@staix/agent-hub 0.15.0 → 0.17.0

package/docs/verification/2026-10-25-0.16.0.md

@@ -0,0 +1,82 @@
+# 0.16.0 release verification
+
+This record covers release preparation and source review. It claims no installation, running-hub restart or live TUI launch.
+
+## Candidate
+
+Version 0.16.0, built from merged main 0ba9bc09. The release commit 267f39c0 carries the version, CHANGELOG section and bundle, and every document stamp names it. The person directed the release on 2026-10-25. It includes features, so the minor version is bumped (AGENTS.md, Releasing step 1). It ships with agent-mem 0.7.0, which was published first through its tag workflow and read back from the registry (version, tarball and integrity; `latest` 0.7.0) and from its GitHub Release body.
+
+- Always-ask slice 3 (#750): the local worker, Pi and Codex command approvals are classed. A throwing gate asks deny-only. `gh api graphql` is classed by operation (#761), and the literal words around a shell expansion are classed, failing closed where the opaque part can change the class (#763).
+- Memory:
+  - the hub uses the amem library for recall and capture, with no claude-mem worker calls (#752);
+  - verified symbol anchors and `ahub doctor --stale-anchors` (#769);
+  - bounded preparation that keeps historical recall (#770);
+  - current-head code neighbours for graphs and briefs (#771);
+  - the exact agent-mem pin is 0.7.0 (this release's pin PR), passing the hub's own command names.
+- Planner authority: task and release planner bindings are persisted, with up to 8 planners and the `task_planners` floor (#755). Backlog phase dependencies and issue planning (#766). The board-changed notice skips its author, coalesces per planner and is fyi weight when no plan review is needed (#767).
+- Deliverables: `ahub deliverables` and the dashboard badge (#753).
+- Budget: window kinds, source precedence and per-peer notes (#749).
+- The Codex 0.164.0 reviewer is verified with a model-free production receipt (#768).
+- CI: `closing-refs` fails a PR that would close an issue its text only mentions (#760).
+- The project daemon stops through its normal stop on SIGHUP and SIGQUIT too, so memory sync git (detached since agent-mem 0.7.0) never outlives it (#438, #773).
+- The hardcoded operational constants are inventoried and classified (#764). This changes no runtime behaviour.
+- The live receipt of hub-settled held deliveries and peer retries is recorded (#434 AC8, #772).
+
+Still open:
+- agent-hub backlog #436: serve the hub brief and plan guard from the agent-mem library (agent-mem#40 AC6, hub half).
+- The memory sync log fix (#401, PR #748), which waits on the person.
+- agent-mem#40 #425 and #426, the agent-mem backlog #433 and #437, and agent-mem#48 AC3 (three green Ubuntu runs on main).
+
+## Reviews
+
+The planner reviewed every PR. Where a PR changed permissions, process ownership, privacy or memory authority, an independent read-only reviewer also checked it with isolated probes. Every codex-connector thread was fixed or answered, and resolved, before merge. Each PR merged only after CI was green on both OSes at its reviewed head.
+
+| PR | Merge | Review | CI |
+| --- | --- | --- | --- |
+| #749 (#285) | c1ac6368 | Budget window kinds and notes | exact head, success |
+| #750 (#636 s3) | 9fdea5b1 | Always-ask for local, Pi and Codex | exact head, success |
+| #752 (agent-mem#13 P4) | 1e5da2a4 | amem library recall and capture, no claude-mem worker | exact head, success |
+| #753 (#317, #509) | 6f676ac4 | Deliverables list and badge | exact head, success |
+| #755 (#525) | 18d4cb15 | Planner authority persistence | exact head, success |
+| #761 (#756) | dffc4e44 | `gh api graphql` and run/workflow classing | exact head, success |
+| #763 (#762) | 3d939950 | Shell-expansion classing | exact head, success |
+| #766 (#759) | d9e9c546 | Backlog phase dependencies, issue planning | exact head, success |
+| #767 (#758) | ec226720 | Board-changed notice weight and coalescing | exact head, success |
+| #768 (#757) | fd7aee22 | Codex 0.164.0 reviewer receipt | exact head, success |
+| #769 (#684 p3) | 49fef8b6 | Symbol anchors, stale-anchor inspection | exact head, success |
+| #770 (#684) | 066fbe0d | Bounded preparation, historical recall | exact head, success |
+| #771 (#684 p4) | 3d7ed633 | Current-head code neighbours | exact head, success |
+| #764 (#489 H0) | 7c1d2065 | Constants inventory; two rounds | exact head, success |
+| #772 (#434 AC8) | 8e22f56a | Evidence doc; summary reconciled with its tables | exact head, success |
+| #773 (#438) | 6c7fb8bd | Two rounds: stop on four signals, no SIGQUIT core dump; the test timeout kept under the 20 s ceiling | exact head, success |
