@staix/agent-hub 0.12.45 → 0.14.0

package/docs/verification/2026-10-19-reviewer-isolation.md

@@ -9,6 +9,8 @@ Status: source integration and model-free production-backend admission are verif
 - Existing #223 Claude behavior is retained. This work adds no new live Claude acceptance proof.
 - Codex/Kimi fresh reviewer declarations require `review_mode: "fresh"`. Existing headless instances with roles `["reviewer"]` but no opt-in retain native transport/worktree/permission behavior and stay outside the fresh pool. Claude keeps #223 automatic selection; agy remains metadata-only unavailable. A failed fresh start never downgrades to a continuing native session.
 
+Current-version update: the [2026-10-22 receipt](2026-10-22-codex-reviewer-isolation.md) additionally verifies 0.163.0 and retains 0.146.0. The 0.163.0 unavailability statements below describe this historical slice.
+
 ## Codex native evidence
 
 - Exact executable used for offline probes: `/opt/homebrew/bin/codex`, reporting `codex-cli 0.146.0`. Its npm package resolves to a native binary. A separate fnm executable on PATH reports 0.163.0; that version has no receipt in this slice and must be unavailable.

package/docs/verification/2026-10-22-code-facts.md

@@ -0,0 +1,78 @@
+# Optional code-facts native receipt, 2026-10-22
+
+- Hub source commit: `21ed30ed72f6b5436126461945a9f409eb056b38`.
+- Native tool: installed ripwire 0.6.7. The module verifies its version and output schema/keys; this is not a binary attestation.
+- Host: macOS, Bun 1.4.2. Model-free tiny temporary Git fixture with two TypeScript functions; no model, provider login or live agent turn.
+- The production `CodeFacts` methods were invoked for changed symbols, one enclosing definition, existence and one-hop neighbours. All four returned parsed known values. Both actual XML verbs and the actual callers/callees JSON path were exercised.
+- The fixture's main HEAD stayed unchanged; after every read the disposable worktree was removed and only the original fixture checkout remained. The fixture itself was removed afterwards. No analysis of the agent-hub main checkout was performed.
+- Change kinds remain unknown: ripwire 0.6.7 omits deleted definitions and does not expose both-tree change identity. `countsFloor` is retained for graph observations. This receipt does not establish a complete semantic diff or graph.
+- Separate Linux fakes cover missing/version/schema/truncated/overflow failures, deadline teardown, an exited CLI leaving a descendant, reader close, untracked owner contamination, repository filters, metadata screening and review admission fences. The strict file/coverage gate is unchanged.
+
+## Parsed fixture values
+
+```json
+{
+  "changed": {
+    "state": "known",
+    "value": [
+      {
+        "name": "retained",
+        "kind": "fn",
+        "path": "a.ts",
+        "line": 1,
+        "ambiguous": false,
+        "change": "unknown"
+      },
+      {
+        "name": "added",
+        "kind": "fn",
+        "path": "a.ts",
+        "line": 3,
+        "ambiguous": false,
+        "change": "unknown"
+      }
+    ]
+  },
+  "at": {
+    "state": "known",
+    "value": [
+      {
+        "name": "added",
+        "kind": "fn",
+        "path": "a.ts",
+        "line": 3,
+        "ambiguous": false,
+        "change": "unknown",
+        "endLine": 3
+      }
+    ]
+  },
+  "exists": {
+    "state": "known",
+    "value": {
+      "exists": true,
+      "ambiguous": false
+    }
+  },
+  "neighbours": {
+    "state": "known",
+    "value": {
+      "countsFloor": true,
+      "callers": [
+        {
+          "name": "added",
+          "kind": "fn",
+          "path": "a.ts",
+          "line": 3,
+          "ambiguous": false,
+          "change": "unknown"
+        }
+      ],
+      "callees": [],
+      "hiddenAmbiguous": 0
+    }
+  },
+  "mainUnchanged": true,
+  "worktrees": 1
+}
+```

package/docs/verification/2026-10-22-codex-reviewer-isolation.md

@@ -0,0 +1,61 @@
+# Codex 0.163.0 fresh-reviewer isolation receipt
+
+Date: 2026-10-22. Platform: macOS arm64. Scope: model-free production `codexReviewerBackend.prepare`; no `codex exec`, model request, account login, credential copy or live review was performed. This extends the [0.146.0 receipt](2026-10-19-reviewer-isolation.md), retaining its limitations.
+
+## Source identity
+
+The upstream annotated tag `openai/codex` `rust-v0.163.0` resolves to tag object `129b8ec7ee6f4511557a4856279f529025c25af4`, peeled commit `83086188ae0614bd882818ff1aa23f3194962012` (`git ls-remote` readback).
