@staix/agent-hub 0.14.0 → 0.16.0

package/docs/verification/2026-10-23-terminal-claude-execution-root.md

@@ -0,0 +1,41 @@
+# Terminal Claude execution-root receipt
+
+Date: 2026-10-23. Native version: Claude Code 2.1.309. Scope: #525 R5b, slice 525-5.
+
+## Native cwd evidence
+
+An isolated HOME and CLAUDE_CONFIG_DIR, empty of authentication, loaded one fixture stdio MCP server. The native session ran from a separate fixture cwd with:
+
+```sh
+claude --bare --print --input-format stream-json --output-format stream-json --verbose --strict-mcp-config --mcp-config <fixture.json> --no-session-persistence --tools ''
+```
+
+The driver sent exactly one `control_request` with `request.subtype: initialize` and no user messages. The native control response was success. The fixture observed MCP initialize and tools/list. The MCP process's canonical cwd matched the native session cwd. Stderr was empty. The owned native session group was terminated and reaped afterwards; no fixture MCP process remained. No model request, login, real credential HOME or person's live session was used.
+
+A separate `claude mcp list` health check from two different fixture directories also started the server in each caller's canonical cwd. The actual session initialization, rather than that health check alone, is the basis for hello cwd.
+
+## Host admission and limits
+
+The launcher and daemon independently use the existing managed-worktree resolver. A matching launch id, private record executionCwd, native hello cwd and validated noncanonical worktree are all required. The proof is tied to the attached socket and claim generation. Missing or mismatched root stays unisolated; explicit routing refuses a write owner. A launch replacement or detach invalidates proof. Facts use the verified root, and recovery revalidates it against the declaration.
+
+The native observation covers this installed version's initialize-only session. It does not certify a real implementation turn, native --worktree behavior, a user hook that changes cwd, other native versions or kernel write isolation. The daemon rejects differing reported cwd regardless of those reasons. A real account/model turn remains the manual smoke leg.
+
+Runtime proof revalidates the worktree before owner reads/effects, sharing evidence only within synchronous code in one event-loop turn. This uses the existing resolver's aggregate 5-second Git budget per peer (up to four Git subprocesses). No terminal Claude implementer is declared in this repository, so this receipt makes no live multi-instance CPU claim. The existing resolver's ponytail applies: an asynchronous validation/admission boundary or correctly invalidated semantic inventory cache is the upgrade if that cost becomes material.
+
+## Verification
+
+Candidate checks are recorded in the PR and task handoff at the exact head. Focused tests cover positive ownership/facts, absent and mismatched evidence, replacement/detach, private-record and size fences, native launch cwd versus canonical hub root, and terminal recovery root/identity drift.
+
+Native candidate validation with pinned Bun 1.4.2: `scripts/check.sh --changed` passed 3,618 tests across 285 files, 194,424 assertions, 0 failures (753.24 seconds). The gate ended `check: no current-invocation agent-hub daemon leaks` and `check: OK (changed)`. Bundle freshness and npm package contents passed. The new mismatch test fails on a named assertion when the cwd comparison is removed, then passes with the source restored. CI on both OSes remains a separate exact-head review gate; no CI pass is claimed here.
+
+## R1 follow-up
+
+The review found that verifier-only declarations bypassed the implementer-only facts guard. Every declared worktree now requires current owner-root proof before facts permission or tree observations; absent/revoked proof returns no grant and no canonical-tree fallback. The regression establishes a real hook generation, changes permission through the console, then checks revoked and missing roots under both ask-when-needed and never-ask. It fails against the former facts guard.
+
+The channel resolves its cwd best-effort on each connection. A deleted native cwd omits root evidence while preserving hub messaging; an actual removed-directory reconnect regression fails against the former unguarded lookup and passes with the fix. This never upgrades missing evidence into owner isolation.
+
+The readonly-glob seed now targets the verified-root expression and still removes only readonly policy enforcement. Shard 14/64 passed all seven sequential green-to-named-assertion detections, including that seed.
+
+The original macOS CI failure at 9dc3cf03 was `hdiutil create` returning 1 before the HFS+ sandbox body ran, rather than an accepted forbidden write. This PR changes no sandbox/deny implementation or HFS+ test. The unchanged named HFS+ test passed three consecutive native runs (307 assertions each) on the R1 candidate. This does not establish the new head's GitHub macOS result; both-OS exact-head CI remains required.
+
+R1 local gate with pinned Bun 1.4.2: `scripts/check.sh --changed` passed 3,634 tests across 286 selected files, 194,501 assertions, 0 failures (762.35 seconds), no current-invocation daemon leaks, `check: OK (changed)`. The watchdog used the hosted macOS 1,260-second setting; per-test timeout stayed 20 seconds. This was the changed gate, not a 506-file full-suite claim. New-head CI remains unobserved until the reviewer reads its results.

package/docs/verification/2026-10-24-always-ask-adapters.md

@@ -0,0 +1,52 @@
+# Always-ask adapter receipt (#636 slice 3)
+
+The host sees and gates received Codex command approvals and every local/Pi model tool call. Codex remains listed as `always-ask not enforceable`: a native call can execute without sending an approval request. This is a capability ceiling, not a statement that all native calls were observed.
+
+## Native Codex boundary
+
+On 2026-10-24, the installed `codex-cli 0.163.0` ran under an isolated HOME and CODEX_HOME with a fresh project directory. The environment contained only the explicit executable PATH and those two isolated homes. Version, schema generation and app-server initialize completed with zero stderr bytes. No login, provider request, model turn or real personal Codex home was used. Native initialization confirmed 0.163.0 and the isolated home. Host and installation identifiers are omitted here.
+
+The generated ServerRequest schema SHA-256 is `f339be472737a0003efa25fba2e6e6c9237e621cd065b6d6995c51256e9dc1fb`. It defines:
+
+- `item/commandExecution/requestApproval`: threadId, turnId, itemId and startedAtMs; command/cwd may be null; kind may be command or writeStdin. The gate handles a reported command, excluding writeStdin, and binds its answer to the observed live turn. Its response is accept or decline.
+- `execCommandApproval`: conversationId, callId, command argv and cwd. The gate preserves argv for classification and answers approved or abort.
+- File-change and permission-profile approvals carry different payload contracts. They remain native, as do absent/unknown command payloads.
+- Native approval policy includes `never`. The existing hub mode mapper sends approvalPolicy never for never-ask. The proxy has no pre-tool path when no RPC is emitted. Received-RPC tests prove gating in all hub modes, not interception of an absent request. No authenticated native never-ask execution was attempted.
+
+Codex and ACP approval copy stays privacy-screened; a cut, withheld or changed command is deny-only. The local/Pi on-prem console receives the complete tool title as described below. An intercepted id is answered once and suppresses guessed, duplicated or late TUI replies. Thread/turn replacement, completion, interruption, disconnect and stop invalidate pending decisions before effects. A missing current native turn denies. `ponytail:` each socket retains at most 1024 intercepted ids; reaching the cap closes both sides instead of evicting late-reply fences. The upgrade is an explicit reattachment/session-lifetime protocol.
