@staix/agent-hub 0.18.0 → 0.20.0

package/docs/verification/2026-10-27-0.20.0.md

@@ -0,0 +1,75 @@
+# 0.20.0 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.20.0 and no live TUI launch.
+
+## Candidate
+
+Version 0.20.0, prepared from main 8403b84d plus the agent-mem pin commit b72a4c24 (14 commits since v0.19.0, 3 of them `feat`; bump rule: minor). The release commits carry the `@staix/agent-mem` 0.11.0 pin, the version, the CHANGELOG section, the bundle (plugin 0.20.0, built with the pinned Bun 1.4.2 after a frozen install), the document corrections and the documentation stamps. `scripts/release-prepare.ts` (#893) wrote the version files and this report's skeleton.
+
+What changed (see `CHANGELOG.md` for the full list):
+- A bounded CI watcher per exact PR head with one `ci_completed` notice to the owner and the reviewer, and a held premature review re-offered on green (#785: #886).
+- Opt-in, machine-local `tasks.auto_pull`: a freed planner slot pulls the top backlog card explicitly reserved for that peer (#785: #889).
+- Release preparation as an agent task and a guarded one-shot tag that needs the person's consent (#787: #893).
+- The local-worker and Pi sandbox adds only new loose objects to the shared git object store (#864: #881).
+- Peer ports replace native type checks in the daemon (#625 slices 2b to 2e: #882, #887, #890, #891); behavior unchanged.
+- `@staix/agent-mem` 0.11.0; the mawk progress filter (#883: #884); the quiet branch binding (#880: #885); the default-branch probe isolation (#863: #875); hang-watch test margins (#877); the accepted external module-instance contract (#754: #892, spec only).
+
+## Reviews
+
+Every PR below merged with exact-head CI green (ubuntu, macOS and seeded guards), no unresolved review thread and no pending change request; the conductor read each before merging. (#880 and #883 in the commit subjects are issues, fixed by #885 and #884.)
+
+| PR | Task | Merge | Review |
+| --- | --- | --- | --- |
+| #875 (#863) | | 8122373b | merged earlier on 2026-10-27, exact-head CI green |
+| #877 | | 8a48175a | merged earlier on 2026-10-27, exact-head CI green |
+| #881 (#864) | 522 | d089ebaa | the person approved PR #881 at 0f70acb1 (codex read-only review addressed); the board approval was recorded by the person afterwards |
+| #882 (#625 2b) | 348 | 8b2579e5 | claude, approved at the merged head |
+| #884 (#883) | | 0afa6bdd | the person approved; codex read-only review (OCR delegation), no findings |
+| #885 (#880) | | db50fddd | the person approved; codex read-only review (OCR delegation), no findings; backlog card 528 closed as superseded by it |
+| #886 (#785 P1b) | 458 | 0682dd4c | claude approved at the board-bound 5b525c2e; the PR head a2d1f73d added only a real-daemon test and a host-only seam, reviewed, and the merge is pinned to it |
+| #887 (#625 2c) | 349 | 201cc80a | claude, approved at the merged head |
+| #889 (#785 P1c) | 459 | c2a8b121 | claude, after two change requests (admission recheck before the board write; seed rot on an anchored line), approved at the merged head |
+| #890 (#625 2e) | 350 | fdc3f469 | claude, approved at the merged head |
+| #891 (#625 2d) | 351 | 7a599197 | claude, approved at the merged head |
+| #892 (#754 contract) | 287 | 9205ce15 | claude approved at the board-bound f181f51e; the PR head 6970d9a3 only clarified reviewer independence, reviewed, and the merge is pinned to it; the person decided O1 to O4 on #754 |
+| #893 (#787 P3b) | 463 | 8403b84d | claude, after one change request (the CLI test reached the real origin), approved at the merged head |
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.19.0: none.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.20.0`, person only, and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+Thirteen documents were stale against the 0.19.0 stamps (bc8a7f25). Each was read against the commits under its `docs/verified.json` paths and restamped at a9e2970d with `bun scripts/release-prepare.ts restamp ... --reviewed`.
+
+| Document | Result | What changed |
+| --- | --- | --- |
+| `README.md` | corrected | release report link to 0.20.0; Status line written by release-prepare |
+| `docs/quickstart.md` | corrected | install pin `v0.20.0`; new "Upgrading to 0.20.0" section (amem 0.11.0 for every shared home, CI watcher, `tasks.auto_pull`, object-store sandbox, quiet branch binding) |
+| `docs/operations.md` | corrected | version and protocol-16 range to 0.20.0; `tasks.auto_pull` machine-local wording and settings row; CI watcher scope (not private, no restore after restart, 12-character head, console line for a person, no re-offer after a failure) |
+| `docs/security.md` | corrected | `tasks.auto_pull` in the machine-local list and the ordinary dashboard-session rules |
+| `docs/agent-notes/adapters.md` | corrected | new rule for the delivery, lifecycle and session ports (#625 2b-2c) |
+| `docs/agent-notes/daemon.md` | corrected | dispatch through ports, predicates only at ratchet rows; claude-launch-proof.ts counted by the ratchet; `peer_stop` admission by `hubOwned` and `form` |
+| `docs/agent-notes/bus.md` | corrected | delivery-only retry refusal keyed on `PeerAdapter.deliveryOnly` |
+| `docs/agent-notes/tasks.md` | corrected | quiet branch-binding rule (#880); `ci-watch.ts` in scope; a background clause removed |
+| `docs/agent-notes/tests.md` | corrected | release-script tests run against a scratch root (#893); the release scripts in scope |
+| `docs/agent-notes/README.md`, `benchmarks.md`, `budget.md`, `local-worker.md` | accurate | checked against #881, #882, #886, #887, #889, #890 and #891 |
+
+Also corrected, outside the stamped set: the `@staix/agent-mem` pin text in `docs/memory.md`; `AGENTS.md` area lists (`src/hub/ci-watch.ts` and the release scripts); `docs/verified.json` source paths for adapters, tasks and tests; the CHANGELOG `tasks.auto_pull` wording. `ahub help` matches `src/cli/main.ts` and `src/cli/launch.ts`: `src/cli/` and the adapter definitions are unchanged since v0.19.0, and no changed file adds a command or flag. Note for the next CooperBench collection: #881 changed `profile()` in `src/local/sandbox.ts`, a study condition (`docs/agent-notes/benchmarks.md`).