+
+- [Exec switches](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/exec/src/cli.rs#L40) retain ephemeral sessions, ignored user config and ignored execpolicy rules. These do not remove every config layer.
+- [Apps gate](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/core/src/mcp.rs#L403) excludes the runtime compatibility MCP server when Apps is disabled; configured MCP inventory alone cannot establish that.
+- [Plugin manager](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/core-plugins/src/manager.rs#L821) returns no plugins when disabled. [MCP schema](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/config/src/mcp_types.rs#L234) retains disabled-server exclusion and the enabled-tools allowlist.
+- Legacy `notify` is independent of the hooks feature: [session construction](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/core/src/session/mod.rs#L5461), [hook registry](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/hooks/src/registry.rs#L124). The host now additionally pins `notify=[]` in both metadata proofs and returned exec argv. This is a source/argv guarantee, not a model-driven hook execution test.
+- [Seatbelt compiler](https://github.com/openai/codex/blob/83086188ae0614bd882818ff1aa23f3194962012/codex-rs/sandboxing/src/seatbelt.rs#L624) retains anchored unreadable-glob translation, including `**/`, canonical-prefix and ancestor protections.
+
+## Native production preparation
+
+The installed fnm launcher was selected explicitly, rather than changing `codex_bin` or downgrading the main peer. The producer resolves it to the native `@openai/codex-darwin-arm64` executable and hashes its bytes. Its receipt's binary identity is `sha256:721bb3cd0657262380cfc3458992e1d7ec2c0a9a6e4b7365924c2ffc71722d4e` (the receipt hashes the native binary digest in the bound-command file list).
+
+The probe created separate temporary HOME, CODEX_HOME and project directories. It removed inherited variables except PATH, TMPDIR and LANG, then set only those temporary homes. The hub transport was inert `/usr/bin/false` with no token. The actual production prepare function was invoked with a fresh session id, abort signal, fixed prompt and private paths. It returned a launch description; that launch was never executed. Both launch-owned and outer temporary directories were removed in `finally`.
+
+Runs:
+
+- Empty temporary homes, 0.163.0: passed every production admission leg.
+- Separate temporary home with only synthetic stdio and HTTP MCP declarations: passed; ambient servers were disabled stubs, and only `agent-hub` remained enabled with exactly `hub_review` and `hub_task_show`.
+- Final policy including `notify=[]`, 0.163.0 with synthetic ambient servers: passed again.
+- Retained 0.146.0 executable with final policy and empty temporary homes: passed. Its receipt binary identity is `sha256:4a6398187165c5bd75ad92c9a6fba6df6d401a59b62f7e1ecf9218a8196852a6`.
+
+After the centralized compatibility change (#691) merged, both final production preparations were repeated from the rebased source: 0.163.0 with synthetic ambient MCP entries and 0.146.0 with empty homes. Both passed again, retaining the binary identities above and the `legacy-notify-disabled` evidence.
+
+The producer required unique effective Apps/plugins/hooks rows with value false, exact MCP transport/tool readback, bounded bundled-model catalog validation, stable binary/config metadata, public read success and all native sandbox canaries below. Every successful launch returned `readOnly: true`, `strictMcp: true`, `ephemeral: true` and `current(): true`.
+
+| Native canary | Required observed result |
+| --- | --- |
+| Public file | Read allowed |
+| Exact private path | Read denied |
+| Nested `**/*.env` private path | Read denied |
+| Symlink alias into private glob | Read denied |
+| Portable-core `.env` and `.agenthub/state` | Read denied |
+| Synthetic host gh, kube and docker credential roots | Read denied |
+| Symlink alias into synthetic credential root | Read denied |
+| New file creation | Write denied; file absent |
+
+Central compatibility policy marks 0.146.0 and 0.163.0 as verified. Other versions are refused unless the person explicitly trusts that exact version on this machine; every runtime isolation proof still runs after trust. The receipt reports the observed version. Refusals name the observed and verified versions in a bounded diagnostic; malformed version output becomes unknown without echoing native text. The daemon preserves the centralized compatibility refusal, while ordinary isolation failures remain generic.
+
+## Evidence boundaries
+
+The network setting remains configured disabled, without a separate network probe. Web search is requested disabled; effective model-turn mode is not read back. Returned exec argv is checked, but no run proves exec selecting the named default permission profile. No account/model review, TUI interaction or native Linux result is claimed. These runtime tests exercise the installed macOS binary; same-user filesystem/config mutation after the final metadata check remains outside atomic snapshot guarantees. The supported credential-root list is bounded, not a classifier for every private host file. Hosted CI and the changed-source gate are separate code-verification evidence recorded on the PR.