+
+## Local and Pi boundary
+
+The shared tool runner passes its parsed arguments into the existing host permit callback. The host fixes cwd/workdir to the execution root it actually uses and runs the same action classifier before never-ask, ask-when-needed and Pi's per-tool grant. A classed call waits for a person's allow-once or denial even in an unattended daemon. Only the separately labelled explicit class-budget option opens a bounded allowance. Unknown calls still follow their existing mode. All existing path revalidation, readonly and sandbox checks remain in place after approval.
+
+Pi's persisted call receipt contains the classification and approval operation, so replaying the same call id spends no second allowance. Its verified person-authored idle shell retains its existing person-command path. No model tool is relabelled as a person command.
+
+The managed terminal and headless Claude forms remain in the status table: terminal evidence must match a live hooked generation; the owned headless form installs the managed hook and accepts only current-child allow-once/denial through its native prompt tool. Native requirements are never relaxed by a cached class budget.
+
+A cut approval command is marked `[cut, N chars]` and offers only denial, with no allow-once or multi-call budget. Whole-command privacy screening precedes the cut. `ponytail:` startup still reads untracked machine-local action policy without retained person confirmation. Weakening defaults is visible as attention in status; the upgrade is a retained person-bound startup confirmation.
+
+## Verification
+
+The dedicated tests use loopback fake transports and fresh temp projects with no git remote. The harmless marker before `git push` proves whether a denied or stale call executed without requiring network activity. Native sandbox-exec provides the allowed-effect leg on macOS; Linux preserves the explicit unavailable-sandbox refusal rather than widening execution.
+
+Pinned Bun 1.4.2 typecheck and 74 focused tests passed (670 assertions), including real daemon Local/Pi approvals, managed headless Claude status, shared ACP/Claude regressions and the registry guard. Replacing the shared host gate with an unconditional native fallback made both new real-daemon tests fail named assertions, with no timeout; the original source was restored byte-for-byte. The full changed gate is recorded in the PR handoff. Real provider/model turns remain unverified. PR #749's budget kind/source fields and its token counters are separate from these per-session action allowances; its daemon and documentation hunks are retained when rebasing.
+
+
+## Rebase onto 0.15.0 and crash-status regression
+
+The branch keeps the 0.15.0 release changelog section and its Jcode/headless-Claude documentation recheck, with this feature under Unreleased. The generated bundle was rebuilt with frozen dependencies and Bun 1.4.2. Runtime and test code were unchanged by the rebase itself.
+
+A subsequent bot finding exposed an unexpected-exit status gap: Pi.fail marks the peer offline without setting its requested-stop flags, so acceptingTools alone could still report active enforcement. The status projection now requires both a non-offline state and acceptingTools. A real daemon regression makes its fake native Pi process exit with code 7; before the fix it fails the named enforceable=false assertion, and after the fix status is not enforceable and the stopped tool endpoint performs no effect. Typecheck, the 12 relevant tests (187 assertions), and bundle freshness pass. All test/gate invocations clear inherited AGENTHUB_HOME per the current area note. The interrupted pre-fix gate is not counted as passing proof; the final changed gate is reported separately.
+
+
+## Round-one presentation and status boundaries
+
+The person's on-prem local/Pi console now receives the complete host tool title after the class line, even for a private turn. The host-only optional presentation port must match the exact executed bash/git form. A shortened, withheld or mismatched view is deny-only and carries no class-budget choice. ACP/Codex consumers also enforce the deny-only flag against forged answers. Their unknown/unclassed native flow is unchanged. A public positive budget control remains covered; the former private-command budget-acceptance expectation is replaced with denial because approval of hidden commands is the rejected behavior.
+
+Red-first real daemon controls reproduced both failures: a 793-character command lost its significant tail at the public 512-character cut, and a PII-turn command became wholly withheld. They now verify full console visibility, denied effects and allow-once behavior, plus absence of private material from logs, status, ordinary peer messages and subsequent model history. Pi has its own long-command control. Incomplete host-title, native cut/withheld and forged grant controls deny.
+
+Managed Claude implementer status requires a current busy child generation. An idle instance with no process is not enforceable (also fixes #402); the idle assertion failed before that correction, while the existing active-child positive control remains. Local action allowances now use a dedicated session port and no longer widen contextSession for checkpoints, telemetry or supervision.
+
+Legacy Codex execCommandApproval has a conversation/call id but no provable native turn id by itself. Without an observed active turn from turn/started it is auto-declined, without a person request; no turn identity is invented. A dedicated legacy no-turn control pins this fail-closed compatibility ceiling. Native 0.163.0 command payload shapes were probed model-free; real legacy-provider behavior remains unverified.
+
+All actual conflict markers in operations.md were removed, preserving the intended local-policy text and its open startup-confirmation ceiling. The first-party tracked/untracked tree scan (excluding .git and node_modules) returns zero markers. Relevant focused checks pass 59 tests / 648 assertions; final gate results are in the PR handoff.

package/docs/verification/2026-10-24-amem-runtime.md

@@ -0,0 +1,69 @@
+# amem runtime integration receipt
+
+Task #392, agent-mem#13 Design F and AC7. The branch consumes the published first-party library, without vendoring it. This receipt describes fixture evidence, not a personal-memory migration or a live provider/model run.
+
+## Publication
+
+A cache-busting npm registry read on 2026-10-24 reported latest 0.6.0, published 2026-10-23T19:15:25.981Z, gitHead `2a182f2f23b7744a746b6854f9fb920df627a99f`. It contains P3 squash `0df2cf91`. The manifest and lock exact-pin 0.6.0; Bun 1.4.2 installed it before bundle generation.
+
+## AC7 mapping
+
+- Recall: actual temporary MemoryStore rows supply bounded curated recall; canonical project scope ignores the old caller's basename chain. Complete-row host screens exclude another project and private rows before selection. Native long-term/fails-first recall remains; supplemental short-term context replaces model-produced worker observations.
+- Capture: real published CaptureStore receives deterministic lifecycle/tool records, closes per append, and owns cap, retention and contention replay. A duplicate tool call is captured once; repeated Stop events at the same clock still remain distinct. Complete input/output is screened before the excerpt bound. Denied paths and memory bookkeeping are excluded. Capture rows never become curated ask/brief evidence.
+- Ask: genuine full `mem:` ids survive evidence generation and citation validation. A fake model's correctly cited answer is accepted using only actual stored evidence. Model answers/checkpoints are pending candidates; candidate text retains submitted metadata and kind. Old model-answer titles are excluded from curated projections.
+- Briefs: actual library rows supply search and neighbourhood results using published SearchIndex after screening. Native graph/fails-first presentation stays authoritative. Full ids do not invent legacy observation numbers.
+- No worker: the actual-client integration runs with fetch blocked and a worker tripwire listener that receives zero requests. Runtime client/capture expose no URL or worker endpoint dispatch. HTTP retained in test/fakes/mem-worker.ts is an explicitly injected host-only fake for historical ordering/privacy tests.
+- Privacy/profile: a real daemon with malformed selected-profile metadata completes two public local read turns and answers status while no capture database or spool is created, including SessionEnd. Selector bytes remain unchanged. Private turns remain suppressed by LocalPeer before capture; existing PII/secret/path tests retain their assertions.