+
+## Checks
+
+- `node scripts/check-docs.mjs --require-fresh`: `docs: OK (0 stale documents)`.
+- `bun x tsc --noEmit`: clean. `bun scripts/build.mjs --check`: fresh. `node scripts/check-package.mjs`: `package: OK (575 files, @staix/agent-hub@0.20.0)`.
+- Full `scripts/check.sh` on Linux (remote_dev verify, mawk container): see the release PR.
+- The release PR's exact-head CI run: see the release PR.
+
+## Known gaps, not blocking
+
+- No running hub was upgraded to 0.20.0 and no live TUI was launched; the installed hub on this machine is still 0.18.0.
+- No new native acceptance receipt was recorded for this release.
+- The global `amem` CLI on this machine is not yet 0.11.0; upgrade it with the hub (every amem sharing a memory home must be 0.11.0 or later).
+- `test/memory-code-head-684.test.ts` (#367 cached HEAD proof) still flakes under local load (#519, assigned); CI is the gate.
+- External module-kind instances (#754 implementation, PR #894) are not in this release.

package/docs/verification/claude-permission-transport-native.py

@@ -0,0 +1,187 @@
+# Model-free native receipt of the headless Claude permission transport (#843 AC5, task #507).
+# Repeats the case table of 2026-10-23-headless-claude-permissions.md on each installed binary given.
+# Usage: python3 claude-permission-transport-native.py OUTPUT --claude /absolute/claude [--claude ...]
+# No account, no provider, no model: a loopback server answers with a fixed Write tool call, then a completion.
+import argparse, hashlib, http.server, json, os, pathlib, signal, subprocess, threading, time
+
+parser = argparse.ArgumentParser()
+parser.add_argument('output')
+parser.add_argument('--claude', action='append', required=True)
+args = parser.parse_args()
+ROOT = pathlib.Path(args.output).resolve()
+ROOT.mkdir(mode=0o700, parents=False, exist_ok=False)
+
+# Fixture stdio MCP server. It records the call first, then behaves as the case says.
+MCP = r'''import sys, json, os, time
+case = os.environ['CASE']
+for line in sys.stdin:
+    try: q = json.loads(line)
+    except Exception: continue
+    method, rid = q.get('method'), q.get('id')
+    if rid is None: continue
+    if method == 'initialize':
+        r = {'protocolVersion': '2024-11-05', 'capabilities': {'tools': {}}, 'serverInfo': {'name': 'fixture', 'version': '1'}}
+    elif method == 'tools/list':
+        tools = [] if case == 'missing-tool' else [{'name': 'approve', 'description': 'Person approval fixture', 'inputSchema': {'type': 'object', 'properties': {'tool_name': {'type': 'string'}, 'input': {'type': 'object'}, 'tool_use_id': {'type': 'string'}}, 'required': ['tool_name', 'input']}}]
+        r = {'tools': tools}
+    elif method == 'tools/call':
+        args = q.get('params', {}).get('arguments', {})
+        with open(os.environ['RECEIPT'], 'a') as f: print(json.dumps({'arguments': args}), file=f)
+        if case == 'pending': time.sleep(120)
+        if case == 'disconnect': sys.exit(1)
+        if case == 'mcp-error':
+            print(json.dumps({'jsonrpc': '2.0', 'id': rid, 'error': {'code': -32000, 'message': 'fixture hub unavailable'}}), flush=True); continue
+        if case == 'deadline': time.sleep(.1)
+        if case in ('deny', 'hook-deny', 'deadline'):
+            value = {'behavior': 'deny', 'message': 'no person answered' if case == 'deadline' else 'fixture denied'}
+        else:
+            value = {'behavior': 'allow', 'updatedInput': args.get('input', {})}
+        r = {'content': [{'type': 'text', 'text': json.dumps(value)}]}
+    else:
+        r = {}
+    print(json.dumps({'jsonrpc': '2.0', 'id': rid, 'result': r}), flush=True)
+'''
+(ROOT / 'mcp.py').write_text(MCP)
+
+
+class Handler(http.server.BaseHTTPRequestHandler):
+    def log_message(self, *a): pass
+
+    def do_POST(self):
+        q = json.loads(self.rfile.read(int(self.headers['Content-Length'])))
+        state = self.server.state
+        state['requests'] += 1
+        if 'count_tokens' in self.path:
+            self.send_response(200); self.end_headers(); self.wfile.write(json.dumps({'input_tokens': 100}).encode()); return
+        if state.get('tools_file') and not os.path.exists(state['tools_file']):
+            with open(state['tools_file'], 'w') as f: json.dump(q.get('tools', []), f)
+        msgs = q.get('messages', [])
+        results = sum(1 for m in msgs if isinstance(m.get('content'), list) for x in m['content'] if isinstance(x, dict) and x.get('type') == 'tool_result')
+        done = results >= 1
+        content = [{'type': 'text', 'text': 'Fixture finished.'}] if done else [{'type': 'tool_use', 'id': 'toolu_probe_0', 'name': 'Write', 'input': {'file_path': state['target'], 'content': 'probe'}}]
+        result = {'id': 'msg_probe_%d' % results, 'type': 'message', 'role': 'assistant', 'model': 'claude-sonnet-4-5', 'content': content, 'stop_reason': 'end_turn' if done else 'tool_use', 'stop_sequence': None, 'usage': {'input_tokens': 100, 'output_tokens': 10}}
+        if not q.get('stream'):
+            self.send_response(200); self.send_header('Content-Type', 'application/json'); self.end_headers(); self.wfile.write(json.dumps(result).encode()); return