+
+## Per-review start failure classes (#722)
+
+Date: 2026-10-23. Platform: macOS arm64, Codex 0.163.0 (Homebrew `/opt/homebrew/bin/codex` and the fnm launcher), no model request, login or credential copy. Every CLI run used a temporary HOME and CODEX_HOME with only PATH, TMPDIR and LANG inherited; the person's real `~/.codex` was never passed to an agent CLI (its file names and table names were read, never values).
+
+Reproduction of the reported `start_failed`, model-free, with the production `codexReviewerBackend.prepare`:
+
+- Empty temporary homes: the receipt was produced (14 evidence entries) on both launchers, in about 0.3 to 0.4 s.
+- Synthetic ambient configuration shaped like the real one (features, a marketplace, a plugin, four MCP servers with per-tool tables and an env table, a `hooks.json`): the receipt was produced in each of four variants.
+- Each proof command (`--version`, `features list`, `mcp list --json`, `debug models --bundled`) took 54 to 82 ms, idle and with 12 busy loops running, against the 2 s per-command and 12 s total budgets.
+- The proof commands did not rewrite `config.toml` (inode, size and mtime unchanged), so the config fence does not trip on them.
+- This machine's credential roots: none is a dangling link, and the checkout is inside none of them.
+
+So no hub bug was reproduced in the proof legs, and the first failure on 2026-10-22 happened in a daemon whose environment is not reproducible from the file system alone. The fix is the diagnosis: the refusal now carries one of the closed classes `version`, `binary`, `mcp_inventory`, `plugins_hooks_apps`, `sandbox_proof`, `credential_root`, `timeout`, `unknown`. It is in the unavailable reason, a `hub.log` line and the `reviewer` line of `ahub status`, and never holds a path, native CLI text or a token (a credential root is named by its path class). The next `start_failed` on this machine therefore names its leg. Fixture tests cover each class (`test/codex-review-isolation.test.ts`, `test/reviewer-pool-daemon.test.ts`, `test/output.test.ts`).

package/docs/verification/2026-10-22-kimi-qwen-compat.md

@@ -0,0 +1,79 @@
+# Kimi 2.3.0 and Qwen Code 0.26.0 compatibility receipt
+
+## Scope and identity
+
+This #373/#691 follow-up covers model-free native contracts. No real account, provider inference, personal configuration, native login, credential refresh or personal machine trust was used or changed. PATH's Kimi was already 2.3.0; PATH's Qwen remains 0.25.0. Qwen 0.26.0 was installed into a private temporary prefix with npm install scripts disabled. This receipt does not upgrade either tool.
+
+| Artifact | Binding |
+| --- | --- |
+| Kimi native macOS arm64 executable | version `2.3.0`; SHA-256 `33eb2b6201ec4864daba89f57e4913126b483fdbe22d70411691ef7dbfca190d` |
+| Kimi source | tag `@moonshot-ai/kimi-code@2.3.0`, commit [`b5e28fd6beac752a2cdcc0ff2f5fdf40e6494fbb`](https://github.com/MoonshotAI/kimi-code/tree/b5e28fd6beac752a2cdcc0ff2f5fdf40e6494fbb) |
+| Qwen package | `@qwen-code/qwen-code@0.26.0`; npm gitHead [`ac97ce7a70d9b2ea5d62b357e3d9b0851423afc9`](https://github.com/QwenLM/qwen-code/tree/ac97ce7a70d9b2ea5d62b357e3d9b0851423afc9) |
+| Qwen npm integrity | `sha512-JFO+gXpc3AVB+sR+ybQUb20DFfBMgB3p+F+rbru6xWeooYTixqOhCa3tOj0gCrDfkRxZFIziIH+zL05JgA2xVw==` |
+| Qwen `cli-entry.js` | SHA-256 `3c53a220bdf124e8ef9fd28cd3465c761a2a466deb6dc6a97272d0a6d1121f59` |
+| Qwen `chunks/acpAgent-5XER3TGL.js` | SHA-256 `a50d4de8c3c2abc90d3b5c2a9e00e0084f5a8cf21f0a66a3cc3125d6bd63f6a0` |
+
+## Kimi private production preparation
+
+The actual `kimiReviewerBackend.prepare` ran against an isolated HOME and a synthetic native KIMI_CODE_HOME containing only a managed `kimi` provider, invented access-only OAuth data, credentials/oauth directories and device identity. No personal file was linked. The producer created its own clean cwd, private home, empty skills directory and replace-mode environment. Its mode-0600 config contains the managed provider only, without the synthetic token value. Its agent YAML has exactly `mcp__agent-hub__hub_review` and `mcp__agent-hub__hub_task_show`, with `subagents: []`. Directory/device links point only to the synthetic source. `current()` passed and source config/token bytes survived cleanup.
