc3458992e1d7ec2c0a9a6e4b7365924c2ffc71722d4e` (the receipt hashes the native binary digest in the bound-command file list).
+
+The probe created separate temporary HOME, CODEX_HOME and project directories. It removed inherited variables except PATH, TMPDIR and LANG, then set only those temporary homes. The hub transport was inert `/usr/bin/false` with no token. The actual production prepare function was invoked with a fresh session id, abort signal, fixed prompt and private paths. It returned a launch description; that launch was never executed. Both launch-owned and outer temporary directories were removed in `finally`.
+
+Runs:
+
+- Empty temporary homes, 0.163.0: passed every production admission leg.
+- Separate temporary home with only synthetic stdio and HTTP MCP declarations: passed; ambient servers were disabled stubs, and only `agent-hub` remained enabled with exactly `hub_review` and `hub_task_show`.
+- Final policy including `notify=[]`, 0.163.0 with synthetic ambient servers: passed again.
+- Retained 0.146.0 executable with final policy and empty temporary homes: passed. Its receipt binary identity is `sha256:4a6398187165c5bd75ad92c9a6fba6df6d401a59b62f7e1ecf9218a8196852a6`.
+
+After the centralized compatibility change (#691) merged, both final production preparations were repeated from the rebased source: 0.163.0 with synthetic ambient MCP entries and 0.146.0 with empty homes. Both passed again, retaining the binary identities above and the `legacy-notify-disabled` evidence.
+
+The producer required unique effective Apps/plugins/hooks rows with value false, exact MCP transport/tool readback, bounded bundled-model catalog validation, stable binary/config metadata, public read success and all native sandbox canaries below. Every successful launch returned `readOnly: true`, `strictMcp: true`, `ephemeral: true` and `current(): true`.
+
+| Native canary | Required observed result |
+| --- | --- |
+| Public file | Read allowed |
+| Exact private path | Read denied |
+| Nested `**/*.env` private path | Read denied |
+| Symlink alias into private glob | Read denied |
+| Portable-core `.env` and `.agenthub/state` | Read denied |
+| Synthetic host gh, kube and docker credential roots | Read denied |
+| Symlink alias into synthetic credential root | Read denied |
+| New file creation | Write denied; file absent |
+
+Central compatibility policy marks 0.146.0 and 0.163.0 as verified. Other versions are refused unless the person explicitly trusts that exact version on this machine; every runtime isolation proof still runs after trust. The receipt reports the observed version. Refusals name the observed and verified versions in a bounded diagnostic; malformed version output becomes unknown without echoing native text. The daemon preserves the centralized compatibility refusal, while ordinary isolation failures remain generic.
+
+## Evidence boundaries
+
+The network setting remains configured disabled, without a separate network probe. Web search is requested disabled; effective model-turn mode is not read back. Returned exec argv is checked, but no run proves exec selecting the named default permission profile. No account/model review, TUI interaction or native Linux result is claimed. These runtime tests exercise the installed macOS binary; same-user filesystem/config mutation after the final metadata check remains outside atomic snapshot guarantees. The supported credential-root list is bounded, not a classifier for every private host file. Hosted CI and the changed-source gate are separate code-verification evidence recorded on the PR.

package/docs/verification/2026-10-22-kimi-qwen-compat.md

@@ -0,0 +1,79 @@
+# Kimi 2.3.0 and Qwen Code 0.26.0 compatibility receipt
+
+## Scope and identity
+
+This #373/#691 follow-up covers model-free native contracts. No real account, provider inference, personal configuration, native login, credential refresh or personal machine trust was used or changed. PATH's Kimi was already 2.3.0; PATH's Qwen remains 0.25.0. Qwen 0.26.0 was installed into a private temporary prefix with npm install scripts disabled. This receipt does not upgrade either tool.