+        self.send_response(200); self.send_header('Content-Type', 'text/event-stream'); self.end_headers()
+        start = dict(result); start.update(content=[], stop_reason=None, usage={'input_tokens': 100, 'output_tokens': 0})
+        events = [('message_start', {'type': 'message_start', 'message': start})]
+        for i, c in enumerate(content):
+            block = dict(c)
+            if c['type'] == 'tool_use': block['input'] = {}
+            else: block['text'] = ''
+            delta = {'type': 'input_json_delta', 'partial_json': json.dumps(c['input'])} if c['type'] == 'tool_use' else {'type': 'text_delta', 'text': c['text']}
+            events.extend([('content_block_start', {'type': 'content_block_start', 'index': i, 'content_block': block}), ('content_block_delta', {'type': 'content_block_delta', 'index': i, 'delta': delta}), ('content_block_stop', {'type': 'content_block_stop', 'index': i})])
+        events.extend([('message_delta', {'type': 'message_delta', 'delta': {'stop_reason': result['stop_reason'], 'stop_sequence': None}, 'usage': {'output_tokens': 10}}), ('message_stop', {'type': 'message_stop'})])
+        try:
+            for e, v in events:
+                self.wfile.write(('event: ' + e + '\ndata: ' + json.dumps(v) + '\n\n').encode()); self.wfile.flush()
+        except (BrokenPipeError, ConnectionResetError):
+            pass
+
+
+def sha(file):
+    digest = hashlib.sha256()
+    with file.open('rb') as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b''):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def empty_group(pid):
+    try:
+        table = subprocess.run(['/bin/ps', '-axo', 'pgid=,stat='], env={'PATH': '/usr/bin:/bin', 'LC_ALL': 'C', 'TZ': 'UTC'}, capture_output=True, text=True, timeout=3)
+    except (OSError, subprocess.TimeoutExpired):
+        return False
+    if table.returncode or len(table.stdout) > 1024 * 1024: return False
+    rows = [line.split() for line in table.stdout.splitlines() if line.strip()]
+    return bool(rows) and all(len(r) == 2 for r in rows) and not any(r[0] == str(pid) and not r[1].startswith('Z') for r in rows)
+
+
+def rows(file):
+    return [json.loads(line) for line in file.read_text().splitlines() if line] if file.exists() else []
+
+
+HOOK_FAIL = {'hooks': {'PreToolUse': [{'matcher': 'Write', 'hooks': [{'type': 'command', 'command': 'exit 1'}]}]}}
+# case -> (settings, expected native exit, mcp calls, file written, tool_result is_error, external stop expected)
+CASES = {
+    'allow':         ({}, 0, 1, True, False, False),
+    'deny':          ({}, 0, 1, False, True, False),
+    'missing-tool':  ({}, 1, 0, False, None, False),
+    'hook-deny':     (HOOK_FAIL, 0, 1, False, True, False),
+    'hook-allow':    (HOOK_FAIL, 0, 1, True, False, False),
+    'mcp-error':     ({}, 0, 1, False, True, False),
+    'disconnect':    ({}, 0, 1, False, True, False),
+    'pending':       ({}, None, 1, False, None, True),
+    'deadline':      ({}, 0, 1, False, True, False),
+}
+
+results = []
+for index, raw in enumerate(args.claude):
+    binary = pathlib.Path(raw).resolve()
+    digest = sha(binary)
+    # The index keeps two binaries with the same basename or the same version in separate directories.
+    ident = ROOT / ('identity-%d-%s' % (index, binary.name)); ident.mkdir()
+    v = subprocess.run([str(binary), '--version'], env={'HOME': str(ident), 'CLAUDE_CONFIG_DIR': str(ident / 'config'), 'PATH': '/usr/bin:/bin'}, capture_output=True, text=True, timeout=10)
+    assert v.returncode == 0, v
+    version = v.stdout.strip().split()[0]
+    for case, (settings, want_exit, want_calls, want_file, want_error, want_stop) in CASES.items():
+        d = ROOT / ('%d-%s-%s' % (index, version, case)); d.mkdir()
+        home = d / 'home'; home.mkdir(); work = d / 'work'; work.mkdir(); work = work.resolve()
+        target = work / 'probe.txt'
+        out = {'version': version, 'binarySha256': digest, 'case': case}
+        srv = native = None
+        try:
+            srv = http.server.ThreadingHTTPServer(('127.0.0.1', 0), Handler)
+            srv.state = {'requests': 0, 'target': str(target), 'tools_file': str(d / 'tools.json')}
+            threading.Thread(target=srv.serve_forever, daemon=True).start()
+            (d / 'mcp.json').write_text(json.dumps({'mcpServers': {'fixture': {'command': '/usr/bin/python3', 'args': [str(ROOT / 'mcp.py')], 'env': {'CASE': case, 'RECEIPT': str(d / 'mcp.jsonl')}}}}))
+            (d / 'settings.json').write_text(json.dumps(settings))
+            env = {'HOME': str(home), 'CLAUDE_CONFIG_DIR': str(home / 'config'), 'PATH': '/usr/bin:/bin', 'ANTHROPIC_BASE_URL': 'http://127.0.0.1:%d' % srv.server_port, 'ANTHROPIC_API_KEY': 'synthetic-probe-not-a-credential', 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC': '1', 'DISABLE_AUTOUPDATER': '1'}
+            argv = [str(binary), '-p', '--output-format', 'stream-json', '--verbose', '--strict-mcp-config', '--mcp-config', str(d / 'mcp.json'), '--setting-sources', '', '--settings', str(d / 'settings.json'), '--permission-mode', 'default', '--permission-prompts', 'host', '--permission-prompt-tool', 'mcp__fixture__approve', '--model', 'claude-sonnet-4-5', 'Run the fixture write.']