+
+Before deciding the verified list, a synthetic trust record inside this disposable fixture lifted only the version gate; every production preparation check remained active. After the evidence passed and the verified entry was added, preparation was repeated without that fixture trust. Runtime checks remain required before every production child. This is native tool policy, not a filesystem/network sandbox.
+
+The real `createReviewerMcpSession` exposed exactly the two tools. A different task ID, a third tool and missing per-session authority were refused. Revocation refused subsequent reads. Native allowed calls reached the host only as `hub_task_show {id:7}` and `hub_review {id:7}`. No full daemon control token or actual project board was involved.
+
+## Kimi native allowlist positive and negative controls
+
+A separate native print fixture used the generated agent and task-bound MCP config. Only its managed provider endpoint and synthetic OAuth slot were redirected to a loopback fixed-response Anthropic-protocol server. These fixed responses perform no inference. The production prepared files were not modified; its `current()` remained true. No static API-key provider or OAuth-lock override was selected.
+
+The pinned native source derives an endpoint-specific OAuth key from `sha256(JSON.stringify({oauthHost,baseUrl})).slice(0,16)`, with prefix `oauth/kimi-code-env-`. Only invented access-only records were created in that slot. See [managed auth scoping](https://github.com/MoonshotAI/kimi-code/blob/b5e28fd6beac752a2cdcc0ff2f5fdf40e6494fbb/packages/oauth/src/managed-kimi-code.ts#L324) and [storage-name resolution](https://github.com/MoonshotAI/kimi-code/blob/b5e28fd6beac752a2cdcc0ff2f5fdf40e6494fbb/packages/oauth/src/toolkit.ts#L465).
+
+| Native case | Observed result |
+| --- | --- |
+| Exact two-tool agent | exit 0; four fixed-response requests, every inventory exactly the two hub names; both allowed MCP operations reached the host |
+| Inject unlisted `Write` | native result `Tool "Write" not found`; owned marker remained `unchanged` |
+| Same arguments with `Write` explicitly added to the agent | exit 0; two fixed-response requests, inventory includes `Write`; marker became `synthetic-write-control` |
+
+Both use production print flags (`-p`, stream-json, explicit agent file and empty skills). Children had new owned process groups, a 30 s deadline and a 1 MiB combined output cap; cleanup completed before temporary trees were removed. Synthetic source configuration/token bytes stayed unchanged. Session hints inside temporary homes were not resumed.
+
+Three earlier harness outcomes are retained as non-passes: combining `-p` with `--auto` was rejected before any request; redirecting the endpoint without its scoped synthetic token produced no configured credential and zero requests; a collector required `tool_result.is_error`, but native Kimi emits the explicit tool-not-found text without that flag. The corrected collector checks that actual refusal together with exact inventory, unchanged marker and the successful Write positive control. None was an authenticated attempt or a concealed native-version failure.
+
+## Qwen native ACP and permission contract
+
+The actual private-prefix CLI ran with isolated HOME/QWEN_HOME/QWEN_RUNTIME_DIR/XDG_CONFIG_HOME/TMPDIR, clean cwd and an allowlisted environment. It used a dummy OpenAI key, fixture model and unreachable loopback base, with `--acp --bare --advisor off --auth-type openai --telemetry=false`. No `session/prompt` or authentication RPC was sent. Native Node transport guards were loaded before imports; six background network attempts were blocked. No provider inference or account request occurred.
+
+Observed native readback:
+
+- initialize protocolVersion 1, served `agentInfo.name = qwen-code`, `version = 0.26.0`;
+- session/new with no MCP servers succeeded;
+- advertised modes: `plan`, `default`, `auto-edit`, `auto`, `yolo`;
+- native ACKs for `default -> auto-edit -> yolo -> default`;
+- bounded 30 s RPC deadlines and 1 MiB combined output; SIGTERM exit and whole owned process group gone.
+
+The hub continues to map only ask/default, ask-when-needed/auto-edit and never-ask/yolo. Auto and plan are not added to its permission map. The served ACP identity was checked independently of the npm/CLI version label.