+| #774 (pin) | 0ba9bc09 | Pin agent-mem 0.7.0. The hub passes its command names; the pinned-version tests and the generation-review placeholder test follow 0.7.0; help lists the person-only --history/--as-of; a new test pins the person gate. Reviewed by an independent read-only reviewer: the codex-review route was unavailable, because the planner was at its WIP cap with #401 | exact head, success |
+
+## Document review
+
+Fourteen documents were stale against the 0.15.0 stamps (ea32305f, and 88caef80 for local-worker.md). Read-only reviewers in four groups checked each one against `git log <stamp>..HEAD` over its paths and the PRs above, and corrected what was wrong.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.16.0 and the verification link. Up to 8 planners with per-task binding (#755), `ahub deliverables` (#753), amem in process with no claude-mem worker (#752), always-ask for local, Pi and Codex (#750). |
+| `docs/quickstart.md` | corrected | Install pin `v0.16.0`. A new "Upgrading to 0.16.0" section: always-ask slice 3, shell-expansion and graphql classing, the memory library, planner lists and the `task_planners` floor, deliverables, budget kinds, code neighbours and `--stale-anchors`, Codex 0.164.0, and `ahub upgrade`. The agent-mem pin is 0.7.0. |
+| `docs/security.md` | corrected | Always-ask coverage and limits after slice 3 (#750). Memory checkpoints and `ask --remember` save candidates only (#752). Code neighbours (#769, #771). Deliverables are person-only (#753). Planner authority (#755). The pin is 0.7.0. |
+| `docs/operations.md` | corrected | The agent-mem pin is 0.7.0. CI hang limits (macOS 1440 s in 30 min). The closing-refs workflow. Always-ask literal-prefix and shell-expansion classing. Deliverables. The #758 notice. Planners edit only the cards they plan. Dropped the "after it is released" wording for #759 and #684 phases 3-4. |
+| `src/cli/help.ts` | corrected | Every command, subcommand and flag compared with main.ts, launch.ts, settings-edit.ts and the native and configured-ACP entries. The `ahub budget` description names each number's kind and source (#749). tsc and help.test pass. |
+| `docs/agent-notes/adapters.md` | corrected | Local and Pi classing at the host execution root; a throwing gate asks deny-only; the Codex interception scope, and pending classed waits denied on stop, watchdog, detach, adoption or turn end (#750). |
+| `docs/agent-notes/daemon.md` | corrected | The `action_policy` enforcement list (#750). The planner setting of 1 to 8 ids (#755). The in-process amem client and shutdown order (#752). Memory symbols and stale anchors (#769, #770). Code neighbours (#771). The scope gains the memory modules and `src/cli/memory.ts`. The memory sync stop rule came with #773. |
+| `docs/agent-notes/budget.md` | corrected | windowKind as the only classifier; gating and headroom precedence; no-quota peers as information only; the scope gains window-kind.ts and budget-notes.ts (#749). |
+| `docs/agent-notes/tasks.md` | corrected | Completion-note symbol anchors (#769, #771). Naming a planner is refused for closed or PII work (#755). Backlog identity-change screening and a truncated grooming walk (#766). |
+| `docs/agent-notes/tests.md` | corrected | The closing-refs rule (#760). MemoryClient is the in-process amem store; FakeMemoryClient for worker-shaped tests (#752). |
+| `docs/agent-notes/local-worker.md` | corrected | Permit wrappers pass parsed arguments for always-ask (#750). Capture `sourceId` and project-relative paths for read, write and edit only (#752). |
+| `docs/agent-notes/README.md` | corrected | Background only: why closing-refs exists and what it can't reach. |
+| `docs/agent-notes/bus.md` | no change | bus.ts changed only a comment; the envelope plan-review refs are additive; the #767 coalescing rule lives in tasks.md. |
+| `docs/agent-notes/benchmarks.md` | no change | #750 adds an optional permit input that the benchmark permit ignores; there is no action gate there. |
+
+The AGENTS.md area lists and the `docs/verified.json` paths gain the release's new files: changed-tests.mjs, check-closing-refs.mjs and closing-refs.yml (Tests); window-kind.ts and budget-notes.ts (Budget); the memory symbol, code-neighbour and stale-anchor modules and `src/cli/memory.ts` (Daemon).
+
+## Known gaps, not blocking
+
+- `docs/operations.md` still says "native memory remains shared according to claude-mem aliases". The code behind it is agent-mem's `projectChain`, and this release didn't change it.
+- `memory.worker_url` is still listed as a machine-local key. The config loaders accept it, but it's ignored at runtime.
+- Some agent-mem 0.7.0 messages still name `amem` under `ahub memory` (the sync remote hint, and the --all-projects and --to refusals): the library takes no command names there. This is an upstream follow-up.
+- The live legs are the person's: a real local or Pi classed prompt (a private turn included), a real Codex command-approval prompt, the `task_planners` refusal on downgrade, and the dashboard Deliverables chip and Code neighbours toggle.