+            started = time.monotonic()
+            native = subprocess.Popen(argv, cwd=work, env=env, stdout=open(d / 'stdout', 'w'), stderr=open(d / 'stderr', 'w'), start_new_session=True)
+            stopped_externally = False
+            try:
+                native.wait(timeout=25)
+            except subprocess.TimeoutExpired:
+                stopped_externally = True
+                os.killpg(native.pid, signal.SIGKILL); native.wait(timeout=5)
+            elapsed = round(time.monotonic() - started, 3)
+            calls = rows(d / 'mcp.jsonl')
+            frames = rows(d / 'stdout')
+            tool_results = [b for f in frames if f.get('type') == 'user' for b in f.get('message', {}).get('content', []) if isinstance(b, dict) and b.get('type') == 'tool_result']
+            final = [f for f in frames if f.get('type') == 'result']
+            written = target.exists() and target.read_text() == 'probe'
+            out.update(nativeExit=None if stopped_externally else native.returncode, stoppedExternally=stopped_externally, mcpCalls=len(calls), fileWritten=written, toolResultErrors=[b.get('is_error') for b in tool_results], resultFrame=[{'is_error': f.get('is_error'), 'denials': len(f.get('permission_denials', []))} for f in final], elapsedSeconds=elapsed, requests=srv.state['requests'])
+            assert stopped_externally == want_stop, ('external stop', stopped_externally)
+            if want_exit is not None: assert native.returncode == want_exit, ('exit', native.returncode, (d / 'stderr').read_text()[-400:])
+            assert len(calls) == want_calls, ('mcp calls', calls)
+            if want_calls:
+                call = calls[0]['arguments']
+                assert call['tool_name'] == 'Write' and call['input'] == {'file_path': str(target), 'content': 'probe'} and call['tool_use_id'] == 'toolu_probe_0', call
+            assert written == want_file, ('file written', written)
+            # A successful native tool_result carries no is_error key at all; only a failed one sets it to true.
+            if want_error is not None: assert [b.get('is_error') is True for b in tool_results] == [want_error], tool_results
+            if case in ('deny', 'hook-deny', 'deadline'): assert final and final[0].get('permission_denials') and len(final[0]['permission_denials']) == 1, final
+            out['passed'] = True
+        except Exception as error:
+            out.update(passed=False, error=repr(error))
+        finally:
+            if native is not None:
+                if native.poll() is None:
+                    try: os.killpg(native.pid, signal.SIGKILL)
+                    except ProcessLookupError: pass
+                    native.wait(timeout=5)
+                end = time.monotonic() + 1
+                while not empty_group(native.pid) and time.monotonic() < end: time.sleep(.02)
+                out['nativeGroupEmpty'] = empty_group(native.pid)
+                if not out['nativeGroupEmpty']: out.update(passed=False, cleanup='native group not established empty')
+            if srv: srv.shutdown()
+            out['binaryUnchanged'] = sha(binary) == digest
+            if not out['binaryUnchanged']: out.update(passed=False, error='native binary changed during probe')
+        results.append(out)
+        print(json.dumps(out), flush=True)
+receipt = {'cases': results, 'certified': all(r['passed'] for r in results), 'account': False, 'inference': False}
+(ROOT / 'receipt.json').write_text(json.dumps(receipt, indent=2))
+print(json.dumps({'receipt': str(ROOT / 'receipt.json'), 'certified': receipt['certified']}), flush=True)
+raise SystemExit(0 if receipt['certified'] else 1)

package/docs/verification/claude-shell-wrapper-host.ts

@@ -0,0 +1,20 @@
+// Model-free native receipt fixture. Run by claude-shell-wrapper-native.py, never by production startup.
+import { readFileSync } from "node:fs";
+import { createHostShellWrapper } from "../../src/hub/claude-shell-wrapper.ts";
+import { hostShellEnvironment } from "../../src/local/shell-environment.ts";
+import { realPath } from "../../src/hub/project.ts";
+
+const fixture = JSON.parse(readFileSync(process.argv[2]!, "utf8")) as { root: string; executable: string };
+const root = realPath(fixture.root), executable = realPath(fixture.executable), signal = new AbortController();
+const wrapper = await createHostShellWrapper();
+const command = wrapper.issue({ peer: "claude-fixture", task: 1, generation: "native-fixture:1", root, branch: "fixture/task", executable, argv: [],
+  env: hostShellEnvironment({ AGENTHUB_PEER_ID: "claude-fixture" }), signal: signal.signal, timeoutMs: 5000,
+  current: () => !signal.signal.aborted && realPath(fixture.root) === root && realPath(fixture.executable) === executable });
+if (!command) throw new Error("host receipt fixture refused");
+process.stdout.write(`${JSON.stringify(command)}\n`);
+let closing: Promise<void> | undefined;
+const close = () => closing ??= (async () => { signal.abort(); await wrapper.close(); })();
+process.on("SIGTERM", () => { void close().then(() => process.exit(0), () => process.exit(1)); });
+process.on("SIGINT", () => { void close().then(() => process.exit(0), () => process.exit(1)); });
+for await (const _chunk of process.stdin) { /* Parent ownership pipe, not command input. */ }
+await close();

package/docs/verification/claude-shell-wrapper-native.py

@@ -0,0 +1,145 @@
+# Model-free native receipt. Usage: python3 this.py OUTPUT --bun /absolute/bun --claude /absolute/claude [--claude ...]
