@staix/agent-hub 0.19.0 → 0.21.0

package/docs/verification/2026-10-29-0.21.0.md

@@ -0,0 +1,61 @@
+# 0.21.0 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.21.0 and no live TUI launch.
+
+## Candidate
+
+Version 0.21.0, prepared first from main 3254c912 (57 commits since v0.20.0, 36 of them `feat`; bump rule: minor) and merged untagged as b35a05b1. It was then completed from main 26a8a835 with seven more PRs (see Second release pass), 68 non-merge commits since v0.20.0 in all. The release commits carry the version, the CHANGELOG section, the bundle and the documentation stamps.
+
+## Reviews
+
+Pull requests named by the commits since v0.20.0: #961, #960, #548, #954, #933, #955, #959, #957, #950, #948, #958, #956, #945, #951, #947, #952, #554, #953, #555, #949, #941, #944, #946, #801, #936, #798, #934, #942, #943, #940, #938, #939, #901, #937, #786, #928, #927, #515, #926, #923, #925, #924, #922, #919, #921, #920, #918, #914, #917, #916, #911, #913, #915, #902, #910, #909, #907, #908, #906, #904, #905, #903, #898, #894, #879, #897, #896.
+
+Each of these merged with `gh pr merge --squash --match-head-commit <head>` after its hub review, with exact-head CI green and no unresolved review thread at that head. Approvals that were bound to an earlier head than the one merged:
+- #954 (task 548): codex-review approved code-only at 1928e88e. The conductor reviewed the delta to 7ee6e5cb, which added the shard names in ci-gates, the git warm-up and the shard-variable unset, and merged on green exact-head CI.
+- #959 (task 556): approved before a conflict-only rebase to ee2c146d. seeds.json was rebuilt from main's seeds plus the PR's own.
+- #955 (task 557): the person approved the merge before the review-fix commit f8d3b5b0, which answered the two connector threads with tests. The hub approval was then recorded by the person.
+- #960 (task 535): approved at a23caea2, the merged head. Shard 4 of its exact-head run was green on a rerun of the failed job, an unchanged PTY test (task 559).
+- #961 (task 539): approved at 07de10c6, the merged head. Shard 1 was green on a rerun of the failed job, an unchanged code-facts deadline test (task 559).
+This record does not re-read the review history of each PR merged before 2026-10-29; they were merged under the same rule.
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.20.0: `docs/verification/2026-10-28-claude-2.1.311-2.1.312-bash-permission.json`, `docs/verification/2026-10-28-claude-2.1.311-2.1.312-permission-transport.json`, `docs/verification/2026-10-28-claude-implementer-permission-triage.md`, `docs/verification/2026-10-28-jcode-0.99.1-usage.md`, `docs/verification/2026-10-28-realpath-name-audit.md`, `docs/verification/2026-10-28-routing-f0bb8ad0.md`, `docs/verification/2026-10-29-model-effort-capabilities.md`, `docs/verification/claude-implementer-permission-triage.ts`.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.21.0`, person only, and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+`node scripts/check-docs.mjs --require-fresh` reported 15 stale documents. Each was reread against `git log <stamp>..HEAD -- <its source paths>`, corrected in aeeaeb04, and restamped at aeeaeb04 in 97b59d60:
+- src/cli/help.ts (16 commits): the `sdlc merge` output flags, `task label --created` being the person's, and the start rule for external module instances.
+- README.md (47): the release report link.
+- docs/quickstart.md (47): the install pin, the historical 0.20.0 amem pin, and a new "Upgrading to 0.21.0" note.
+- docs/operations.md (49): 20 corrections. Commands the conductor may now run (queue resolve, stop, roster add/remove, board import, task role), the queue backpressure settings row, the tier-3 structural keys, `ahub down`, the CI watcher's rerun behaviour, the console Rooms table, dirty submodules, and the external module instances.
+- docs/security.md (45): the new machine-local fields (including `rooms`), typed-name judging, `doc_read`/`web_fetch`, source and corpus screening, the intake split, the rooms X1 to X5b status, the DOING line, the external module instances, and the read-only planner instances.
+- docs/agent-notes (adapters 36, budget 28, bus 29, daemon 36, local-worker 9, models 2, tasks 40, tests 54, README 9, benchmarks 8): renamed or moved rules corrected (conductor operations, recovery target floors, schedule timers, pack resolution, remote recipients in the bus, context admission, the Codex planner sandbox, Claude failure stages, CLI print guards). Rationale moved into docs/agent-notes/README.md. benchmarks.md needed no change.
+The CHANGELOG 0.21.0 section was completed with the merged PRs that had no entry: rooms #908/#910/#922/#941/#956/#959, #927, #951, #961, #905, #894, #950, #928, #903, #952, #942 and the test fixes. The #933 entry now names the agy launcher as well as Jcode.
+
+## Second release pass
+
+The person asked on 2026-10-30 to merge the open PRs before tagging, so the first release merge (b35a05b1, PR #965) was not tagged. These PRs merged after it, each after its hub review, with exact-head CI green and no unresolved review thread:
+- #966 (task 440, #489 H1) and #967 (task 561, #963), both approved at their merged heads.
