@staix/agent-hub 0.16.0 → 0.18.0

package/docs/verification/2026-10-25-0.17.0.md

@@ -0,0 +1,74 @@
+# 0.17.0 release verification
+
+This record covers release preparation and source review. It claims no installation, running-hub restart or live TUI launch.
+
+## Candidate
+
+Version 0.17.0, built from merged main 57384ce9. The release commit 66db7605 carries the version, CHANGELOG section and bundle (plugin 0.17.0, built with the pinned Bun 1.4.2), and every document stamp names it. Control protocol stays 16. The person directed the release on 2026-10-25, and chose to include #805 after it found real-binary Qwen TUI defects. The minor rises because #778, #790 and #791 are features. It includes:
+
+- Qwen Code's own TUI driven by the hub over dual output, `ahub qwen --mode tui`, with its two stated limits: a hub deny ends the turn without an answer, and a stalled turn is never cancelled (#286 Part 3, #791). It is gated by the `qwen-dual` compat entry, verified 0.26.1 only, from the live T0 receipt `2026-10-25-qwen-dual-output-t0.md`.
+- The Codex reviewer approves exactly `hub_review` and `hub_task_show`, per tool (#783, #796), with a model-backed receipt (`2026-10-25-codex-0164-reviewer-tool-call.md`). Before it, Codex 0.164.0 `exec` refused every MCP tool call, so `codex-review` recorded no verdict.
+- The Qwen TUI's real-binary fixes (#286, #805): the owner is bound at the root of Qwen's process tree, a hub deny completes the delivery, and the exec runs in the person's environment without another agent's markers. Receipt: `2026-10-25-qwen-dual-output-hub-e2e.md`, rerun by jcode on the merged head c71f07d6.
+- A reviewer turn that ends without a verdict is logged in one screened line and re-offered, or goes to the person when the person named that reviewer (#453, #804). Receipt: `2026-10-25-reviewer-no-verdict-diagnostics.md` (fake transport).
+- Reviewer admission refusals no longer mark the reviewer unavailable (#781, #789); an unavailable reviewer slot no longer fences agy task reads (#794); the Kimi 2.3.1 fresh reviewer is verified model-free (#797).
+- Stop-and-archive keeps the blocking error as the audit `cause` (#776, #777).
+- Recurring-finding cards count a task only where the finding was recorded open or accepted (#328, #780).
+- Hub briefs and plan guards are served from agent-mem's intent brief (#779).
+- The native-branch ratchet and the fixed-builtin gate for proof-adjacent ports (#625 slice 2a, #790).
+- Shared AST helpers and seed-rot diagnostics; seeded CI passes the base with `--base` (#684 phase 5, #778).
+- The missing generation sync remote is quiet (#401, #748).
+- Documentation: live-leg classes and this repository's reviewer-merge convention (#784 P0, #795); the Kimi AC11 usage receipt (#285, #782).
+
+Still open, not in this release:
+- #466 (#793 remote check runner, PR #806): changes requested; on a real Docker daemon the source copy fails and comma-bearing labels can wedge cleanup.
+- #783 AC3: the first real `codex-review` verdict on a hub running this release.
+
+## Reviews
+
+The planner reviewed every PR it did not author; the person approved the planner's own PRs (#748, #777, #780, #795) after OCR-delegated review. Where a PR changed reviewer isolation, permissions or a native adapter, an independent read-only reviewer also checked it. Every codex-connector thread was fixed or answered and resolved before merge.
+
+| PR | Merge | Review | CI |
+| --- | --- | --- | --- |
+| #748 (#401) | 38cde512 | Person, after a rebase | exact head, success |
+| #778 (#684 p5) | f11a2a1c | Two rounds: seed-rot context in a depth-1 CI checkout fixed with full history and `--base` | exact head, success (one unrelated #525 flake on a first run) |
+| #779 (agent-mem#40 AC6) | ebbbcd84 | Two rounds: plan-guard fails kept first under the library cap; the fixture uses the production predicates | exact head, success |
+| #780 (#328) | 0c6fdbc5 | Person, after OCR: occurrence by id, withheld reviews skipped | exact head, success |
+| #782 (#285 AC11) | 383b435f | Receipt arithmetic and scope; credential symlink nit | exact head, success (one unrelated #525 flake) |
+| #777 (#776) | 0af97add | Person, after OCR: audit contract comment | exact head, success |
+| #789 (#781) | d308268d | Admission refusal separated from start failures | exact head, success |
+| #790 (#625 2a) | e8deb15d | Independent review: builtin behaviour unchanged, identity gate, static ratchet | exact head, success |
+| #791 (#286 P3) | f3a6e701 | Spec limits and security boundary by hand; three bot P2s fixed | exact head, success |
+| #794 | 4d5bd7cf | Reviewed in its own task | exact head, success |
+| #795 (#784 P0) | 42929225 | Person, after a by-hand review (OCR selected no files): merge duty kept out of shipped templates | exact head, success |
+| #796 (#783) | 95374582 | Exact two-tool map, model-backed receipt | exact head, success |
+| #797 | 95e032b4 | Reviewed in its own task | exact head, success |
+| #804 (#453) | f0517b5d | Independent review: AC1 and AC2 met, three nits left open; re-filed at an unchanged tree after a procedural changes_requested | exact head, success |
+| #805 (#286) | 57384ce9 | OCR delegated review found another agent's markers reaching Qwen's hub MCP server through the person's env; fixed in the PR with a regression test; jcode reran the real-binary probe on the final head | exact head, success |
+
+## Document review
+
+Eleven documents were stale against the 0.16.0 stamps (267f39c0). Three read-only reviewers checked each one against `git log 267f39c0..HEAD` over its paths and the PRs above, and corrected what was wrong (commit 0ca857af, rebased from 24b654a9).
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.17.0, control protocol 16, and the verification link. Feature bullets unaffected. |
+| `docs/quickstart.md` | corrected | Install pin `v0.17.0`. A new "Upgrading to 0.17.0" section: the Qwen TUI opt-in and its limits (end it in its terminal before an upgrade, then rerun `ahub qwen --mode tui`), the Codex reviewer fix, reviewer availability, agy task reads, the upgrade audit cause. |
+| `src/cli/help.ts` | no change | The Qwen row comes from the definition's `cli.usage`, updated by #791; main.ts, launch.ts and the other native entries are unchanged. help.test passes. |
+| `docs/operations.md` | corrected | Qwen TUI start refusals; the Codex per-tool approval and the model-backed receipt rule; reviewer admission; the audit cause; seed-rot `--base`; the quiet missing remote. Known gaps fixed: the memory project key sentence (no claude-mem aliases) and `memory.worker_url` marked ignored. |
+| `docs/security.md` | corrected | The state-dir refusal exempts the hub's own tools; Codex per-tool approval; the agy placeholder slot fences nothing; native proof ports read only from fixed builtin definitions; `memory.worker_url` ignored. |
+| `docs/agent-notes/adapters.md` | corrected | The native-branch ratchet and proof-port rules (#790); Qwen TUI refusals, `holdsTerminal()`, the submit prefix, the unwritten-answer rule, event lines over 1 MiB skipped (#791); the agy reviewer-slot fence (#794). |
+| `docs/agent-notes/daemon.md` | corrected | Audit cause; `quietSyncError`; library-served briefs with host policy (#779). Scope gains `src/memory/brief.ts` and `src/hub/memory-plan-guard.ts`. |
+| `docs/agent-notes/tasks.md` | corrected | The #780 occurrence rule made exact (by id, non-withheld reviews). |
+| `docs/agent-notes/tests.md` | corrected | Seed-rot context and `--base`; `scripts/lib/ts-ast.ts` is lexical and never imported from `src/`; the proof-gate test cuts daemon code by exact declaration text; the Qwen fake. |
+| `docs/agent-notes/budget.md` | corrected | Scope line only: `src/hub/instance-budget.ts` and `src/hub/usage-rollup.ts`. |
+| `docs/agent-notes/bus.md` | no change | bus.ts unchanged; the Qwen adapter addresses replies through `replyParent` and `replyAudience`. |
+
+After #804 and #805 merged, a second recheck (commit 1ee886cb) added the no-verdict log line and re-offer rule to `docs/operations.md` and `docs/quickstart.md`, bound the Qwen owner at the root of its process tree in `docs/security.md` and the adapters note, stated the person-env rule for the Qwen exec in `docs/security.md`, and noted in `docs/quickstart.md` that a deny completes the delivery. `docs/agent-notes/README.md` went stale only through the daemon note's scope line; it holds background only and needs no change.
+
+The AGENTS.md area lists and the `docs/verified.json` paths gain `src/memory/brief.ts`, `src/hub/memory-plan-guard.ts` (Daemon) and `scripts/lib/ts-ast.ts` (Tests).
+
+## Known gaps, not blocking
+
+- No live Qwen TUI turn with a model has run; #286 stays open for it.
+- `codex-review` takes effect only after the running hub is upgraded to this release; #783 AC3 is recorded then.
+- `test/claude-implementer-daemon.test.ts` flaked twice on unrelated PRs with "JSON Parse error: Unexpected EOF" (task #454), and `test/memory-code-head-684.test.ts` "#367 cached HEAD proof" fails about one run in three on main (hub fail note d13a75e3).