+import argparse, hashlib, http.server, json, os, pathlib, select, shlex, signal, subprocess, sys, threading
+parser=argparse.ArgumentParser(); parser.add_argument('output'); parser.add_argument('--bun',required=True); parser.add_argument('--claude',action='append',required=True)
+args=parser.parse_args(); ROOT=pathlib.Path(args.output).resolve(); ROOT.mkdir(mode=0o700,parents=False,exist_ok=False)
+HOST=pathlib.Path(__file__).with_name('claude-shell-wrapper-host.ts').resolve()
+MCP="import sys,json,os,time\nfor line in sys.stdin:\n try: q=json.loads(line)\n except: continue\n method=q.get('method'); rid=q.get('id')\n if rid is None: continue\n if method=='initialize': r={'protocolVersion':'2024-11-05','capabilities':{'tools':{}},'serverInfo':{'name':'fixture','version':'1'}}\n elif method=='tools/list': r={'tools':[{'name':'approve','description':'Person approval fixture','inputSchema':{'type':'object','properties':{'tool_name':{'type':'string'},'input':{'type':'object'},'tool_use_id':{'type':'string'}},'required':['tool_name','input','tool_use_id'],'additionalProperties':False}}]}\n elif method=='tools/call':\n  mode=os.environ['CASE']; args=q.get('params',{}).get('arguments',{})\n  if mode=='timeout': time.sleep(60)\n  if mode=='approval-timeout': time.sleep(.1)\n  if mode=='disconnect': sys.exit(1)\n  if mode=='tool-error':\n   print(json.dumps({'jsonrpc':'2.0','id':rid,'error':{'code':-32000,'message':'fixture hub unavailable'}}),flush=True); continue\n  if mode in ('deny','hook-failure','approval-timeout'): value={'behavior':'deny','message':'no person answered' if mode=='approval-timeout' else 'fixture denied'}\n  else:\n   updated=args.get('input',{})\n   if mode=='normalized' and updated.get('description') in ('probe1','probe2'): updated={'command':os.environ['NORMALIZED'],'description':'host-bound fixture'}\n   value={'behavior':'allow','updatedInput':updated}\n  with open(os.environ['RECEIPT'],'a') as f: print(json.dumps({'arguments':args,'response':value}),file=f)\n  r={'content':[{'type':'text','text':json.dumps(value)}]}\n else: r={}\n print(json.dumps({'jsonrpc':'2.0','id':rid,'result':r}),flush=True)\n"
+(ROOT/'mcp.py').write_text(MCP)
+class Handler(http.server.BaseHTTPRequestHandler):
+ def log_message(self,*a): pass
+ def do_POST(self):
+  q=json.loads(self.rfile.read(int(self.headers['Content-Length'])))
+  state=self.server.state
+  state['requests']+=1
+  if 'count_tokens' in self.path:
+   b=json.dumps({'input_tokens':100}).encode(); self.send_response(200);self.end_headers();self.wfile.write(b);return
+  msgs=q.get('messages',[])
+  with open(state['record'],'a') as f:f.write(json.dumps({'path':self.path,'keys':list(q),'tools':[x.get('name') for x in q.get('tools',[])],'messages':msgs})+'\n')
+  count=sum(1 for m in msgs if isinstance(m.get('content'),list) for x in m['content'] if isinstance(x,dict) and x.get('type')=='tool_result'); seen=count>=len(state['commands'])
+  content=[{'type':'text','text':'Fixture finished.'}] if seen else [{'type':'tool_use','id':'toolu_probe_'+str(count),'name':'Bash','input':{'command':state['commands'][count],'description':'probe'+str(count)}}]
+  result={'id':'msg_probe_'+str(count),'type':'message','role':'assistant','model':'claude-sonnet-4-5','content':content,'stop_reason':'end_turn' if seen else 'tool_use','stop_sequence':None,'usage':{'input_tokens':100,'output_tokens':10}}
+  if not q.get('stream'):
+   self.send_response(200);self.send_header('Content-Type','application/json');self.end_headers();self.wfile.write(json.dumps(result).encode());return
+  self.send_response(200);self.send_header('Content-Type','text/event-stream');self.end_headers()
+  start=dict(result);start.update(content=[],stop_reason=None,usage={'input_tokens':100,'output_tokens':0})
+  events=[('message_start',{'type':'message_start','message':start})]
+  for i,c in enumerate(content):
+   block=dict(c)
+   if c['type']=='tool_use': block['input']={}
+   else: block['text']=''
+   events.append(('content_block_start',{'type':'content_block_start','index':i,'content_block':block}))
+   delta={'type':'input_json_delta','partial_json':json.dumps(c['input'])} if c['type']=='tool_use' else {'type':'text_delta','text':c['text']}
+   events.extend([('content_block_delta',{'type':'content_block_delta','index':i,'delta':delta}),('content_block_stop',{'type':'content_block_stop','index':i})])
+  events.extend([('message_delta',{'type':'message_delta','delta':{'stop_reason':result['stop_reason'],'stop_sequence':None},'usage':{'output_tokens':10}}),('message_stop',{'type':'message_stop'})])
+  try:
+   for e,v in events:self.wfile.write(('event: '+e+'\ndata: '+json.dumps(v)+'\n\n').encode());self.wfile.flush()