package/docs/verification/2026-10-25-0.17.0.md

@@ -0,0 +1,74 @@
+# 0.17.0 release verification
+
+This record covers release preparation and source review. It claims no installation, running-hub restart or live TUI launch.
+
+## Candidate
+
+Version 0.17.0, built from merged main 57384ce9. The release commit 66db7605 carries the version, CHANGELOG section and bundle (plugin 0.17.0, built with the pinned Bun 1.4.2), and every document stamp names it. Control protocol stays 16. The person directed the release on 2026-10-25, and chose to include #805 after it found real-binary Qwen TUI defects. The minor rises because #778, #790 and #791 are features. It includes:
+
+- Qwen Code's own TUI driven by the hub over dual output, `ahub qwen --mode tui`, with its two stated limits: a hub deny ends the turn without an answer, and a stalled turn is never cancelled (#286 Part 3, #791). It is gated by the `qwen-dual` compat entry, verified 0.26.1 only, from the live T0 receipt `2026-10-25-qwen-dual-output-t0.md`.
+- The Codex reviewer approves exactly `hub_review` and `hub_task_show`, per tool (#783, #796), with a model-backed receipt (`2026-10-25-codex-0164-reviewer-tool-call.md`). Before it, Codex 0.164.0 `exec` refused every MCP tool call, so `codex-review` recorded no verdict.
+- The Qwen TUI's real-binary fixes (#286, #805): the owner is bound at the root of Qwen's process tree, a hub deny completes the delivery, and the exec runs in the person's environment without another agent's markers. Receipt: `2026-10-25-qwen-dual-output-hub-e2e.md`, rerun by jcode on the merged head c71f07d6.
+- A reviewer turn that ends without a verdict is logged in one screened line and re-offered, or goes to the person when the person named that reviewer (#453, #804). Receipt: `2026-10-25-reviewer-no-verdict-diagnostics.md` (fake transport).
+- Reviewer admission refusals no longer mark the reviewer unavailable (#781, #789); an unavailable reviewer slot no longer fences agy task reads (#794); the Kimi 2.3.1 fresh reviewer is verified model-free (#797).
+- Stop-and-archive keeps the blocking error as the audit `cause` (#776, #777).
+- Recurring-finding cards count a task only where the finding was recorded open or accepted (#328, #780).
+- Hub briefs and plan guards are served from agent-mem's intent brief (#779).
+- The native-branch ratchet and the fixed-builtin gate for proof-adjacent ports (#625 slice 2a, #790).
+- Shared AST helpers and seed-rot diagnostics; seeded CI passes the base with `--base` (#684 phase 5, #778).
+- The missing generation sync remote is quiet (#401, #748).
+- Documentation: live-leg classes and this repository's reviewer-merge convention (#784 P0, #795); the Kimi AC11 usage receipt (#285, #782).
+
+Still open, not in this release:
+- #466 (#793 remote check runner, PR #806): changes requested; on a real Docker daemon the source copy fails and comma-bearing labels can wedge cleanup.
+- #783 AC3: the first real `codex-review` verdict on a hub running this release.
+
+## Reviews
+
+The planner reviewed every PR it did not author; the person approved the planner's own PRs (#748, #777, #780, #795) after OCR-delegated review. Where a PR changed reviewer isolation, permissions or a native adapter, an independent read-only reviewer also checked it. Every codex-connector thread was fixed or answered and resolved before merge.
+
+| PR | Merge | Review | CI |
+| --- | --- | --- | --- |
+| #748 (#401) | 38cde512 | Person, after a rebase | exact head, success |
+| #778 (#684 p5) | f11a2a1c | Two rounds: seed-rot context in a depth-1 CI checkout fixed with full history and `--base` | exact head, success (one unrelated #525 flake on a first run) |
+| #779 (agent-mem#40 AC6) | ebbbcd84 | Two rounds: plan-guard fails kept first under the library cap; the fixture uses the production predicates | exact head, success |
+| #780 (#328) | 0c6fdbc5 | Person, after OCR: occurrence by id, withheld reviews skipped | exact head, success |
+| #782 (#285 AC11) | 383b435f | Receipt arithmetic and scope; credential symlink nit | exact head, success (one unrelated #525 flake) |
+| #777 (#776) | 0af97add | Person, after OCR: audit contract comment | exact head, success |
+| #789 (#781) | d308268d | Admission refusal separated from start failures | exact head, success |
+| #790 (#625 2a) | e8deb15d | Independent review: builtin behaviour unchanged, identity gate, static ratchet | exact head, success |
+| #791 (#286 P3) | f3a6e701 | Spec limits and security boundary by hand; three bot P2s fixed | exact head, success |
+| #794 | 4d5bd7cf | Reviewed in its own task | exact head, success |
+| #795 (#784 P0) | 42929225 | Person, after a by-hand review (OCR selected no files): merge duty kept out of shipped templates | exact head, success |
+| #796 (#783) | 95374582 | Exact two-tool map, model-backed receipt | exact head, success |
+| #797 | 95e032b4 | Reviewed in its own task | exact head, success |
+| #804 (#453) | f0517b5d | Independent review: AC1 and AC2 met, three nits left open; re-filed at an unchanged tree after a procedural changes_requested | exact head, success |
+| #805 (#286) | 57384ce9 | OCR delegated review found another agent's markers reaching Qwen's hub MCP server through the person's env; fixed in the PR with a regression test; jcode reran the real-binary probe on the final head | exact head, success |
+
+## Document review
+
+Eleven documents were stale against the 0.16.0 stamps (267f39c0). Three read-only reviewers checked each one against `git log 267f39c0..HEAD` over its paths and the PRs above, and corrected what was wrong (commit 0ca857af, rebased from 24b654a9).
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.17.0, control protocol 16, and the verification link. Feature bullets unaffected. |
+| `docs/quickstart.md` | corrected | Install pin `v0.17.0`. A new "Upgrading to 0.17.0" section: the Qwen TUI opt-in and its limits (end it in its terminal before an upgrade, then rerun `ahub qwen --mode tui`), the Codex reviewer fix, reviewer availability, agy task reads, the upgrade audit cause. |
+| `src/cli/help.ts` | no change | The Qwen row comes from the definition's `cli.usage`, updated by #791; main.ts, launch.ts and the other native entries are unchanged. help.test passes. |
+| `docs/operations.md` | corrected | Qwen TUI start refusals; the Codex per-tool approval and the model-backed receipt rule; reviewer admission; the audit cause; seed-rot `--base`; the quiet missing remote. Known gaps fixed: the memory project key sentence (no claude-mem aliases) and `memory.worker_url` marked ignored. |
+| `docs/security.md` | corrected | The state-dir refusal exempts the hub's own tools; Codex per-tool approval; the agy placeholder slot fences nothing; native proof ports read only from fixed builtin definitions; `memory.worker_url` ignored. |
+| `docs/agent-notes/adapters.md` | corrected | The native-branch ratchet and proof-port rules (#790); Qwen TUI refusals, `holdsTerminal()`, the submit prefix, the unwritten-answer rule, event lines over 1 MiB skipped (#791); the agy reviewer-slot fence (#794). |
+| `docs/agent-notes/daemon.md` | corrected | Audit cause; `quietSyncError`; library-served briefs with host policy (#779). Scope gains `src/memory/brief.ts` and `src/hub/memory-plan-guard.ts`. |
+| `docs/agent-notes/tasks.md` | corrected | The #780 occurrence rule made exact (by id, non-withheld reviews). |
+| `docs/agent-notes/tests.md` | corrected | Seed-rot context and `--base`; `scripts/lib/ts-ast.ts` is lexical and never imported from `src/`; the proof-gate test cuts daemon code by exact declaration text; the Qwen fake. |
+| `docs/agent-notes/budget.md` | corrected | Scope line only: `src/hub/instance-budget.ts` and `src/hub/usage-rollup.ts`. |
+| `docs/agent-notes/bus.md` | no change | bus.ts unchanged; the Qwen adapter addresses replies through `replyParent` and `replyAudience`. |
+
+After #804 and #805 merged, a second recheck (commit 1ee886cb) added the no-verdict log line and re-offer rule to `docs/operations.md` and `docs/quickstart.md`, bound the Qwen owner at the root of its process tree in `docs/security.md` and the adapters note, stated the person-env rule for the Qwen exec in `docs/security.md`, and noted in `docs/quickstart.md` that a deny completes the delivery. `docs/agent-notes/README.md` went stale only through the daemon note's scope line; it holds background only and needs no change.
+
+The AGENTS.md area lists and the `docs/verified.json` paths gain `src/memory/brief.ts`, `src/hub/memory-plan-guard.ts` (Daemon) and `scripts/lib/ts-ast.ts` (Tests).
+
+## Known gaps, not blocking
+
+- No live Qwen TUI turn with a model has run; #286 stays open for it.
+- `codex-review` takes effect only after the running hub is upgraded to this release; #783 AC3 is recorded then.
+- `test/claude-implementer-daemon.test.ts` flaked twice on unrelated PRs with "JSON Parse error: Unexpected EOF" (task #454), and `test/memory-code-head-684.test.ts` "#367 cached HEAD proof" fails about one run in three on main (hub fail note d13a75e3).