+
+| Artifact | Binding |
+| --- | --- |
+| Kimi native macOS arm64 executable | version `2.3.0`; SHA-256 `33eb2b6201ec4864daba89f57e4913126b483fdbe22d70411691ef7dbfca190d` |
+| Kimi source | tag `@moonshot-ai/kimi-code@2.3.0`, commit [`b5e28fd6beac752a2cdcc0ff2f5fdf40e6494fbb`](https://github.com/MoonshotAI/kimi-code/tree/b5e28fd6beac752a2cdcc0ff2f5fdf40e6494fbb) |
+| Qwen package | `@qwen-code/qwen-code@0.26.0`; npm gitHead [`ac97ce7a70d9b2ea5d62b357e3d9b0851423afc9`](https://github.com/QwenLM/qwen-code/tree/ac97ce7a70d9b2ea5d62b357e3d9b0851423afc9) |
+| Qwen npm integrity | `sha512-JFO+gXpc3AVB+sR+ybQUb20DFfBMgB3p+F+rbru6xWeooYTixqOhCa3tOj0gCrDfkRxZFIziIH+zL05JgA2xVw==` |
+| Qwen `cli-entry.js` | SHA-256 `3c53a220bdf124e8ef9fd28cd3465c761a2a466deb6dc6a97272d0a6d1121f59` |
+| Qwen `chunks/acpAgent-5XER3TGL.js` | SHA-256 `a50d4de8c3c2abc90d3b5c2a9e00e0084f5a8cf21f0a66a3cc3125d6bd63f6a0` |
+
+## Kimi private production preparation
+
+The actual `kimiReviewerBackend.prepare` ran against an isolated HOME and a synthetic native KIMI_CODE_HOME containing only a managed `kimi` provider, invented access-only OAuth data, credentials/oauth directories and device identity. No personal file was linked. The producer created its own clean cwd, private home, empty skills directory and replace-mode environment. Its mode-0600 config contains the managed provider only, without the synthetic token value. Its agent YAML has exactly `mcp__agent-hub__hub_review` and `mcp__agent-hub__hub_task_show`, with `subagents: []`. Directory/device links point only to the synthetic source. `current()` passed and source config/token bytes survived cleanup.
+
+Before deciding the verified list, a synthetic trust record inside this disposable fixture lifted only the version gate; every production preparation check remained active. After the evidence passed and the verified entry was added, preparation was repeated without that fixture trust. Runtime checks remain required before every production child. This is native tool policy, not a filesystem/network sandbox.
+
+The real `createReviewerMcpSession` exposed exactly the two tools. A different task ID, a third tool and missing per-session authority were refused. Revocation refused subsequent reads. Native allowed calls reached the host only as `hub_task_show {id:7}` and `hub_review {id:7}`. No full daemon control token or actual project board was involved.
+
+## Kimi native allowlist positive and negative controls
+
+A separate native print fixture used the generated agent and task-bound MCP config. Only its managed provider endpoint and synthetic OAuth slot were redirected to a loopback fixed-response Anthropic-protocol server. These fixed responses perform no inference. The production prepared files were not modified; its `current()` remained true. No static API-key provider or OAuth-lock override was selected.
+
+The pinned native source derives an endpoint-specific OAuth key from `sha256(JSON.stringify({oauthHost,baseUrl})).slice(0,16)`, with prefix `oauth/kimi-code-env-`. Only invented access-only records were created in that slot. See [managed auth scoping](https://github.com/MoonshotAI/kimi-code/blob/b5e28fd6beac752a2cdcc0ff2f5fdf40e6494fbb/packages/oauth/src/managed-kimi-code.ts#L324) and [storage-name resolution](https://github.com/MoonshotAI/kimi-code/blob/b5e28fd6beac752a2cdcc0ff2f5fdf40e6494fbb/packages/oauth/src/toolkit.ts#L465).
+
+| Native case | Observed result |
+| --- | --- |
+| Exact two-tool agent | exit 0; four fixed-response requests, every inventory exactly the two hub names; both allowed MCP operations reached the host |
+| Inject unlisted `Write` | native result `Tool "Write" not found`; owned marker remained `unchanged` |
+| Same arguments with `Write` explicitly added to the agent | exit 0; two fixed-response requests, inventory includes `Write`; marker became `synthetic-write-control` |
+
+Both use production print flags (`-p`, stream-json, explicit agent file and empty skills). Children had new owned process groups, a 30 s deadline and a 1 MiB combined output cap; cleanup completed before temporary trees were removed. Synthetic source configuration/token bytes stayed unchanged. Session hints inside temporary homes were not resumed.
+
+Three earlier harness outcomes are retained as non-passes: combining `-p` with `--auto` was rejected before any request; redirecting the endpoint without its scoped synthetic token produced no configured credential and zero requests; a collector required `tool_result.is_error`, but native Kimi emits the explicit tool-not-found text without that flag. The corrected collector checks that actual refusal together with exact inventory, unchanged marker and the successful Write positive control. None was an authenticated attempt or a concealed native-version failure.