+  except BrokenPipeError:pass
+
+def stop(process):
+ if process is None: return True
+ try:
+  if process.stdin: process.stdin.close()
+  try: process.wait(timeout=25)
+  except subprocess.TimeoutExpired:
+   if process.poll() is None:
+    try: os.killpg(process.pid,signal.SIGKILL)
+    except ProcessLookupError: pass
+   process.wait(timeout=5)
+  return process.returncode==0
+ except (OSError,subprocess.TimeoutExpired):return False
+
+def empty_group(pid):
+ try:table=subprocess.run(['/bin/ps','-axo','pgid=,stat='],env={'PATH':'/usr/bin:/bin','LC_ALL':'C','TZ':'UTC'},capture_output=True,text=True,timeout=3)
+ except (OSError,subprocess.TimeoutExpired):return False
+ if table.returncode or len(table.stdout)>1024*1024:return False
+ parsed=[line.split() for line in table.stdout.splitlines() if line.strip()]
+ return bool(parsed) and all(len(row)==2 for row in parsed) and not any(row[0]==str(pid) and not row[1].startswith('Z') for row in parsed)
+
+def rows(file):
+ return [json.loads(line) for line in file.read_text().splitlines() if line]
+
+def sha(file):
+ digest=hashlib.sha256()
+ with file.open('rb') as stream:
+  for block in iter(lambda:stream.read(1024*1024),b''):digest.update(block)
+ return digest.hexdigest()
+
+results=[]
+for raw_binary in args.claude:
+ binary=pathlib.Path(raw_binary).resolve(); identity=ROOT/('identity-'+binary.name); identity.mkdir()
+ version=subprocess.run([str(binary),'--version'],env={'HOME':str(identity),'CLAUDE_CONFIG_DIR':str(identity/'config'),'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=10)
+ assert version.returncode==0 and version.stdout.strip().split()[0] in ('2.1.309','2.1.310'),(version.returncode,version.stdout)
+ label=version.stdout.strip().split()[0]; digest=sha(binary)
+ for mode in ('context','normalized'):
+  d=ROOT/(label+'-'+mode); d.mkdir(); home=d/'home';home.mkdir(); work=d/"work 'quoted'";work.mkdir();(work/'sub').mkdir()
+  work=work.resolve(); host_bin=d/"host bin's";host_bin.mkdir(); executable=host_bin/'fixture';counter=d/'effects'
+  program='#!/usr/bin/python3\nimport json,os,pathlib,sys\np=pathlib.Path('+repr(str(counter))+');p.write_text(str(int(p.read_text())+1) if p.exists() else "1")\nprint(json.dumps({"marker":"HOST_EXECUTABLE","cwd":os.getcwd(),"executable":os.path.realpath(sys.argv[0]),"nativeVars":{k:os.environ.get(k) for k in ["GIT_DIR","RIPGREP_CONFIG_PATH"]},"peer":os.environ.get("AGENTHUB_PEER_ID"),"term":os.environ.get("TERM"),"home":os.environ.get("HOME"),"path":os.environ.get("PATH"),"tmpdir":os.environ.get("TMPDIR")}))\n'
+  executable.write_text(program);executable.chmod(0o700)
+  helper=None;srv=None;native=None
+  result={'version':version.stdout.strip(),'binarySha256':digest,'case':mode}
+  try:
+   rewritten=''
+   if mode=='normalized':
+    fixture=d/'host.json';fixture.write_text(json.dumps({'root':str(work),'executable':str(executable)}))
+    helper=subprocess.Popen([str(pathlib.Path(args.bun).resolve()),str(HOST),str(fixture)],env={'HOME':str(home),'PATH':'/opt/homebrew/bin:/usr/bin:/bin','LANG':'C','TERM':'dumb'},stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=open(d/'host.stderr','w'),text=True,start_new_session=True)
+    assert select.select([helper.stdout],[],[],10)[0],'host fixture handshake timeout'
+    reply=json.loads(helper.stdout.readline());rewritten=reply['command'];assert isinstance(rewritten,str) and rewritten
+   commands=['cd sub && pwd','pwd']+(['pwd'] if mode=='normalized' else [])
+   srv=http.server.ThreadingHTTPServer(('127.0.0.1',0),Handler);srv.state={'requests':0,'record':str(d/'api.jsonl'),'commands':commands}
+   threading.Thread(target=srv.serve_forever,daemon=True).start()
+   config={'mcpServers':{'fixture':{'command':'/usr/bin/python3','args':[str(ROOT/'mcp.py')],'env':{'CASE':mode,'RECEIPT':str(d/'mcp.jsonl'),'NORMALIZED':rewritten}}}}
+   (d/'mcp.json').write_text(json.dumps(config));(d/'settings.json').write_text(json.dumps({'permissions':{'ask':['Bash']}}))
+   native_env={'HOME':str(home),'CLAUDE_CONFIG_DIR':str(home/'config'),'PATH':'/usr/bin:/bin','ANTHROPIC_BASE_URL':'http://127.0.0.1:'+str(srv.server_port),'ANTHROPIC_API_KEY':'synthetic-probe-not-a-credential','CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC':'1','DISABLE_AUTOUPDATER':'1','GIT_DIR':str(d/'poison-git'),'RIPGREP_CONFIG_PATH':str(d/'poison-rg')}
+   argv=[str(binary),'-p','--output-format','stream-json','--verbose','--strict-mcp-config','--mcp-config',str(d/'mcp.json'),'--setting-sources','','--settings',str(d/'settings.json'),'--permission-mode','default','--permission-prompts','host','--permission-prompt-tool','mcp__fixture__approve','--model','claude-sonnet-4-5','Run the fixture commands.']