+- #969 (task 562, #964), approved at its merged head.
+- #968 (task 324, #637 part 2): codex-review approved code-only at 51d1c934; the conductor made a conflict-only rebase to f3483920 and merged on green CI.
+- #962 (task 559): approved at 5b86e10d; two conflict-only rebases by the conductor to 82e05552.
+- #971 (task 400): approved; a conflict-free rebase by the conductor to a22c914e.
+- #970 (task 441, #489 H2): codex-review approved code-only at b91c8a09; the conductor made a conflict-free rebase to d3d0cfe9, plus a docs-only dogfood row at 5d2b841d that answered the connector thread.
+Each conductor rebase was verified as content-identical for the PR's own files. CI flakes in this pass, each passing on a single rerun of the failed job: the release-tag, qwen-dual and peer-stop timing tests (task 563, PR #973, not in this release) and path-policy, smoke-pty and code-facts (fixed by #962). PRs whose heads predated a workflow change on main failed with "Module not found" until rebased (hub memory b659b689).
+The CHANGELOG 0.21.0 section gained #966, #967, #969 and #971, and #970's entry moved in from Unreleased. The 11 documents stale after these merges were reread and restamped in this pass.
+
+## Checks
+
+First pass at 97b59d60: `node scripts/check-docs.mjs --require-fresh` printed `docs: OK (0 stale documents)`, `bun x tsc --noEmit` was clean, `bun scripts/build.mjs --check` exited 0 and `node scripts/check-package.mjs` printed `package: OK (635 files, @staix/agent-hub@0.21.0)`.
+Second pass, after the restamp at e2ee0ad4 in a worktree with its own frozen install: `check-docs --require-fresh` printed `docs: OK (0 stale documents)`, tsc was clean, `build.mjs --check` exited 0 and `check-package` printed `package: OK (637 files, @staix/agent-hub@0.21.0)`. A build run before that worktree's own install resolved the main checkout's older dependency and looked stale; that was the known ancestor-import-path trap, not a bundle change. The release PR's exact-head CI is the full gate.
+
+## Known gaps, not blocking
+
+- The release adds no live receipt. Still open: #912 AC1 (a fresh Jcode peer calling hub_send in its first turn), #793 AC6 (task 468, pi's remote check; it needs the hub restarted with the remote runner), #418 AC8 (managed-Pi receipts), and native/account execution of #900 conductor recovery and #802 context admission.
+- Three timing flakes on the sharded macOS leg (path-policy, smoke-pty, code-facts) each passed on a rerun of the failed job. The test fixes are task 559 (PR #962), and the macOS PTY bridge hang under load is task 560. Neither is in this release.
+- docs/operations.md has no section yet for schedules and folder triggers, sources, intake, corpus.paths, doc_read/web_fetch or `ahub smoke run`. They are described in the spec, data-policy, memory.md and smoke.md.
+- The full `scripts/check.sh` was not run locally; the release PR's CI runs it on both OSes.
+- Not in this release (still open or after the cut): task 563 (PR #973, the round-2 timing fixes), task 323 (PR #972, `ahub learn`) and task 444 (#489 H3).

package/docs/verification/2026-10-29-model-effort-capabilities.md

@@ -0,0 +1,123 @@
+# Model and effort capability receipt (#266 AC1)
+
+Date: 2026-10-29. Scope: configuration/control capability verification only,
+under task 430. Source baseline: `88e38f3d`. No runtime policy is implemented.
+The native binaries were Codex 0.165.0, Claude Code 2.1.312 and Kimi 2.3.2.
+
+## Isolation and evidence boundary
+
+Each native invocation received a separate empty HOME and separate
+CLAUDE_CONFIG_DIR, CODEX_HOME, KIMI_CODE_HOME and XDG roots, plus a scratch cwd.
+The child environment contained no real account credentials or inherited
+provider/gateway overrides. macOS Seatbelt denied network access. No real
+account/provider config was copied, no login/update/config-write command was
+used, and runtime model/effort choices were confined to the isolated process.
+One native worker ran at a time under the resource policy.
+
+This receipt retains counts, versions and fixed outcomes only. No input/output
+text, credential, endpoint, native session/launch id or usage data is included.
+Setter/readback success is frontend state evidence, not a served-model receipt.
+Every invocation leader exited or was explicitly terminated and reaped; this is
+not a native sandbox or real-account certification. Nine owned temporary fixture roots were
+removed after capture. This does not change a native compatibility pin or
+establish an adapter T0 receipt.
+
+## Call inventory
+
+| Operation | Native invocation count | Outcome |
+| --- | ---: | --- |
+| Version | 3 | all exit 0 |
+| Root/subcommand help | 6 | all exit 0 |
+| Codex installed experimental schema generation | 1 | exit 0; 460 JSON schema files |
+| Codex protocol sessions | 2 | initialize/config/thread/turn controls below; both reaped |
+| Claude print/control sessions | 3 | control-only exploration and final status/readback below; all reaped |
+| Kimi ACP session | 1 | initialize success; session creation refused; reaped |
+| Total | 16 | sequential, bounded, no completed provider turn |
+
+These totals are controller-run accounting across the entire authorized probe
+sequence, including three subcommand-help calls and two preliminary Claude
+invocations. The selected final capability outcomes below do not imply that the
+preliminary ACKs proved effective settings.