+
+The published ACP chunk does not export its permission builder. A scratch copy rewrote import URLs to the installed package and added exports for the native `SubAgentTracker`, `toPermissionOptions` and `resolvePermissionOutcome`; native function bodies were unchanged. Its real `createApprovalHandler` ran with synthetic client/tool/event ports, without a prompt or tool execution. The request carried `sessionId`, `toolCallId`, pending status/title/content/locations/kind/rawInput and `_meta.toolName`; options carried `optionId`, `name`, and `kind`. Offered `proceed_once`/allow_once selection reached the native respond callback, cancellation resolved to cancel, and an unoffered option ID was rejected. The group was removed and no network attempt occurred in this callback fixture.
+
+This is published-code callback evidence, not a model-generated ACP permission turn. Existing host mapping tests retain configured-server/call-ID binding, raw-argument display and offered-option selection; an unrecognized title still requires ordinary approval. The callback does not grant any broader MCP identity.
+
+## Reproduction and remaining live legs
+
+The external `scratchpad/temp/agent-hub-373` evidence archive contains the bounded Kimi producer/result and Qwen initialize/mode/permission producers, synthetic transcripts, result JSON and SHA-256 manifest. The Kimi/hub producer uses pinned Bun 1.4.2; Qwen uses Node with Python controllers. Each repository runs one admitted native/test job at a time. The Qwen prefix is recreated from the exact npm package with `--ignore-scripts`; the native executable's served identity must still pass. No historical 2.2.0 live receipt is relabelled as a 2.3.0 pass.
+
+Real Kimi login/refresh and attached-TUI coexistence, a model-produced review verdict/quality, actual provider readiness, Qwen model-selected permission turns and production rollout remain unverified live legs. Kimi token usage is not measured by this receipt. The exact versions may enter compat verified; no future version, compatible line, sandbox relaxation or skipped runtime proof is inferred.
+
+
+## Host validation
+
+Focused portable fixtures: 49 pass, 0 fail, 277 assertions across `compat`, `qwen-peer`, `kimi-review` and `reviewer-mcp`; typecheck passed. The Qwen host parser also consumed the captured native callback fields and selected only an offered once option, with cancellation and unknown-option refusal. Kimi's final production preparation plus native controls passed with `fixtureTrustOnly: false`. The generated plugin bundle is rebuilt with pinned Bun after the frozen install; runtime isolation proofs are unchanged.
+
+External producer/result fingerprints:
+
+| Archive item | SHA-256 |
+| --- | --- |
+| `kimi-probe.ts` | `fc3a210f18736586fafd3294dd8f8212bf6e341b62deb6bff4828bcfce835bd4` |
+| `kimi-native-result.json` | `3c7008f251dcf0ac266dedcf1934c15dc53f1e1dc89a21aeb234e5742238b9c1` |
+| `kimi-verified-result.json` | `9d283932e1f01ca14694e577e30f0b9039a93c088267e16c8d3aff6367fff609` |
+| `qwen-probe.py` | `bc6834b0e3015f482262b22ea97c89cb5036e1b1ed97a59f19e7feff25bcbd6d` |
+| `qwen-native-result.json` | `9322ec7c575542d035cc6bbaf596d39b576a926b24de012b5e6492bf08d3c19d` |
+| `qwen-permission-result.json` | `8fd15c8e5c5e793992187e19b1f4bfdb60ce020fba13f55360b743c2528e34ae` |
+| `qwen-native-permission-exports.mjs` | `75ba574de1f52bfc45f4e49bacd4bf4b904946c401d43a35bd539f3ea54a27ff` |

package/docs/verification/2026-10-23-0.13.0.md

@@ -0,0 +1,89 @@
+# 0.13.0 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or a live TUI launch.
+
+## Candidate
+
+Version 0.13.0, from merged main at 1423a0c6. On 2026-10-22 the person directed: finish the work in progress and release agent-hub and agent-mem. They also set the version rule: a release with any feature bumps the minor version, and a fix-only release bumps the patch. This release adds features, so it is 0.13.0 rather than 0.12.46. The rule is now in AGENTS.md "Releasing".
+
+- Version policy for native agent CLIs (#691, #692): `ahub agents`, person trust, and named refusals. Receipts for Codex reviewer 0.163.0 (#697), and for Kimi reviewer 2.3.0 and Qwen Code 0.26.0 (#714).
+- Extra Jcode instances with hub tools bound to an owned launch (#685, #693).
+- Usage, in three slices (#683):
+  - U1, ledger events (#698);
+  - U2, the roll-up and `ahub usage` (#702);
+  - U3, the console Usage panel (#706).
+- Code structure (#682, #684):
+  - optional code facts (#703);
+  - head-bound task symbols (#708);
+  - console changed symbols (#709) and overlaps (#710);
+  - normalized plan-symbol overlap (#715).