+   native=subprocess.Popen(argv,cwd=work,env=native_env,stdout=open(d/'stdout','w'),stderr=open(d/'stderr','w'),start_new_session=True)
+   native.wait(timeout=25);assert native.returncode==0,(native.returncode,(d/'stderr').read_text())
+   assert (d/'stderr').read_text()==''
+   calls=rows(d/'mcp.jsonl');assert len(calls)==len(commands),calls
+   frames={}
+   for frame in rows(d/'stdout'):
+    if frame.get('type')!='user':continue
+    for block in frame.get('message',{}).get('content',[]):
+     if block.get('type')=='tool_result':
+      ident=block['tool_use_id'];assert ident not in frames;frames[ident]=(frame.get('tool_use_result'),block)
+   assert set(frames)=={'toolu_probe_'+str(i) for i in range(len(commands))},frames
+   for i,call in enumerate(calls):
+    assert call['arguments']=={'tool_name':'Bash','input':{'command':commands[i],'description':'probe'+str(i)},'tool_use_id':'toolu_probe_'+str(i)},call
+    expected=call['arguments']['input'] if i==0 or mode=='context' else {'command':rewritten,'description':'host-bound fixture'}
+    assert call['response']=={'behavior':'allow','updatedInput':expected},call
+   def output(i):
+    tool,block=frames['toolu_probe_'+str(i)];assert isinstance(tool,dict) and block.get('is_error') is False and tool.get('stderr')=='' and tool.get('interrupted') is False,(tool,block)
+    assert block.get('content')==tool['stdout'];return tool['stdout']
+   assert output(0).strip()==str(work/'sub')
+   if mode=='context':
+    assert output(1).strip()==str(work/'sub');result['persistentCwd']=True
+   else:
+    observed=json.loads(output(1));assert observed['marker']=='HOST_EXECUTABLE' and observed['cwd']==str(work) and observed['executable']==str(executable.resolve()),observed
+    assert observed['nativeVars']=={'GIT_DIR':None,'RIPGREP_CONFIG_PATH':None},observed
+    assert observed['peer']=='claude-fixture' and observed['term']=='dumb' and observed['home']==str(home) and observed['path']=='/opt/homebrew/bin:/usr/bin:/bin',observed
+    assert observed['tmpdir'] and 'ahub-shell-' in observed['tmpdir'] and str(d) not in observed['tmpdir'],observed
+    replay_tool,replay=frames['toolu_probe_2'];assert replay.get('is_error') is True and 'host shell execution refused' in json.dumps(replay_tool),frames['toolu_probe_2']
+    assert counter.read_text()=='1',counter.read_text()
+    result.update(rewrite=True,priorCd=True,environmentIsolation=True,replayRefused=True,effects=1,quotedPaths=True)
+   result.update(passed=True,nativeExit=0,requests=srv.state['requests'],permissionCalls=len(calls))
+  except Exception as error:result.update(passed=False,error=repr(error))
+  finally:
+   if native is not None:
+    # Signal only while this unreaped direct child still owns its pid, never a group id after successful wait.
+    if native.poll() is None:
+     try:os.killpg(native.pid,signal.SIGKILL)
+     except ProcessLookupError:pass
+    native.wait(timeout=5)
+    import time
+    deadline=time.monotonic()+1
+    while not empty_group(native.pid) and time.monotonic()<deadline:time.sleep(.02)
+    result['nativeGroupEmpty']=empty_group(native.pid)
+    if not result['nativeGroupEmpty']:result.update(passed=False,cleanup='native group not established empty; no unrelated process signalled')
+   result['hostStopped']=stop(helper)
+   if not result['hostStopped']:result.update(passed=False,cleanup='host wrapper cleanup failed')
+   if srv:srv.shutdown()
+   result['binaryUnchanged']=sha(binary)==digest
+   if not result['binaryUnchanged']:result.update(passed=False,error='native binary changed during probe')
+  results.append(result);print(json.dumps(result),flush=True)
+receipt={'cases':results,'certified':all(row['passed'] for row in results),'account':False,'inference':False}
+(ROOT/'receipt.json').write_text(json.dumps(receipt,indent=2));print(json.dumps({'receipt':str(ROOT/'receipt.json'),'certified':receipt['certified']}),flush=True)
+raise SystemExit(0 if receipt['certified'] else 1)

package/docs/verification/pi-140-model-free.ts

@@ -0,0 +1,57 @@
+import {mkdtempSync, mkdirSync, readFileSync} from 'node:fs';
+import {join, resolve} from 'node:path';
+import {homedir} from 'node:os';
+import {fileURLToPath} from 'node:url';
+import assert from 'node:assert/strict';
+const launcher=resolve(process.argv[2] ?? join(homedir(),'.pi/agent/bin/pi'));
+const packageRoot=resolve(process.argv[3] ?? join(homedir(),'.pi/agent/install/releases/1.4.0/node_modules/@earendil-works/pi-coding-agent'));
+const extension=fileURLToPath(new URL('../../src/pi/extension.ts',import.meta.url));
+const driver=fileURLToPath(new URL('./pi-140-native.mjs',import.meta.url));
+import {PiToolReceipts} from '../../src/pi/tool-receipts.ts';
+const home=mkdtempSync('/tmp/ahub-505-native-home.'); mkdirSync(join(home,'agent'));
+const pkg=JSON.parse(readFileSync(join(packageRoot,'package.json'),'utf8'));
+assert.equal(pkg.name,'@earendil-works/pi-coding-agent');assert.equal(pkg.version,'1.4.0');
+const version=Bun.spawn([launcher,'--version'],{cwd:home,env:{HOME:home,PATH:process.env.PATH!,PI_CODING_AGENT_DIR:join(home,'agent')},stdin:'ignore',stdout:'pipe',stderr:'pipe'});
+const versionTimer=setTimeout(()=>version.kill(),10000);
+const [versionCode,versionOut,versionErr]=await Promise.all([version.exited,new Response(version.stdout).text(),new Response(version.stderr).text()]);clearTimeout(versionTimer);