package/docs/verification/2026-10-25-codex-0164-reviewer-tool-call.md

@@ -0,0 +1,52 @@
+# Codex 0.164.0 reviewer tool-call receipt
+
+Result: one real model review recorded one approved verdict through the production stdio MCP and `Tasks` boundary. Date: 2026-10-25, macOS arm64. Hub task: 465; Refs #783. The successful run took approximately 30 seconds, from 04:26:28 UTC to 04:26:58 UTC. No production task, PR, daemon or personal MCP configuration was changed.
+
+## Execution and identity
+
+The fixture used production `startDaemon`, `ReviewerPrintPeer`, `codexReviewerBackend`, the stdio hub plugin and `Tasks`. A builder proposed and accepted one temporary task, the fixture console assigned its reviewer, and builder completion triggered the actual native model process. The fixture never called `hub_review` itself or substituted a fake tool result. Success required a persisted reviewer verdict containing the task's private synthetic marker; a model chat answer would not satisfy the check.
+
+| Evidence | Observed value |
+|---|---|
+| Native version | `0.164.0` |
+| Backend-reported binary identity SHA-256 | `5b9983835177b544bba49d54b6679faf2f833a8b278068a158698f5c4eef1395` |
+| Tested backend-source SHA-256 | `0f76a216b51884909987e64af08ff92d2c90b8d28086ed523fefe211e4feb78e` |
+| Tested stdio plugin SHA-256 | `55b8b41c2e78b038d8422f9680ef7895f711cfaf8c83fbe849f9d280bb6edee9` |
+| Startup admission profile SHA-256 | `cbfe3fc42ebe09064e0c03c64e69913c9c348f07d0617f040144abccd2d50519` |
+| Fixture head | `fe03a0ab4147be4ccfce8226fbc679aa9e3580e2` |
+| Fixture task / reviewer | `1` / `codex-review` |
+| Persisted state / reviewer verdicts | `approved` / `1` |
+| Synthetic marker matched | `true` |
+| Synthetic marker SHA-256 | `293f1e5564e058979d2d4e1586d2bf4f8e9581eceaccd17346627e48a0b9e6b6` |
+| Persisted history SHA-256 | `0301f21d7f02b4c8635abffa0701f965b935793047771c1db1d653798c684ed4` |
+| Delivery states / final reviewer state | `accepted`, `completed` / `idle` |
+
+The plugin hash identifies the stdio server artifact used in the native run. The backend ran from the modified TypeScript source with the hash above; the plugin was subsequently rebuilt for packaging. The packaging gate checks that regenerated artifact separately. No model run of the subsequently regenerated artifact is claimed.
+
+The readonly database readback checked the persisted actor, approved state, verdict count and marker. The head was bound to the request and enforced by the production running-child/`Tasks.reviewBindingCurrent` authority checks; the fixture did not perform a separate final SQL head/refs readback. The profile hash above is the initial startup admission receipt. `ReviewerPrintPeer` performs production preparation again for the actual review child; that second profile hash was not separately retained.
+
+## Isolation and native policy
+
+The backend inherits its host environment and does not itself create an isolated home. The fixture supplied fresh HOME and CODEX_HOME directories and only one auth.json symlink to the configured account. It copied no personal configuration or credential value. Eighteen additional absolute private roots covered the original account root and the original HOME's bounded credential locations, because replacing HOME would otherwise hide those locations from the backend's standard credential-root enumeration.
+
+The native preparation receipt reported `readOnly: true`, `strictMcp: true`, `ephemeral: true` and all 14 existing evidence markers. Effective Apps, plugins and hooks were disabled; legacy notify and web search were disabled; the project was untrusted; only the two hub review tools were allowed. The existing native public-read, exact private-path, glob, symlink, portable-core, host-credential and write-denial canaries remained required and passed.
+
+The source change supplies explicit `approval_mode: "approve"` overrides for the two allowed tools. The [official configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference) documents `mcp_servers.<id>.tools.<tool>.approval_mode` with `auto | prompt | writes | approve` values. That reference establishes the format; the actual 0.164.0 native/model result is the runtime evidence here. Native 0.164.0 `mcp get --json` does not echo those approval fields; the inventory proves the enabled-tool and transport contract, not approval-policy readback. The real persisted verdict establishes that the tested model could invoke the allowed review tool through that configuration. Native MCP call-frame counts and a separate `hub_task_show` call count were not retained.
+
+## Admission and cleanup
+
+The controller atomically acquired the repository's existing local heavy-job lock before creating auth links or running native preparation. An existing lock would have caused immediate exit 75 without retry or reaping. Remote-job admission was checked separately by the coordinator; this is not global enforcement.
+
+The fixture deadline was 110 seconds and the controller deadline 120 seconds. The one actual model review finished within both. Cleanup awaited the production daemon and `OwnedPrintChild` process-group teardown. The driver group was subsequently absent, and an additional scan found zero new processes whose argv named the fixture root. That extra scan is limited to the fixture root and is not universal orphan detection.
+
+The source-account auth metadata comparison was unchanged before and after the successful run, without reading credential values. Both metadata hashes were `fa8d925c16ed3503eda3a0cbcb037101fbde4d6bc3b448a9693a39d6ec84fe81`. Temporary auth link, HOME, CODEX_HOME, project and task state were removed, and the controller's own lock was released after cleanup confirmation. The synthetic source file remained unchanged during review.
+
+Private proof metadata remained at mode 0600, 2612 bytes, SHA-256 `eff722e3085acf1a0a21cc6569a793f1eb51e152cfd4a3d57e8d168ce94b9d32`. The mode-0600 harness output log was empty. No credential value, control token, private path, marker value or model prose is reproduced here.
+
+## Earlier attempts and limits
+
+The initial admitted attempt selected PATH's `codex-cli 0.146.0` rather than the separately installed 0.164.0 launcher. Reviewer startup returned successfully, then the fixture's explicit version guard refused before a model-review request. The failure-message hash was `f8b54e55485eb602d97d36e3705a749b21695a3ba3705ce79cb90dec92a9d1c0`, later matched to the harness's own static version-guard error. Positive cleanup was recorded; source-account metadata comparison was not retained on that initial failure path and remains unverified for that attempt.
+
+A separately authorized setup-only diagnosis passed daemon startup and console connection in 0.25 seconds, with zero native preparations and zero model requests. It confirmed unchanged account metadata and cleanup. The harness then selected the retained 0.164.0 launcher explicitly, and the coordinator authorized the single actual model run documented above. There was no automatic model retry.
+
+This receipt proves the tested source/native/model/tool/host round trip in the temporary fixture. It does not prove production deployment, native Linux behavior, an effective network-isolation probe, or every possible reviewer workflow. The installed 0.16.0 runtime remained unchanged; production use still requires a separate release and runtime upgrade.