+- SDLC:
+  - issue and PR identity linking (#694, #695);
+  - test integrity (#481 S4, #674);
+  - person release approval (#481 S6, #690);
+  - the dogfood scorecard (#687, #701, #704);
+  - profile review checklists (#507, #675).
+- Console review guidance (#711, #712) and the pull-only queue drain with person bulk discard (#713, #716). Empty pull-only polling is detected (#681, #696).
+- The action-policy foundation (#636 slice 1, #678). Adapter pre-tool gates are still pending.
+- Fixes:
+  - check exit and pipes (#558, #676);
+  - snapshot attribution (#612, #672);
+  - WIP-respecting readiness (#655, #671);
+  - sandbox kill markers (#700);
+  - flaky macOS tests (#375, #376, #378).
+- Still open:
+  - #689, config editing from the console and dashboard;
+  - #683 U4, the dashboard Usage view (board #358);
+  - agent-mem#13 P3 and P4, the hooks and the switch from the hub to amem;
+  - #684 phases 3 and 4.
+
+## Reviews
+
+Each PR was reviewed by the planner. Where a PR changed shared storage, concurrency or privacy, an independent read-only reviewer also checked it in an isolated worktree. Every codex-connector thread was fixed or answered and resolved before merge, and each PR merged only on exact-head CI success on Ubuntu and macOS.
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #692 (#691) | see PR | Registry guard, seed re-anchor | exact head, success |
+| #695 (#694) | see PR | Pre-effect identity semantics | exact head, success |
+| #706 (#683 U3) | b7bacde5 | Two rounds. The first-answer test asserted a fold time; it now asserts the complete-or-behind contract | exact head, success |
+| #707 (#378) | e2387aea | Two rounds; the seed now fails on a named assertion, not a timeout | exact head, success |
+| #708 (#684 2a) | 3c762864 | Separate-table receipt, flow-revision fence, PII drop | exact head, success |
+| #709 (#684 2b) | 23a0d7c6 | A connector P1 (a raw receipt rendered unscreened) fixed with a `repositoryKey` guard | exact head, success |
+| #710 (#379) | 3212f667 | Shared disjointness predicate, PII pairs excluded | exact head, success |
+| #712 (#711) | f571745c | Six changes per the issue; the agent-shell cause offers no bypass | exact head, success |
+| #714 (#373) | c959f131 | A connector finding (stale version guidance) fixed by deriving it from COMPAT | exact head, success (the local gate rerun at the hosted 1260 s ceiling) |
+| #715 (#682 1b) | e72578c0 | The dogfood row and two nits added by the reviewer, who said so in the PR | exact head, success |
+| #716 (#713) | a6206f0a | Eight items, including busy-peer queued discard and closed-list refusal causes; console-only discard | exact head, success |
+
+## Document review
+
+Fourteen documents were stale against the 0.12.45 stamps (`help.ts` against c969a519). Read-only reviewers in five groups checked each one against `git log <stamp>..HEAD` over its paths, plus PR #715's diff. They corrected every statement a merged change made wrong or missing, with a code reference for each.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.13.0; `ahub usage`; `ahub agents` and trust under Upgrading; verification link. |
+| `docs/quickstart.md` | corrected | Install pin `v0.13.0`; "Upgrading to 0.13.0" covers version policy, Jcode re-registration and instances, `ahub init`, Usage, dogfood, review choice, symbols, the pull drain and queue discard, and the release guard. Two working-day rows. |
+| `docs/operations.md` | corrected | The doc version; `usage` in the shared-table commands; the Usage console table; `[--json]` on queue discard; the usage telemetry; `ahub report --dogfood`; the Kimi TUI drain; agent versions and the `unknown` verdict; the scope of the weekly watch; headless Jcode instances. |
+| `docs/security.md` | corrected | `action_policy` is machine-local; the new events and usage access; console-only discard and version trust; refusals under `--live-test`; the trust record; the Jcode line plus trust and its owned-launch binding; agy trust; symbol screening; release authorization. |
+| `src/cli/help.ts` | corrected | `[--full]` on budget, board and doctor; `[--json]` on queue discard; the `unknown` agents verdict. Every other row matches the parsers in main.ts and launch.ts. |
+| `docs/agent-notes/adapters.md` | corrected | Scope paths; Jcode async preflight; `ahub agents` is console-only; instance home rules; Codex reviewer `notify=[]`; the inbox polling rule. |
+| `docs/agent-notes/budget.md` | corrected | `usage-rollup.ts` in scope; expired-pause resume; reset thresholds; planner refused during a private turn. |
+| `docs/agent-notes/bus.md` | corrected | Scope paths; the #713 rules checked against the code. |
+| `docs/agent-notes/local-worker.md` | corrected | Kill markers (#700). The `"direct"` removal is no longer promised for 0.13.0, because it remains. |
+| `docs/agent-notes/daemon.md` | corrected | Queue `D` discard; `action_policy` trust; the #612 HEAD-move rules. |
+| `docs/agent-notes/tasks.md` | corrected | Notice grouping pointer; normalized symbol overlap; task code symbols; test integrity; release authorization; the dogfood scorecard. |
+| `docs/agent-notes/tests.md` | corrected | Run local tests with `env -u AGENTHUB_HOME`, because the preload keeps an inherited hub home; ripwire test fakes. |
+| `docs/agent-notes/README.md` | corrected | Background section for the rationale moved out for 0.13.0. |
+| `docs/agent-notes/benchmarks.md` | no change | Its only source change, in sandbox.ts, is outside its scope. |
+
+Follow-ups noted by the reviewers, not changed in this release:
+- `scripts/check.sh` should unset `AGENTHUB_HOME`.