+
+| Protocol process | Sent messages | Observed messages | Outcome |
+| --- | ---: | ---: | --- |
+| Codex launch/config/thread | 4 | 5 | config readbacks matched |
+| Kimi initialize/new | 2 | 2 | initialize passed; new refused |
+| Claude preliminary model control | 2 | 3 | ACKs observed; exact alias echo was not an effective-model proof |
+| Claude preliminary effort exploration | 4 | 9 | ACKs observed; exact-text status matcher did not classify the readback |
+| Claude final session controls | 5 | 12 | launch/session effort and selected model-family readbacks verified |
+| Codex bounded turn/interrupt/resume | 7 | 21 | frontend sticky readbacks verified; turn interrupted |
+| Total | 24 | 52 | counts only |
+
+The sent total includes two initialization notifications and five local Claude
+slash-command messages. The final Claude process checked effort before changing
+model and parsed the status value rather than requiring an exact alias/text echo.
+The three subcommand-help calls (Codex app-server, schema generator and Kimi ACP)
+all exited 0. Earlier exploration is included in the inventory rather than hidden
+or counted as an additional provider proof.
+
+## Sanitized outcomes
+
+| Native | Operation | Outcome |
+| --- | --- | --- |
+| Codex 0.165.0 | initialize | success |
+| Codex | launch config read | requested model match; requested effort match |
+| Codex | thread override readback | requested model match; requested effort match |
+| Codex | model catalog | success; 9 entries |
+| Codex | turn override | accepted |
+| Codex | bounded interrupt | success; no completed provider result observed |
+| Codex | no-override resume | requested replacement model match; replacement effort match; permission unchanged; sandbox unchanged |
+| Claude Code 2.1.312 | initialize with launch model/effort flags | success |
+| Claude | launch effort status | requested level match |
+| Claude | session effort setter and status | success; requested level match |
+| Claude | session model control | success; model field returned; requested model-family match |
+| Kimi 2.3.2 | initialize | success |
+| Kimi | new session | RPC error -32000; selected models/options/readbacks unknown |
+
+The installed Codex schema describes `turn/start.model` and `effort` as defaults
+for subsequent turns too. `ReasoningEffort` is a nonempty string here, not a
+closed global enum; the model catalog advertises supported options per model.
+Claude native help advertises launch model/effort, while its local effort status
+and model control provided configuration readback. No provider answer followed
+any of these checks. The Kimi refusal must not be relabeled unsupported; this
+receipt neither changed its config nor supplied an account to get past it.
+
+## Hub wiring and remaining proof
+
+At the source baseline, the hub's Codex-created turn contains no model/effort
+setter, even though native/TUI fields can pass through. Claude's declared writer
+model is a launch argument for each child; production closes its input stream
+and has no session-setting sender. Kimi has a launch-model argument and native
+permission-mode handling, with no model/effort setter or effective-model reader.
+A requested launch alias in recovery metadata is not a provider-serving model.
+
+Actual provider application for every vendor, Kimi session-level model/graded
+thinking readback, real interactive/account behavior, and matrix execution are
+**UNVERIFIED**. Task/role exec, mapping, routing policy, ladders and budgets remain
+later slices. A future setting path must not change permissions or sandbox and
+must refuse an unsupported/unverified mapping rather than silently ignore it.
+
+## Sources and reproduction
+
+The [spec capability table](../specs/2026-09-19-agent-hub-design.md#vendor-model-and-effort-controls-266-ac1)
+and [smoke procedure](../smoke.md#model-and-effort-capability-verification-266-ac1)
+are the entry points. Native help, installed generated schema and filtered
+control outcomes are the version-bound observations; raw native output is not
+part of the checked-in receipt.
+
+Corroborating primary sources, consulted 2026-10-29:
+
+- [OpenAI app-server](https://learn.chatgpt.com/docs/app-server): turn overrides,
+  subsequent-turn defaults and per-model advertised effort options.
+- [Claude model configuration](https://code.claude.com/docs/en/model-config):
+  launch and session model/effort controls, with later-message effort semantics.
+- [Claude SDK model setter](https://github.com/anthropics/claude-agent-sdk-python/blob/main/src/claude_agent_sdk/_internal/query.py):
+  the model control request shape.
+- [Kimi command reference](https://moonshotai.github.io/kimi-code/en/reference/kimi-command)
+  and [ACP coverage](https://moonshotai.github.io/kimi-code/en/reference/kimi-acp):
+  launch model and documented session model/thinking controls.
+- [Kimi graded ACP effort report](https://github.com/MoonshotAI/kimi-code/issues/1486):
+  an open report about boolean collapse, not this receipt's proof of installed
+  graded-effort support. A thinking toggle is not a verified graded setting.
+
+Moving upstream documentation cannot certify another binary or a real provider.