+
+## Qwen native ACP and permission contract
+
+The actual private-prefix CLI ran with isolated HOME/QWEN_HOME/QWEN_RUNTIME_DIR/XDG_CONFIG_HOME/TMPDIR, clean cwd and an allowlisted environment. It used a dummy OpenAI key, fixture model and unreachable loopback base, with `--acp --bare --advisor off --auth-type openai --telemetry=false`. No `session/prompt` or authentication RPC was sent. Native Node transport guards were loaded before imports; six background network attempts were blocked. No provider inference or account request occurred.
+
+Observed native readback:
+
+- initialize protocolVersion 1, served `agentInfo.name = qwen-code`, `version = 0.26.0`;
+- session/new with no MCP servers succeeded;
+- advertised modes: `plan`, `default`, `auto-edit`, `auto`, `yolo`;
+- native ACKs for `default -> auto-edit -> yolo -> default`;
+- bounded 30 s RPC deadlines and 1 MiB combined output; SIGTERM exit and whole owned process group gone.
+
+The hub continues to map only ask/default, ask-when-needed/auto-edit and never-ask/yolo. Auto and plan are not added to its permission map. The served ACP identity was checked independently of the npm/CLI version label.
+
+The published ACP chunk does not export its permission builder. A scratch copy rewrote import URLs to the installed package and added exports for the native `SubAgentTracker`, `toPermissionOptions` and `resolvePermissionOutcome`; native function bodies were unchanged. Its real `createApprovalHandler` ran with synthetic client/tool/event ports, without a prompt or tool execution. The request carried `sessionId`, `toolCallId`, pending status/title/content/locations/kind/rawInput and `_meta.toolName`; options carried `optionId`, `name`, and `kind`. Offered `proceed_once`/allow_once selection reached the native respond callback, cancellation resolved to cancel, and an unoffered option ID was rejected. The group was removed and no network attempt occurred in this callback fixture.
+
+This is published-code callback evidence, not a model-generated ACP permission turn. Existing host mapping tests retain configured-server/call-ID binding, raw-argument display and offered-option selection; an unrecognized title still requires ordinary approval. The callback does not grant any broader MCP identity.
+
+## Reproduction and remaining live legs
+
+The external `scratchpad/temp/agent-hub-373` evidence archive contains the bounded Kimi producer/result and Qwen initialize/mode/permission producers, synthetic transcripts, result JSON and SHA-256 manifest. The Kimi/hub producer uses pinned Bun 1.4.2; Qwen uses Node with Python controllers. Each repository runs one admitted native/test job at a time. The Qwen prefix is recreated from the exact npm package with `--ignore-scripts`; the native executable's served identity must still pass. No historical 2.2.0 live receipt is relabelled as a 2.3.0 pass.
+
+Real Kimi login/refresh and attached-TUI coexistence, a model-produced review verdict/quality, actual provider readiness, Qwen model-selected permission turns and production rollout remain unverified live legs. Kimi token usage is not measured by this receipt. The exact versions may enter compat verified; no future version, compatible line, sandbox relaxation or skipped runtime proof is inferred.
+
+
+## Host validation
+
+Focused portable fixtures: 49 pass, 0 fail, 277 assertions across `compat`, `qwen-peer`, `kimi-review` and `reviewer-mcp`; typecheck passed. The Qwen host parser also consumed the captured native callback fields and selected only an offered once option, with cancellation and unknown-option refusal. Kimi's final production preparation plus native controls passed with `fixtureTrustOnly: false`. The generated plugin bundle is rebuilt with pinned Bun after the frozen install; runtime isolation proofs are unchanged.
+
+External producer/result fingerprints:
+
+| Archive item | SHA-256 |
+| --- | --- |
+| `kimi-probe.ts` | `fc3a210f18736586fafd3294dd8f8212bf6e341b62deb6bff4828bcfce835bd4` |
+| `kimi-native-result.json` | `3c7008f251dcf0ac266dedcf1934c15dc53f1e1dc89a21aeb234e5742238b9c1` |
+| `kimi-verified-result.json` | `9d283932e1f01ca14694e577e30f0b9039a93c088267e16c8d3aff6367fff609` |
+| `qwen-probe.py` | `bc6834b0e3015f482262b22ea97c89cb5036e1b1ed97a59f19e7feff25bcbd6d` |
+| `qwen-native-result.json` | `9322ec7c575542d035cc6bbaf596d39b576a926b24de012b5e6492bf08d3c19d` |
+| `qwen-permission-result.json` | `8fd15c8e5c5e793992187e19b1f4bfdb60ce020fba13f55360b743c2528e34ae` |
+| `qwen-native-permission-exports.mjs` | `75ba574de1f52bfc45f4e49bacd4bf4b904946c401d43a35bd539f3ea54a27ff` |