package/docs/verification/2026-10-25-kimi-231-reviewer-compat.md

@@ -0,0 +1,48 @@
+# Kimi 2.3.1 fresh-reviewer compatibility receipt
+
+## Scope and identity
+
+This #792 (K1) receipt repeats the model-free 2.3.0 procedure (`2026-10-22-kimi-qwen-compat.md`) on the installed Kimi 2.3.1. No real account, provider inference, personal configuration, native login, credential refresh or personal machine trust was used or changed. Per the person's 2026-10-25 decision the result is a version verification only: no `kimi-review` instance is declared, and Kimi stays a pull-only TUI peer. The reviewer remains off until a project declares one.
+
+| Artifact | Binding |
+| --- | --- |
+| Kimi native macOS arm64 executable | version `2.3.1`; SHA-256 `f06ba6a3bb7ed2fc1f82590f7c22570736d9ee7344059fa92404ca75dc2d5b45` |
+| Kimi source | tag `@moonshot-ai/kimi-code@2.3.1`, commit [`684bae9ea6a437f3bae98bba1dcb797a917d500b`](https://github.com/MoonshotAI/kimi-code/tree/684bae9ea6a437f3bae98bba1dcb797a917d500b) |
+
+## What changed since 2.3.0
+
+Four commits (`b5e28fd6..684bae9e`): workspace trust decoupled from runtime initialization (c569bab5), session-lock holder names and a lock takeover path (0e3980e7), a web dist sync and the release. The two that touch reviewer isolation:
+
+- `workspaceMcpConfigService.ts` reloads file MCP servers after a trust change and adds `KIMI_CODE_TRUST_WORKSPACE` (`trustEnv.ts`). Project MCP is still loaded only for a trusted workspace. The reviewer child runs with a replaced environment and a clean temporary cwd, so neither the variable nor a project MCP file reaches it. The probe sets the variable in the host environment as a decoy and asserts it is absent from the launch environment.
+- Session locks gained a takeover path and `KIMI_CODE_SESSION_LOCK=0`. A fresh reviewer never resumes or shares a session, so this does not change its contract.
+
+## Results
+
+The 2.3.0 producer was copied with only the version, source commit, output paths and the decoy changed. It ran against an isolated HOME and a synthetic native `KIMI_CODE_HOME` (managed `kimi` provider, invented access-only OAuth record, device identity). The native print leg redirected only the managed provider endpoint and its scoped synthetic OAuth slot to a loopback fixed-response server, which performs no inference.
+
+| Leg | Fixture trust run | Verified run (no trust) |
+| --- | --- | --- |
+| `kimiReviewerBackend.prepare` (private config, exact two-tool agent, empty skills, replace env, `current()`) | pass | pass (`fixtureTrustOnly: false`) |
+| Task-bound MCP: exactly `hub_review` and `hub_task_show`; other task id, third tool and missing auth refused; revocation refuses reads | pass | pass |
+| Native exact-two-tools: 4 requests, every inventory exactly the two hub names, both calls reached the host, injected `Write` refused, marker `unchanged` | pass | pass |
+| Native positive control: `Write` added to the agent; inventory includes it, marker written | pass | pass |
+| Trust-env decoy absent from the launch environment | pass | pass |
+| Cleanup of owned groups and temporary trees | pass | pass |
+
+Before and after the verified run, the SHA-256 of the real `~/.kimi-code` `config.toml`, `mcp.json`, `device_id` and a digest over every file in `credentials/` and `oauth/` were identical.
+
+The producer ran with Bun 1.4.3 (the installed one); the 2.3.0 producer used pinned Bun 1.4.2. The hub code it exercises is plain TypeScript with no bundle step.
+
+## Not verified
+
+A real-account review, attached-TUI coexistence during a review, OAuth refresh under a real token, review quality, token usage and quota behaviour remain unverified, as for 2.3.0. No future version or compatible line is inferred.
+
+## Evidence
+
+Kept outside the repository in `scratchpad/temp/agent-hub-792`:
+
+| Item | SHA-256 |
+| --- | --- |
+| `kimi-probe.ts` | `0a7ed09fa3f27afd7177d262b668cc8a5700f4b4292141210806baba9fd540e1` |
+| `kimi-native-result.json` (fixture trust) | `42368dab8aa210934ed66dae6e93113d078245461f9da10ee97286b582ff063d` |
+| `kimi-verified-result.json` (no trust) | `b962a7ed389cf915051c1e7c73c54bb5dccb0dd96c522806371f6d7eb28e047d` |