+- Gate: required full `scripts/check.sh` and its exact head/check tail are recorded in the task handoff. Both OS CI is a separate reviewer check.
+
+## Validation and boundaries
+
+Pinned typecheck, bundle generation and 309 focused tests (1940 assertions) pass. A further 19 tests (265 assertions) verify the privacy change and profile fence. Reverting full-id citation support and bypassing complete-event capture screening each causes a named actual-store test to fail; original source is restored afterward. Final full-gate results supersede these focused checks.
+
+OCR delegation selected 11 reviewable files. Independent source review covered the eight production modules and manifest; generated bundle is checked by regeneration/freshness, and the test-only HTTP fixture is classified separately. It found three concrete issues (citation grammar, event identity/time and unavailable-profile capture), all fixed and rechecked, plus a misleading successful-save suffix, removed. Excluded tests/docs/lock are not claimed as OCR-covered. No reviewer verdict or CI result is inferred from this local review.
+
+Accepted behavior changes and ceilings are in docs/memory.md. Supplemental reads refuse above 4096 curated rows; policy-aware paging is the upgrade path. Duplicate-call timestamps retain 1024 newest ids; older repeated ids can capture again, and a host-supplied source-event timestamp is the upgrade path. Candidate text including provenance must fit the package's complete 4000-character bound or save is unavailable. `memory.native=false` deliberately disables curated reads/writes; enabled capture still requires its own selected-profile binding. `memory.worker_url` is ignored. Doctor reports installed library availability, not a store health proof. Historical benchmark arm labels are not evidence of a live worker or comparable new collection.
+
+No personal memory bytes were migrated, no claude-mem worker was stopped, and no release or publication is performed by this PR. The person-run cutover, real device sync and P6 resource/retrieval week remain separate.
+
+
+## Full-gate contract refresh
+
+The first full gate at `eb35d8b6` completed 6712 tests: 6708 pass, three obsolete contract assertions failed, one installed legacy/new consumer-parity leg skipped, and no current-invocation daemon leaks. The failed assertions expected the retired doctor worker row and duplicate auxiliary saves after a native write. Their replacements assert the exact-pinned library row, no worker row, native payload/kind preservation and zero auxiliary copies. A further 15 tests (133 assertions) pass, including a valid production daemon with a legacy worker tripwire URL: curated recall and control ask work, deterministic lifecycle/tool capture persists, raw capture is absent from evidence, and the listener receives zero requests. Reverting the unavailable-profile capture fence fails its actual daemon test on capture artifacts. Source is restored after each mutation.
+
+New memory_brief events identify source amem while retaining the old scalar claudeMem count for log-reader compatibility. Doctor attests the installed version against the exact pin without opening a memory store. The installed legacy/new consumer-parity skip is retained as unverified; this environment did not provide an installed ahub for that leg. Final required full-gate results are in the handoff, not inferred from focused checks.
+
+
+## Capture invocation identity
+
+The e90388b3 full suite passed 6712 tests with one installed-consumer skip and no leaks, but a separate actual-store probe found a missing case: two real turns reusing provider id call_0 produced only one tool row. A red-first real daemon test then executed four identical reads using call_0 twice per turn over two turns; all provider/control assertions passed before the capture count failed (expected 4, got 1).
+
+Capture now receives the existing LocalPeer session/turn/step plus a host invocation counter as sourceId. Its timestamp cache and published-store receipt bind that identity, while the original provider toolUseId remains metadata. A same-clock direct test separately proves that one observation replays once and different host invocations remain distinct. The real daemon test and prior local-worker/privacy tests pass together (31 tests, 222 assertions). The modified host path retains its private-turn gate and tool exclusions. The final full gate and exact fixed head are recorded in the handoff; the earlier green head is not claimed as proof of this fix.
+
+
+## Structured write-policy boundary
+
+The invocation-fixed 8b8b2025 full gate passed 6713 tests with one installed-consumer skip, no failures and no leaks (882.56 s). A later write-boundary probe found that JSON-escaped strings could bypass a whitespace PII pattern. The first probe used an inadmissible newline pii.paths entry and is not counted as production evidence. The corrected red-first tests use the valid routing pattern private\s+folder; raw path/value/key/title and a private JSON output tail beyond character 4000 are refused. A valid space-containing private-path policy also exposed cwd metadata falsely suppressing public events. These tests and complete custom-deny-path checks failed seven named assertions against 8b8b2025, without timeouts.
+
+Write policy now sees literal structured keys/values (including key: value secret pairs) and encoded actual data. Known tool input/output JSON is decoded once from full source text; storage bounding follows screening. Non-persisted host cwd/session/source identifiers are separated from content while canonical project/profile fences remain. The published store still owns final normalization. Public controls prevent a deny-all implementation from passing; the old fake HTTP response alone retains its legacy 4000 cap. Focused typecheck and 39 tests/276 assertions pass. A follow-up red-first numeric-password case fails on the string-only projection and passes when finite JSON scalars also contribute key: value pairs; the failed assertion received a stored capture id. The red-proof wrapper initially expected an error label Bun did not print, so its exit was not treated as the test result; the named assertion and restored source were checked directly. The earlier green full heads are not claimed as proof of this final privacy delta; the handoff records its own exact full-gate head/result.
+
+
+## PR 752 first-review corrections
+
+The obsolete worker-platform whitelist is removed from both the client and recall caller. Actual-store notes by local, jcode, Claude and Codex are delivered to every receiving peer, including its own notes; privacy and canonical-project exclusions stay before rendering. Supplemental reads now use the public bounded exact-project keyset pages, keep the newest candidates, and report truncation in recall/brief text and control status. Other projects' shared rows no longer displace these supplemental rows; native shared long-term recall remains. Relation metadata folding is a core cost still outside the row-body bound.
+
+The production native ask source now emits full memory ids, matching the client before dedupe and evidence budgeting. Legacy short-id host fixtures canonicalize only when one full id uniquely matches the prefix. Colliding full ids remain distinct. Capture reuses its profile-bound handle, reopens on changed effective R6 config before the next append, releases it on refusal/shutdown, and persists relative file paths instead of commands or absolute paths. The substring fallback matches separate terms. The legacy fallback invocation ceiling is explicit; live LocalPeer always supplies its own invocation identity. Stale agent-facing worker text and the identical-branch ternary are removed. Final exact-head test and CI state belong to the handoff; earlier green heads do not establish this delta.
+
+
+First-review validation before the final gate: pinned Bun 1.4.2 typecheck and bundle rebuild pass; 153 focused tests across nine files pass with 6644 assertions. Four restored-old-behavior probes each fail a named assertion for all-author recall, bounded page reads, ask id dedupe and relative-only path metadata, then restore source byte-for-byte. The cached-handle regression also changes home R6 bounds from 512 MB/90 days to 1 MB/1 day and proves the next append reopens the handle and removes the expired row. A real daemon control response and the person's status renderer both expose truncation. The required full-gate result and its exact head follow in the task handoff, not inferred from this focused run.
+
+
+## PR 752 second-review CI correction
+
+At `e288b1a4`, run 40028391482 failed Ubuntu's cancellation-permission fixture. macOS job 120670470231 had no failing assertion: the cancellation test and both document-baseline tests passed, and the suite was still passing benchmark tests when the 1260-second whole-suite watchdog terminated it (exit 143, no invocation daemon leaks). No snapshot fixture change was needed for that run.
