@staix/agent-hub 0.16.0 → 0.17.0

package/docs/verification/2026-10-25-kimi-usage-ac11.md

@@ -0,0 +1,48 @@
+# Kimi usage counting live receipt (#285 AC11)
+
+## Scope and isolation
+
+Measured on 2026-10-25 with agent-hub source `38cde512ca489cc7cbdd032fc16fe213758b41dd` and Kimi Code CLI 2.3.1. ACP initialization served protocol version 1 and agent version 2.3.1. Every wire file declared wire protocol 1.5; all four usage rows had `usageScope: "turn"`.
+
+The measured process had a new disposable cwd, `HOME`, `KIMI_CODE_HOME`, `TMPDIR` and `XDG_CONFIG_HOME`. Its generated native config retained only the installed managed provider and model settings, with hooks and telemetry disabled. The installed account's credential/oauth directories and device identity were symlinked into the disposable native home without printing their contents. No personal project or prior session was read. No `/usages` credential or plan-quota probe was made; #285 AC9 remains outside this receipt.
+
+The ACP sequence was one ordinary no-tool prompt, `/usage`, one prompt requiring a subagent, and `/usage` again. Raw prompts, answers, session identifiers and transcript paths are not reproduced here. The measurements below contain field names, counts and timings only.
+
+## Wire rows and native `/usage`
+
+`counted` means `inputOther + inputCacheCreation + output`, the hub ceiling rule. `total` also includes `inputCacheRead`. Native `Session total` is its displayed input plus output.
+
+| Point after turn | Main rows | Subagent rows | Main `total` | All-agent `counted` | All-agent cache reads | All-agent `total` | Native `Session total` |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| Ordinary prompt | 1 | 0 | 23,847 | 4,647 | 19,200 | 23,847 | 23,847 |
+| Subagent prompt | 3 | 1 | 72,058 | 10,326 | 73,984 | 84,310 | 72,058 |
+
+After the ordinary prompt, native input was 23,769 and output 78. After the subagent prompt, native input was 71,811 and output 247. Both native totals exactly equal the main-agent four-counter wire total. The second native total excludes the subagent's 12,252 tokens: 84,310 all-agent tokens minus 12,252 equals 72,058.
+
+Therefore `/usage` reconciles with the main-agent wire sum, not the all-agent sum once a subagent runs. The hub intentionally counts subagents, so its all-agent total can be higher than Kimi's native session total without a counting error. Cache reads are part of the native session total but remain excluded from the hub ceiling count.
+
+The production `KimiWireReader` independently read this captured session as `status: "ok"`: four rows, `counted` 10,326, cache reads 73,984 and `total` 84,310, exactly matching the direct field-only scan.
+
+## Turn-end timing
+
+- After the ordinary prompt's `session/prompt` result, the synchronous disk read still had zero rows. The main row was present by the read 1,000 ms later. This run does not prove that an ordinary main row is already durable at the prompt-result instant.
+- After the subagent prompt's result, all three main rows and the subagent row were already present synchronously and remained unchanged at 1,000 ms.
+- The ordinary prompt emitted `usage_update { used: 23847, size: 1048576 }` at the prompt-result boundary (0 ms observed delay). The subagent prompt emitted `{ used: 24175, size: 1048576 }` 5 ms after its result. These are context occupancy readings, not cumulative session consumption.
+- Neither `/usage` turn emitted a `usage_update`.
+
+## Does ACP `/usage` cost a model call?
+
+No model request was recorded for either `/usage` turn in this run.
+
+| `/usage` turn | Rows before | Rows at prompt result | Rows 1,000 ms later | Elapsed |
+| --- | ---: | ---: | ---: | ---: |
+| After ordinary prompt | 1 | 1 | 1 | 3 ms |
+| After subagent prompt | 4 | 4 | 4 | 2 ms |
+
+Both turns returned `stopReason: "end_turn"`. Their answers contained context occupancy and main-session totals, not plan-quota fields. With no new `usage.record` at either the response or the settled read, these ACP `/usage` calls did not consume a model request.
+
+## Evidence retention and verdict
+
+The external evidence is under the workspace scratchpad's `temp/agent-hub-429/run2/` directory, with raw ACP and answer files mode 0600. The producer is `temp/agent-hub-429/probe.ts`; its SHA-256 is `c9105d46a4aa3627b4ec5a907e62e2795aba057fb6d02666215f02566c4e50cf`. The sanitized result JSON SHA-256 is `727f22fb1412be3f4bd90db44626f90acce65e2badb4c5548db89fbacdeafc47`.
+
+AC11's Kimi legs are **VERIFIED** for the installed 2.3.1 session described here: native occupancy timing, main and subagent wire rows, native-total reconciliation, and the model-call cost of ACP `/usage`. The ordinary main-row result also records a timing limitation rather than claiming synchronous durability. This receipt does not verify another Kimi version, plan quotas, or #199 AC5.