package/docs/verification/2026-10-25-kimi-usage-ac11.md

@@ -0,0 +1,48 @@
+# Kimi usage counting live receipt (#285 AC11)
+
+## Scope and isolation
+
+Measured on 2026-10-25 with agent-hub source `38cde512ca489cc7cbdd032fc16fe213758b41dd` and Kimi Code CLI 2.3.1. ACP initialization served protocol version 1 and agent version 2.3.1. Every wire file declared wire protocol 1.5; all four usage rows had `usageScope: "turn"`.
+
+The measured process had a new disposable cwd, `HOME`, `KIMI_CODE_HOME`, `TMPDIR` and `XDG_CONFIG_HOME`. Its generated native config retained only the installed managed provider and model settings, with hooks and telemetry disabled. The installed account's credential/oauth directories and device identity were symlinked into the disposable native home without printing their contents. No personal project or prior session was read. No `/usages` credential or plan-quota probe was made; #285 AC9 remains outside this receipt.
+
+The ACP sequence was one ordinary no-tool prompt, `/usage`, one prompt requiring a subagent, and `/usage` again. Raw prompts, answers, session identifiers and transcript paths are not reproduced here. The measurements below contain field names, counts and timings only.
+
+## Wire rows and native `/usage`
+
+`counted` means `inputOther + inputCacheCreation + output`, the hub ceiling rule. `total` also includes `inputCacheRead`. Native `Session total` is its displayed input plus output.
+
+| Point after turn | Main rows | Subagent rows | Main `total` | All-agent `counted` | All-agent cache reads | All-agent `total` | Native `Session total` |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| Ordinary prompt | 1 | 0 | 23,847 | 4,647 | 19,200 | 23,847 | 23,847 |
+| Subagent prompt | 3 | 1 | 72,058 | 10,326 | 73,984 | 84,310 | 72,058 |
+
+After the ordinary prompt, native input was 23,769 and output 78. After the subagent prompt, native input was 71,811 and output 247. Both native totals exactly equal the main-agent four-counter wire total. The second native total excludes the subagent's 12,252 tokens: 84,310 all-agent tokens minus 12,252 equals 72,058.
+
+Therefore `/usage` reconciles with the main-agent wire sum, not the all-agent sum once a subagent runs. The hub intentionally counts subagents, so its all-agent total can be higher than Kimi's native session total without a counting error. Cache reads are part of the native session total but remain excluded from the hub ceiling count.
+
+The production `KimiWireReader` independently read this captured session as `status: "ok"`: four rows, `counted` 10,326, cache reads 73,984 and `total` 84,310, exactly matching the direct field-only scan.
+
+## Turn-end timing
+
+- After the ordinary prompt's `session/prompt` result, the synchronous disk read still had zero rows. The main row was present by the read 1,000 ms later. This run does not prove that an ordinary main row is already durable at the prompt-result instant.
+- After the subagent prompt's result, all three main rows and the subagent row were already present synchronously and remained unchanged at 1,000 ms.
+- The ordinary prompt emitted `usage_update { used: 23847, size: 1048576 }` at the prompt-result boundary (0 ms observed delay). The subagent prompt emitted `{ used: 24175, size: 1048576 }` 5 ms after its result. These are context occupancy readings, not cumulative session consumption.
+- Neither `/usage` turn emitted a `usage_update`.
+
+## Does ACP `/usage` cost a model call?
+
+No model request was recorded for either `/usage` turn in this run.
+
+| `/usage` turn | Rows before | Rows at prompt result | Rows 1,000 ms later | Elapsed |
+| --- | ---: | ---: | ---: | ---: |
+| After ordinary prompt | 1 | 1 | 1 | 3 ms |
+| After subagent prompt | 4 | 4 | 4 | 2 ms |
+
+Both turns returned `stopReason: "end_turn"`. Their answers contained context occupancy and main-session totals, not plan-quota fields. With no new `usage.record` at either the response or the settled read, these ACP `/usage` calls did not consume a model request.
+
+## Evidence retention and verdict
+
+The external evidence is under the workspace scratchpad's `temp/agent-hub-429/run2/` directory, with raw ACP and answer files mode 0600. The producer is `temp/agent-hub-429/probe.ts`; its SHA-256 is `c9105d46a4aa3627b4ec5a907e62e2795aba057fb6d02666215f02566c4e50cf`. The sanitized result JSON SHA-256 is `727f22fb1412be3f4bd90db44626f90acce65e2badb4c5548db89fbacdeafc47`.
+
+AC11's Kimi legs are **VERIFIED** for the installed 2.3.1 session described here: native occupancy timing, main and subagent wire rows, native-total reconciliation, and the model-call cost of ACP `/usage`. The ordinary main-row result also records a timing limitation rather than claiming synchronous durability. This receipt does not verify another Kimi version, plan quotas, or #199 AC5.

package/docs/verification/2026-10-25-qwen-dual-output-hub-e2e.md

@@ -0,0 +1,23 @@
+# Qwen dual-output hub end-to-end, 2026-10-25 (#449)
+
+- Scope: what the hub's own Qwen TUI path did against the real `qwen` 0.26.1 binary. It complements the T0 receipt (`2026-10-25-qwen-dual-output-t0.md`), which checked Qwen's protocol alone.
+- Setup: the real `startDaemon`, the real `ahub qwen --mode tui` CLI (`src/cli/main.js`) run under a pty, and the real `qwen` 0.26.1 it exec'd. Qwen's model was a scripted OpenAI-compatible server on loopback (no real model, no account, no network). Every run used a scratch `HOME` and a scratch git project; the person's `~/.qwen` was not read. The probes are throwaway scripts and are not committed.
+- Not covered: a real model, a real account, and the dashboard or console UI itself (approvals were answered through the control `permit` message the console sends).
+
+| Check | Observed |
+| --- | --- |
+| CLI refusals | `--mode tui` without a terminal refuses ("needs a terminal"); `--mode bogus` prints the usage; `--print-command` previews the dual-output argv with no `--acp` and creates no file. |
+| Launch | The CLI got the launch from the daemon and ran Qwen in the pty. Qwen's `session_start` attached the peer (idle). |
+| Owner binding | Real Qwen is a `script` wrapper, a node launcher and a `cli.js` child, and all three name `--input-file`. The first version required exactly one match and never bound an owner (found by this run); it now binds the root of the tree. `holdsTerminal()` is true. |
+| Delivery and answer | A published message became a `submit`; Qwen answered; the final assistant text was shared; the peer went busy then idle. |
+| Approval allow | A shell command produced a `can_use_tool` request; the console got it with the command text; `permit allow` made Qwen run it (the file was created) and the turn answered. |
+| Approval deny | `permit deny`: no file was created, no answer was shared, the peer went idle. The first version settled the delivery `needs_review`, which held the peer's queue (status showed `needsReview 1`, held) and wedged later messages; a deny now completes. After the fix the queue was empty and not held. |
+| State dir | A shell command appending to the hub's `input.jsonl` was refused without asking the console, and nothing was written into the file. The next message was answered normally. |
+| Launch environment | The CLI's exec first failed with "Executable not found in $PATH": the daemon's launch carries only the peer marker. The person's environment is now the base and the marker goes over it. |
+| Adoption | The adapter was stopped while Qwen kept running (the hub's stop does not signal it). A new adapter on the same state dir adopted it from the saved offset (4262 both times), launched nothing, and processed no event twice; the next delivery worked. |
+| Stall | With a model that never answered, the peer stayed busy, reported "stalled ... press Esc in the Qwen terminal", did not signal Qwen (still alive), and cleared the notice when the late answer arrived and was shared. |
+| Stop | `ahub stop qwen` refused: "Qwen belongs to its own terminal". |
+
+## A claim I checked and withdrew
+
+- During the run, a second daemon on the same project answered "qwen is off roster" after the first one's `settings_set roster.qwen true`. I first read that as a roster bug on `origin/main` and reproduced it there. It is not one: those probes passed `config:` to `startDaemon`, an embedded config that overrides the project's local roster file. Without that option the roster persisted across a daemon restart (checked with the same two-daemon sequence). Nothing about the roster path needs changing, and nothing here depends on it. The adoption leg above drives the adapter on the same state dir because that is the unit that carries the adoption logic, not because the roster failed.