package/docs/verification/2026-10-25-0.18.0.md

@@ -0,0 +1,76 @@
+# 0.18.0 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.18.0 and no live TUI launch.
+
+## Candidate
+
+Version 0.18.0, built from merged main f0e9589a (26 commits since v0.17.0, 19 of them `feat`). The release commit carries the version, the CHANGELOG section, the bundle (plugin 0.18.0, built with the pinned Bun 1.4.2 and the worktree's own frozen `node_modules`) and the document corrections, and every document stamp names it. Control protocol stays 16. `@staix/agent-mem` stays exact-pinned at 0.8.0. The task asked for a release once the in-progress work finished; the release PR is merged with a merge commit by the conductor, then tagged `v0.18.0`.
+
+What changed (see `CHANGELOG.md` for the full list):
+- Readable CLI output by default for the `sdlc` read commands, the task, backlog and release commands, and restart, upgrade, recovery, models, `queue resolve` and `budget execution` (#814: #831, #833, #834), with `--json` byte-identical and two guard scans (#837).
+- Guarded merge, merge records and post-merge cleanup guards, and one GitHub COMMENT review per hub verdict (#786: #815, #823, #825).
+- Exact-head CI evidence and current planner rulings in the review request (#824, #826; #835, #836); `review.same_family = "never"` (#820, #828).
+- Agent shell authority: read-only `ahub` forms for every agent and a closed operational family for the conductor (#812: #818, #827, #832); planner task reads and untouched cancel (#822); proven read-only shell grants for Pi and the local worker (#816, #829).
+- Planner WIP split (#784, #819), the isolated remote Docker check runner (#793: #806, #807), dirty-submodule turn facts (#798, #808), and dogfood profile metrics (#799: #810, #817, #830).
+
+## Reviews
+
+Every PR below merged after hub reviews and bot review threads were answered, with exact-head CI green at merge (the conductor read it). The review counts are the GitHub COMMENT reviews each PR carries.
+
+| PR | Merge | GitHub reviews |
+| --- | --- | --- |
+| #806 (#793) | 170199d6 | 4 |
+| #807 (#793) | fd94621a | 2 |
+| #808 (#798) | 79b33c0d | 2 |
+| #810 (#799) | 860b0c66 | 4 |
+| #811 | edcc059d | 2 |
+| #813 (#525) | 577668de | 2 |
+| #815 (#786) | f236aa59 | 4 |
+| #817 (#799) | b23ad7b7 | 2 |
+| #818 (#812) | 61e2fd3f | 4 |
+| #819 (#784) | b454e527 | 2 |
+| #821 | 7d539061 | 2 |
+| #822 | 97473e85 | 4 |
+| #823 (#786) | be35c0c8 | 2 |
+| #825 (#786) | 10a784f9 | 4 |
+| #826 (#824) | 85559fc8 | 2 |
+| #827 (#812) | 2e77055f | 5 |
+| #828 (#820) | abb3aa93 | 5 |
+| #829 (#816) | 0ee33764 | 4 |
+| #830 (#799) | 3d9a42b3 | 2 |
+| #831 (#814) | 2e56ed37 | 4 |
+| #832 (#812) | 7ae412f9 | 2 |
+| #833 (#814) | e95e052a | 2 |
+| #834 (#814) | 486d47a6 | 5 |
+| #836 (#835) | 5f2fd0c6 | 4 |
+| #837 (#814) | f0e9589a | 2 |
+
+## Document review
+
+Fourteen documents were stale against the 0.17.0 stamps (66db7605), 28 commits earlier. Each was rechecked against `git log 66db7605..HEAD` over its paths, the merged PRs above and the source itself, by this implementer. Most features were already documented by the PR that introduced them (operations.md carries 12 of those commits, tasks.md 7, daemon.md 3); the recheck looked for what no PR had updated.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `src/cli/help.ts` | corrected | Every usage string in `main.ts`, `launch.ts`, `identity.ts` and `upgrade*.ts` was cross-checked against the help rows for its command and flags; the top-level command words of help and of the `commands` table match both ways (`pause\|resume` documented as one row). Corrections: `--full` added to `projects`, `queue list` and `task show` (accepted by their usage and by `operations.md`); the authority wording now matches `classifyPeerCommand` and the operations tables (`sdlc status\|explain\|queue\|release`, `queue list` and `release show` open to any agent as public views; `task cancel` and `export` also the conductor's; `task show` gives an agent the public view). `test/help.test.ts` and `test/identity.test.ts` pass unchanged. |
+| `docs/security.md` | corrected | The conductor paragraph said a conductor cannot resolve deliveries or stop a peer; #818 and #827 grant both through the closed operational family, each admitted by `admitOperational` (role recheck, closed audit label), so the paragraph now lists the family, its bounds and what stays with the person, and the read-only forms any agent may run. The agent-mem pin sentence said 0.7.0; it is 0.8.0. |
+| `docs/operations.md` | corrected | The header said 0.13.0; it describes 0.18.0 (protocol 16). The upgrade compatibility sentence and row said protocol 16 ended at 0.12.43; every tag from 0.12.20 through 0.17.0 carries `PROTOCOL = 16` (checked with `git show <tag>:src/hub/control-client.ts`), so both now read 0.18.0. The #812, #816, #820, #784, #793, #786 and #799 sections were already current. |
+| `docs/quickstart.md` | corrected | Install pin `v0.18.0`; "Upgrading to the next release" is now "Upgrading to 0.18.0" and gains the agent and conductor authority, `auto_merge` (off by default), `review.same_family`, the Pi and local read-only shell grants, the opt-in remote runner and the 0.8.0 pin. |
+| `README.md` | corrected | Status 0.18.0, control protocol 16, and the verification link points to this report. Feature bullets unaffected. |
+| `docs/agent-notes/adapters.md` | corrected | New rules for the proven read-only shell grant and its synchronous recheck (#816) and for agent shell authority tables (#812). Scope gains `src/hub/read-only-shell.ts`, `read-only-shell-proof.ts`, `operational-authority.ts` (AGENTS.md and the manifest together). |
+| `docs/agent-notes/local-worker.md` | corrected | The `bash` tool's permit, host recheck and one `forceAsk` retry (#816), and the turn-generation binding. |
+| `docs/agent-notes/benchmarks.md` | corrected | The one covered file that changed, `src/local/tools.ts` (bash permit path), needs no benchmark driver change; stated. |
+| `docs/agent-notes/tests.md` | corrected | The two CLI print scans and the per-command output tests (#814). Scope gains `test/cli-json-guard.test.ts`. |
+| `docs/agent-notes/tasks.md` | no change | Already records the planner WIP breakdown, hub-verified CI block, verdict mirror, guarded merge and `review.same_family`. Scope gains `src/hub/sdlc-merge.ts` and `sdlc-mirror.ts`, which it already names. |
+| `docs/agent-notes/daemon.md` | no change | Already records the CLI output default, `upgrade-output.ts` and the generic print guard (merged with #833 and #834). |
+| `docs/agent-notes/bus.md` | no change | `daemon.ts` changed in operational admission, review and tool handling; the bus, digest and reply paths this note covers were not touched (no `bus.ts` change since the stamp). |
+| `docs/agent-notes/budget.md` | no change | Same: no `budget.ts`, `usage-rollup.ts` or pause-persistence change since the stamp. |
+| `docs/agent-notes/README.md` | corrected | Background for the CLI print guards and agent shell authority; `console-state.ts` changed only to show the planner WIP split in the Peers detail. |
+
+Also corrected, outside the stamped set: `docs/memory.md` named agent-mem pin 0.7.0 and now says 0.8.0.
+
+## Known gaps, not blocking
+
+- The recheck was by one implementer reading source and PRs, not three independent reviewers; the reviewer of this PR is the independent check on it.
+- No running hub has been upgraded to 0.18.0 here. `auto_merge`, the verdict mirror and the conductor operational family are source and fixture tested; their live receipts follow the upgrade (see `docs/dogfood.md` rows #786, #812, #835).
+- `docs/operations.md` has hand-written statements about older releases (for example "removed in 0.13.0") that were not touched.
+- Flaky tests seen on main: `test/memory-code-head-684.test.ts` "#367 cached HEAD proof" (hub fail note d13a75e3). If the full gate hits it, the run is repeated and both results are reported in the task.

