@staix/agent-hub 0.13.0 → 0.15.0

package/docs/verification/2026-10-23-terminal-claude-execution-root.md

@@ -0,0 +1,41 @@
+# Terminal Claude execution-root receipt
+
+Date: 2026-10-23. Native version: Claude Code 2.1.309. Scope: #525 R5b, slice 525-5.
+
+## Native cwd evidence
+
+An isolated HOME and CLAUDE_CONFIG_DIR, empty of authentication, loaded one fixture stdio MCP server. The native session ran from a separate fixture cwd with:
+
+```sh
+claude --bare --print --input-format stream-json --output-format stream-json --verbose --strict-mcp-config --mcp-config <fixture.json> --no-session-persistence --tools ''
+```
+
+The driver sent exactly one `control_request` with `request.subtype: initialize` and no user messages. The native control response was success. The fixture observed MCP initialize and tools/list. The MCP process's canonical cwd matched the native session cwd. Stderr was empty. The owned native session group was terminated and reaped afterwards; no fixture MCP process remained. No model request, login, real credential HOME or person's live session was used.
+
+A separate `claude mcp list` health check from two different fixture directories also started the server in each caller's canonical cwd. The actual session initialization, rather than that health check alone, is the basis for hello cwd.
+
+## Host admission and limits
+
+The launcher and daemon independently use the existing managed-worktree resolver. A matching launch id, private record executionCwd, native hello cwd and validated noncanonical worktree are all required. The proof is tied to the attached socket and claim generation. Missing or mismatched root stays unisolated; explicit routing refuses a write owner. A launch replacement or detach invalidates proof. Facts use the verified root, and recovery revalidates it against the declaration.
+
+The native observation covers this installed version's initialize-only session. It does not certify a real implementation turn, native --worktree behavior, a user hook that changes cwd, other native versions or kernel write isolation. The daemon rejects differing reported cwd regardless of those reasons. A real account/model turn remains the manual smoke leg.
+
+Runtime proof revalidates the worktree before owner reads/effects, sharing evidence only within synchronous code in one event-loop turn. This uses the existing resolver's aggregate 5-second Git budget per peer (up to four Git subprocesses). No terminal Claude implementer is declared in this repository, so this receipt makes no live multi-instance CPU claim. The existing resolver's ponytail applies: an asynchronous validation/admission boundary or correctly invalidated semantic inventory cache is the upgrade if that cost becomes material.
+
+## Verification
+
+Candidate checks are recorded in the PR and task handoff at the exact head. Focused tests cover positive ownership/facts, absent and mismatched evidence, replacement/detach, private-record and size fences, native launch cwd versus canonical hub root, and terminal recovery root/identity drift.
+
+Native candidate validation with pinned Bun 1.4.2: `scripts/check.sh --changed` passed 3,618 tests across 285 files, 194,424 assertions, 0 failures (753.24 seconds). The gate ended `check: no current-invocation agent-hub daemon leaks` and `check: OK (changed)`. Bundle freshness and npm package contents passed. The new mismatch test fails on a named assertion when the cwd comparison is removed, then passes with the source restored. CI on both OSes remains a separate exact-head review gate; no CI pass is claimed here.
+
+## R1 follow-up
+
+The review found that verifier-only declarations bypassed the implementer-only facts guard. Every declared worktree now requires current owner-root proof before facts permission or tree observations; absent/revoked proof returns no grant and no canonical-tree fallback. The regression establishes a real hook generation, changes permission through the console, then checks revoked and missing roots under both ask-when-needed and never-ask. It fails against the former facts guard.
+
+The channel resolves its cwd best-effort on each connection. A deleted native cwd omits root evidence while preserving hub messaging; an actual removed-directory reconnect regression fails against the former unguarded lookup and passes with the fix. This never upgrades missing evidence into owner isolation.
+
+The readonly-glob seed now targets the verified-root expression and still removes only readonly policy enforcement. Shard 14/64 passed all seven sequential green-to-named-assertion detections, including that seed.
+
+The original macOS CI failure at 9dc3cf03 was `hdiutil create` returning 1 before the HFS+ sandbox body ran, rather than an accepted forbidden write. This PR changes no sandbox/deny implementation or HFS+ test. The unchanged named HFS+ test passed three consecutive native runs (307 assertions each) on the R1 candidate. This does not establish the new head's GitHub macOS result; both-OS exact-head CI remains required.
+
+R1 local gate with pinned Bun 1.4.2: `scripts/check.sh --changed` passed 3,634 tests across 286 selected files, 194,501 assertions, 0 failures (762.35 seconds), no current-invocation daemon leaks, `check: OK (changed)`. The watchdog used the hosted macOS 1,260-second setting; per-test timeout stayed 20 seconds. This was the changed gate, not a 506-file full-suite claim. New-head CI remains unobserved until the reviewer reads its results.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -69,11 +69,13 @@
         "src/cli/configured-acp-entry.ts",
         "src/cli/preview.ts",
         "src/hub/roster.ts",
-        "src/hub/instances.ts"
+        "src/hub/instances.ts",
+        "src/hub/action-enforce.ts",
+        "src/hub/permission-payload.ts"
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -85,7 +87,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -99,11 +101,15 @@
         "src/adapters/registry.ts",
         "src/hub/instance-budget.ts",
         "src/hub/claude-state.ts",
-        "src/adapters/definitions/native-channel-state.ts"
+        "src/adapters/definitions/native-channel-state.ts",
+        "src/hub/usage-rollup.ts",
+        "src/adapters/kimi-wire-usage.ts",
+        "src/hub/kimi-usage.ts",
+        "src/hub/token-window.ts"
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -118,7 +124,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -175,7 +181,13 @@
         "src/adapters/configured-acp.ts",
         "src/hub/config-trust.ts",
         "src/cli/memory.ts",
-        "src/adapters/definitions/native-channel-state.ts"
+        "src/adapters/definitions/native-channel-state.ts",
+        "src/hub/task-code-group.ts",
+        "src/cli/status-lines.ts",
+        "src/hub/config-tier.ts",
+        "src/hub/config-edit.ts",
+        "src/hub/config-edit-host.ts",
+        "src/hub/claude-launch-proof.ts"
       ]
     },
     "docs/agent-notes/local-worker.md": {
@@ -199,7 +211,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -226,11 +238,16 @@
         "src/hub/no-writes.ts",
         "src/adapters/registry.ts",
         "src/hub/review-findings.ts",
-        "src/hub/plan-conformance.ts"
+        "src/hub/plan-conformance.ts",
+        "src/hub/sdlc-metrics.ts",
+        "src/hub/spec-read.ts",
+        "src/hub/workflow.ts",
+        "src/hub/deliverables.ts",
+        "src/hub/deliverable-files.ts"
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "d4defd2c7b0eabb1df4868329fdd6cfefafc72ec",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -249,7 +266,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",
@@ -258,7 +275,7 @@
       ]
     },
     "src/cli/help.ts": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
       "paths": [
         "src/cli/main.ts",
         "src/cli/launch.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",