+
+Only the cancellation late-answer fixture now holds the existing Bun fake-clock/timer ports after live child setup and before the permission request. It awaits a native WebSocket permission push instead of polling a fake clock, then cancels and answers allow while expiry and heartbeat remain held. The existing permit acknowledgement and final deny assertions are unchanged, with extra held-clock/timer/restoration controls. Real timers are restored in finally before daemon cleanup; ordinary expiry and stop tests retain real timers. A native WebSocket probe shows I/O remains live with both timer paths held. All 15 permission/projection tests pass (172 assertions). Removing the current-task cancellation guard fails the named final deny assertion, then the exact source is restored.
+
+Per the progressing-cutoff rule in tests.md, hosted macOS alone gets a 1440-second whole-suite watchdog and a 30-minute job ceiling. Ubuntu remains at 1080 seconds and 25 minutes, and every individual test keeps its 20-second limit. Production permission, snapshot and P3 resource limits are unchanged. Exact-head full-gate and CI status are recorded in the handoff.
+
+Pinned typecheck passes. The installed actionlint parser rejects the pre-existing concurrency.queue key identically on the baseline and modified workflow; it reports no additional diagnostic, and a successful actionlint run is not claimed. GitHub CI remains the workflow execution proof.

package/docs/verification/2026-10-24-codex-0164-reviewer-isolation.md

@@ -0,0 +1,55 @@
+# Codex 0.164.0 fresh-reviewer isolation receipt
+
+Date: 2026-10-24. Platform: macOS arm64. Scope: model-free production `codexReviewerBackend.prepare`; no `codex exec`, model request, account login, credential copy or live review was performed, and the person's real home and `~/.codex` were never passed to the Codex CLI. This extends the [0.163.0 receipt](2026-10-22-codex-reviewer-isolation.md) (and through it the [0.146.0 receipt](2026-10-19-reviewer-isolation.md)), retaining their limitations. Issue: #757.
+
+Result: every leg passed. `0.164.0` is added to `COMPAT["codex-review"].verified`.
+
+## Source identity
+
+The upstream annotated tag `openai/codex` `rust-v0.164.0` resolves to tag object `fe3b29455488c2e189e43ad5526a107900c5e1b7`, peeled commit `6aaac694803004a63c6f393d153c96d22521a6b9` (`git ls-remote` readback of `refs/tags/rust-v0.164.0` and `refs/tags/rust-v0.164.0^{}`, 2026-10-24). For comparison the 0.163.0 readback in the same call was tag object `129b8ec7ee6f4511557a4856279f529025c25af4`, peeled commit `83086188ae0614bd882818ff1aa23f3194962012`, matching the earlier receipt.
+
+Each file below was fetched at the peeled commit (HTTP 200) and the quoted region was read, not only located. Lines moved since 0.163.0 (the Apps gate and the notify wiring in particular), so the claims were rechecked against the code and not against the old line numbers.
+
+- [Exec switches](https://github.com/openai/codex/blob/6aaac694803004a63c6f393d153c96d22521a6b9/codex-rs/exec/src/cli.rs#L40): `--ephemeral` (no session files persisted), `--ignore-user-config` (`$CODEX_HOME/config.toml` is not loaded; auth still uses `CODEX_HOME`) and `--ignore-rules` (user and project execpolicy `.rules` are not loaded) are still global exec switches. They do not remove every config layer, so the host still fences config files itself.
+- [Apps gate](https://github.com/openai/codex/blob/6aaac694803004a63c6f393d153c96d22521a6b9/codex-rs/core/src/mcp.rs#L458): the implicit Apps connection is registered only when `apps_enabled` holds and the session is not `SessionIsolation::Isolated`; otherwise the compatibility registration is removed. A session with MCP servers disabled sets `apps_enabled = false` ([L279](https://github.com/openai/codex/blob/6aaac694803004a63c6f393d153c96d22521a6b9/codex-rs/core/src/mcp.rs#L279)). The configured MCP inventory alone cannot show the runtime compatibility server, so effective feature readback of Apps stays a required leg.
+- [Plugin manager](https://github.com/openai/codex/blob/6aaac694803004a63c6f393d153c96d22521a6b9/codex-rs/core-plugins/src/manager.rs#L823): `plugins_for_config` returns `PluginLoadOutcome::default()` (no plugins) when `plugins_enabled` is false. [MCP schema](https://github.com/openai/codex/blob/6aaac694803004a63c6f393d153c96d22521a6b9/codex-rs/config/src/mcp_types.rs#L240): `enabled` defaults true and a false server is not initialized; [`enabled_tools`](https://github.com/openai/codex/blob/6aaac694803004a63c6f393d153c96d22521a6b9/codex-rs/config/src/mcp_types.rs#L288) is an allow-list ("only these tools will be registered") and `disabled_tools` is applied after it.
+- Legacy `notify` is independent of the hooks feature. [Session construction](https://github.com/openai/codex/blob/6aaac694803004a63c6f393d153c96d22521a6b9/codex-rs/core/src/session/mod.rs#L5581) copies `config.notify` into `legacy_notify_argv` while `feature_enabled` is set separately from `Feature::CodexHooks`; the [hook registry](https://github.com/openai/codex/blob/6aaac694803004a63c6f393d153c96d22521a6b9/codex-rs/hooks/src/registry.rs#L133) builds an after-agent hook from a non-empty `legacy_notify_argv` without consulting that flag, and the session comment ([L2343](https://github.com/openai/codex/blob/6aaac694803004a63c6f393d153c96d22521a6b9/codex-rs/core/src/session/mod.rs#L2343)) says legacy notify settings stay session-static. The host therefore keeps pinning `notify=[]` in both metadata proofs and the returned exec argv. This is a source and argv guarantee, not a model-driven hook execution test.
+- [Seatbelt compiler](https://github.com/openai/codex/blob/6aaac694803004a63c6f393d153c96d22521a6b9/codex-rs/sandboxing/src/seatbelt.rs#L624): `build_seatbelt_unreadable_glob_policy` still turns each unreadable glob into anchored read and write denies, canonicalizes the static prefix (`canonicalize_glob_static_prefix_for_sandbox`), keeps the `/**/` literal-basename form and denies renames of every ancestor directory that could hold a match.
+
+## Native production preparation
+
+The installed fnm launcher for 0.164.0 was selected explicitly (`command: [<codex.js>]`), without changing `codex_bin`. The production resolver maps it to the native `@openai/codex-darwin-arm64` executable and hashes its bytes. Binary identity: `sha256:5b9983835177b544bba49d54b6679faf2f833a8b278068a158698f5c4eef1395`.
+
+How it was run. A throwaway producer (not committed) made a fresh temporary root with separate HOME, CODEX_HOME and project directories inside it, and started the production call in a child with a cleared environment: only PATH, TMPDIR, LANG, the two temporary homes and a marker for the temporary root. The child refused to run if HOME was the person's real home, if `os.homedir()` differed from HOME, if HOME, CODEX_HOME or the project was not inside the temporary root, or if any other variable was inherited. The hub transport was the inert `/usr/bin/false` with no token. The actual `codexReviewerBackend.prepare` was invoked with a fresh session id, an abort signal, a fixed prompt and private paths (`**/*.env`, `.private`, `nested/secret`, `~/private-proof`). It returned a launch description; that launch was never executed, and the temporary root was removed afterwards (no run directory was left).