package/docs/verification/2026-10-25-codex-0164-reviewer-tool-call.md

@@ -0,0 +1,52 @@
+# Codex 0.164.0 reviewer tool-call receipt
+
+Result: one real model review recorded one approved verdict through the production stdio MCP and `Tasks` boundary. Date: 2026-10-25, macOS arm64. Hub task: 465; Refs #783. The successful run took approximately 30 seconds, from 04:26:28 UTC to 04:26:58 UTC. No production task, PR, daemon or personal MCP configuration was changed.
+
+## Execution and identity
+
+The fixture used production `startDaemon`, `ReviewerPrintPeer`, `codexReviewerBackend`, the stdio hub plugin and `Tasks`. A builder proposed and accepted one temporary task, the fixture console assigned its reviewer, and builder completion triggered the actual native model process. The fixture never called `hub_review` itself or substituted a fake tool result. Success required a persisted reviewer verdict containing the task's private synthetic marker; a model chat answer would not satisfy the check.
+
+| Evidence | Observed value |
+|---|---|
+| Native version | `0.164.0` |
+| Backend-reported binary identity SHA-256 | `5b9983835177b544bba49d54b6679faf2f833a8b278068a158698f5c4eef1395` |
+| Tested backend-source SHA-256 | `0f76a216b51884909987e64af08ff92d2c90b8d28086ed523fefe211e4feb78e` |
+| Tested stdio plugin SHA-256 | `55b8b41c2e78b038d8422f9680ef7895f711cfaf8c83fbe849f9d280bb6edee9` |
+| Startup admission profile SHA-256 | `cbfe3fc42ebe09064e0c03c64e69913c9c348f07d0617f040144abccd2d50519` |
+| Fixture head | `fe03a0ab4147be4ccfce8226fbc679aa9e3580e2` |
+| Fixture task / reviewer | `1` / `codex-review` |
+| Persisted state / reviewer verdicts | `approved` / `1` |
+| Synthetic marker matched | `true` |
+| Synthetic marker SHA-256 | `293f1e5564e058979d2d4e1586d2bf4f8e9581eceaccd17346627e48a0b9e6b6` |
+| Persisted history SHA-256 | `0301f21d7f02b4c8635abffa0701f965b935793047771c1db1d653798c684ed4` |
+| Delivery states / final reviewer state | `accepted`, `completed` / `idle` |
+
+The plugin hash identifies the stdio server artifact used in the native run. The backend ran from the modified TypeScript source with the hash above; the plugin was subsequently rebuilt for packaging. The packaging gate checks that regenerated artifact separately. No model run of the subsequently regenerated artifact is claimed.
+
+The readonly database readback checked the persisted actor, approved state, verdict count and marker. The head was bound to the request and enforced by the production running-child/`Tasks.reviewBindingCurrent` authority checks; the fixture did not perform a separate final SQL head/refs readback. The profile hash above is the initial startup admission receipt. `ReviewerPrintPeer` performs production preparation again for the actual review child; that second profile hash was not separately retained.
+
+## Isolation and native policy
+
+The backend inherits its host environment and does not itself create an isolated home. The fixture supplied fresh HOME and CODEX_HOME directories and only one auth.json symlink to the configured account. It copied no personal configuration or credential value. Eighteen additional absolute private roots covered the original account root and the original HOME's bounded credential locations, because replacing HOME would otherwise hide those locations from the backend's standard credential-root enumeration.
+
+The native preparation receipt reported `readOnly: true`, `strictMcp: true`, `ephemeral: true` and all 14 existing evidence markers. Effective Apps, plugins and hooks were disabled; legacy notify and web search were disabled; the project was untrusted; only the two hub review tools were allowed. The existing native public-read, exact private-path, glob, symlink, portable-core, host-credential and write-denial canaries remained required and passed.
+
+The source change supplies explicit `approval_mode: "approve"` overrides for the two allowed tools. The [official configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference) documents `mcp_servers.<id>.tools.<tool>.approval_mode` with `auto | prompt | writes | approve` values. That reference establishes the format; the actual 0.164.0 native/model result is the runtime evidence here. Native 0.164.0 `mcp get --json` does not echo those approval fields; the inventory proves the enabled-tool and transport contract, not approval-policy readback. The real persisted verdict establishes that the tested model could invoke the allowed review tool through that configuration. Native MCP call-frame counts and a separate `hub_task_show` call count were not retained.
+
+## Admission and cleanup
+
+The controller atomically acquired the repository's existing local heavy-job lock before creating auth links or running native preparation. An existing lock would have caused immediate exit 75 without retry or reaping. Remote-job admission was checked separately by the coordinator; this is not global enforcement.
+