+assert.equal(versionCode,0);assert.equal(versionOut.trim(),'1.4.0');assert.equal(versionErr,'');
+const ledger=new PiToolReceipts(join(home,'hub.db'));
+let effects=0, providers=0; const events:any[]=[];
+const bridge=Bun.serve({hostname:'127.0.0.1',port:0,async fetch(req){
+ const url=new URL(req.url); if(req.headers.get('authorization')!=='Bearer fixture')return new Response('forbidden',{status:403});
+ if(url.pathname==='/commands') {await Bun.sleep(25);return Response.json({command:null});}
+ const body=await req.json() as any;
+ if(url.pathname==='/event'){events.push(body.type);return Response.json({ok:true});}
+ if(url.pathname==='/budget')return Response.json({decisions:[]});
+ if(url.pathname==='/tool') {
+  const text=await ledger.execute(body.sessionId,body.toolCallId,body.name,body.args,async()=>{
+   if(body.args.value==='deny')return 'error: fixture permission denied';
+   effects++;return 'fixture success';
+  });
+  return Response.json({text,failed:text.startsWith('error:')});
+ }
+ providers++;return new Response('provider forbidden',{status:500});
+}});
+const env={HOME:home,PATH:process.env.PATH!,PI_CODING_AGENT_DIR:join(home,'agent'),HUB_EXTENSION:extension,PI_COMPAT_PACKAGE:packageRoot,
+ AGENTHUB_PI_BRIDGE_URL:`http://127.0.0.1:${bridge.port}`,AGENTHUB_PI_BRIDGE_TOKEN:'fixture',AGENTHUB_PI_OWNER_TOKEN:'fixture',
+ AGENTHUB_PI_TOOLS:JSON.stringify([{name:'compat_probe',description:'model-free fixture',parameters:{type:'object',properties:{value:{type:'string'}},required:['value']}}])};
+const child=Bun.spawn(['node',driver],{cwd:home,env,stdin:'ignore',stdout:'pipe',stderr:'pipe'});
+const timer=setTimeout(()=>child.kill(),10000);
+const [code,stdout,stderr]=await Promise.all([child.exited,new Response(child.stdout).text(),new Response(child.stderr).text()]);clearTimeout(timer);
+console.log(JSON.stringify({code,stdout,stderr,effects,providers,events,isolatedHome:home}));
+const native=Bun.spawn([launcher,'--mode','rpc','--provider','agent-hub-local','--model','fixture','--no-builtin-tools','--no-skills','--no-prompt-templates','--no-extensions','--extension',env.HUB_EXTENSION,'--session-dir',join(home,'native-sessions')],{
+ cwd:home,env:{...env,AGENTHUB_PI_RELAY_URL:`http://127.0.0.1:${bridge.port}/v1`,AGENTHUB_PI_RELAY_TOKEN:'fixture',AGENTHUB_PI_MODELS:JSON.stringify([{id:'fixture',name:'fixture'}])},stdin:'pipe',stdout:'pipe',stderr:'pipe'});
+native.stdin.write(JSON.stringify({id:'probe',type:'get_state'})+'\n');
+const nativeTimer=setTimeout(()=>native.kill(),10000);
+let wire='';for await(const chunk of native.stdout){wire+=new TextDecoder().decode(chunk);if(wire.includes('"command":"get_state"')){native.kill();break;}}
+await native.exited;clearTimeout(nativeTimer);const nativeErr=await new Response(native.stderr).text();
+console.log(JSON.stringify({nativeRpc:wire,nativeStderr:nativeErr,providers,events}));
+bridge.stop(true);await ledger.close();
+assert.equal(code,0);assert.equal(stderr,'');
+const result=JSON.parse(stdout);
+assert.equal(result.extension,'loaded');assert.equal(result.first.isError,false);assert.deepEqual(result.first,result.replay);assert.equal(result.denied.isError,true);
+assert.equal(effects,1);assert.equal(providers,0);assert.equal(nativeErr,'');
+const state=wire.trim().split('\n').map(line=>JSON.parse(line)).find(item=>item.command==='get_state');
+assert.equal(state?.success,true);assert.equal(state.data.messageCount,0);assert.ok(state.data.sessionId);assert.ok(state.data.sessionFile);
+assert.ok(events.includes('session_start'));assert.ok(events.includes('session_shutdown'));
+console.log('pi 1.4.0 model-free receipt: PASS');

package/docs/verification/pi-140-native.mjs

@@ -0,0 +1,21 @@
+import { pathToFileURL } from 'node:url';
+const { createAgentSession, DefaultResourceLoader, SessionManager, SettingsManager } = await import(pathToFileURL(`${process.env.PI_COMPAT_PACKAGE}/dist/index.js`).href);
+const cwd = process.env.HOME;
+const settingsManager = SettingsManager.create(cwd, process.env.PI_CODING_AGENT_DIR);
+const loader = new DefaultResourceLoader({cwd, agentDir:process.env.PI_CODING_AGENT_DIR, settingsManager,
+  noExtensions:true, additionalExtensionPaths:[process.env.HUB_EXTENSION], noSkills:true, noPromptTemplates:true, noThemes:true});
+await loader.reload();
+const {session, extensionsResult} = await createAgentSession({cwd, agentDir:process.env.PI_CODING_AGENT_DIR,
+  resourceLoader:loader, settingsManager, sessionManager:SessionManager.create(cwd, `${cwd}/sessions`), noTools:'builtin'});
+if (extensionsResult.errors.length) throw new Error(JSON.stringify(extensionsResult.errors));
+await session.bindExtensions({mode:'rpc'});
+const tool = session.extensionRunner.getAllRegisteredTools().find(t=>t.definition.name==='compat_probe');
+if (!tool) throw new Error('hub extension tool not registered');
+const invoke = async (id, args) => tool.definition.execute(id, args, new AbortController().signal);
+const first = await invoke('same-call', {value:'fixture'});
+const replay = await invoke('same-call', {value:'fixture'});
+const denied = await invoke('denied-call', {value:'deny'});
+console.log(JSON.stringify({extension:'loaded',first,replay,denied,tools:session.getActiveToolNames()}));
+await session.extensionRunner.emit({type:'session_shutdown'});
+session.dispose();
+process.exit(0);