package/docs/verification/2026-10-25-qwen-dual-output-hub-e2e.md

@@ -0,0 +1,23 @@
+# Qwen dual-output hub end-to-end, 2026-10-25 (#449)
+
+- Scope: what the hub's own Qwen TUI path did against the real `qwen` 0.26.1 binary. It complements the T0 receipt (`2026-10-25-qwen-dual-output-t0.md`), which checked Qwen's protocol alone.
+- Setup: the real `startDaemon`, the real `ahub qwen --mode tui` CLI (`src/cli/main.js`) run under a pty, and the real `qwen` 0.26.1 it exec'd. Qwen's model was a scripted OpenAI-compatible server on loopback (no real model, no account, no network). Every run used a scratch `HOME` and a scratch git project; the person's `~/.qwen` was not read. The probes are throwaway scripts and are not committed.
+- Not covered: a real model, a real account, and the dashboard or console UI itself (approvals were answered through the control `permit` message the console sends).
+
+| Check | Observed |
+| --- | --- |
+| CLI refusals | `--mode tui` without a terminal refuses ("needs a terminal"); `--mode bogus` prints the usage; `--print-command` previews the dual-output argv with no `--acp` and creates no file. |
+| Launch | The CLI got the launch from the daemon and ran Qwen in the pty. Qwen's `session_start` attached the peer (idle). |
+| Owner binding | Real Qwen is a `script` wrapper, a node launcher and a `cli.js` child, and all three name `--input-file`. The first version required exactly one match and never bound an owner (found by this run); it now binds the root of the tree. `holdsTerminal()` is true. |
+| Delivery and answer | A published message became a `submit`; Qwen answered; the final assistant text was shared; the peer went busy then idle. |
+| Approval allow | A shell command produced a `can_use_tool` request; the console got it with the command text; `permit allow` made Qwen run it (the file was created) and the turn answered. |
+| Approval deny | `permit deny`: no file was created, no answer was shared, the peer went idle. The first version settled the delivery `needs_review`, which held the peer's queue (status showed `needsReview 1`, held) and wedged later messages; a deny now completes. After the fix the queue was empty and not held. |
+| State dir | A shell command appending to the hub's `input.jsonl` was refused without asking the console, and nothing was written into the file. The next message was answered normally. |
+| Launch environment | The CLI's exec first failed with "Executable not found in $PATH": the daemon's launch carries only the peer marker. The person's environment is now the base and the marker goes over it. |
+| Adoption | The adapter was stopped while Qwen kept running (the hub's stop does not signal it). A new adapter on the same state dir adopted it from the saved offset (4262 both times), launched nothing, and processed no event twice; the next delivery worked. |
+| Stall | With a model that never answered, the peer stayed busy, reported "stalled ... press Esc in the Qwen terminal", did not signal Qwen (still alive), and cleared the notice when the late answer arrived and was shared. |
+| Stop | `ahub stop qwen` refused: "Qwen belongs to its own terminal". |
+
+## A claim I checked and withdrew
+
+- During the run, a second daemon on the same project answered "qwen is off roster" after the first one's `settings_set roster.qwen true`. I first read that as a roster bug on `origin/main` and reproduced it there. It is not one: those probes passed `config:` to `startDaemon`, an embedded config that overrides the project's local roster file. Without that option the roster persisted across a daemon restart (checked with the same two-daemon sequence). Nothing about the roster path needs changing, and nothing here depends on it. The adoption leg above drives the adapter on the same state dir because that is the unit that carries the adoption logic, not because the roster failed.