+The fixture deadline was 110 seconds and the controller deadline 120 seconds. The one actual model review finished within both. Cleanup awaited the production daemon and `OwnedPrintChild` process-group teardown. The driver group was subsequently absent, and an additional scan found zero new processes whose argv named the fixture root. That extra scan is limited to the fixture root and is not universal orphan detection.
+
+The source-account auth metadata comparison was unchanged before and after the successful run, without reading credential values. Both metadata hashes were `fa8d925c16ed3503eda3a0cbcb037101fbde4d6bc3b448a9693a39d6ec84fe81`. Temporary auth link, HOME, CODEX_HOME, project and task state were removed, and the controller's own lock was released after cleanup confirmation. The synthetic source file remained unchanged during review.
+
+Private proof metadata remained at mode 0600, 2612 bytes, SHA-256 `eff722e3085acf1a0a21cc6569a793f1eb51e152cfd4a3d57e8d168ce94b9d32`. The mode-0600 harness output log was empty. No credential value, control token, private path, marker value or model prose is reproduced here.
+
+## Earlier attempts and limits
+
+The initial admitted attempt selected PATH's `codex-cli 0.146.0` rather than the separately installed 0.164.0 launcher. Reviewer startup returned successfully, then the fixture's explicit version guard refused before a model-review request. The failure-message hash was `f8b54e55485eb602d97d36e3705a749b21695a3ba3705ce79cb90dec92a9d1c0`, later matched to the harness's own static version-guard error. Positive cleanup was recorded; source-account metadata comparison was not retained on that initial failure path and remains unverified for that attempt.
+
+A separately authorized setup-only diagnosis passed daemon startup and console connection in 0.25 seconds, with zero native preparations and zero model requests. It confirmed unchanged account metadata and cleanup. The harness then selected the retained 0.164.0 launcher explicitly, and the coordinator authorized the single actual model run documented above. There was no automatic model retry.
+
+This receipt proves the tested source/native/model/tool/host round trip in the temporary fixture. It does not prove production deployment, native Linux behavior, an effective network-isolation probe, or every possible reviewer workflow. The installed 0.16.0 runtime remained unchanged; production use still requires a separate release and runtime upgrade.

package/docs/verification/2026-10-25-codex-review-live-verdict.md

@@ -0,0 +1,35 @@
+# Live codex-review verdict receipt (0.17.0)
+
+Date: 2026-10-25, macOS arm64. Refs #783 AC3. Result: the production hub's `codex-review` instance reviewed one real pull request and recorded an approved verdict through `hub_review`. This is the first verdict recorded by `codex-review` on a running hub since the no-verdict failure of #783; the [model-backed fixture receipt](2026-10-25-codex-0164-reviewer-tool-call.md) covered the same path in a temporary fixture only.
+
+## Setup
+
+| Item | Value |
+|---|---|
+| Hub | 0.17.0 release runtime, the project's own daemon (not a fixture) |
+| Native reviewer | `codex-cli 0.164.0` (`ahub agents`: verified) |
+| Declaration | `codex-review`, kind `codex`, roles `["reviewer"]`, `start_mode: "headless"`, `review_mode: "fresh"` (untracked `config.local.json`) |
+| Enabled with | `ahub --live-test roster add codex-review`, then `ahub --live-test codex --as codex-review` (user-authorized live test) |
+| Status after start | `codex-review idle attached`, no `reviewer isolation unavailable` line |
+
+## The review
+
+| Item | Value |
+|---|---|
+| Hub task / PR | #476 / #809 (docs only, `docs/operations.md`, +9 lines) |
+| Owner / reviewer | `claude` / `codex-review` (assigned by routing) |
+| Reviewed head | `ce16b44be52161a950b66f9220e3cb565ae4781f` |
+| Review request sent | 09:12:17 UTC |
+| Reviewer busy | 09:12:17 UTC |
+| Verdict recorded | 09:13:03 UTC, `approved` (46 s after the request) |
+| Reviewer idle | 09:13:08 UTC |
+| Board state after | `approved`, reviewer `codex-review` |
+
+The verdict note cited the two code locations the doc change describes (`validateInstances`, `resolveInstanceExecutionCwd`), reported a read-only `check-docs` run and `git diff --check`, and listed one unmet item: it could not run `scripts/check.sh --changed` because the read-only sandbox refuses the gate's lock, install and build writes. The hub logged `premature review: exact-head full CI is not green` at the request; the review ran anyway, and the merge waited for CI separately.
+
+## Limits
+
+- One review of one small docs-only change. A code review with findings and a `changes_requested` verdict were not exercised.
+- Token use for this single review is unknown: `ahub usage` reports a cumulative counted total for `codex-review`, not per review.
+- The reviewer cannot run the repository gate; its approvals rely on CI and the owner's reported gate for that.
+- macOS only; native Linux behavior is not covered.