+- `usage-rollup.ts`, `inbox-polling.ts`, `task-code-symbols.ts`, `symbol-normalizer.ts`, `test-integrity.ts`, `sdlc-release-authorization.ts`, `dogfood*.ts` and `console-review/symbols/usage.ts` are not yet in the AGENTS.md area lists or the `verified.json` paths.
+
+## Retirement in this release
+
+The version bump closes the #481 deprecation window (`RETIRED_WORKFLOW_FROM = "0.13.0"`). `sdlc.workflow` no longer loads, and the `phase` receipt name is refused. Three workflow tests that used `phase` inside the window failed on the first release CI run. They now assert the refusal and record `criteria`, and their other assertions are unchanged. This project uses neither setting. `local.bash_network: "direct"` is not version-gated and only warns, so its removal moves to a later release. `docs/agent-notes/tests.md` was rechecked against that test change (no rule affected) and restamped at the test commit.
+
+## Release mechanics
+
+Merge the release PR with a merge commit, because the stamps name release-branch commits. Run `node scripts/check-docs.mjs --require-fresh` on the merged main, then tag `v0.13.0`. Afterwards read the published version back from the registry with a cache-busting request.

package/docs/verification/2026-10-23-0.14.0.md

@@ -0,0 +1,69 @@
+# 0.14.0 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or a live TUI launch.
+
+## Candidate
+
+Version 0.14.0, from merged main at 11623553. On 2026-10-23 the person directed the release. It includes features, so the minor version is bumped (AGENTS.md, Releasing step 1).
+
+- Roles capability per kind and form (#525-1, #725). A Claude channel instance may implement or verify in its own worktree. `planner` needs a kind that can plan, both for instances and for `roles` entries keyed by an instance id. This repository's claude holds the implementer role.
+- The dashboard Usage view (#683 U4, #726) and the task sheet's Code group (#684 phase 2c, #731).
+- SDLC metrics and control bands (#481 S7, #730): `ahub sdlc metrics`, `hub_sdlc_metrics`, and `[bands.<metric>]` with the log, diagnose and propose tiers.
+- The compact `ahub board` (#724, #728): one line per task, with `--full` keeping the wrapped layout.
+- Fixes:
+  - `ahub codex --as` for a headless reviewer (#720, #721);
+  - reviewer start-failure cause classes (#722, #727);
+  - issue identity linked at propose and accept (#723, #729);
+  - reserved backlog pulls offered to their reserved peer (#718, #732).
+- Still open:
+  - #689, config editing;
+  - #684 phases 3 and 4;
+  - agent-mem#13 P3 (board #391) and P4 (#392);
+  - #719, the post-upgrade daemon CPU (#386);
+  - the release-metric bands and gates-run record (#481, recorded in the S7 amendment).
+
+## Reviews
+
+The planner reviewed each PR. Where a PR changed shared storage, concurrency, privacy or the review path, an independent read-only reviewer also checked it in a detached worktree. Every codex-connector thread was fixed or answered, and resolved, before merge. Each PR merged on green CI at its exact head; a rebase that touched only CHANGELOG or the spec was rechecked to keep the code identical to the approved head.