package/docs/verification/2026-10-25-qwen-dual-output-t0.md

@@ -0,0 +1,20 @@
+# Qwen dual-output TUI verification, 2026-10-25
+
+- Scope: #286 Part 3 gate, T0 checks Q2 to Q7 for a Qwen TUI the hub drives through dual output (`--input-file`, `--json-file`). Supersedes the Q2-Q7 "Unverified" rows of `2026-10-11-acp-watch-t0.md`.
+- Base: main beea9b19, agent-hub 0.16.0. Qwen Code 0.26.1 (fnm global install; the same command reported 0.25.0 earlier the same day, so the install changed underneath).
+- Isolation: every run used a scratch `HOME` holding only `.qwen/settings.json` (OpenAI-compatible auth, one model, auto-update off, usage statistics off, no hooks, no MCP servers except the T0 one), a scratch git project as cwd, and an environment of `HOME`, `PATH`, `TERM`, `LANG`, `TMPDIR` and the gateway key only. The person's real `~/.qwen` was not read or written.
+- Model: `flashnext/qwen3.8-flash-next` through the campus gateway, `--approval-mode default`.
+- Harness: the TUI ran on a pseudo-terminal (120x40). The harness appended JSONL to the input file, read the event file, and sent keys or signals only where a row says so. Driving a TUI by typing into its terminal is out of scope for #286; the key presses below only stand in for the person.
+
+| Check | Verdict | Evidence and consequence |
+| --- | --- | --- |
+| Q2 | Pass | A `{"type":"submit","text"}` record shows as a `user` event and a user turn in the TUI, then `stream_event`s, an `assistant` event and `message_stop`. A submit written while a 60-line turn was streaming waited and started after that turn's `message_stop` (queued, not interleaved). The TUI emits no `result` event per turn: the end of a turn is an `assistant` event whose `stop_reason` is not `tool_use`, followed by `message_stop`. `system/session_start` lists `supported_events` and carries `session_id` and `version`. |
+| Q3 | Pass, with one gap | A tool that needs approval emits `control_request` `can_use_tool` with `request_id`, the exact `tool_name` (`run_shell_command`; an MCP tool from `--mcp-config` as `mcp__t0__t0_echo`), `tool_use_id`, input and `permission_suggestions`. `confirmation_response` `allowed:true` answers `control_response` success and the tool runs. An answer given in the TUI (Enter) emits `control_response` success with the same `request_id`, so a pending hub approval can be withdrawn. A later answer for a settled id gets `control_response` error "unknown request_id (already resolved, cancelled, or never issued)". Gap: `allowed:false` cancels the whole turn and emits no event at all (no `control_response`, no `tool_result`, no `assistant`); the file was not created and the model later called it cancelled. Read-only commands (`echo`) ran without any approval in default mode. |
+| Q4 | Fail | The input protocol has only `submit` and `confirmation_response` (source: the RemoteInput reader; any other `type` is logged as unknown). SIGINT to the qwen process during a 400-line turn did not stop it: the turn completed all 400 lines. Esc pressed in the TUI stopped a turn at 88 lines, and the next submit ran normally, but that is the person's key, not something the hub may send. A hub watchdog cannot stop a running Qwen TUI turn. |
+| Q5 | Pass | With `--json-file` a FIFO that nobody opened for reading, the TUI started, took a submit from the input file and answered it on screen. Nothing blocked. |
+| Q6 | Pass | After the process was stopped, `qwen -r <session_id>` with the same input and event files resumed the conversation (it recalled a code word from before the restart), did not replay any earlier `submit`, and appended to the event file. |
+| Q7 | Recorded | `qwen --version` under the isolated environment: 0.26.1. `COMPAT.qwen.verified` lists 0.25.0 and 0.26.0, so 0.26.1 is outside the verified set. |
+
+## Consequence for #286 AC9
+
+AC9 is conditional on Q2 to Q6 passing. Q4 fails, so the condition does not hold as written. Building Part 3 anyway needs an owner decision and a spec amendment that names the two limits: the watchdog reports a stalled Qwen TUI turn to the person instead of stopping it, and the adapter itself marks the turn ended when the hub sends a deny, because Qwen emits nothing for it.