package/docs/verification/2026-10-25-kimi-231-reviewer-compat.md

@@ -0,0 +1,48 @@
+# Kimi 2.3.1 fresh-reviewer compatibility receipt
+
+## Scope and identity
+
+This #792 (K1) receipt repeats the model-free 2.3.0 procedure (`2026-10-22-kimi-qwen-compat.md`) on the installed Kimi 2.3.1. No real account, provider inference, personal configuration, native login, credential refresh or personal machine trust was used or changed. Per the person's 2026-10-25 decision the result is a version verification only: no `kimi-review` instance is declared, and Kimi stays a pull-only TUI peer. The reviewer remains off until a project declares one.
+
+| Artifact | Binding |
+| --- | --- |
+| Kimi native macOS arm64 executable | version `2.3.1`; SHA-256 `f06ba6a3bb7ed2fc1f82590f7c22570736d9ee7344059fa92404ca75dc2d5b45` |
+| Kimi source | tag `@moonshot-ai/kimi-code@2.3.1`, commit [`684bae9ea6a437f3bae98bba1dcb797a917d500b`](https://github.com/MoonshotAI/kimi-code/tree/684bae9ea6a437f3bae98bba1dcb797a917d500b) |
+
+## What changed since 2.3.0
+
+Four commits (`b5e28fd6..684bae9e`): workspace trust decoupled from runtime initialization (c569bab5), session-lock holder names and a lock takeover path (0e3980e7), a web dist sync and the release. The two that touch reviewer isolation:
+
+- `workspaceMcpConfigService.ts` reloads file MCP servers after a trust change and adds `KIMI_CODE_TRUST_WORKSPACE` (`trustEnv.ts`). Project MCP is still loaded only for a trusted workspace. The reviewer child runs with a replaced environment and a clean temporary cwd, so neither the variable nor a project MCP file reaches it. The probe sets the variable in the host environment as a decoy and asserts it is absent from the launch environment.
+- Session locks gained a takeover path and `KIMI_CODE_SESSION_LOCK=0`. A fresh reviewer never resumes or shares a session, so this does not change its contract.
+
+## Results
+
+The 2.3.0 producer was copied with only the version, source commit, output paths and the decoy changed. It ran against an isolated HOME and a synthetic native `KIMI_CODE_HOME` (managed `kimi` provider, invented access-only OAuth record, device identity). The native print leg redirected only the managed provider endpoint and its scoped synthetic OAuth slot to a loopback fixed-response server, which performs no inference.
+
+| Leg | Fixture trust run | Verified run (no trust) |
+| --- | --- | --- |
+| `kimiReviewerBackend.prepare` (private config, exact two-tool agent, empty skills, replace env, `current()`) | pass | pass (`fixtureTrustOnly: false`) |
+| Task-bound MCP: exactly `hub_review` and `hub_task_show`; other task id, third tool and missing auth refused; revocation refuses reads | pass | pass |
+| Native exact-two-tools: 4 requests, every inventory exactly the two hub names, both calls reached the host, injected `Write` refused, marker `unchanged` | pass | pass |
+| Native positive control: `Write` added to the agent; inventory includes it, marker written | pass | pass |
+| Trust-env decoy absent from the launch environment | pass | pass |
+| Cleanup of owned groups and temporary trees | pass | pass |
+
+Before and after the verified run, the SHA-256 of the real `~/.kimi-code` `config.toml`, `mcp.json`, `device_id` and a digest over every file in `credentials/` and `oauth/` were identical.
+
+The producer ran with Bun 1.4.3 (the installed one); the 2.3.0 producer used pinned Bun 1.4.2. The hub code it exercises is plain TypeScript with no bundle step.
+
+## Not verified
+
+A real-account review, attached-TUI coexistence during a review, OAuth refresh under a real token, review quality, token usage and quota behaviour remain unverified, as for 2.3.0. No future version or compatible line is inferred.
+
+## Evidence
+
+Kept outside the repository in `scratchpad/temp/agent-hub-792`:
+
+| Item | SHA-256 |
+| --- | --- |
+| `kimi-probe.ts` | `0a7ed09fa3f27afd7177d262b668cc8a5700f4b4292141210806baba9fd540e1` |
+| `kimi-native-result.json` (fixture trust) | `42368dab8aa210934ed66dae6e93113d078245461f9da10ee97286b582ff063d` |
+| `kimi-verified-result.json` (no trust) | `b962a7ed389cf915051c1e7c73c54bb5dccb0dd96c522806371f6d7eb28e047d` |

package/docs/verification/2026-10-25-kimi-usage-ac11.md

@@ -0,0 +1,48 @@
+# Kimi usage counting live receipt (#285 AC11)
+
+## Scope and isolation
+
+Measured on 2026-10-25 with agent-hub source `38cde512ca489cc7cbdd032fc16fe213758b41dd` and Kimi Code CLI 2.3.1. ACP initialization served protocol version 1 and agent version 2.3.1. Every wire file declared wire protocol 1.5; all four usage rows had `usageScope: "turn"`.
+
+The measured process had a new disposable cwd, `HOME`, `KIMI_CODE_HOME`, `TMPDIR` and `XDG_CONFIG_HOME`. Its generated native config retained only the installed managed provider and model settings, with hooks and telemetry disabled. The installed account's credential/oauth directories and device identity were symlinked into the disposable native home without printing their contents. No personal project or prior session was read. No `/usages` credential or plan-quota probe was made; #285 AC9 remains outside this receipt.
+
+The ACP sequence was one ordinary no-tool prompt, `/usage`, one prompt requiring a subagent, and `/usage` again. Raw prompts, answers, session identifiers and transcript paths are not reproduced here. The measurements below contain field names, counts and timings only.
+
+## Wire rows and native `/usage`
+
+`counted` means `inputOther + inputCacheCreation + output`, the hub ceiling rule. `total` also includes `inputCacheRead`. Native `Session total` is its displayed input plus output.
+
+| Point after turn | Main rows | Subagent rows | Main `total` | All-agent `counted` | All-agent cache reads | All-agent `total` | Native `Session total` |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| Ordinary prompt | 1 | 0 | 23,847 | 4,647 | 19,200 | 23,847 | 23,847 |
+| Subagent prompt | 3 | 1 | 72,058 | 10,326 | 73,984 | 84,310 | 72,058 |
+
+After the ordinary prompt, native input was 23,769 and output 78. After the subagent prompt, native input was 71,811 and output 247. Both native totals exactly equal the main-agent four-counter wire total. The second native total excludes the subagent's 12,252 tokens: 84,310 all-agent tokens minus 12,252 equals 72,058.
+
+Therefore `/usage` reconciles with the main-agent wire sum, not the all-agent sum once a subagent runs. The hub intentionally counts subagents, so its all-agent total can be higher than Kimi's native session total without a counting error. Cache reads are part of the native session total but remain excluded from the hub ceiling count.
+
+The production `KimiWireReader` independently read this captured session as `status: "ok"`: four rows, `counted` 10,326, cache reads 73,984 and `total` 84,310, exactly matching the direct field-only scan.
+
+## Turn-end timing
+
+- After the ordinary prompt's `session/prompt` result, the synchronous disk read still had zero rows. The main row was present by the read 1,000 ms later. This run does not prove that an ordinary main row is already durable at the prompt-result instant.
+- After the subagent prompt's result, all three main rows and the subagent row were already present synchronously and remained unchanged at 1,000 ms.
+- The ordinary prompt emitted `usage_update { used: 23847, size: 1048576 }` at the prompt-result boundary (0 ms observed delay). The subagent prompt emitted `{ used: 24175, size: 1048576 }` 5 ms after its result. These are context occupancy readings, not cumulative session consumption.
+- Neither `/usage` turn emitted a `usage_update`.
+
+## Does ACP `/usage` cost a model call?
+
+No model request was recorded for either `/usage` turn in this run.
+
+| `/usage` turn | Rows before | Rows at prompt result | Rows 1,000 ms later | Elapsed |
+| --- | ---: | ---: | ---: | ---: |
+| After ordinary prompt | 1 | 1 | 1 | 3 ms |
+| After subagent prompt | 4 | 4 | 4 | 2 ms |
+
+Both turns returned `stopReason: "end_turn"`. Their answers contained context occupancy and main-session totals, not plan-quota fields. With no new `usage.record` at either the response or the settled read, these ACP `/usage` calls did not consume a model request.
+
+## Evidence retention and verdict
+
+The external evidence is under the workspace scratchpad's `temp/agent-hub-429/run2/` directory, with raw ACP and answer files mode 0600. The producer is `temp/agent-hub-429/probe.ts`; its SHA-256 is `c9105d46a4aa3627b4ec5a907e62e2795aba057fb6d02666215f02566c4e50cf`. The sanitized result JSON SHA-256 is `727f22fb1412be3f4bd90db44626f90acce65e2badb4c5548db89fbacdeafc47`.
+
+AC11's Kimi legs are **VERIFIED** for the installed 2.3.1 session described here: native occupancy timing, main and subagent wire rows, native-total reconciliation, and the model-call cost of ACP `/usage`. The ordinary main-row result also records a timing limitation rather than claiming synchronous durability. This receipt does not verify another Kimi version, plan quotas, or #199 AC5.