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #721 (#720) | see PR | Headless `--as` returns after the start | exact head, success |
+| #725 (#525-1) | a4d0c284 | Connector P1: planner kept for instance-id roles, now gated in `effectiveInstanceRoles`; stale bundle rebuilt | exact head, success |
+| #726 (#683 U4) | 4ac69e30 | Three rounds: behind flag, render tests, docs, then the manager forwarding `view` through an allowlist | exact head, success |
+| #727 (#722) | 43334eb0 | Closed cause classes, no paths or native text; live check deferred to after this release | exact head, success |
+| #728 (#724) | 5ebf02a5 | Connector P2: long owner id kept the row single-line; person approved | exact head, success (two unrelated macOS flakes rerun) |
+| #729 (#723) | 32aa4f32 | Three connector threads fixed by the planner: ambiguous sibling refused, hint silent in mode off, backfill cursor | exact head, success |
+| #730 (#481 S7) | af0b7451 | Three rounds: stale-head evidence, episode cards, held timer, spec amendment, rename to `first_pass_check`, drift floor | exact head, success |
+| #731 (#684 2c) | e284dac2 | Two rounds: withheld plan names mark the group incomplete | exact head, success |
+| #732 (#718) | 6a782550 | Two rounds: seed rot and an invalid seed detection fixed; explain previews the reserved-only pull | exact head, success |
+
+## Document review
+
+Twelve documents were stale against the 0.13.0 stamps (88caef80, and d4defd2c for tests.md); the agent-notes README went stale through daemon.md during this review. Read-only reviewers in four groups checked each one against `git log <stamp>..HEAD` over its paths and the nine PRs, and corrected every statement a merged change made wrong.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.14.0; `ahub sdlc metrics` and bands; the dashboard Usage view; verification link. |
+| `docs/quickstart.md` | corrected | Install pin `v0.14.0`. "Upgrading to 0.14.0" covers the compact board, Usage view, Code group, metrics and bands, issue links, reviewer cause classes, Claude instances, reserved pulls, `--as` and the Claude restart. The board row in the working-day table. |
+| `docs/operations.md` | corrected | The Usage view `unavailable` state and omitted-limits note; the board column rule (min(30, longest title)), plus AFTER and OWNER at narrow widths; the Code group counts and `planWithheld`; the classes a Claude implementer instance can still be routed; the #525 refusals; `--as` for hub-started reviewers; cause classes; metrics and bands; S4 and S6 shipped, S5 pending; issue linking; reserved pulls. |
+| `docs/security.md` | corrected | The snapshot data of the Usage view and Code group; the manager's `view` allowlist; Claude instance worktrees; cause classes; issue linking with no GitHub read; the metrics authority, band card text and `band_notices`. |
+| `src/cli/help.ts` | corrected | `ahub sdlc metrics [--since <YYYY-MM-DD\|ISO time>]`. Every subcommand and flag in main.ts and launch.ts has a row. |
+| `docs/agent-notes/adapters.md` | corrected | Version and native-policy refusals keep their own sanitized message; how `ReviewerPrintPeer` classes its own failures. |
+| `docs/agent-notes/budget.md` | corrected | The roll-up's readers include the console panel and the dashboard; `UsageRollup.daily` rules. |
+| `docs/agent-notes/bus.md` | no change | No bus source changed; identifiers spot-checked. |
+| `docs/agent-notes/daemon.md` | corrected | Scope includes `task-code-group.ts`. Rules for: the `view` allowlist, the Usage view, the Code group, the band timer, the compact board (`STAGE_CODES` tracking sdlc.ts), Claude instance roles, and `--as` for reviewer variants. |
+| `docs/agent-notes/tasks.md` | corrected | Scope includes `sdlc-metrics.ts`. The #718 reserved-pull rule; `planner` needs `plannerEligible`; the qualified-title rule rewritten to match the code. |
+| `docs/agent-notes/README.md` | no change | Background only; the new daemon.md rules leave its rationale entries unchanged (stale through daemon.md, a listed path). |
+| `docs/agent-notes/tests.md` | no change | The new tests follow the existing rules; the #732 seed sentence matches seeds.json. |
+
+AGENTS.md area lists and the `docs/verified.json` paths gain `sdlc-metrics.ts`, `usage-rollup.ts`, `task-code-group.ts`, `spec-read.ts` and `status-lines.ts`.
+
+Follow-ups noted by the reviewers, not changed in this release:
+- A person-started Claude implementer instance is refused only for implement, test and bulk_edit tasks (`ownerIsolation`). Other classes can still route to it until #525-5. operations.md now says so.
+- The #725 planner filter also drops `planner` for configured ACP agents (they have no `projection`). This is documented now, but the PR did not announce it.
+- The #684 2c spec amendment says `codeGroup` screens symbol ids; the screening happens earlier, in `publicView`.
+
+## Checks
+
+The `scripts/check.sh` full gate, `node scripts/check-docs.mjs --require-fresh`, and CI on the release head are recorded in the release PR.