package/docs/verification/2026-10-25-reviewer-no-verdict-diagnostics.md

@@ -0,0 +1,35 @@
+# Reviewer no-verdict diagnostics and fallback receipt
+
+Date: 2026-10-25. Refs #783. This receipt records fake-transport checks of the production adapter, host policy, Tasks and delivery journal. It records no new model call, native isolation proof or production runtime upgrade. The final PR head and packaging gate are recorded with the PR.
+
+## Diagnostics
+
+The fake reviewer checks cover an exit with no `hub_review` call, a structured native approval refusal that never reaches the host, and an actual host `hub_review` refusal. Each produces one bounded no-verdict diagnostic containing the exit code and allowlisted tool metadata. Tool argument objects and model-message events are discarded. Native metadata remains bound to its original task and generation through stdout drain even after leader-exit verdict authority is revoked.
+
+The native parser follows the pinned [Codex 0.164.0 SDK McpToolCallItem](https://github.com/openai/codex/blob/rust-v0.164.0/sdk/typescript/src/items.ts) server, tool and error-message fields. This source contract is not a new native execution receipt.
+
+The privacy fixture extracts the production daemon diagnostic callback, `screenMemory`, `boundedSafe` and `contextPii` declarations and binds their actual policy helpers. It verifies current task/head/generation and attachment guards, private task/turn withholding, and secret/private/denied content placed beyond the output bound. Screening receives the complete refusal before controls are removed or the refusal is shortened. Safe output stays on one line; unsafe or stale details are withheld. The first full host refusal is retained separately from native display metadata, so a truncated native echo cannot hide a secret beyond 4000 characters. A different later host refusal sets sticky uncertainty rather than replacing the first refusal or accumulating a history. Both this echo case and conservative uncertainty withholding are covered by a controlled child barrier and the production diagnostic callback.
+
+## Re-offer and delivery settlement
+
+Three daemon scenarios use only a fake Codex transport: no tool call, native approval refusal, and a real host tool refusal. In each, the task is offered to the person, its actual delivery-journal row ends `completed`, no reviewer queue hold remains, and the same reviewer accepts a later request that records a verdict. The native-refusal scenario starts with a person-named reviewer and verifies escalation to the person rather than an agent the person did not choose.
+
+Separate actual Tasks and delivery-journal checks verify that accepted agent publication completes the old delivery, while failed publication or failed person notification retains `needs_review` and its queue hold. A real daemon publication-failure check then triggers unrelated board and queue changes and confirms that automatic supersession retirement preserves the explicitly unconfirmed hold. A separate ordinary superseded review hold still retires, so this exclusion does not disable normal cleanup. A changed binding during publication cannot confirm the old offer. Adapter checks hold settlement while an asynchronous fallback is pending and require explicit confirmation before completion. Existing stop, watchdog and generation fences remain covered by their regression tests.
+
+Focused commands:
+
+```sh
+env -u AGENTHUB_HOME bun test test/reviewer-print.test.ts test/reviewer-lifecycle-followup.test.ts test/reviewer-mcp.test.ts test/reviewer-pool-tasks.test.ts test/reviewer-no-verdict.test.ts test/reviewer-no-verdict-journal.test.ts test/reviewer-no-verdict-privacy.test.ts
+env -u AGENTHUB_HOME bun test test/reviewer-no-verdict-daemon.test.ts --test-name-pattern "diagnostics reoffer"
+env -u AGENTHUB_HOME bun test test/reviewer-no-verdict-daemon.test.ts --test-name-pattern "explicitly unconfirmed|ordinary superseded"
+```
+
+The first command passed 56 tests with zero failures. The second passed three daemon scenarios, and the third passed two retirement scenarios, all with zero failures. These are fake-transport checks, not evidence that a production model used this new tracer.
+
+## Existing live proof and limits
+
+The approved [Codex 0.164.0 reviewer tool-call receipt](2026-10-25-codex-0164-reviewer-tool-call.md) records one real model review and a persisted approved verdict through the production stdio MCP and Tasks boundary. That work corrected the native per-tool approval configuration for exactly the two permitted review tools. Its approved live evidence supplies the prior successful native tool-call leg for #783.
+
+This change adds a structured tracer to the backend module, so its module hash differs from the earlier receipt. The reused proof applies to the unchanged native preparation and per-tool approval path; it does not claim that the exact newly instrumented module was model-tested. The historical task 328 fallback exception was not re-executed here, and no manual-nomination cause is inferred for that historical attempt. The manual and no-pool failure paths are demonstrated by the new deterministic tests.
+
+Installed 0.16.0 behavior remains separate from these source and fixture checks. Production diagnostics, corrected approvals and re-offer settlement require a release and runtime upgrade.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -75,7 +75,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -87,7 +87,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -111,7 +111,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -126,7 +126,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -193,11 +193,13 @@
         "src/hub/memory-symbols.ts",
         "src/hub/memory-code-overlay.ts",
         "src/hub/memory-code-head.ts",
-        "src/hub/memory-stale-anchors.ts"
+        "src/hub/memory-stale-anchors.ts",
+        "src/memory/brief.ts",
+        "src/hub/memory-plan-guard.ts"
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
@@ -209,7 +211,7 @@
       ]
     },
     "docs/agent-notes/models.md": {
-      "verifiedAgainst": "e57b1936bd234fad65aded000c921f5c9d7a3718",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/models/",
         "src/hub/inference.ts",
@@ -217,7 +219,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -253,7 +255,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -271,11 +273,12 @@
         "src/adapters/conformance/",
         "scripts/changed-tests.mjs",
         "scripts/check-closing-refs.mjs",
-        ".github/workflows/closing-refs.yml"
+        ".github/workflows/closing-refs.yml",
+        "scripts/lib/ts-ast.ts"
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",
@@ -284,7 +287,7 @@
       ]
     },
     "src/cli/help.ts": {
-      "verifiedAgainst": "267f39c008428b3a3fc7ae67c64198ef0f93bbee",
+      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
       "paths": [
         "src/cli/main.ts",
         "src/cli/launch.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",