+
+Runs:
+
+- Before the compat change, 0.164.0 with empty temporary homes: refused at the version leg only (`causeClass: version`, "Version not verified: ... 0.164.0 (verified 0.146.0, 0.163.0)"), in 0.13 s. This is the person's reported refusal, reproduced model-free.
+- With `0.164.0` added, 0.164.0 with empty temporary homes: passed every production admission leg (0.25 s).
+- With `0.164.0` added, 0.164.0 with synthetic ambient configuration in the temporary CODEX_HOME (a legacy `notify` command, Apps, plugins and hooks switched on, one stdio and one HTTP MCP server): passed again (0.26 s). Ambient servers were disabled stubs and only `agent-hub` stayed enabled with exactly the two review tools.
+- Retained 0.146.0 executable with the same policy and empty temporary homes: passed (0.40 s), binary identity `sha256:4a6398187165c5bd75ad92c9a6fba6df6d401a59b62f7e1ecf9218a8196852a6`, unchanged from the earlier receipts.
+
+Every successful launch returned `backend: codex`, `readOnly: true`, `strictMcp: true`, `ephemeral: true`, `current(): true`, `notify=[]` in its argv and no model run. The recorded evidence list was identical for all three passing runs: `model-free-mcp-inventory-disabled-ambient`, `hub-tools-exact-allowlist`, `plugins-and-hooks-disabled`, `legacy-notify-disabled`, `apps-disabled-effective-feature-readback`, `web-search-disabled`, `project-untrusted`, `native-public-read-private-deny-write-deny`, `native-glob-and-symlink-private-deny`, `portable-core-name-and-state-deny`, `standard-host-credential-roots-denied`, `binary-config-stable`, `binary-hash-once-metadata-fence`, `session-ephemeral`.
+
+| Native canary | Required observed result | 0.164.0 |
+| --- | --- | --- |
+| Public file | Read allowed | passed |
+| Exact private path | Read denied | passed |
+| Nested `**/*.env` private path | Read denied | passed |
+| Symlink alias into private glob | Read denied | passed |
+| Portable-core `.env` and `.agenthub/state` | Read denied | passed |
+| Synthetic host gh, kube and docker credential roots | Read denied | passed |
+| Symlink alias into synthetic credential root | Read denied | passed |
+| New file creation | Write denied; file absent | passed |
+
+The producer inside `prepare` requires unique effective Apps, plugins and hooks rows with value false, exact MCP transport and tool readback, a bounded bundled-model catalog check, stable binary and config metadata, public read success and all of the canaries above; a failure of any one refuses with a closed cause class (#722). None failed.
+
+## Compatibility change
+
+`COMPAT["codex-review"].verified` becomes `["0.146.0", "0.163.0", "0.164.0"]` (`src/adapters/compat.ts`). Another version is still refused unless the person runs `ahub agents trust codex-review <version>`, and every runtime isolation proof still runs after trust. The fixtures that used 0.164.0 as their example of an unverified version now use 0.165.0, and `test/compat.test.ts` covers the new entry and its neighbours (0.164.1, 0.165.0, a prerelease and a prefixed string stay refused).
+
+## Evidence boundaries
+
+Unchanged from the 0.163.0 receipt. The network setting remains configured disabled, without a separate network probe. Web search is requested disabled; the effective model-turn mode is not read back. Returned exec argv is checked, but no run proves exec selecting the named default permission profile. No account or model review, TUI interaction or native Linux result is claimed. The runs exercise the installed macOS binary; same-user filesystem or config mutation after the final metadata check remains outside atomic snapshot guarantees. The supported credential-root list is bounded, not a classifier for every private host file. The source claims are read at the 0.164.0 tag only; a later 0.164.x is a different version and is not covered. Hosted CI and the changed-source gate are separate code-verification evidence recorded on the PR.
+
+Each Codex upgrade still repeats these steps by hand; making the producer a committed one-command script is the follow-up named in #757, not part of this receipt.

package/docs/verification/2026-10-24-delivery-holds-ac8.md

@@ -0,0 +1,264 @@
+# Live receipt of hub-settled held deliveries and peer retries (#434 AC8)
+
+Live evidence for issue #434 AC8 collected from `.agenthub/state/hub.db` and daemon CLI readbacks on 2026-10-24. AC1–AC7 were merged in PRs #440, #448 and #578. This document records IDs, revisions, counts and timestamps only, with no message text.
+
+## Result
+
+- **Leg 1 (Hub-settled held deliveries):** Evidenced. 39 rows recorded in `resolution_history` with `actor = 'hub'` and `action = 'completed'`, all representing automated settlements of superseded notices across peers `claude` and `codex-review`.
+- **Leg 2 (Peer retries and retry evidence):** Evidenced. 2 peer retry rows recorded in `resolution_history` (`actor = 'peer:claude'`, `action = 'retry'`), and 27 rows recorded in `delivery_retry_evidence` across peers `claude` (18), `jcode` (8), and `kimi` (1).
+- **Daemon readbacks:** Captured `ahub status` (daemon 0.15.0 active on control port 4600) and `ahub queue` (both honest agent refusal and queue status snapshot).
+
+## Leg 1: Hub-settled held deliveries
+
+Query:
+```sql
+SELECT r.id, r.delivery_id, r.peer, r.actor, r.action, r.reason,
+       r.observed_revision, r.result_revision, r.result_state,
+       r.original_ids, d.created_at, d.updated_at
+FROM resolution_history r
+LEFT JOIN deliveries d ON r.delivery_id = d.id
+WHERE r.actor = 'hub' AND r.action = 'completed'
+ORDER BY r.id;
+```
+
+Total count: 39 rows.
+
+Summary by peer:
+- `claude`: 19 rows
+- `codex-review`: 20 rows
+
+Distinct reason categories:
+- Superseded review moved notices: 20 rows (tasks #120, #307, #317, #343, #362, #367, #391, #405, #406, #407, #408, #409, #410, #411)
+- Superseded task approved notices: 20 rows (tasks #113, #199, #202, #236, #238, #245, #267, #271, #272, #273, #302, #343, #368, #383)
+- Row 82 carries both reasons, so it counts in both categories.