package/docs/verification/2026-10-25-qwen-dual-output-hub-e2e.md

@@ -0,0 +1,23 @@
+# Qwen dual-output hub end-to-end, 2026-10-25 (#449)
+
+- Scope: what the hub's own Qwen TUI path did against the real `qwen` 0.26.1 binary. It complements the T0 receipt (`2026-10-25-qwen-dual-output-t0.md`), which checked Qwen's protocol alone.
+- Setup: the real `startDaemon`, the real `ahub qwen --mode tui` CLI (`src/cli/main.js`) run under a pty, and the real `qwen` 0.26.1 it exec'd. Qwen's model was a scripted OpenAI-compatible server on loopback (no real model, no account, no network). Every run used a scratch `HOME` and a scratch git project; the person's `~/.qwen` was not read. The probes are throwaway scripts and are not committed.
+- Not covered: a real model, a real account, and the dashboard or console UI itself (approvals were answered through the control `permit` message the console sends).
+
+| Check | Observed |
+| --- | --- |
+| CLI refusals | `--mode tui` without a terminal refuses ("needs a terminal"); `--mode bogus` prints the usage; `--print-command` previews the dual-output argv with no `--acp` and creates no file. |
+| Launch | The CLI got the launch from the daemon and ran Qwen in the pty. Qwen's `session_start` attached the peer (idle). |
+| Owner binding | Real Qwen is a `script` wrapper, a node launcher and a `cli.js` child, and all three name `--input-file`. The first version required exactly one match and never bound an owner (found by this run); it now binds the root of the tree. `holdsTerminal()` is true. |
+| Delivery and answer | A published message became a `submit`; Qwen answered; the final assistant text was shared; the peer went busy then idle. |
+| Approval allow | A shell command produced a `can_use_tool` request; the console got it with the command text; `permit allow` made Qwen run it (the file was created) and the turn answered. |
+| Approval deny | `permit deny`: no file was created, no answer was shared, the peer went idle. The first version settled the delivery `needs_review`, which held the peer's queue (status showed `needsReview 1`, held) and wedged later messages; a deny now completes. After the fix the queue was empty and not held. |
+| State dir | A shell command appending to the hub's `input.jsonl` was refused without asking the console, and nothing was written into the file. The next message was answered normally. |
+| Launch environment | The CLI's exec first failed with "Executable not found in $PATH": the daemon's launch carries only the peer marker. The person's environment is now the base and the marker goes over it. |
+| Adoption | The adapter was stopped while Qwen kept running (the hub's stop does not signal it). A new adapter on the same state dir adopted it from the saved offset (4262 both times), launched nothing, and processed no event twice; the next delivery worked. |
+| Stall | With a model that never answered, the peer stayed busy, reported "stalled ... press Esc in the Qwen terminal", did not signal Qwen (still alive), and cleared the notice when the late answer arrived and was shared. |
+| Stop | `ahub stop qwen` refused: "Qwen belongs to its own terminal". |
+
+## A claim I checked and withdrew
+
+- During the run, a second daemon on the same project answered "qwen is off roster" after the first one's `settings_set roster.qwen true`. I first read that as a roster bug on `origin/main` and reproduced it there. It is not one: those probes passed `config:` to `startDaemon`, an embedded config that overrides the project's local roster file. Without that option the roster persisted across a daemon restart (checked with the same two-daemon sequence). Nothing about the roster path needs changing, and nothing here depends on it. The adoption leg above drives the adapter on the same state dir because that is the unit that carries the adoption logic, not because the roster failed.