package/docs/verification/2026-10-25-qwen-dual-output-t0.md

@@ -0,0 +1,20 @@
+# Qwen dual-output TUI verification, 2026-10-25
+
+- Scope: #286 Part 3 gate, T0 checks Q2 to Q7 for a Qwen TUI the hub drives through dual output (`--input-file`, `--json-file`). Supersedes the Q2-Q7 "Unverified" rows of `2026-10-11-acp-watch-t0.md`.
+- Base: main beea9b19, agent-hub 0.16.0. Qwen Code 0.26.1 (fnm global install; the same command reported 0.25.0 earlier the same day, so the install changed underneath).
+- Isolation: every run used a scratch `HOME` holding only `.qwen/settings.json` (OpenAI-compatible auth, one model, auto-update off, usage statistics off, no hooks, no MCP servers except the T0 one), a scratch git project as cwd, and an environment of `HOME`, `PATH`, `TERM`, `LANG`, `TMPDIR` and the gateway key only. The person's real `~/.qwen` was not read or written.
+- Model: `flashnext/qwen3.8-flash-next` through the campus gateway, `--approval-mode default`.
+- Harness: the TUI ran on a pseudo-terminal (120x40). The harness appended JSONL to the input file, read the event file, and sent keys or signals only where a row says so. Driving a TUI by typing into its terminal is out of scope for #286; the key presses below only stand in for the person.
+
+| Check | Verdict | Evidence and consequence |
+| --- | --- | --- |
+| Q2 | Pass | A `{"type":"submit","text"}` record shows as a `user` event and a user turn in the TUI, then `stream_event`s, an `assistant` event and `message_stop`. A submit written while a 60-line turn was streaming waited and started after that turn's `message_stop` (queued, not interleaved). The TUI emits no `result` event per turn: the end of a turn is an `assistant` event whose `stop_reason` is not `tool_use`, followed by `message_stop`. `system/session_start` lists `supported_events` and carries `session_id` and `version`. |
+| Q3 | Pass, with one gap | A tool that needs approval emits `control_request` `can_use_tool` with `request_id`, the exact `tool_name` (`run_shell_command`; an MCP tool from `--mcp-config` as `mcp__t0__t0_echo`), `tool_use_id`, input and `permission_suggestions`. `confirmation_response` `allowed:true` answers `control_response` success and the tool runs. An answer given in the TUI (Enter) emits `control_response` success with the same `request_id`, so a pending hub approval can be withdrawn. A later answer for a settled id gets `control_response` error "unknown request_id (already resolved, cancelled, or never issued)". Gap: `allowed:false` cancels the whole turn and emits no event at all (no `control_response`, no `tool_result`, no `assistant`); the file was not created and the model later called it cancelled. Read-only commands (`echo`) ran without any approval in default mode. |
+| Q4 | Fail | The input protocol has only `submit` and `confirmation_response` (source: the RemoteInput reader; any other `type` is logged as unknown). SIGINT to the qwen process during a 400-line turn did not stop it: the turn completed all 400 lines. Esc pressed in the TUI stopped a turn at 88 lines, and the next submit ran normally, but that is the person's key, not something the hub may send. A hub watchdog cannot stop a running Qwen TUI turn. |
+| Q5 | Pass | With `--json-file` a FIFO that nobody opened for reading, the TUI started, took a submit from the input file and answered it on screen. Nothing blocked. |
+| Q6 | Pass | After the process was stopped, `qwen -r <session_id>` with the same input and event files resumed the conversation (it recalled a code word from before the restart), did not replay any earlier `submit`, and appended to the event file. |
+| Q7 | Recorded | `qwen --version` under the isolated environment: 0.26.1. `COMPAT.qwen.verified` lists 0.25.0 and 0.26.0, so 0.26.1 is outside the verified set. |
+
+## Consequence for #286 AC9
+
+AC9 is conditional on Q2 to Q6 passing. Q4 fails, so the condition does not hold as written. Building Part 3 anyway needs an owner decision and a spec amendment that names the two limits: the watchdog reports a stalled Qwen TUI turn to the person instead of stopping it, and the adapter itself marks the turn ended when the hub sends a deny, because Qwen emits nothing for it.

package/docs/verification/2026-10-25-reviewer-no-verdict-diagnostics.md

@@ -0,0 +1,35 @@
+# Reviewer no-verdict diagnostics and fallback receipt
+
+Date: 2026-10-25. Refs #783. This receipt records fake-transport checks of the production adapter, host policy, Tasks and delivery journal. It records no new model call, native isolation proof or production runtime upgrade. The final PR head and packaging gate are recorded with the PR.
+
+## Diagnostics
+
+The fake reviewer checks cover an exit with no `hub_review` call, a structured native approval refusal that never reaches the host, and an actual host `hub_review` refusal. Each produces one bounded no-verdict diagnostic containing the exit code and allowlisted tool metadata. Tool argument objects and model-message events are discarded. Native metadata remains bound to its original task and generation through stdout drain even after leader-exit verdict authority is revoked.
+
+The native parser follows the pinned [Codex 0.164.0 SDK McpToolCallItem](https://github.com/openai/codex/blob/rust-v0.164.0/sdk/typescript/src/items.ts) server, tool and error-message fields. This source contract is not a new native execution receipt.
+
+The privacy fixture extracts the production daemon diagnostic callback, `screenMemory`, `boundedSafe` and `contextPii` declarations and binds their actual policy helpers. It verifies current task/head/generation and attachment guards, private task/turn withholding, and secret/private/denied content placed beyond the output bound. Screening receives the complete refusal before controls are removed or the refusal is shortened. Safe output stays on one line; unsafe or stale details are withheld. The first full host refusal is retained separately from native display metadata, so a truncated native echo cannot hide a secret beyond 4000 characters. A different later host refusal sets sticky uncertainty rather than replacing the first refusal or accumulating a history. Both this echo case and conservative uncertainty withholding are covered by a controlled child barrier and the production diagnostic callback.
+
+## Re-offer and delivery settlement
+
+Three daemon scenarios use only a fake Codex transport: no tool call, native approval refusal, and a real host tool refusal. In each, the task is offered to the person, its actual delivery-journal row ends `completed`, no reviewer queue hold remains, and the same reviewer accepts a later request that records a verdict. The native-refusal scenario starts with a person-named reviewer and verifies escalation to the person rather than an agent the person did not choose.
+
+Separate actual Tasks and delivery-journal checks verify that accepted agent publication completes the old delivery, while failed publication or failed person notification retains `needs_review` and its queue hold. A real daemon publication-failure check then triggers unrelated board and queue changes and confirms that automatic supersession retirement preserves the explicitly unconfirmed hold. A separate ordinary superseded review hold still retires, so this exclusion does not disable normal cleanup. A changed binding during publication cannot confirm the old offer. Adapter checks hold settlement while an asynchronous fallback is pending and require explicit confirmation before completion. Existing stop, watchdog and generation fences remain covered by their regression tests.
+
+Focused commands:
+
+```sh
+env -u AGENTHUB_HOME bun test test/reviewer-print.test.ts test/reviewer-lifecycle-followup.test.ts test/reviewer-mcp.test.ts test/reviewer-pool-tasks.test.ts test/reviewer-no-verdict.test.ts test/reviewer-no-verdict-journal.test.ts test/reviewer-no-verdict-privacy.test.ts
+env -u AGENTHUB_HOME bun test test/reviewer-no-verdict-daemon.test.ts --test-name-pattern "diagnostics reoffer"
+env -u AGENTHUB_HOME bun test test/reviewer-no-verdict-daemon.test.ts --test-name-pattern "explicitly unconfirmed|ordinary superseded"
+```
+
+The first command passed 56 tests with zero failures. The second passed three daemon scenarios, and the third passed two retirement scenarios, all with zero failures. These are fake-transport checks, not evidence that a production model used this new tracer.
+
+## Existing live proof and limits
+
+The approved [Codex 0.164.0 reviewer tool-call receipt](2026-10-25-codex-0164-reviewer-tool-call.md) records one real model review and a persisted approved verdict through the production stdio MCP and Tasks boundary. That work corrected the native per-tool approval configuration for exactly the two permitted review tools. Its approved live evidence supplies the prior successful native tool-call leg for #783.
+
+This change adds a structured tracer to the backend module, so its module hash differs from the earlier receipt. The reused proof applies to the unchanged native preparation and per-tool approval path; it does not claim that the exact newly instrumented module was model-tested. The historical task 328 fallback exception was not re-executed here, and no manual-nomination cause is inferred for that historical attempt. The manual and no-pool failure paths are demonstrated by the new deterministic tests.
+
+Installed 0.16.0 behavior remains separate from these source and fixture checks. Production diagnostics, corrected approvals and re-offer settlement require a release and runtime upgrade.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -75,7 +75,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -87,7 +87,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -105,11 +105,13 @@
         "src/hub/usage-rollup.ts",
         "src/adapters/kimi-wire-usage.ts",
         "src/hub/kimi-usage.ts",
-        "src/hub/token-window.ts"
+        "src/hub/token-window.ts",
+        "src/hub/window-kind.ts",
+        "src/hub/budget-notes.ts"
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -124,7 +126,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -187,11 +189,17 @@
         "src/hub/config-tier.ts",
         "src/hub/config-edit.ts",
         "src/hub/config-edit-host.ts",
-        "src/hub/claude-launch-proof.ts"
+        "src/hub/claude-launch-proof.ts",
+        "src/hub/memory-symbols.ts",
+        "src/hub/memory-code-overlay.ts",
+        "src/hub/memory-code-head.ts",
+        "src/hub/memory-stale-anchors.ts",
+        "src/memory/brief.ts",
+        "src/hub/memory-plan-guard.ts"
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "88caef80a31cf63ec182881e2c9bb48b0844e7e8",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
@@ -203,7 +211,7 @@
       ]
     },
     "docs/agent-notes/models.md": {
-      "verifiedAgainst": "e57b1936bd234fad65aded000c921f5c9d7a3718",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/models/",
         "src/hub/inference.ts",
@@ -211,7 +219,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -247,7 +255,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -262,11 +270,15 @@
         "src/local/sandbox.ts",
         "src/models/mlx.ts",
         "src/cli/upgrade-interactive.ts",
-        "src/adapters/conformance/"
+        "src/adapters/conformance/",
+        "scripts/changed-tests.mjs",
+        "scripts/check-closing-refs.mjs",
+        ".github/workflows/closing-refs.yml",
+        "scripts/lib/ts-ast.ts"
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",
@@ -275,7 +287,7 @@
       ]
     },
     "src/cli/help.ts": {
-      "verifiedAgainst": "ea32305fafd9bdac6b5e6f9d9048006f3c1ba060",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/cli/main.ts",
         "src/cli/launch.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",
@@ -17,7 +17,7 @@
     "bun": ">=1.4.2"
   },
   "dependencies": {
-    "@staix/agent-mem": "0.4.0"
+    "@staix/agent-mem": "0.7.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",