+
+| ID | Delivery ID | Peer | Action | Reason | Observed Rev | Result Rev | Result State | Created At (epoch ms) | Updated At (epoch ms) |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| 41 | `6d1dabf0-0e7a-4dc4-b276-31236001d3e7` | claude | completed | superseded: task #245 approved | 9550 | 9557 | completed | - | - |
+| 42 | `311b138a-7c67-4e55-b964-430cb28d134a` | claude | completed | superseded: task #236 approved | 10450 | 10457 | completed | - | - |
+| 43 | `e9e94cc6-761d-4df9-89bd-970ea01b8777` | claude | completed | superseded: task #202 approved | 10451 | 10459 | completed | - | - |
+| 55 | `63f60bcf-88c5-4157-a829-ca86384ca091` | claude | completed | superseded: task #273 approved | 10917 | 10928 | completed | - | - |
+| 56 | `5d1adc89-900e-40d6-a8c4-7397264e0435` | claude | completed | superseded: task #267 approved | 10918 | 10930 | completed | - | - |
+| 57 | `7854b544-5e6b-4b8f-bd17-06af3dcf0139` | claude | completed | superseded: task #273 approved | 10919 | 10932 | completed | - | - |
+| 58 | `ffc88bfb-be43-49de-b71f-989aa3d42b56` | claude | completed | superseded: task #272 approved | 10920 | 10934 | completed | - | - |
+| 59 | `d844954d-fa8b-4e3c-9648-8eedb862126d` | claude | completed | superseded: task #272 approved | 10921 | 10936 | completed | - | - |
+| 60 | `332b6cba-8bbd-4ae5-bb69-f0270377e22b` | claude | completed | superseded: task #271 approved | 12987 | 12990 | completed | 1792545979266 | 1792611635109 |
+| 61 | `a46fa9df-3ce4-46bd-b371-50bddbf1c991` | claude | completed | superseded: task #302 approved | 13826 | 13836 | completed | 1792623040581 | 1792632313095 |
+| 71 | `f2978d0e-e721-4762-88d6-cbf2dce6e4d2` | claude | completed | superseded: task #199 approved | 16199 | 16212 | completed | 1792633725600 | 1792707673174 |
+| 72 | `a8b684cf-5ec2-412a-b1c9-9cab80a2abdd` | claude | completed | superseded: task #368 approved | 16200 | 16214 | completed | 1792636027148 | 1792707673748 |
+| 73 | `ec7ba4a9-7711-4793-a48e-50178bbea407` | claude | completed | superseded: task #238 approved | 16202 | 16216 | completed | 1792673774838 | 1792707674312 |
+| 75 | `00e42d5a-4025-4a74-81d8-1b4a4319d75f` | claude | completed | superseded: task #113 approved | 17300 | 17311 | completed | 1792717036914 | 1792731834168 |
+| 76 | `840b6b5a-218f-4f59-ac84-a9758c128b5c` | claude | completed | superseded: task #383 approved | 17406 | 17409 | completed | 1792723380061 | 1792732958999 |
+| 77 | `a5c2d3ca-5efb-410a-8bf8-0eb88f9a2b5b` | codex-review | completed | superseded: task #391 review moved | 18512 | 18516 | completed | 1792764956503 | 1792765089338 |
+| 78 | `0c3132cf-561b-4171-897b-68d83935ec61` | codex-review | completed | superseded: presence; task #120 review moved | 18569 | 18573 | completed | 1792766023588 | 1792766107384 |
+| 79 | `bca279a0-6ce3-448a-a63e-f14d878ea30a` | codex-review | completed | superseded: task #317 review moved | 18721 | 18725 | completed | 1792767098495 | 1792767215264 |
+| 80 | `47b252ce-5100-47d0-8cb4-23a7bbd38bf3` | codex-review | completed | superseded: task #343 review moved | 18880 | 18884 | completed | 1792770281363 | 1792770339943 |
+| 81 | `e5bc68fc-9f79-4d69-be5a-bc8499c75bf6` | codex-review | completed | superseded: task #405 review moved | 19280 | 19284 | completed | 1792806254483 | 1792806323145 |
+| 82 | `32b2da11-8255-4424-9b88-1be25f20f011` | codex-review | completed | superseded: task #120 review moved; task #343 approved | 19343 | 19347 | completed | 1792807212479 | 1792807284646 |
+| 83 | `f7ca1953-2947-4188-b26a-9359e19d7a22` | claude | completed | superseded: task #343 approved | 19356 | 19363 | completed | 1792770632001 | 1792807353138 |
+| 84 | `2a255963-39d6-4444-9351-be40c03c5ae9` | claude | completed | superseded: task #343 approved | 19357 | 19365 | completed | 1792771569426 | 1792807353716 |
+| 85 | `e2a05e26-f726-4a46-b633-8991bceeb11d` | claude | completed | superseded: task #343 approved | 19358 | 19367 | completed | 1792773205777 | 1792807354291 |
+| 86 | `ea242ca1-c4d3-4f9e-8ff4-bf9fbb6b3ffb` | claude | completed | superseded: task #343 approved | 19359 | 19369 | completed | 1792777170138 | 1792807354876 |
+| 87 | `9e559591-23d1-4191-8176-e13711d9f4e2` | codex-review | completed | superseded: task #410 review moved | 19508 | 19512 | completed | 1792810119681 | 1792810191086 |
+| 88 | `b56dc79b-38a4-4f8d-be9c-21ac897a06dc` | codex-review | completed | superseded: task #410 review moved | 19558 | 19562 | completed | 1792810477810 | 1792810549280 |
+| 89 | `0cc7bff2-07a6-4fed-b418-7329dce5b5c0` | codex-review | completed | superseded: task #120 review moved | 19602 | 19606 | completed | 1792811734528 | 1792811810101 |
+| 90 | `2b0a8cba-f2e2-4386-baf3-96a0c0fd74cf` | codex-review | completed | superseded: task #307 review moved | 19638 | 19642 | completed | 1792812394516 | 1792812484042 |
+| 91 | `4396b8f1-0244-482a-8ead-83e6530c815b` | codex-review | completed | superseded: task #409 review moved | 19768 | 19772 | completed | 1792813838541 | 1792813905267 |
+| 92 | `69277fb5-35ee-4eae-83e1-024a212084d7` | codex-review | completed | superseded: task #408 review moved | 19888 | 19892 | completed | 1792817545648 | 1792817592012 |
+| 93 | `f93b2128-f484-4315-95a4-4000320cfd5b` | codex-review | completed | superseded: task #409 review moved | 19922 | 19926 | completed | 1792818208498 | 1792818255247 |
+| 94 | `deeb38d5-2b80-4e00-8670-77b18a0d734a` | codex-review | completed | superseded: task #407 review moved | 19981 | 19987 | completed | 1792818319041 | 1792818376775 |
+| 95 | `502bc163-5402-4555-9624-779455927c8f` | codex-review | completed | superseded: task #406 review moved | 20034 | 20038 | completed | 1792818734567 | 1792818774051 |
+| 96 | `bbdb8cc4-683b-4599-a55d-6a67042af2c1` | codex-review | completed | superseded: task #407 review moved | 20104 | 20108 | completed | 1792818984020 | 1792819038495 |
+| 97 | `0398cef2-81bb-4a35-9db5-527354c13a1f` | codex-review | completed | superseded: task #362 review moved | 20192 | 20196 | completed | 1792821436652 | 1792821515862 |
+| 98 | `acc465f1-a4a7-4c08-824d-8cad246c21e4` | codex-review | completed | superseded: task #411 review moved | 20384 | 20388 | completed | 1792825648154 | 1792825731015 |
+| 99 | `19815686-118e-440a-8e74-e9168cf09c7e` | codex-review | completed | superseded: presence; task #367 review moved | 20478 | 20482 | completed | 1792829816207 | 1792829953436 |
+| 100 | `c5d72139-becd-4efd-84aa-93727f26e1c8` | codex-review | completed | superseded: task #307 review moved | 20570 | 20574 | completed | 1792831304320 | 1792831369674 |
+
+## Leg 2: Peer retries and delivery retry evidence
+
+### Resolution history peer retries
+
+Query:
+```sql
+SELECT r.id, r.delivery_id, r.peer, r.actor, r.action, r.reason,
+       r.observed_revision, r.result_revision, r.result_state,
+       r.original_ids, d.created_at, d.updated_at
+FROM resolution_history r
+LEFT JOIN deliveries d ON r.delivery_id = d.id
+WHERE r.actor LIKE 'peer:%' AND r.action = 'retry';
+```
+
+Total count: 2 rows.
+
+| ID | Delivery ID | Peer | Actor | Action | Reason | Observed Rev | Result Rev | Result State | Created At | Updated At |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| 44 | `bac5f601-0a40-40ca-bc33-2b322786ef3f` | claude | peer:claude | retry | recipient requested one uncertain redelivery | 10449 | 10463 | failed | - | - |
+| 74 | `e93041db-aa3f-4add-bb9a-6f0bdd4a49a0` | claude | peer:claude | retry | recipient requested one uncertain redelivery | 16201 | 16249 | failed | 1792672086395 | 1792708295642 |
+
+### Delivery retry evidence table
+
+Query:
+```sql
+SELECT project_id, peer, original_id, proof_id, warning
+FROM delivery_retry_evidence
+ORDER BY peer, original_id;
+```
+
+Total count: 27 rows.
+
+Counts by peer:
+- `claude`: 18 rows (10 warning, 8 non-warning)
+- `jcode`: 8 rows (0 warning, 8 non-warning)
+- `kimi`: 1 row (0 warning, 1 non-warning)
+
+| Project ID | Peer | Original ID | Proof ID | Warning |
+| --- | --- | --- | --- | --- |
+| `p_0afc219a423f4abb476a346b` | claude | `04ba3917-0114-4817-a08e-24aa5aeb2235` | `932d40ee-b48f-4469-b3a8-29e76a0f544d` | 1 |
+| `p_0afc219a423f4abb476a346b` | claude | `2435c0f1-9eee-4de0-87ba-5beef5c2f3d6` | `bac5f601-0a40-40ca-bc33-2b322786ef3f` | 1 |
+| `p_0afc219a423f4abb476a346b` | claude | `2d0d63eb-8225-4a00-8f58-0e133e0e8afa` | `e93041db-aa3f-4add-bb9a-6f0bdd4a49a0` | 1 |
+| `p_0afc219a423f4abb476a346b` | claude | `38af66af-9de5-4747-b2f5-f743d0152f4e` | `932d40ee-b48f-4469-b3a8-29e76a0f544d` | 1 |
+| `p_0afc219a423f4abb476a346b` | claude | `47e7187e-4ae6-4cb5-9430-73a439a53b2e` | `932d40ee-b48f-4469-b3a8-29e76a0f544d` | 1 |
+| `p_0afc219a423f4abb476a346b` | claude | `4eef920f-4071-48cd-befc-d8f0786b429f` | `34989d5f-91f5-4229-aa57-a24f907b8579` | 0 |
+| `p_0afc219a423f4abb476a346b` | claude | `53f3aacc-6e8c-44ea-8950-dcc6611ae81f` | `9868d37c-a074-4a5f-8dfb-ed57b7c5dece:retry:1` | 0 |
+| `p_0afc219a423f4abb476a346b` | claude | `5ba85330-7531-4202-91a5-5a0fd2389b9b` | `932d40ee-b48f-4469-b3a8-29e76a0f544d` | 1 |
+| `p_0afc219a423f4abb476a346b` | claude | `8b1ec4f5-3148-44fc-83f6-2464c9a63e5a` | `561b7945-b513-4d51-9ab6-6f3b493ff879` | 0 |
+| `p_0afc219a423f4abb476a346b` | claude | `a1961c24-5514-4616-85b1-e136aad3839d` | `bac5f601-0a40-40ca-bc33-2b322786ef3f` | 1 |
+| `p_0afc219a423f4abb476a346b` | claude | `bbd7cb90-1459-4f76-88df-56225915cb56` | `932d40ee-b48f-4469-b3a8-29e76a0f544d` | 1 |
+| `p_0afc219a423f4abb476a346b` | claude | `ccf59013-46b6-4076-a2be-247581f95813` | `9b498481-ef64-4bd0-8c40-c27b14292b52` | 0 |
+| `p_0afc219a423f4abb476a346b` | claude | `cebc507c-703a-4922-8302-3bff9c7c4de6` | `03ce737d-108f-4e39-83ce-356417f2a9d4` | 0 |
+| `p_0afc219a423f4abb476a346b` | claude | `d569be23-5aa5-4a14-bd1a-3b82e0afd70a` | `2593f2cc-1ae2-4e2b-9c0b-9ce42af38434` | 0 |
+| `p_0afc219a423f4abb476a346b` | claude | `d60f23f6-bc62-4f59-904c-a72d39af5d4f` | `7f729253-19d6-4c89-95e7-70aeeb270fbc:retry:1` | 0 |
+| `p_0afc219a423f4abb476a346b` | claude | `da0bab7a-1a87-4bcb-af7c-b7cc105c5959` | `e29af6c9-cfae-4adf-9bdc-1c47b7682b91` | 1 |
+| `p_0afc219a423f4abb476a346b` | claude | `e9bcc3b8-a8b9-4abb-a516-3562666695b6` | `932d40ee-b48f-4469-b3a8-29e76a0f544d` | 1 |
+| `p_0afc219a423f4abb476a346b` | claude | `f38b1e54-3cbb-49fd-9899-823df54475eb` | `ac82560b-42c1-4065-8b3b-f3d09dc146ab` | 0 |
+| `p_0afc219a423f4abb476a346b` | jcode | `0929dca7-1beb-405b-8d05-54da9d1e2a52` | `a40791a5-7fbe-4f8d-831e-50884f27c549` | 0 |
+| `p_0afc219a423f4abb476a346b` | jcode | `74075a33-5419-48ee-8bed-130bb73b0f83` | `a40791a5-7fbe-4f8d-831e-50884f27c549` | 0 |
+| `p_0afc219a423f4abb476a346b` | jcode | `80b383a8-685c-4646-bc2d-fce5e8d1af35` | `63f42c34-360a-489c-8b46-d6845a59d51d` | 0 |
+| `p_0afc219a423f4abb476a346b` | jcode | `957748a4-6300-4bfc-a7a2-f11eae1644e0` | `f6b775a7-ced0-4ee1-99a9-e960ae30604f` | 0 |
+| `p_0afc219a423f4abb476a346b` | jcode | `9a0f40a2-e758-4f9a-a227-1d825b23e888` | `3474c3f7-4b99-4446-a90f-b3282052a495` | 0 |
+| `p_0afc219a423f4abb476a346b` | jcode | `a84a651a-57fa-41b5-a897-777ef1e46614` | `63f42c34-360a-489c-8b46-d6845a59d51d` | 0 |
+| `p_0afc219a423f4abb476a346b` | jcode | `a8f3f51a-01f4-472f-9c29-1b95a8ca24fc` | `9d9793b1-36f7-4d53-9f77-a05eb12468a4` | 0 |
+| `p_0afc219a423f4abb476a346b` | jcode | `f6648a12-3490-47aa-8730-9a49db76e9db` | `a40791a5-7fbe-4f8d-831e-50884f27c549` | 0 |
+| `p_0afc219a423f4abb476a346b` | kimi | `9b94929f-37fe-4b20-81f4-80767415708d` | `22f98e94-8172-4550-bc17-71287accf410:retry:1` | 0 |
+
+## Daemon and queue readbacks
+
+### ahub status readback
+
+```text
+agent-hub 0.15.0  pid 40780  control 127.0.0.1:4600
+/Users/yj.lee/workspace/work/dev/agent-hub
+  config retained  action_policy.always_ask; run ahub settings reload
+  retained reason  action_policy.always_ask: guarded change needs a selected
+      setting or a confirmed terminal reload; review and run ahub settings
+      reload, or revert this key
+  memory  generation f1ea606e; ready; agent-mem 0.4.0
+  planner  claude (roles)
+
+PEER          STATE    MODE       LINK       Q  !  QUOTA     MODEL  CONTEXT
+agy           busy     -          pull-only  -  -  -         -      unknown
+  agy flow roles  implementer, verifier
+  agy catalog roles  unconfirmed
+  agy pending roles  none
+  pull-only  messages wait for hub_inbox; permission modes and session recovery
+      are not managed
+  agy last read  18m ago
+  agy action policy  always-ask not enforceable: adapter integration pending;
+      policy disabled
+  permission  unmanaged native permission policy
+claude        idle     -          attached   -  -  5h 7% in  -      83% 4s ago
+                                                   27m,             claude_statusline
+                                                   week 17%         
+                                                   in 5d11h         
+  claude flow roles  planner, reviewer, implementer
+  claude catalog roles  unconfirmed
+  claude pending roles  none
+  claude action policy  always-ask disabled
+codex         busy     -          attached   4  -  week 31%  -      50% 0s ago
+                                                   in 6d08h         codex_token_usage
+  codex flow roles  implementer
+  codex catalog roles  none
+  settling  53034269, 94dcbe81, cc717df7, 17fdcfaa
+  codex action policy  always-ask not enforceable: adapter integration pending;
+      policy disabled
+  codex oldest queued  30m ago
+codex-review  idle     -          attached   -  -  -         -      unknown
+  codex-review flow roles  reviewer
+  codex-review catalog roles  none
+  codex-review action policy  always-ask not enforceable: adapter integration
+      pending; policy disabled
+jcode         busy     unmanaged  attached   6  2  -         -      unknown
+  jcode flow roles  implementer, verifier
+  jcode catalog roles  none
+  settling  f5038b04
+  jcode action policy  always-ask not enforceable: adapter integration pending;
+      policy disabled
+  jcode oldest queued  33m ago
+kimi          idle     -          pull-only  1  -  -         -      unknown
+  kimi flow roles  implementer, verifier
+  kimi catalog roles  unconfirmed
+  kimi pending roles  none
+  pull-only  messages wait for hub_inbox; no push, steer, watchdog or automatic
+      quota handoff
+  kimi last read  5m ago
+  kimi action policy  always-ask not enforceable: adapter integration pending;
+      policy disabled
+  permission  Kimi approves tools in its own TUI; no hub permission mode
+  kimi oldest queued  2m ago
+pi            offline  -          attached   -  -  -                unknown
+  pi flow roles  implementer, verifier
+  pi catalog roles  none
+  pi action policy  always-ask not enforceable: adapter integration pending;
+      policy disabled
+
+settling: the adapter has not confirmed these deliveries yet (Claude: reply or
+    hub_delivery_done). Task state is independent.
+  agy planner WIP  1/1
+  claude planner WIP  1/1
+  codex planner WIP  2/2
+  codex-review planner WIP  0/1
+  jcode planner WIP  1/2
+  kimi planner WIP  1/1
+  pi planner WIP  0/1
+
+TASKS  318 approved, 51 backlog, 46 cancelled, 5 in_progress, 1 in_review, 9
+    proposed (ahub board)
+(O O) ? 1 for review
+```
+
+### ahub queue readback
+
+#### Agent session refusal readback
+
+```text
+ahub: agy cannot run ahub queue; the person runs it in ahub console or a terminal. Refused because inherited agent markers (AGENTHUB_PEER_ID) identify this shell as an agent. A ! command in an agent session runs as that agent; use a separate terminal outside the agent session
+```
+
+#### Terminal / un-marked readback snapshot
+
+```text
+ID                                            PEER          STATE      REV
+12618713-d740-4e41-8ccc-c8f12f274811          claude        completed  20537  24m
+453fb1fe-d1fd-4413-8886-2c4b1a8136b6          claude        completed  20541  24m
+8f872632-b4bc-4c68-8e1e-b1688264de4f          claude        completed  20545  19m
+b266d9ff-414a-4b47-a158-cf7583d7aee5          agy           completed  20547  18m
+4a50aca0-3e1f-4293-a240-d11688d54a0d          claude        completed  20551  17m
+q:jcode:0e32d14a-8291-4cfc-a8b2-7a809c9ddb84  jcode         queued     20603  15m
+ee72773d-9166-41a5-856d-61abb83aaae7          kimi          completed  20554  12m
+17fdcfaa-16ab-460f-b617-66e870e0b57e          codex         accepted   20557  12m
+q:codex:dd29e6f7-44c6-4ae8-af73-0d8ef153fe91  codex         queued     20603  12m
+be1b36aa-f52c-4fbe-ad3c-b69d5a2f9bc9          claude        completed  20562  12m
+c5d72139-becd-4efd-84aa-93727f26e1c8          codex-review  completed  20574  10m
+a2986e19-17d4-4c85-89a5-9563e0759100          claude        completed  20569  10m
+a1ff7fa6-0ddc-465d-ac81-558eab388f93          claude        completed  20582  9m
+4d1521d7-900f-4709-8705-c46383e3578b          codex-review  completed  20578  9m
+b40a92c7-0873-4c54-8c5e-757ff138dcb9          claude        completed  20586  8m
+9c600ed1-f4d4-419c-beb4-65a7fed6b2ea          claude        completed  20589  8m
+q:codex:a28fbf8e-1673-4247-a08d-9da95e4b47c3  codex         queued     20603  5m
+7458b24d-4249-43a3-a727-d8cf1bc97f01          kimi          completed  20592  5m
+q:kimi:9847f827-5fe4-4872-843d-d15a6d303a8e   kimi          queued     20603  2m
+089431f9-effd-4bb1-819c-c1f2359dff06          claude        completed  20598  2m
+q:jcode:aafbd751-b63b-4df3-9673-25dcc869b258  jcode         queued     20603  2m
+7a567c18-c8cd-4cf2-aa6b-ee1748950e0b          claude        completed  20603  1m
+q:codex:ea92d307-f97a-4088-bde2-ffb7d8bc010f  codex         queued     20603  1m
+```