package/docs/verification/2026-10-25-qwen-dual-output-t0.md

@@ -0,0 +1,20 @@
+# Qwen dual-output TUI verification, 2026-10-25
+
+- Scope: #286 Part 3 gate, T0 checks Q2 to Q7 for a Qwen TUI the hub drives through dual output (`--input-file`, `--json-file`). Supersedes the Q2-Q7 "Unverified" rows of `2026-10-11-acp-watch-t0.md`.
+- Base: main beea9b19, agent-hub 0.16.0. Qwen Code 0.26.1 (fnm global install; the same command reported 0.25.0 earlier the same day, so the install changed underneath).
+- Isolation: every run used a scratch `HOME` holding only `.qwen/settings.json` (OpenAI-compatible auth, one model, auto-update off, usage statistics off, no hooks, no MCP servers except the T0 one), a scratch git project as cwd, and an environment of `HOME`, `PATH`, `TERM`, `LANG`, `TMPDIR` and the gateway key only. The person's real `~/.qwen` was not read or written.
+- Model: `flashnext/qwen3.8-flash-next` through the campus gateway, `--approval-mode default`.
+- Harness: the TUI ran on a pseudo-terminal (120x40). The harness appended JSONL to the input file, read the event file, and sent keys or signals only where a row says so. Driving a TUI by typing into its terminal is out of scope for #286; the key presses below only stand in for the person.
+
+| Check | Verdict | Evidence and consequence |
+| --- | --- | --- |
+| Q2 | Pass | A `{"type":"submit","text"}` record shows as a `user` event and a user turn in the TUI, then `stream_event`s, an `assistant` event and `message_stop`. A submit written while a 60-line turn was streaming waited and started after that turn's `message_stop` (queued, not interleaved). The TUI emits no `result` event per turn: the end of a turn is an `assistant` event whose `stop_reason` is not `tool_use`, followed by `message_stop`. `system/session_start` lists `supported_events` and carries `session_id` and `version`. |
+| Q3 | Pass, with one gap | A tool that needs approval emits `control_request` `can_use_tool` with `request_id`, the exact `tool_name` (`run_shell_command`; an MCP tool from `--mcp-config` as `mcp__t0__t0_echo`), `tool_use_id`, input and `permission_suggestions`. `confirmation_response` `allowed:true` answers `control_response` success and the tool runs. An answer given in the TUI (Enter) emits `control_response` success with the same `request_id`, so a pending hub approval can be withdrawn. A later answer for a settled id gets `control_response` error "unknown request_id (already resolved, cancelled, or never issued)". Gap: `allowed:false` cancels the whole turn and emits no event at all (no `control_response`, no `tool_result`, no `assistant`); the file was not created and the model later called it cancelled. Read-only commands (`echo`) ran without any approval in default mode. |
+| Q4 | Fail | The input protocol has only `submit` and `confirmation_response` (source: the RemoteInput reader; any other `type` is logged as unknown). SIGINT to the qwen process during a 400-line turn did not stop it: the turn completed all 400 lines. Esc pressed in the TUI stopped a turn at 88 lines, and the next submit ran normally, but that is the person's key, not something the hub may send. A hub watchdog cannot stop a running Qwen TUI turn. |
+| Q5 | Pass | With `--json-file` a FIFO that nobody opened for reading, the TUI started, took a submit from the input file and answered it on screen. Nothing blocked. |
+| Q6 | Pass | After the process was stopped, `qwen -r <session_id>` with the same input and event files resumed the conversation (it recalled a code word from before the restart), did not replay any earlier `submit`, and appended to the event file. |
+| Q7 | Recorded | `qwen --version` under the isolated environment: 0.26.1. `COMPAT.qwen.verified` lists 0.25.0 and 0.26.0, so 0.26.1 is outside the verified set. |
+
+## Consequence for #286 AC9
+
+AC9 is conditional on Q2 to Q6 passing. Q4 fails, so the condition does not hold as written. Building Part 3 anyway needs an owner decision and a spec amendment that names the two limits: the watchdog reports a stalled Qwen TUI turn to the person instead of stopping it, and the adapter itself marks the turn ended when the hub sends a deny, because Qwen emits nothing for it.

package/docs/verification/2026-10-25-remote-docker-transport.md

@@ -0,0 +1,46 @@
+# Remote Docker extraction and cleanup receipt
+
+Date: 2026-10-25. Refs #793, transport slice AC1/AC2/AC4/AC5. This is a local Docker transport-component proof, not an SSH or pi tool-call receipt. No machine opt-in, dependency preparation, account or model call occurred.
+
+## Versions and proof boundary
+
+- Docker daemon 29.5.2, Linux arm64, through an existing Colima VM.
+- Preinstalled image: oven/bun@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895. The fixture asserted the actual container Bun version was 1.4.2. No image pull occurred.
+- Host Bun 1.4.3; macOS bsdtar 3.5.3, libarchive 3.7.4.
+- Tested src/hub/check-runner.ts SHA-256: 58f6a9f2a86acbf4fb9165ca2315c8df2aaca27b871e6ed3eaef79a28d94f3ad.
+- Private driver SHA-256: 07000fd8aadf00625255784f5ac7b27f6ec6f56166c1e6118031bf963545f091.
+
+The existing VM exposes only two CPUs. Two initial attempts with the unchanged production four-CPU argument failed before transfer, and both cleaned their owned resources. The final component driver therefore lowered only the CPU cap from four to two. This is a stricter native-test limit; the product still requests four CPUs. The VM was not reconfigured or restarted. The exact four-CPU launch on the eventual remote host remains unverified.
+
+The driver used the production remoteRunnerTransport with ContainerRunner's shared lifecycle and a direct Docker command port. It supplied no always-true dependency-ready predicate. A separate actual RemoteRunner.available() call returned remote dependencies unprepared, so this proof grants no sandboxed-peer tests capability.
+
+## Transfer and negative controls
+
+A private synthetic Git fixture contained a nested canary, a lockfile and a bare bun:test file. The working-tree canary was changed after commit. The component returned the committed content, not the dirty working-tree version:
+
+- Source commit: abac005b3a543eb3f7d10c74222009e027055776.
+- Tree: 7cb96483df51495ff14e3ae2ad58b1f1398e2385.
+- Lockfile SHA-256: 87b7aa7d4cc3d62bbabeb5971dac92dcf6f0a52815d11afb027fbed4b769c946.
+
+Before extraction, the driver attached a benign macOS extended attribute to the staged canary. A baseline host archive retained that attribute, and the former docker cp - ...:/work path failed against the same running, read-only-root/tmpfs container. The production normalized archive omitted the custom attribute, macOS provenance metadata and host username. Its headers used uid/gid 65532 and static check owner/group names.
+
+The unchanged production copy function streamed that archive through non-root docker exec -i ... tar --no-same-owner -xf - -C /work. Readback asserted exact committed content and source ownership uid 65532. The real Bun test exited zero; its process reported uid 65532 and six threads under the 64-pid limit. This is one small workload, not a capacity proof for every permitted check.
+
+Docker documents the tmpfs copy limitation and recommends an in-container tar stream for this boundary: [Docker cp corner cases](https://docs.docker.com/reference/cli/docker/container/cp/#corner-cases).
+
+## Readiness, labels and teardown
+
+The production readiness probe started a detached, project-labeled container, transferred its own tiny source using that same copy function, then checked non-root content readback and network isolation. The driver also inspected its run container and confirmed:
+
+- Read-only root; network none; uid/gid 65532:65532.
+- Capabilities dropped with ALL; no-new-privileges.
+- 64 pids, 4 GiB memory and the disclosed two-CPU native-test cap.
+- Source-only transfer; no host path, home, socket or credential mount.
+
+The image and an added fixture label contained commas. The production inventory still found the owned container using project/name filters and individual JSON-encoded .Label fields. It never parsed the comma-joined .Labels display.
+
+The shared lifecycle persisted a finished remote-shaped receipt, exit zero and linux/arm64 (remote docker 29.5.2). That is the library's platform string; this run used local Docker and no SSH connection. Production cleanup confirmed container absence and released the fixture repository heavy lease. Final project-scoped inventory was empty. The driver removed its own placeholder volume and fixture source, then released its separate native-verification reservation. No other project containers were stopped.
+
+## Remaining work
+
+The production runner remains unavailable until the separate admitted, lockfile/Bun-keyed dependency preparation exists (AC3). A real remote SSH leg, the unchanged four-CPU launch there, person opt-in and pi's live hub_check_start receipt (AC6) remain separate work. The fake transport/config regressions and final packaging gate are recorded with the PR's exact head.

package/docs/verification/2026-10-25-reviewer-no-verdict-diagnostics.md

@@ -0,0 +1,35 @@
+# Reviewer no-verdict diagnostics and fallback receipt
+
+Date: 2026-10-25. Refs #783. This receipt records fake-transport checks of the production adapter, host policy, Tasks and delivery journal. It records no new model call, native isolation proof or production runtime upgrade. The final PR head and packaging gate are recorded with the PR.
+
+## Diagnostics
+
+The fake reviewer checks cover an exit with no `hub_review` call, a structured native approval refusal that never reaches the host, and an actual host `hub_review` refusal. Each produces one bounded no-verdict diagnostic containing the exit code and allowlisted tool metadata. Tool argument objects and model-message events are discarded. Native metadata remains bound to its original task and generation through stdout drain even after leader-exit verdict authority is revoked.
+
+The native parser follows the pinned [Codex 0.164.0 SDK McpToolCallItem](https://github.com/openai/codex/blob/rust-v0.164.0/sdk/typescript/src/items.ts) server, tool and error-message fields. This source contract is not a new native execution receipt.
+
+The privacy fixture extracts the production daemon diagnostic callback, `screenMemory`, `boundedSafe` and `contextPii` declarations and binds their actual policy helpers. It verifies current task/head/generation and attachment guards, private task/turn withholding, and secret/private/denied content placed beyond the output bound. Screening receives the complete refusal before controls are removed or the refusal is shortened. Safe output stays on one line; unsafe or stale details are withheld. The first full host refusal is retained separately from native display metadata, so a truncated native echo cannot hide a secret beyond 4000 characters. A different later host refusal sets sticky uncertainty rather than replacing the first refusal or accumulating a history. Both this echo case and conservative uncertainty withholding are covered by a controlled child barrier and the production diagnostic callback.
+
+## Re-offer and delivery settlement
+
+Three daemon scenarios use only a fake Codex transport: no tool call, native approval refusal, and a real host tool refusal. In each, the task is offered to the person, its actual delivery-journal row ends `completed`, no reviewer queue hold remains, and the same reviewer accepts a later request that records a verdict. The native-refusal scenario starts with a person-named reviewer and verifies escalation to the person rather than an agent the person did not choose.
+
+Separate actual Tasks and delivery-journal checks verify that accepted agent publication completes the old delivery, while failed publication or failed person notification retains `needs_review` and its queue hold. A real daemon publication-failure check then triggers unrelated board and queue changes and confirms that automatic supersession retirement preserves the explicitly unconfirmed hold. A separate ordinary superseded review hold still retires, so this exclusion does not disable normal cleanup. A changed binding during publication cannot confirm the old offer. Adapter checks hold settlement while an asynchronous fallback is pending and require explicit confirmation before completion. Existing stop, watchdog and generation fences remain covered by their regression tests.
+
+Focused commands:
+
+```sh
+env -u AGENTHUB_HOME bun test test/reviewer-print.test.ts test/reviewer-lifecycle-followup.test.ts test/reviewer-mcp.test.ts test/reviewer-pool-tasks.test.ts test/reviewer-no-verdict.test.ts test/reviewer-no-verdict-journal.test.ts test/reviewer-no-verdict-privacy.test.ts
+env -u AGENTHUB_HOME bun test test/reviewer-no-verdict-daemon.test.ts --test-name-pattern "diagnostics reoffer"
+env -u AGENTHUB_HOME bun test test/reviewer-no-verdict-daemon.test.ts --test-name-pattern "explicitly unconfirmed|ordinary superseded"
+```
+
+The first command passed 56 tests with zero failures. The second passed three daemon scenarios, and the third passed two retirement scenarios, all with zero failures. These are fake-transport checks, not evidence that a production model used this new tracer.
+
+## Existing live proof and limits
+
+The approved [Codex 0.164.0 reviewer tool-call receipt](2026-10-25-codex-0164-reviewer-tool-call.md) records one real model review and a persisted approved verdict through the production stdio MCP and Tasks boundary. That work corrected the native per-tool approval configuration for exactly the two permitted review tools. Its approved live evidence supplies the prior successful native tool-call leg for #783.
+
+This change adds a structured tracer to the backend module, so its module hash differs from the earlier receipt. The reused proof applies to the unchanged native preparation and per-tool approval path; it does not claim that the exact newly instrumented module was model-tested. The historical task 328 fallback exception was not re-executed here, and no manual-nomination cause is inferred for that historical attempt. The manual and no-pool failure paths are demonstrated by the new deterministic tests.
+
+Installed 0.16.0 behavior remains separate from these source and fixture checks. Production diagnostics, corrected approvals and re-offer settlement require a release and runtime upgrade.

package/docs/verification/profiles/YYYY-MM-DD-general.md

@@ -0,0 +1,46 @@
+# General profile weekly verification receipt
+
+Template only. No pilot result or verdict has been recorded.
+
+- Week ending: YYYY-MM-DD
+- Profile id: general
+- Window bounds: unknown
+
+## Recorded profile JSON
+
+Run ahub report --dogfood --since 7d --json once at the review boundary. Replace the null below with only the emitted profile subsection. Preserve numbers and null values. Include no project/person name, task title, path, raw log or model text; use anonymous identifiers where necessary.
+
+    null
+
+## Verification verdicts
+
+Choose exactly one listed verdict for each claim after inspecting recorded evidence. Unknown data alone cannot establish support. These placeholders are not verdicts.
+
+- writing-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- general-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- research-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- native-model-ingestion
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- context-retention
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- native-account-research
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- research-measurement
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown

package/docs/verification/profiles/YYYY-MM-DD-research.md

@@ -0,0 +1,61 @@
+# Research profile weekly verification receipt
+
+Template only. No pilot result or verdict has been recorded.
+
+- Week ending: YYYY-MM-DD
+- Profile id: research
+- Window bounds: unknown
+
+## Recorded profile JSON
+
+Run ahub report --dogfood --since 7d --json once at the review boundary. Replace the null below with only the emitted profile subsection. Preserve numbers and null values. Include no project/person name, task title, path, raw log or model text; use anonymous identifiers where necessary.
+
+    null
+
+## Research measurements
+
+Copy only emitted counts and anonymous task/claim slots. These placeholders remain unknown until recorded evidence supports a value.
+
+- Current-plan declared sources and claims per task: unknown
+- Claims reaching a person verdict: unknown
+- Claim slots with model label, person verdict and agreement: unknown
+- Agreement counts by supported/unsupported/unclear label: unknown
+- Recorded task-check outcomes by class alias: unknown
+- Proven checks.fact_check selection and pass/fail by alias: unknown
+- Missing check keys per run: unknown
+- Section-overlap notices and confirmed section edits: unknown
+
+Task-check history alone does not prove checks.fact_check ran. A model label or task approval alone does not prove a person verdict or agreement. Preserve every emitted null.
+
+## Verification verdicts
+
+Choose exactly one listed verdict for each claim after inspecting recorded evidence. Unknown data alone cannot establish support. These placeholders are not verdicts.
+
+- writing-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- general-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- research-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- native-model-ingestion
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- context-retention
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- native-account-research
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- research-measurement
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown